Revoke all refresh tokens on password change (#486 )

Fix session invalidation for local auth bypass (#487 )
Add guards against exposing passwords to the UI (#477 )
2026-09-09 11:59:02 -04:00 · 2026-03-02 14:58:19 +02:00 · 2026-03-02 13:34:20 +02:00 · 2026-03-02 13:11:34 +02:00 · 2026-03-02 13:00:23 +02:00 · 2026-03-02 12:45:52 +02:00
843 changed files with 89675 additions and 42172 deletions
@@ -0,0 +1,30 @@
+name: 'Get Vault Secrets'
+description: 'Retrieves secrets from HashiCorp Vault using AppRole authentication'
+inputs:
+  vault_host:
+    description: 'Vault server URL'
+    required: true
+  vault_role_id:
+    description: 'Vault AppRole Role ID'
+    required: true
+  vault_secret_id:
+    description: 'Vault AppRole Secret ID'
+    required: true
+  secrets:
+    description: 'Secrets to retrieve (multiline string, one per line in format: path | output_name)'
+    required: true
+    default: |
+      secrets/data/github repo_readonly_pat | REPO_READONLY_PAT
+      secrets/data/github packages_pat | PACKAGES_PAT
+
+runs:
+  using: "composite"
+  steps:
+    - name: Get vault secrets
+      uses: hashicorp/vault-action@v2
+      with:
+        url: ${{ inputs.vault_host }}
+        method: approle
+        roleId: ${{ inputs.vault_role_id }}
+        secretId: ${{ inputs.vault_secret_id }}
+        secrets: ${{ inputs.secrets }}
@@ -1,54 +1,87 @@
 name: Build Docker Images

 on:
-  push:
-    tags:
-      - "v*.*.*"
  pull_request:
    paths:
      - 'code/**'
-  workflow_dispatch:
  workflow_call:
+    inputs:
+      push_docker:
+        description: 'Push Docker image to registry'
+        type: boolean
+        required: false
+        default: true
+      app_version:
+        description: 'Application version'
+        type: string
+        required: false
+        default: ''
+
+# Cancel in-progress runs for the same PR
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  REGISTRY_IMAGE: ghcr.io/cleanuparr/cleanuparr

 jobs:
-  build_app:
+  # Compute tags, version, and push decision for downstream jobs
+  prepare:
    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    outputs:
+      tags: ${{ steps.build-info.outputs.tags }}
+      version: ${{ steps.build-info.outputs.version }}
+      version_docker_tag: ${{ steps.build-info.outputs.version_docker_tag }}
+      branch: ${{ steps.build-info.outputs.branch }}
+      push: ${{ steps.build-info.outputs.push }}
+      github_sha: ${{ github.sha }}
    steps:
-
-      - name: Set github context
-        timeout-minutes: 1
-        run: |
-          echo 'githubRepository=${{ github.repository }}' >> $GITHUB_ENV
-          echo 'githubSha=${{ github.sha }}' >> $GITHUB_ENV
-          echo 'githubRef=${{ github.ref }}' >> $GITHUB_ENV
-          echo 'githubHeadRef=${{ github.head_ref }}' >> $GITHUB_ENV
-
      - name: Initialize build info
+        id: build-info
        timeout-minutes: 1
        run: |
-          githubHeadRef=${{ env.githubHeadRef }}
+          githubHeadRef="${{ github.head_ref }}"
+          githubRef="${{ github.ref }}"
+          inputVersion="${{ inputs.app_version }}"
          latestDockerTag=""
          versionDockerTag=""
          majorVersionDockerTag=""
          minorVersionDockerTag=""
          version="0.0.1"

-          if [[ "$githubRef" =~ ^"refs/tags/" ]]; then
+          if [[ -n "$inputVersion" ]]; then
+            # Version provided via input (manual release)
+            branch="main"
+            latestDockerTag="latest"
+            versionDockerTag="$inputVersion"
+            version="$inputVersion"
+
+            # Extract major and minor versions for additional tags
+            if [[ "$versionDockerTag" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+) ]]; then
+              majorVersionDockerTag="${BASH_REMATCH[1]}"
+              minorVersionDockerTag="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}"
+            fi
+          elif [[ "$githubRef" =~ ^"refs/tags/" ]]; then
+            # Tag push
            branch=${githubRef##*/}
            latestDockerTag="latest"
            versionDockerTag=${branch#v}
            version=${branch#v}
-            
+
            # Extract major and minor versions for additional tags
            if [[ "$versionDockerTag" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+) ]]; then
              majorVersionDockerTag="${BASH_REMATCH[1]}"
              minorVersionDockerTag="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}"
            fi
          else
-            # Determine if this run is for the main branch or another branch
            if [[ -z "$githubHeadRef" ]]; then
              # Main branch
-              githubRef=${{ env.githubRef }}
              branch=${githubRef##*/}
              versionDockerTag="$branch"
            else
@@ -59,25 +92,45 @@ jobs:
          fi

          githubTags=""
-
          if [ -n "$latestDockerTag" ]; then
-            githubTags="$githubTags,ghcr.io/cleanuparr/cleanuparr:$latestDockerTag"
+            githubTags="$githubTags,$REGISTRY_IMAGE:$latestDockerTag"
          fi
          if [ -n "$versionDockerTag" ]; then
-            githubTags="$githubTags,ghcr.io/cleanuparr/cleanuparr:$versionDockerTag"
+            githubTags="$githubTags,$REGISTRY_IMAGE:$versionDockerTag"
          fi
          if [ -n "$minorVersionDockerTag" ]; then
-            githubTags="$githubTags,ghcr.io/cleanuparr/cleanuparr:$minorVersionDockerTag"
+            githubTags="$githubTags,$REGISTRY_IMAGE:$minorVersionDockerTag"
          fi
          if [ -n "$majorVersionDockerTag" ]; then
-            githubTags="$githubTags,ghcr.io/cleanuparr/cleanuparr:$majorVersionDockerTag"
+            githubTags="$githubTags,$REGISTRY_IMAGE:$majorVersionDockerTag"
          fi

-          # set env vars
-          echo "branch=$branch" >> $GITHUB_ENV
-          echo "githubTags=$githubTags" >> $GITHUB_ENV
-          echo "versionDockerTag=$versionDockerTag" >> $GITHUB_ENV
-          echo "version=$version" >> $GITHUB_ENV
+          githubTags="${githubTags#,}"
+
+          # Determine push decision
+          push="${{ github.event_name == 'pull_request' || inputs.push_docker == true }}"
+
+          echo "tags=$githubTags" >> $GITHUB_OUTPUT
+          echo "version=$version" >> $GITHUB_OUTPUT
+          echo "version_docker_tag=$versionDockerTag" >> $GITHUB_OUTPUT
+          echo "branch=$branch" >> $GITHUB_OUTPUT
+          echo "push=$push" >> $GITHUB_OUTPUT
+
+  # Build each platform in parallel
+  build:
+    runs-on: ubuntu-latest
+    needs: [prepare]
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - linux/amd64
+          - linux/arm64
+    steps:
+      - name: Prepare platform pair
+        run: |
+          platform=${{ matrix.platform }}
+          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV

      - name: Get vault secrets
        uses: hashicorp/vault-action@v2
@@ -87,8 +140,6 @@ jobs:
          roleId: ${{ secrets.VAULT_ROLE_ID }}
          secretId: ${{ secrets.VAULT_SECRET_ID }}
          secrets:
-            secrets/data/docker username | DOCKER_USERNAME;
-            secrets/data/docker password | DOCKER_PASSWORD;
            secrets/data/github repo_readonly_pat | REPO_READONLY_PAT;
            secrets/data/github packages_pat | PACKAGES_PAT

@@ -96,16 +147,97 @@ jobs:
        uses: actions/checkout@v4
        timeout-minutes: 1
        with:
-          repository: ${{ env.githubRepository }}
-          ref: ${{ env.branch }}
+          repository: ${{ github.repository }}
+          ref: ${{ needs.prepare.outputs.branch }}
          token: ${{ env.REPO_READONLY_PAT }}

+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        timeout-minutes: 5

-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+      - name: Login to GitHub Container Registry
+        if: needs.prepare.outputs.push == 'true'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push by digest
+        if: needs.prepare.outputs.push == 'true'
+        id: build-push
+        timeout-minutes: 30
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ github.workspace }}/code
+          file: ${{ github.workspace }}/code/Dockerfile
+          provenance: false
+          labels: |
+            commit=sha-${{ needs.prepare.outputs.github_sha }}
+            version=${{ needs.prepare.outputs.version_docker_tag }}
+          build-args: |
+            VERSION=${{ needs.prepare.outputs.version }}
+            PACKAGES_USERNAME=${{ secrets.PACKAGES_USERNAME }}
+            PACKAGES_PAT=${{ env.PACKAGES_PAT }}
+          platforms: ${{ matrix.platform }}
+          outputs: type=image,"name=${{ env.REGISTRY_IMAGE }}",push-by-digest=true,name-canonical=true,push=true
+          cache-from: type=gha,scope=build-${{ env.PLATFORM_PAIR }}
+          cache-to: type=gha,scope=build-${{ env.PLATFORM_PAIR }},mode=max
+
+      - name: Build (no push)
+        if: needs.prepare.outputs.push != 'true'
+        timeout-minutes: 30
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ github.workspace }}/code
+          file: ${{ github.workspace }}/code/Dockerfile
+          provenance: false
+          labels: |
+            commit=sha-${{ needs.prepare.outputs.github_sha }}
+            version=${{ needs.prepare.outputs.version_docker_tag }}
+          build-args: |
+            VERSION=${{ needs.prepare.outputs.version }}
+            PACKAGES_USERNAME=${{ secrets.PACKAGES_USERNAME }}
+            PACKAGES_PAT=${{ env.PACKAGES_PAT }}
+          platforms: ${{ matrix.platform }}
+          push: false
+          cache-from: type=gha,scope=build-${{ env.PLATFORM_PAIR }}
+          cache-to: type=gha,scope=build-${{ env.PLATFORM_PAIR }},mode=max
+
+      - name: Export digest
+        if: needs.prepare.outputs.push == 'true'
+        run: |
+          mkdir -p ${{ runner.temp }}/digests
+          digest="${{ steps.build-push.outputs.digest }}"
+          touch "${{ runner.temp }}/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        if: needs.prepare.outputs.push == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: digests-${{ env.PLATFORM_PAIR }}
+          path: ${{ runner.temp }}/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  # Create multi-platform manifest and push with final tags
+  merge:
+    runs-on: ubuntu-latest
+    needs: [prepare, build]
+    if: needs.prepare.outputs.push == 'true'
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@v4
+        with:
+          path: ${{ runner.temp }}/digests
+          pattern: digests-*
+          merge-multiple: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
@@ -114,25 +246,25 @@ jobs:
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

-      - name: Build and push docker image
-        timeout-minutes: 15
-        uses: docker/build-push-action@v6
-        with:
-          context: ${{ github.workspace }}/code
-          file: ${{ github.workspace }}/code/Dockerfile
-          provenance: false
-          labels: |
-            commit=sha-${{ env.githubSha }}
-            version=${{ env.versionDockerTag }}
-          build-args: |
-            VERSION=${{ env.version }}
-            PACKAGES_USERNAME=${{ secrets.PACKAGES_USERNAME }}
-            PACKAGES_PAT=${{ env.PACKAGES_PAT }}
-          outputs: |
-            type=image
-          platforms: |
-            linux/amd64
-            linux/arm64
-          push: true
-          tags: |
-            ${{ env.githubTags }}
+      - name: Create manifest list and push
+        timeout-minutes: 5
+        working-directory: ${{ runner.temp }}/digests
+        run: |
+          tags="${{ needs.prepare.outputs.tags }}"
+          tag_args=""
+          IFS=',' read -ra TAG_ARRAY <<< "$tags"
+          for tag in "${TAG_ARRAY[@]}"; do
+            tag=$(echo "$tag" | xargs)
+            if [ -n "$tag" ]; then
+              tag_args="$tag_args -t $tag"
+            fi
+          done
+
+          docker buildx imagetools create $tag_args \
+            $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)
+
+      - name: Inspect image
+        run: |
+          tags="${{ needs.prepare.outputs.tags }}"
+          first_tag=$(echo "$tags" | tr ',' '\n' | grep -v '^$' | head -1 | xargs)
+          docker buildx imagetools inspect "$first_tag"
@@ -1,40 +1,55 @@
 name: Build Executables

 on:
-  push:
-    tags:
-      - "v*.*.*"
-  workflow_dispatch:
  workflow_call:
+    inputs:
+      app_version:
+        description: 'Application version'
+        type: string
+        required: false
+        default: ''

 jobs:
-  build:
+  # Build for each platform in parallel using matrix strategy
+  build-platform:
    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: true
+      matrix:
+        include:
+          - runtime: win-x64
+            platform: win-amd64
+          - runtime: linux-x64
+            platform: linux-amd64
+          - runtime: linux-arm64
+            platform: linux-arm64
+          - runtime: osx-x64
+            platform: osx-amd64
+          - runtime: osx-arm64
+            platform: osx-arm64
+
    steps:
-
-      - name: Gate
-        if: ${{ !startsWith(github.ref, 'refs/tags/') && github.event_name != 'workflow_dispatch' }}
-        run: |
-          echo "This workflow only runs on tag events or manual dispatch. Pipeline finished."
-          exit 0
-
      - name: Set variables
        run: |
-          repoFullName=${{ github.repository }}
          ref=${{ github.ref }}
-          
-          # Handle both tag events and manual dispatch
-          if [[ "$ref" =~ ^refs/tags/ ]]; then
+
+          # Use input version if provided, otherwise determine from ref
+          if [[ -n "${{ inputs.app_version }}" ]]; then
+            appVersion="${{ inputs.app_version }}"
+            releaseVersion="v$appVersion"
+          elif [[ "$ref" =~ ^refs/tags/ ]]; then
            releaseVersion=${ref##refs/tags/}
            appVersion=${releaseVersion#v}
          else
-            # For manual dispatch, use a default version
            releaseVersion="dev-$(date +%Y%m%d-%H%M%S)"
            appVersion="0.0.1-dev"
          fi

+          repoFullName=${{ github.repository }}
+          repositoryName=${repoFullName#*/}
+
          echo "githubRepository=${{ github.repository }}" >> $GITHUB_ENV
-          echo "githubRepositoryName=${repoFullName#*/}" >> $GITHUB_ENV
+          echo "githubRepositoryName=$repositoryName" >> $GITHUB_ENV
          echo "releaseVersion=$releaseVersion" >> $GITHUB_ENV
          echo "appVersion=$appVersion" >> $GITHUB_ENV
          echo "executableName=Cleanuparr.Api" >> $GITHUB_ENV
@@ -58,27 +73,28 @@ jobs:
          ref: ${{ github.ref_name }}
          token: ${{ env.REPO_READONLY_PAT }}

-      - name: Setup Node.js for frontend build
-        uses: actions/setup-node@v4
-        with:
-          node-version: '18'
-          cache: 'npm'
-          cache-dependency-path: code/frontend/package-lock.json
-
-      - name: Build frontend
-        run: |
-          cd code/frontend
-          npm ci
-          npm run build
-
      - name: Setup dotnet
        uses: actions/setup-dotnet@v4
        with:
-          dotnet-version: 9.0.x
-      
+          dotnet-version: 10.0.x
+
+      - name: Cache NuGet packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json', '**/*.csproj') }}
+          restore-keys: |
+            ${{ runner.os }}-nuget-
+
+      - name: Download frontend artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: frontend-dist
+          path: code/frontend/dist/ui/browser
+
      - name: Install dependencies and restore
        run: |
-          dotnet nuget add source --username ${{ github.repository_owner }} --password ${{ secrets.PACKAGES_PAT }} --store-password-in-clear-text --name Cleanuparr https://nuget.pkg.github.com/Cleanuparr/index.json
+          dotnet nuget add source --username ${{ github.repository_owner }} --password ${{ env.PACKAGES_PAT }} --store-password-in-clear-text --name Cleanuparr https://nuget.pkg.github.com/Cleanuparr/index.json
          dotnet restore code/backend/${{ env.executableName }}/${{ env.executableName }}.csproj

      - name: Copy frontend to backend wwwroot
@@ -86,52 +102,25 @@ jobs:
          mkdir -p code/backend/${{ env.executableName }}/wwwroot
          cp -r code/frontend/dist/ui/browser/* code/backend/${{ env.executableName }}/wwwroot/

-      - name: Build win-x64
-        run: dotnet publish code/backend/${{ env.executableName }}/${{ env.executableName }}.csproj -c Release --runtime win-x64 --self-contained -o artifacts/${{ env.githubRepositoryName }}-${{ env.appVersion }}-win-amd64 /p:PublishSingleFile=true /p:Version=${{ env.appVersion }} /p:DebugSymbols=false
+      - name: Build ${{ matrix.platform }}
+        run: |
+          dotnet publish code/backend/${{ env.executableName }}/${{ env.executableName }}.csproj \
+            -c Release \
+            --runtime ${{ matrix.runtime }} \
+            --self-contained \
+            -o artifacts/${{ env.githubRepositoryName }}-${{ env.appVersion }}-${{ matrix.platform }} \
+            /p:PublishSingleFile=true \
+            /p:Version=${{ env.appVersion }} \
+            /p:DebugSymbols=false

-      - name: Build linux-x64
-        run: dotnet publish code/backend/${{ env.executableName }}/${{ env.executableName }}.csproj -c Release --runtime linux-x64 --self-contained -o artifacts/${{ env.githubRepositoryName }}-${{ env.appVersion }}-linux-amd64 /p:PublishSingleFile=true /p:Version=${{ env.appVersion }} /p:DebugSymbols=false
-
-      - name: Build linux-arm64
-        run: dotnet publish code/backend/${{ env.executableName }}/${{ env.executableName }}.csproj -c Release --runtime linux-arm64 --self-contained -o artifacts/${{ env.githubRepositoryName }}-${{ env.appVersion }}-linux-arm64 /p:PublishSingleFile=true /p:Version=${{ env.appVersion }} /p:DebugSymbols=false
-        
-      - name: Build osx-x64
-        run: dotnet publish code/backend/${{ env.executableName }}/${{ env.executableName }}.csproj -c Release --runtime osx-x64 --self-contained -o artifacts/${{ env.githubRepositoryName }}-${{ env.appVersion }}-osx-amd64 /p:PublishSingleFile=true /p:Version=${{ env.appVersion }} /p:DebugSymbols=false
-
-      - name: Build osx-arm64
-        run: dotnet publish code/backend/${{ env.executableName }}/${{ env.executableName }}.csproj -c Release --runtime osx-arm64 --self-contained -o artifacts/${{ env.githubRepositoryName }}-${{ env.appVersion }}-osx-arm64 /p:PublishSingleFile=true /p:Version=${{ env.appVersion }} /p:DebugSymbols=false
-
-      - name: Zip win-x64
+      - name: Zip artifact
        run: |
          cd ./artifacts
-          zip -r ./${{ env.githubRepositoryName }}-${{ env.appVersion }}-win-amd64.zip ./${{ env.githubRepositoryName }}-${{ env.appVersion }}-win-amd64/
+          zip -r ./${{ env.githubRepositoryName }}-${{ env.appVersion }}-${{ matrix.platform }}.zip ./${{ env.githubRepositoryName }}-${{ env.appVersion }}-${{ matrix.platform }}/

-      - name: Zip linux-x64
-        run: |
-          cd ./artifacts
-          zip -r ./${{ env.githubRepositoryName }}-${{ env.appVersion }}-linux-amd64.zip ./${{ env.githubRepositoryName }}-${{ env.appVersion }}-linux-amd64/
-
-      - name: Zip linux-arm64
-        run: |
-          cd ./artifacts
-          zip -r ./${{ env.githubRepositoryName }}-${{ env.appVersion }}-linux-arm64.zip ./${{ env.githubRepositoryName }}-${{ env.appVersion }}-linux-arm64/
-
-      - name: Zip osx-x64
-        run: |
-          cd ./artifacts
-          zip -r ./${{ env.githubRepositoryName }}-${{ env.appVersion }}-osx-amd64.zip ./${{ env.githubRepositoryName }}-${{ env.appVersion }}-osx-amd64/
-
-      - name: Zip osx-arm64
-        run: |
-          cd ./artifacts
-          zip -r ./${{ env.githubRepositoryName }}-${{ env.appVersion }}-osx-arm64.zip ./${{ env.githubRepositoryName }}-${{ env.appVersion }}-osx-arm64/
-
-      - name: Upload artifacts
+      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
-          name: cleanuparr-executables
-          path: |
-            ./artifacts/*.zip
+          name: executable-${{ matrix.platform }}
+          path: ./artifacts/*.zip
          retention-days: 30
-
-      # Removed individual release step - handled by main release workflow
@@ -0,0 +1,46 @@
+name: Build Frontend
+
+on:
+  workflow_call:
+
+jobs:
+  build-frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Get vault secrets
+        uses: hashicorp/vault-action@v2
+        with:
+          url: ${{ secrets.VAULT_HOST }}
+          method: approle
+          roleId: ${{ secrets.VAULT_ROLE_ID }}
+          secretId: ${{ secrets.VAULT_SECRET_ID }}
+          secrets:
+            secrets/data/github repo_readonly_pat | REPO_READONLY_PAT
+
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        timeout-minutes: 1
+        with:
+          repository: ${{ github.repository }}
+          ref: ${{ github.ref_name }}
+          token: ${{ env.REPO_READONLY_PAT }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: 'npm'
+          cache-dependency-path: code/frontend/package-lock.json
+
+      - name: Build frontend
+        run: |
+          cd code/frontend
+          npm ci
+          npm run build
+
+      - name: Upload frontend artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: frontend-dist
+          path: code/frontend/dist/ui/browser
+          retention-days: 1
@@ -1,28 +1,47 @@
-name: Build macOS ARM Installer
+name: Build macOS Installers

 permissions:
  contents: write

 on:
-  push:
-    tags:
-      - "v*.*.*"
-  workflow_dispatch:
  workflow_call:
+    inputs:
+      app_version:
+        description: 'Application version'
+        type: string
+        required: false
+        default: ''

 jobs:
-  build-macos-arm-installer:
-    name: Build macOS ARM Installer
-    runs-on: macos-14  # ARM runner for Apple Silicon
-    
+  build-macos-installer:
+    name: Build macOS ${{ matrix.arch }} Installer
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: Intel
+            runner: macos-15-intel
+            runtime: osx-x64
+            min_os_version: "10.15"
+            artifact_suffix: intel
+          - arch: ARM
+            runner: macos-15
+            runtime: osx-arm64
+            min_os_version: "11.0"
+            artifact_suffix: arm64
+
    steps:
      - name: Set variables
        run: |
          repoFullName=${{ github.repository }}
          ref=${{ github.ref }}
-          
-          # Handle both tag events and manual dispatch
-          if [[ "$ref" =~ ^refs/tags/ ]]; then
+
+          # Use input version if provided, otherwise determine from ref
+          if [[ -n "${{ inputs.app_version }}" ]]; then
+            appVersion="${{ inputs.app_version }}"
+            releaseVersion="v$appVersion"
+          elif [[ "$ref" =~ ^refs/tags/ ]]; then
            releaseVersion=${ref##refs/tags/}
            appVersion=${releaseVersion#v}
          else
@@ -30,9 +49,9 @@ jobs:
            releaseVersion="dev-$(date +%Y%m%d-%H%M%S)"
            appVersion="0.0.1-dev"
          fi
-          
+
          repositoryName=${repoFullName#*/}
-          
+
          echo "githubRepository=${{ github.repository }}" >> $GITHUB_ENV
          echo "githubRepositoryName=$repositoryName" >> $GITHUB_ENV
          echo "releaseVersion=$releaseVersion" >> $GITHUB_ENV
@@ -58,39 +77,32 @@ jobs:
          token: ${{ env.REPO_READONLY_PAT }}
          fetch-depth: 0

-      - name: Setup Node.js for frontend build
-        uses: actions/setup-node@v4
+      - name: Download frontend artifact
+        uses: actions/download-artifact@v4
        with:
-          node-version: '18'
-          cache: 'npm'
-          cache-dependency-path: code/frontend/package-lock.json
-
-      - name: Build frontend
-        run: |
-          cd code/frontend
-          npm ci
-          npm run build
+          name: frontend-dist
+          path: code/frontend/dist/ui/browser

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
-          dotnet-version: 9.0.x
+          dotnet-version: 10.0.x

      - name: Restore .NET dependencies
        run: |
          dotnet nuget add source --username ${{ github.repository_owner }} --password ${{ env.PACKAGES_PAT }} --store-password-in-clear-text --name Cleanuparr https://nuget.pkg.github.com/Cleanuparr/index.json
          dotnet restore code/backend/${{ env.executableName }}/${{ env.executableName }}.csproj

-      - name: Build macOS ARM executable
+      - name: Build macOS ${{ matrix.arch }} executable
        run: |
          # Clean any existing output directory
          rm -rf dist
          mkdir -p dist/temp
-          
+
          # Build to a temporary location
          dotnet publish code/backend/${{ env.executableName }}/${{ env.executableName }}.csproj \
            -c Release \
-            --runtime osx-arm64 \
+            --runtime ${{ matrix.runtime }} \
            --self-contained true \
            -o dist/temp \
            /p:PublishSingleFile=true \
@@ -103,17 +115,17 @@ jobs:
            /p:_CodeSignDuringBuild=false \
            /p:PublishTrimmed=false \
            /p:TrimMode=link
-          
+
          # Create proper app bundle structure
          mkdir -p dist/Cleanuparr.app/Contents/MacOS
-          
+
          # Copy the built executable (note: AssemblyName is "Cleanuparr" not "Cleanuparr.Api")
          cp dist/temp/Cleanuparr dist/Cleanuparr.app/Contents/MacOS/Cleanuparr
-          
+
          # Copy frontend directly to where it belongs in the app bundle
          mkdir -p dist/Cleanuparr.app/Contents/MacOS/wwwroot
          cp -r code/frontend/dist/ui/browser/* dist/Cleanuparr.app/Contents/MacOS/wwwroot/
-          
+
          # Copy any additional runtime files if they exist
          if [ -d "dist/temp" ]; then
            find dist/temp -name "*.dylib" -exec cp {} dist/Cleanuparr.app/Contents/MacOS/ \; 2>/dev/null || true
@@ -124,16 +136,16 @@ jobs:
        run: |
          # Make sure the executable is actually executable
          chmod +x dist/Cleanuparr.app/Contents/MacOS/Cleanuparr
-          
+
          # Remove any .pdb files that might have been created
          find dist/Cleanuparr.app/Contents/MacOS -name "*.pdb" -delete 2>/dev/null || true
-          
+
          echo "Checking architecture of built binary:"
          file dist/Cleanuparr.app/Contents/MacOS/Cleanuparr
          if command -v lipo >/dev/null 2>&1; then
            lipo -info dist/Cleanuparr.app/Contents/MacOS/Cleanuparr
          fi
-          
+
          echo "Files in MacOS directory:"
          ls -la dist/Cleanuparr.app/Contents/MacOS/

@@ -141,12 +153,12 @@ jobs:
        run: |
          # Create proper app bundle structure
          mkdir -p dist/Cleanuparr.app/Contents/{MacOS,Resources,Frameworks}
-          
+
          # Convert ICO to ICNS for macOS app bundle
          if command -v iconutil >/dev/null 2>&1; then
            # Create iconset directory structure
            mkdir -p Cleanuparr.iconset
-            
+
            # Use existing PNG files from Logo directory for different sizes
            cp Logo/16.png Cleanuparr.iconset/icon_16x16.png
            cp Logo/32.png Cleanuparr.iconset/icon_16x16@2x.png
@@ -158,14 +170,14 @@ jobs:
            cp Logo/512.png Cleanuparr.iconset/icon_256x256@2x.png
            cp Logo/512.png Cleanuparr.iconset/icon_512x512.png
            cp Logo/1024.png Cleanuparr.iconset/icon_512x512@2x.png
-            
+
            # Create ICNS file
            iconutil -c icns Cleanuparr.iconset -o dist/Cleanuparr.app/Contents/Resources/Cleanuparr.icns
-            
+
            # Clean up iconset directory
            rm -rf Cleanuparr.iconset
          fi
-          
+
          # Create Launch Daemon plist
          cat > dist/Cleanuparr.app/Contents/Resources/com.cleanuparr.daemon.plist << EOF
          <?xml version="1.0" encoding="UTF-8"?>
@@ -196,7 +208,7 @@ jobs:
          </dict>
          </plist>
          EOF
-          
+
          # Create Info.plist with proper configuration
          cat > dist/Cleanuparr.app/Contents/Info.plist << EOF
          <?xml version="1.0" encoding="UTF-8"?>
@@ -228,7 +240,7 @@ jobs:
              <key>NSRequiresAquaSystemAppearance</key>
              <false/>
              <key>LSMinimumSystemVersion</key>
-              <string>11.0</string>
+              <string>${{ matrix.min_os_version }}</string>
              <key>LSApplicationCategoryType</key>
              <string>public.app-category.productivity</string>
              <key>NSSupportsAutomaticTermination</key>
@@ -245,7 +257,7 @@ jobs:
          </dict>
          </plist>
          EOF
-          
+
          # Clean up temp directory
          rm -rf dist/temp

@@ -255,96 +267,96 @@ jobs:
          mkdir -p scripts
          cat > scripts/preinstall << 'EOF'
          #!/bin/bash
-          
+
          # Stop and unload existing launch daemon if it exists
          if launchctl list | grep -q "com.cleanuparr.daemon"; then
            launchctl stop com.cleanuparr.daemon 2>/dev/null || true
            launchctl unload /Library/LaunchDaemons/com.cleanuparr.daemon.plist 2>/dev/null || true
          fi
-          
+
          # Stop any running instances of Cleanuparr
          pkill -f "Cleanuparr" || true
          sleep 2
-          
+
          # Remove old installation if it exists
          if [[ -d "/Applications/Cleanuparr.app" ]]; then
            rm -rf "/Applications/Cleanuparr.app"
          fi
-          
+
          # Remove old launch daemon plist if it exists
          if [[ -f "/Library/LaunchDaemons/com.cleanuparr.daemon.plist" ]]; then
            rm -f "/Library/LaunchDaemons/com.cleanuparr.daemon.plist"
          fi
-          
+
          exit 0
          EOF
-          
+
          chmod +x scripts/preinstall
-          
+
          # Create postinstall script
          cat > scripts/postinstall << 'EOF'
          #!/bin/bash
-          
+
          # Set proper permissions for the app bundle
          chmod -R 755 /Applications/Cleanuparr.app
          chmod +x /Applications/Cleanuparr.app/Contents/MacOS/Cleanuparr
-          
+
          # Install the launch daemon
          cp /Applications/Cleanuparr.app/Contents/Resources/com.cleanuparr.daemon.plist /Library/LaunchDaemons/
          chown root:wheel /Library/LaunchDaemons/com.cleanuparr.daemon.plist
          chmod 644 /Library/LaunchDaemons/com.cleanuparr.daemon.plist
-          
+
          # Load and start the service
          launchctl load /Library/LaunchDaemons/com.cleanuparr.daemon.plist
          launchctl start com.cleanuparr.daemon
-          
+
          # Wait a moment for service to start
          sleep 3
-          
+
          # Display as system notification
          osascript -e 'display notification "Cleanuparr service started! Visit http://localhost:11011 in your browser." with title "Installation Complete"' 2>/dev/null || true
-          
+
          exit 0
          EOF
-          
+
          chmod +x scripts/postinstall
-          
+
          # Create uninstall script (optional, for user reference)
          cat > scripts/uninstall_cleanuparr.sh << 'EOF'
          #!/bin/bash
          # Cleanuparr Uninstall Script
          # Run this script with sudo to completely remove Cleanuparr
-          
+
          echo "Stopping Cleanuparr service..."
          launchctl stop com.cleanuparr.daemon 2>/dev/null || true
          launchctl unload /Library/LaunchDaemons/com.cleanuparr.daemon.plist 2>/dev/null || true
-          
+
          echo "Removing service files..."
          rm -f /Library/LaunchDaemons/com.cleanuparr.daemon.plist
-          
+
          echo "Removing application..."
          rm -rf /Applications/Cleanuparr.app
-          
+
          echo "Removing logs..."
          rm -f /var/log/cleanuparr.log
          rm -f /var/log/cleanuparr.error.log
-          
+
          echo "Cleanuparr has been completely removed."
          echo "Note: Configuration files in /Applications/Cleanuparr.app/Contents/MacOS/config/ have been removed with the app."
          EOF
-          
+
          chmod +x scripts/uninstall_cleanuparr.sh
-          
+
          # Copy uninstall script to app bundle for user access
          cp scripts/uninstall_cleanuparr.sh dist/Cleanuparr.app/Contents/Resources/
-          
-          # Determine package name
-          if [[ "${{ github.ref }}" =~ ^refs/tags/ ]]; then
-            pkg_name="Cleanuparr-${{ env.appVersion }}-macos-arm64.pkg"
+
+          # Determine package name - if app_version input was provided, it's a release build
+          if [[ -n "${{ inputs.app_version }}" ]] || [[ "${{ github.ref }}" =~ ^refs/tags/ ]]; then
+            pkg_name="Cleanuparr-${{ env.appVersion }}-macos-${{ matrix.artifact_suffix }}.pkg"
          else
-            pkg_name="Cleanuparr-${{ env.appVersion }}-macos-arm64-dev.pkg"
+            pkg_name="Cleanuparr-${{ env.appVersion }}-macos-${{ matrix.artifact_suffix }}-dev.pkg"
          fi
-          
+
          # Create PKG installer with better metadata
          pkgbuild --root dist/ \
                  --scripts scripts/ \
@@ -353,14 +365,12 @@ jobs:
                  --install-location /Applications \
                  --ownership preserve \
                  ${pkg_name}
-          
+
          echo "pkgName=${pkg_name}" >> $GITHUB_ENV

      - name: Upload installer as artifact
        uses: actions/upload-artifact@v4
        with:
-          name: Cleanuparr-macos-arm64-installer
+          name: Cleanuparr-macos-${{ matrix.artifact_suffix }}-installer
          path: '${{ env.pkgName }}'
          retention-days: 30
-
-      # Removed individual release step - handled by main release workflow 
@@ -1,366 +0,0 @@
-name: Build macOS Intel Installer
-
-permissions:
-  contents: write
-
-on:
-  push:
-    tags:
-      - "v*.*.*"
-  workflow_dispatch:
-  workflow_call:
-
-jobs:
-  build-macos-intel-installer:
-    name: Build macOS Intel Installer
-    runs-on: macos-13  # Intel runner
-    
-    steps:
-      - name: Set variables
-        run: |
-          repoFullName=${{ github.repository }}
-          ref=${{ github.ref }}
-          
-          # Handle both tag events and manual dispatch
-          if [[ "$ref" =~ ^refs/tags/ ]]; then
-            releaseVersion=${ref##refs/tags/}
-            appVersion=${releaseVersion#v}
-          else
-            # For manual dispatch, use a default version
-            releaseVersion="dev-$(date +%Y%m%d-%H%M%S)"
-            appVersion="0.0.1-dev"
-          fi
-          
-          repositoryName=${repoFullName#*/}
-          
-          echo "githubRepository=${{ github.repository }}" >> $GITHUB_ENV
-          echo "githubRepositoryName=$repositoryName" >> $GITHUB_ENV
-          echo "releaseVersion=$releaseVersion" >> $GITHUB_ENV
-          echo "appVersion=$appVersion" >> $GITHUB_ENV
-          echo "executableName=Cleanuparr.Api" >> $GITHUB_ENV
-
-      - name: Get vault secrets
-        uses: hashicorp/vault-action@v2
-        with:
-          url: ${{ secrets.VAULT_HOST }}
-          method: approle
-          roleId: ${{ secrets.VAULT_ROLE_ID }}
-          secretId: ${{ secrets.VAULT_SECRET_ID }}
-          secrets:
-            secrets/data/github repo_readonly_pat | REPO_READONLY_PAT;
-            secrets/data/github packages_pat | PACKAGES_PAT
-
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          repository: ${{ env.githubRepository }}
-          ref: ${{ github.ref_name }}
-          token: ${{ env.REPO_READONLY_PAT }}
-          fetch-depth: 0
-
-      - name: Setup Node.js for frontend build
-        uses: actions/setup-node@v4
-        with:
-          node-version: '18'
-          cache: 'npm'
-          cache-dependency-path: code/frontend/package-lock.json
-
-      - name: Build frontend
-        run: |
-          cd code/frontend
-          npm ci
-          npm run build
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: 9.0.x
-
-      - name: Restore .NET dependencies
-        run: |
-          dotnet nuget add source --username ${{ github.repository_owner }} --password ${{ env.PACKAGES_PAT }} --store-password-in-clear-text --name Cleanuparr https://nuget.pkg.github.com/Cleanuparr/index.json
-          dotnet restore code/backend/${{ env.executableName }}/${{ env.executableName }}.csproj
-
-      - name: Build macOS Intel executable
-        run: |
-          # Clean any existing output directory
-          rm -rf dist
-          mkdir -p dist/temp
-          
-          # Build to a temporary location
-          dotnet publish code/backend/${{ env.executableName }}/${{ env.executableName }}.csproj \
-            -c Release \
-            --runtime osx-x64 \
-            --self-contained true \
-            -o dist/temp \
-            /p:PublishSingleFile=true \
-            /p:Version=${{ env.appVersion }} \
-            /p:DebugType=None \
-            /p:DebugSymbols=false \
-            /p:UseAppHost=true \
-            /p:EnableMacOSCodeSign=false \
-            /p:CodeSignOnCopy=false \
-            /p:_CodeSignDuringBuild=false \
-            /p:PublishTrimmed=false \
-            /p:TrimMode=link
-          
-          # Create proper app bundle structure
-          mkdir -p dist/Cleanuparr.app/Contents/MacOS
-          
-          # Copy the built executable (note: AssemblyName is "Cleanuparr" not "Cleanuparr.Api")
-          cp dist/temp/Cleanuparr dist/Cleanuparr.app/Contents/MacOS/Cleanuparr
-          
-          # Copy frontend directly to where it belongs in the app bundle
-          mkdir -p dist/Cleanuparr.app/Contents/MacOS/wwwroot
-          cp -r code/frontend/dist/ui/browser/* dist/Cleanuparr.app/Contents/MacOS/wwwroot/
-          
-          # Copy any additional runtime files if they exist
-          if [ -d "dist/temp" ]; then
-            find dist/temp -name "*.dylib" -exec cp {} dist/Cleanuparr.app/Contents/MacOS/ \; 2>/dev/null || true
-            find dist/temp -name "createdump" -exec cp {} dist/Cleanuparr.app/Contents/MacOS/ \; 2>/dev/null || true
-          fi
-
-      - name: Post-build setup
-        run: |
-          # Make sure the executable is actually executable
-          chmod +x dist/Cleanuparr.app/Contents/MacOS/Cleanuparr
-          
-          # Remove any .pdb files that might have been created
-          find dist/Cleanuparr.app/Contents/MacOS -name "*.pdb" -delete 2>/dev/null || true
-          
-          echo "Checking architecture of built binary:"
-          file dist/Cleanuparr.app/Contents/MacOS/Cleanuparr
-          if command -v lipo >/dev/null 2>&1; then
-            lipo -info dist/Cleanuparr.app/Contents/MacOS/Cleanuparr
-          fi
-          
-          echo "Files in MacOS directory:"
-          ls -la dist/Cleanuparr.app/Contents/MacOS/
-
-      - name: Create macOS app bundle structure
-        run: |
-          # Create proper app bundle structure
-          mkdir -p dist/Cleanuparr.app/Contents/{MacOS,Resources,Frameworks}
-          
-          # Convert ICO to ICNS for macOS app bundle
-          if command -v iconutil >/dev/null 2>&1; then
-            # Create iconset directory structure
-            mkdir -p Cleanuparr.iconset
-            
-            # Use existing PNG files from Logo directory for different sizes
-            cp Logo/16.png Cleanuparr.iconset/icon_16x16.png
-            cp Logo/32.png Cleanuparr.iconset/icon_16x16@2x.png
-            cp Logo/32.png Cleanuparr.iconset/icon_32x32.png
-            cp Logo/64.png Cleanuparr.iconset/icon_32x32@2x.png
-            cp Logo/128.png Cleanuparr.iconset/icon_128x128.png
-            cp Logo/256.png Cleanuparr.iconset/icon_128x128@2x.png
-            cp Logo/256.png Cleanuparr.iconset/icon_256x256.png
-            cp Logo/512.png Cleanuparr.iconset/icon_256x256@2x.png
-            cp Logo/512.png Cleanuparr.iconset/icon_512x512.png
-            cp Logo/1024.png Cleanuparr.iconset/icon_512x512@2x.png
-            
-            # Create ICNS file
-            iconutil -c icns Cleanuparr.iconset -o dist/Cleanuparr.app/Contents/Resources/Cleanuparr.icns
-            
-            # Clean up iconset directory
-            rm -rf Cleanuparr.iconset
-          fi
-          
-          # Create Launch Daemon plist
-          cat > dist/Cleanuparr.app/Contents/Resources/com.cleanuparr.daemon.plist << EOF
-          <?xml version="1.0" encoding="UTF-8"?>
-          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-          <plist version="1.0">
-          <dict>
-              <key>Label</key>
-              <string>com.cleanuparr.daemon</string>
-              <key>ProgramArguments</key>
-              <array>
-                  <string>/Applications/Cleanuparr.app/Contents/MacOS/Cleanuparr</string>
-              </array>
-              <key>RunAtLoad</key>
-              <true/>
-              <key>KeepAlive</key>
-              <true/>
-              <key>StandardOutPath</key>
-              <string>/var/log/cleanuparr.log</string>
-              <key>StandardErrorPath</key>
-              <string>/var/log/cleanuparr.error.log</string>
-              <key>WorkingDirectory</key>
-              <string>/Applications/Cleanuparr.app/Contents/MacOS</string>
-              <key>EnvironmentVariables</key>
-              <dict>
-                  <key>HTTP_PORTS</key>
-                  <string>11011</string>
-              </dict>
-          </dict>
-          </plist>
-          EOF
-          
-          # Create Info.plist with proper configuration
-          cat > dist/Cleanuparr.app/Contents/Info.plist << EOF
-          <?xml version="1.0" encoding="UTF-8"?>
-          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-          <plist version="1.0">
-          <dict>
-              <key>CFBundleExecutable</key>
-              <string>Cleanuparr</string>
-              <key>CFBundleIdentifier</key>
-              <string>com.Cleanuparr</string>
-              <key>CFBundleName</key>
-              <string>Cleanuparr</string>
-              <key>CFBundleDisplayName</key>
-              <string>Cleanuparr</string>
-              <key>CFBundleVersion</key>
-              <string>${{ env.appVersion }}</string>
-              <key>CFBundleShortVersionString</key>
-              <string>${{ env.appVersion }}</string>
-              <key>CFBundleInfoDictionaryVersion</key>
-              <string>6.0</string>
-              <key>CFBundlePackageType</key>
-              <string>APPL</string>
-              <key>CFBundleSignature</key>
-              <string>CLNR</string>
-              <key>CFBundleIconFile</key>
-              <string>Cleanuparr</string>
-              <key>NSHighResolutionCapable</key>
-              <true/>
-              <key>NSRequiresAquaSystemAppearance</key>
-              <false/>
-              <key>LSMinimumSystemVersion</key>
-              <string>10.15</string>
-              <key>LSApplicationCategoryType</key>
-              <string>public.app-category.productivity</string>
-              <key>NSSupportsAutomaticTermination</key>
-              <false/>
-              <key>NSSupportsSuddenTermination</key>
-              <false/>
-              <key>LSBackgroundOnly</key>
-              <false/>
-              <key>NSAppTransportSecurity</key>
-              <dict>
-                  <key>NSAllowsArbitraryLoads</key>
-                  <true/>
-              </dict>
-          </dict>
-          </plist>
-          EOF
-          
-          # Clean up temp directory
-          rm -rf dist/temp
-
-      - name: Create PKG installer
-        run: |
-          # Create preinstall script to handle existing installations
-          mkdir -p scripts
-          cat > scripts/preinstall << 'EOF'
-          #!/bin/bash
-          
-          # Stop and unload existing launch daemon if it exists
-          if launchctl list | grep -q "com.cleanuparr.daemon"; then
-            launchctl stop com.cleanuparr.daemon 2>/dev/null || true
-            launchctl unload /Library/LaunchDaemons/com.cleanuparr.daemon.plist 2>/dev/null || true
-          fi
-          
-          # Stop any running instances of Cleanuparr
-          pkill -f "Cleanuparr" || true
-          sleep 2
-          
-          # Remove old installation if it exists
-          if [[ -d "/Applications/Cleanuparr.app" ]]; then
-            rm -rf "/Applications/Cleanuparr.app"
-          fi
-          
-          # Remove old launch daemon plist if it exists
-          if [[ -f "/Library/LaunchDaemons/com.cleanuparr.daemon.plist" ]]; then
-            rm -f "/Library/LaunchDaemons/com.cleanuparr.daemon.plist"
-          fi
-          
-          exit 0
-          EOF
-          
-          chmod +x scripts/preinstall
-          
-          # Create postinstall script
-          cat > scripts/postinstall << 'EOF'
-          #!/bin/bash
-          
-          # Set proper permissions for the app bundle
-          chmod -R 755 /Applications/Cleanuparr.app
-          chmod +x /Applications/Cleanuparr.app/Contents/MacOS/Cleanuparr
-          
-          # Install the launch daemon
-          cp /Applications/Cleanuparr.app/Contents/Resources/com.cleanuparr.daemon.plist /Library/LaunchDaemons/
-          chown root:wheel /Library/LaunchDaemons/com.cleanuparr.daemon.plist
-          chmod 644 /Library/LaunchDaemons/com.cleanuparr.daemon.plist
-          
-          # Load and start the service
-          launchctl load /Library/LaunchDaemons/com.cleanuparr.daemon.plist
-          launchctl start com.cleanuparr.daemon
-          
-          # Wait a moment for service to start
-          sleep 3
-          
-          # Display as system notification
-          osascript -e 'display notification "Cleanuparr service started! Visit http://localhost:11011 in your browser." with title "Installation Complete"' 2>/dev/null || true
-          
-          exit 0
-          EOF
-          
-          chmod +x scripts/postinstall
-          
-          # Create uninstall script (optional, for user reference)
-          cat > scripts/uninstall_cleanuparr.sh << 'EOF'
-          #!/bin/bash
-          # Cleanuparr Uninstall Script
-          # Run this script with sudo to completely remove Cleanuparr
-          
-          echo "Stopping Cleanuparr service..."
-          launchctl stop com.cleanuparr.daemon 2>/dev/null || true
-          launchctl unload /Library/LaunchDaemons/com.cleanuparr.daemon.plist 2>/dev/null || true
-          
-          echo "Removing service files..."
-          rm -f /Library/LaunchDaemons/com.cleanuparr.daemon.plist
-          
-          echo "Removing application..."
-          rm -rf /Applications/Cleanuparr.app
-          
-          echo "Removing logs..."
-          rm -f /var/log/cleanuparr.log
-          rm -f /var/log/cleanuparr.error.log
-          
-          echo "Cleanuparr has been completely removed."
-          echo "Note: Configuration files in /Applications/Cleanuparr.app/Contents/MacOS/config/ have been removed with the app."
-          EOF
-          
-          chmod +x scripts/uninstall_cleanuparr.sh
-          
-          # Copy uninstall script to app bundle for user access
-          cp scripts/uninstall_cleanuparr.sh dist/Cleanuparr.app/Contents/Resources/
-          
-          # Determine package name
-          if [[ "${{ github.ref }}" =~ ^refs/tags/ ]]; then
-            pkg_name="Cleanuparr-${{ env.appVersion }}-macos-intel.pkg"
-          else
-            pkg_name="Cleanuparr-${{ env.appVersion }}-macos-intel-dev.pkg"
-          fi
-          
-          # Create PKG installer with better metadata
-          pkgbuild --root dist/ \
-                  --scripts scripts/ \
-                  --identifier com.Cleanuparr \
-                  --version ${{ env.appVersion }} \
-                  --install-location /Applications \
-                  --ownership preserve \
-                  ${pkg_name}
-          
-          echo "pkgName=${pkg_name}" >> $GITHUB_ENV
-
-      - name: Upload installer as artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: Cleanuparr-macos-intel-installer
-          path: '${{ env.pkgName }}'
-          retention-days: 30
-
-      # Removed individual release step - handled by main release workflow 
@@ -1,11 +1,13 @@
 name: Build Windows Installer

 on:
-  push:
-    tags:
-      - "v*.*.*"
-  workflow_dispatch:
  workflow_call:
+    inputs:
+      app_version:
+        description: 'Application version'
+        type: string
+        required: false
+        default: ''

 jobs:
  build-windows-installer:
@@ -17,9 +19,13 @@ jobs:
        run: |
          $repoFullName = "${{ github.repository }}"
          $ref = "${{ github.ref }}"
-          
-          # Handle both tag events and manual dispatch
-          if ($ref -match "^refs/tags/") {
+          $inputVersion = "${{ inputs.app_version }}"
+
+          # Use input version if provided, otherwise determine from ref
+          if ($inputVersion -ne "") {
+            $appVersion = $inputVersion
+            $releaseVersion = "v$appVersion"
+          } elseif ($ref -match "^refs/tags/") {
            $releaseVersion = $ref -replace "refs/tags/", ""
            $appVersion = $releaseVersion -replace "^v", ""
          } else {
@@ -27,15 +33,15 @@ jobs:
            $releaseVersion = "dev-$(Get-Date -Format 'yyyyMMdd-HHmmss')"
            $appVersion = "0.0.1-dev"
          }
-          
+
          $repositoryName = $repoFullName.Split("/")[1]
-          
+
          echo "githubRepository=${{ github.repository }}" >> $env:GITHUB_ENV
          echo "githubRepositoryName=$repositoryName" >> $env:GITHUB_ENV
          echo "releaseVersion=$releaseVersion" >> $env:GITHUB_ENV
          echo "appVersion=$appVersion" >> $env:GITHUB_ENV
-          echo "executableName=Cleanuparr.Api" >> $env:GITHUB_ENV
          echo "APP_VERSION=$appVersion" >> $env:GITHUB_ENV
+          echo "executableName=Cleanuparr.Api" >> $env:GITHUB_ENV

      - name: Get vault secrets
        uses: hashicorp/vault-action@v2
@@ -55,23 +61,16 @@ jobs:
          ref: ${{ github.ref_name }}
          token: ${{ env.REPO_READONLY_PAT }}

-      - name: Setup Node.js for frontend build
-        uses: actions/setup-node@v4
+      - name: Download frontend artifact
+        uses: actions/download-artifact@v4
        with:
-          node-version: '18'
-          cache: 'npm'
-          cache-dependency-path: code/frontend/package-lock.json
-
-      - name: Build frontend
-        run: |
-          cd code/frontend
-          npm ci
-          npm run build
+          name: frontend-dist
+          path: code/frontend/dist/ui/browser

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
-          dotnet-version: 9.0.x
+          dotnet-version: 10.0.x

      - name: Restore .NET dependencies
        run: |
@@ -0,0 +1,45 @@
+name: Dependency Review
+
+on:
+  pull_request:
+    branches:
+      - main
+
+# Cancel in-progress runs for the same PR
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4
+        with:
+          # Fail on critical and high severity vulnerabilities
+          fail-on-severity: high
+          # Warn on moderate vulnerabilities
+          warn-on-severity: moderate
+          # Allow licenses
+          # allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, 0BSD
+          # Comment summarizes the vulnerabilities found
+          comment-summary-in-pr: on-failure
+          # Show dependency changes in PR
+          show-openssf-scorecard: true
+          vulnerability-check: true
+
+      - name: Upload dependency review results
+        uses: actions/upload-artifact@v4
+        with:
+          name: dependency-review-results
+          path: dependency-review-*.json
+          if-no-files-found: ignore
+          retention-days: 30
@@ -27,7 +27,7 @@ jobs:
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
-          node-version: 20.x
+          node-version: 24.x
          cache: yarn
          cache-dependency-path: docs/yarn.lock

@@ -8,8 +8,32 @@ on:
    inputs:
      version:
        description: 'Version to release (e.g., 1.0.0)'
+        required: true
+      runTests:
+        description: 'Run test suite'
+        type: boolean
        required: false
-        default: ''
+        default: true
+      buildDocker:
+        description: 'Build Docker image'
+        type: boolean
+        required: false
+        default: true
+      pushDocker:
+        description: 'Push Docker image to registry'
+        type: boolean
+        required: false
+        default: false
+      buildBinaries:
+        description: 'Build executables and installers'
+        type: boolean
+        required: false
+        default: true
+      createRelease:
+        description: 'Create GitHub release'
+        type: boolean
+        required: false
+        default: false

 jobs:
  # Validate release
@@ -19,7 +43,7 @@ jobs:
      app_version: ${{ steps.version.outputs.app_version }}
      release_version: ${{ steps.version.outputs.release_version }}
      is_tag: ${{ steps.version.outputs.is_tag }}
-      
+
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -32,55 +56,127 @@ jobs:
            release_version=${GITHUB_REF##refs/tags/}
            app_version=${release_version#v}
            is_tag=true
-          elif [[ -n "${{ github.event.inputs.version }}" ]]; then
+          else
            # Manual workflow with version
            app_version="${{ github.event.inputs.version }}"
-            release_version="v$app_version"
-            is_tag=false
-          else
-            # Manual workflow without version
-            app_version="0.0.1-dev-$(date +%Y%m%d-%H%M%S)"
+
+            # Validate version format (x.x.x)
+            if ! [[ "$app_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+              echo "Error: Version must be in format x.x.x (e.g., 1.0.0)"
+              echo "Provided version: $app_version"
+              exit 1
+            fi
+
            release_version="v$app_version"
            is_tag=false
          fi
-          
+
          echo "app_version=$app_version" >> $GITHUB_OUTPUT
          echo "release_version=$release_version" >> $GITHUB_OUTPUT
          echo "is_tag=$is_tag" >> $GITHUB_OUTPUT
-          
-          echo "🏷️ Release Version: $release_version"
-          echo "📱 App Version: $app_version"
-          echo "🔖 Is Tag: $is_tag"
+
+          echo "Release Version: $release_version"
+          echo "App Version: $app_version"
+          echo "Is Tag: $is_tag"
+
+      - name: Check if release already exists
+        run: |
+          if gh release view "${{ steps.version.outputs.release_version }}" &>/dev/null; then
+            echo "❌ Release ${{ steps.version.outputs.release_version }} already exists. Stopping workflow."
+            exit 1
+          fi
+          echo "✅ Release ${{ steps.version.outputs.release_version }} does not exist. Proceeding."
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  # Run tests
+  test:
+    needs: validate
+    if: ${{ needs.validate.outputs.is_tag == 'true' || github.event.inputs.runTests == 'true' }}
+    uses: ./.github/workflows/test.yml
+    secrets: inherit
+
+  # Build frontend once for all build jobs and cache it
+  build-frontend:
+    needs: [validate, test]
+    if: |
+      always() &&
+      needs.validate.result == 'success' &&
+      (needs.test.result == 'success' || needs.test.result == 'skipped') &&
+      (needs.validate.outputs.is_tag == 'true' || github.event.inputs.buildBinaries == 'true')
+    uses: ./.github/workflows/build-frontend.yml
+    secrets: inherit

  # Build portable executables
  build-executables:
-    needs: validate
+    needs: [validate, test, build-frontend]
+    if: |
+      always() &&
+      needs.validate.result == 'success' &&
+      (needs.test.result == 'success' || needs.test.result == 'skipped') &&
+      needs.build-frontend.result == 'success' &&
+      (needs.validate.outputs.is_tag == 'true' || github.event.inputs.buildBinaries == 'true')
    uses: ./.github/workflows/build-executable.yml
+    with:
+      app_version: ${{ needs.validate.outputs.app_version }}
    secrets: inherit

  # Build Windows installer
  build-windows-installer:
-    needs: validate
+    needs: [validate, test, build-frontend]
+    if: |
+      always() &&
+      needs.validate.result == 'success' &&
+      (needs.test.result == 'success' || needs.test.result == 'skipped') &&
+      needs.build-frontend.result == 'success' &&
+      (needs.validate.outputs.is_tag == 'true' || github.event.inputs.buildBinaries == 'true')
    uses: ./.github/workflows/build-windows-installer.yml
+    with:
+      app_version: ${{ needs.validate.outputs.app_version }}
    secrets: inherit

-  # Build macOS Intel installer
-  build-macos-intel:
-    needs: validate
-    uses: ./.github/workflows/build-macos-intel-installer.yml
+  # Build macOS installers (Intel and ARM)
+  build-macos:
+    needs: [validate, test, build-frontend]
+    if: |
+      always() &&
+      needs.validate.result == 'success' &&
+      (needs.test.result == 'success' || needs.test.result == 'skipped') &&
+      needs.build-frontend.result == 'success' &&
+      (needs.validate.outputs.is_tag == 'true' || github.event.inputs.buildBinaries == 'true')
+    uses: ./.github/workflows/build-macos-installer.yml
+    with:
+      app_version: ${{ needs.validate.outputs.app_version }}
    secrets: inherit

-  # Build macOS ARM installer
-  build-macos-arm:
-    needs: validate
-    uses: ./.github/workflows/build-macos-arm-installer.yml
+  # Build and push Docker image(s)
+  build-docker:
+    needs: [validate, test]
+    if: |
+      always() &&
+      needs.validate.result == 'success' &&
+      (needs.test.result == 'success' || needs.test.result == 'skipped') &&
+      (needs.validate.outputs.is_tag == 'true' || github.event.inputs.buildDocker == 'true')
+    uses: ./.github/workflows/build-docker.yml
+    with:
+      push_docker: ${{ needs.validate.outputs.is_tag == 'true' || github.event.inputs.pushDocker == 'true' }}
+      app_version: ${{ needs.validate.outputs.app_version }}
    secrets: inherit

  # Create GitHub release
  create-release:
-    needs: [validate, build-executables, build-windows-installer, build-macos-intel, build-macos-arm]
+    needs: [validate, build-executables, build-windows-installer, build-macos]
    runs-on: ubuntu-latest
-    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
+    if: |
+      always() &&
+      needs.validate.result == 'success' &&
+      needs.build-executables.result == 'success' &&
+      needs.build-windows-installer.result == 'success' &&
+      needs.build-macos.result == 'success' &&
+      (
+        needs.validate.outputs.is_tag == 'true' ||
+        (github.event.inputs.createRelease == 'true' && github.event.inputs.buildBinaries == 'true')
+      )
    
    steps:
      - name: Get vault secrets
@@ -93,15 +189,32 @@ jobs:
          secrets:
            secrets/data/github repo_readonly_pat | REPO_READONLY_PAT

-      - name: Download all artifacts
+      - name: Download executable artifacts
        uses: actions/download-artifact@v4
        with:
+          pattern: executable-*
          path: ./artifacts
+          merge-multiple: true
+
+      - name: Download Windows installer
+        uses: actions/download-artifact@v4
+        with:
+          name: Cleanuparr-windows-installer
+          path: ./artifacts
+
+      - name: Download macOS installers
+        uses: actions/download-artifact@v4
+        with:
+          pattern: Cleanuparr-macos-*-installer
+          path: ./artifacts
+          merge-multiple: true

      - name: List downloaded artifacts
        run: |
-          echo "📦 Downloaded artifacts:"
-          find ./artifacts -type f -name "*.zip" -o -name "*.pkg" -o -name "*.exe" | sort
+          echo "Downloaded artifacts:"
+          find ./artifacts -type f \( -name "*.zip" -o -name "*.pkg" -o -name "*.exe" \) | sort
+          echo ""
+          echo "Total files: $(find ./artifacts -type f \( -name "*.zip" -o -name "*.pkg" -o -name "*.exe" \) | wc -l)"

      - name: Create release
        uses: softprops/action-gh-release@v2
@@ -113,52 +226,62 @@ jobs:
          target_commitish: main
          generate_release_notes: true
          files: |
-            ./artifacts/**/*.zip
-            ./artifacts/**/*.pkg
-            ./artifacts/**/*.exe
+            ./artifacts/*.zip
+            ./artifacts/*.pkg
+            ./artifacts/*.exe

  # Summary job
  summary:
-    needs: [validate, build-executables, build-windows-installer, build-macos-intel, build-macos-arm]
+    needs: [validate, test, build-frontend, build-executables, build-windows-installer, build-macos, build-docker]
    runs-on: ubuntu-latest
    if: always()
-    
+
    steps:
+      - name: Record workflow start time
+        id: workflow-start
+        run: |
+          # Get workflow start time from GitHub API
+          workflow_start=$(gh api repos/${{ github.repository }}/actions/runs/${{ github.run_id }} --jq '.run_started_at')
+          start_epoch=$(date -d "$workflow_start" +%s 2>/dev/null || date -j -f "%Y-%m-%dT%H:%M:%SZ" "$workflow_start" +%s)
+          echo "start=$start_epoch" >> $GITHUB_OUTPUT
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
      - name: Build Summary
        run: |
+          # Calculate total workflow duration
+          start_time=${{ steps.workflow-start.outputs.start }}
+          end_time=$(date +%s)
+          duration=$((end_time - start_time))
+          minutes=$((duration / 60))
+          seconds=$((duration % 60))
          echo "## 🏗️ Cleanuparr Build Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Version**: ${{ needs.validate.outputs.release_version }}" >> $GITHUB_STEP_SUMMARY
          echo "**App Version**: ${{ needs.validate.outputs.app_version }}" >> $GITHUB_STEP_SUMMARY
          echo "**Is Tag**: ${{ needs.validate.outputs.is_tag }}" >> $GITHUB_STEP_SUMMARY
+          echo "**Total Duration**: ${minutes}m ${seconds}s" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Build Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
-          
-          # Check job results
-          if [[ "${{ needs.build-executables.result }}" == "success" ]]; then
-            echo "✅ **Portable Executables**: Success" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "❌ **Portable Executables**: ${{ needs.build-executables.result }}" >> $GITHUB_STEP_SUMMARY
-          fi
-          
-          if [[ "${{ needs.build-windows-installer.result }}" == "success" ]]; then
-            echo "✅ **Windows Installer**: Success" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "❌ **Windows Installer**: ${{ needs.build-windows-installer.result }}" >> $GITHUB_STEP_SUMMARY
-          fi
-          
-          if [[ "${{ needs.build-macos-intel.result }}" == "success" ]]; then
-            echo "✅ **macOS Intel Installer**: Success" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "❌ **macOS Intel Installer**: ${{ needs.build-macos-intel.result }}" >> $GITHUB_STEP_SUMMARY
-          fi
-          
-          if [[ "${{ needs.build-macos-arm.result }}" == "success" ]]; then
-            echo "✅ **macOS ARM Installer**: Success" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "❌ **macOS ARM Installer**: ${{ needs.build-macos-arm.result }}" >> $GITHUB_STEP_SUMMARY
-          fi
-          
+
+          # Helper function to print job result
+          print_result() {
+            local name="$1"
+            local result="$2"
+            case "$result" in
+              success) echo "✅ **$name**: Success" >> $GITHUB_STEP_SUMMARY ;;
+              skipped) echo "⏭️ **$name**: Skipped" >> $GITHUB_STEP_SUMMARY ;;
+              *) echo "❌ **$name**: $result" >> $GITHUB_STEP_SUMMARY ;;
+            esac
+          }
+
+          print_result "Tests" "${{ needs.test.result }}"
+          print_result "Frontend Build" "${{ needs.build-frontend.result }}"
+          print_result "Portable Executables" "${{ needs.build-executables.result }}"
+          print_result "Windows Installer" "${{ needs.build-windows-installer.result }}"
+          print_result "macOS Installers (Intel & ARM)" "${{ needs.build-macos.result }}"
+          print_result "Docker Image Build" "${{ needs.build-docker.result }}"
+
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "🎉 **Build completed!**" >> $GITHUB_STEP_SUMMARY 
@@ -0,0 +1,99 @@
+name: Tests
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'code/backend/**'
+      - '.github/workflows/test.yml'
+  pull_request:
+    paths:
+      - 'code/backend/**'
+      - '.github/workflows/test.yml'
+  workflow_call:
+
+# Cancel in-progress runs for the same PR
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        timeout-minutes: 1
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Cache NuGet packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json', '**/*.csproj') }}
+          restore-keys: |
+            ${{ runner.os }}-nuget-
+
+      - name: Get vault secrets
+        uses: hashicorp/vault-action@v2
+        with:
+          url: ${{ secrets.VAULT_HOST }}
+          method: approle
+          roleId: ${{ secrets.VAULT_ROLE_ID }}
+          secretId: ${{ secrets.VAULT_SECRET_ID }}
+          secrets:
+            secrets/data/github packages_pat | PACKAGES_PAT
+
+      - name: Restore dependencies
+        run: |
+          dotnet nuget add source --username ${{ github.repository_owner }} --password ${{ env.PACKAGES_PAT }} --store-password-in-clear-text --name Cleanuparr https://nuget.pkg.github.com/Cleanuparr/index.json
+          dotnet restore code/backend/cleanuparr.sln
+
+      - name: Build solution
+        run: dotnet build code/backend/cleanuparr.sln --configuration Release --no-restore
+
+      - name: Run tests
+        id: run-tests
+        run: dotnet test code/backend/cleanuparr.sln --configuration Release --no-build --verbosity normal --logger trx --collect:"XPlat Code Coverage" --settings code/backend/coverage.runsettings --results-directory ./coverage
+
+      - name: Upload test results
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-results
+          path: ./coverage/*.trx
+          retention-days: 30
+
+      - name: Upload coverage reports
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-report
+          path: ./coverage/**/coverage.cobertura.xml
+          retention-days: 30
+
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          files: ./coverage/**/coverage.cobertura.xml
+          token: ${{ secrets.CODECOV_TOKEN }}
+          fail_ci_if_error: false
+          flags: backend
+          name: backend-coverage
+
+      - name: Test Summary
+        run: |
+          echo "## Test Results" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          if [ "${{ steps.run-tests.outcome }}" == "success" ]; then
+            echo "✅ All tests passed!" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "❌ Tests failed or were cancelled. Status: ${{ steps.run-tests.outcome }}" >> $GITHUB_STEP_SUMMARY
+          fi
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Test artifacts have been uploaded for detailed analysis." >> $GITHUB_STEP_SUMMARY
@@ -0,0 +1,66 @@
+name: Get Version Info
+
+on:
+  workflow_call:
+    inputs:
+      manual_version:
+        description: 'Manual version override (e.g., 1.0.0)'
+        required: false
+        type: string
+        default: ''
+    outputs:
+      app_version:
+        description: 'Application version (without v prefix)'
+        value: ${{ jobs.version.outputs.app_version }}
+      release_version:
+        description: 'Release version (with v prefix)'
+        value: ${{ jobs.version.outputs.release_version }}
+      is_tag:
+        description: 'Whether this is a tag event'
+        value: ${{ jobs.version.outputs.is_tag }}
+      repository_name:
+        description: 'Repository name without owner'
+        value: ${{ jobs.version.outputs.repository_name }}
+
+jobs:
+  version:
+    runs-on: ubuntu-latest
+    outputs:
+      app_version: ${{ steps.version.outputs.app_version }}
+      release_version: ${{ steps.version.outputs.release_version }}
+      is_tag: ${{ steps.version.outputs.is_tag }}
+      repository_name: ${{ steps.version.outputs.repository_name }}
+
+    steps:
+      - name: Calculate version info
+        id: version
+        run: |
+          repoFullName="${{ github.repository }}"
+          repositoryName="${repoFullName#*/}"
+
+          if [[ "${{ github.ref }}" =~ ^refs/tags/ ]]; then
+            # Tag event
+            release_version="${GITHUB_REF##refs/tags/}"
+            app_version="${release_version#v}"
+            is_tag="true"
+          elif [[ -n "${{ inputs.manual_version }}" ]]; then
+            # Manual workflow with version
+            app_version="${{ inputs.manual_version }}"
+            release_version="v${app_version}"
+            is_tag="false"
+          else
+            # Development build
+            app_version="0.0.1-dev-$(date +%Y%m%d-%H%M%S)"
+            release_version="v${app_version}"
+            is_tag="false"
+          fi
+
+          echo "app_version=${app_version}" >> $GITHUB_OUTPUT
+          echo "release_version=${release_version}" >> $GITHUB_OUTPUT
+          echo "is_tag=${is_tag}" >> $GITHUB_OUTPUT
+          echo "repository_name=${repositoryName}" >> $GITHUB_OUTPUT
+
+          echo "📦 Repository: ${repositoryName}"
+          echo "🏷️ Release Version: ${release_version}"
+          echo "📱 App Version: ${app_version}"
+          echo "🔖 Is Tag: ${is_tag}"
@@ -0,0 +1,350 @@
+# Cleanuparr - Claude AI Rules
+
+## 🚨 Critical Guidelines
+
+**READ THIS FIRST:**
+1. ⚠️ **DO NOT break existing functionality** - All features are critical and must continue to work
+2. ❓ **When in doubt, ASK** - Always clarify before implementing uncertain changes
+3. 📋 **Follow existing patterns** - Study the codebase style before making changes
+4. 🆕 **Ask before introducing new patterns** - Use current coding standards or get approval first
+
+## Project Overview
+
+Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, Lidarr, Readarr, Whisparr and supported download clients like qBittorrent, Transmission, Deluge, µTorrent and rTorrent. It provides malware protection, automated cleanup, and queue management for *arr applications.
+
+**Key Features:**
+- Strike system for bad downloads
+- Malware detection and blocking
+- Automatic search triggering after removal
+- Orphaned download cleanup with cross-seed support
+- Support for multiple notification providers (Discord, etc.)
+
+## Architecture & Tech Stack
+
+### Backend
+- **.NET 10.0** (C#) with ASP.NET Core
+- **Architecture**: Clean Architecture pattern
+  - `Cleanuparr.Domain` - Domain models and business logic
+  - `Cleanuparr.Application` - Application services and use cases
+  - `Cleanuparr.Infrastructure` - External integrations (*arr apps, download clients)
+  - `Cleanuparr.Persistence` - Data access with EF Core (SQLite)
+  - `Cleanuparr.Api` - REST API and web host
+  - `Cleanuparr.Shared` - Shared utilities
+- **Database**: SQLite with Entity Framework Core 10.0
+  - Two separate contexts: `DataContext` and `EventsContext`
+- **Key Libraries**:
+  - MassTransit (messaging)
+  - Quartz.NET (scheduling)
+  - Serilog (logging)
+  - SignalR (real-time communication)
+
+### Frontend
+- **Angular 21** with TypeScript 5.9 (standalone components, zoneless, OnPush)
+- **UI**: Custom glassmorphism design system (no external UI frameworks)
+- **Icons**: @ng-icons/core + @ng-icons/tabler-icons
+- **Design System**: 3-layer SCSS (`_variables` → `_tokens` → `_themes`), dark/light themes
+- **State Management**: @ngrx/signals (Angular signals-based)
+- **Real-time Updates**: SignalR (@microsoft/signalr)
+- **PWA**: Service Worker support enabled
+
+### Documentation
+- **Docusaurus** (TypeScript-based static site)
+- Hosted at https://cleanuparr.github.io/Cleanuparr/
+
+### Deployment
+- **Docker** (primary distribution method)
+- Standalone executables for Windows, macOS, and Linux
+- Platform installers for Windows (.exe) and macOS (.pkg)
+
+## Development Setup
+
+### Prerequisites
+- .NET 10.0 SDK
+- Node.js 18+
+- Git
+- (Optional) Make for database migrations
+- (Optional) JetBrains Rider or Visual Studio
+
+### GitHub Packages Authentication
+Cleanuparr uses GitHub Packages for NuGet dependencies. Configure access:
+
+```bash
+dotnet nuget add source \
+  --username YOUR_GITHUB_USERNAME \
+  --password YOUR_GITHUB_PAT \
+  --store-password-in-clear-text \
+  --name Cleanuparr \
+  https://nuget.pkg.github.com/Cleanuparr/index.json
+```
+
+You need a GitHub PAT with `read:packages` permission.
+
+### Running the Backend
+```bash
+cd code/backend
+dotnet build Cleanuparr.Api/Cleanuparr.Api.csproj
+dotnet run --project Cleanuparr.Api/Cleanuparr.Api.csproj
+```
+API runs at http://localhost:5000
+
+### Running the Frontend
+```bash
+cd code/frontend
+npm install
+npm start
+```
+UI runs at http://localhost:4200
+
+### Running Tests
+```bash
+cd code/backend
+dotnet test
+```
+
+### Running Documentation
+```bash
+cd docs
+npm install
+npm start
+```
+Docs run at http://localhost:3000
+
+## Project Structure
+
+```
+Cleanuparr/
+├── code/
+│   ├── backend/
+│   │   ├── Cleanuparr.Api/           # API entry point
+│   │   ├── Cleanuparr.Application/   # Business logic layer
+│   │   ├── Cleanuparr.Domain/        # Domain models
+│   │   ├── Cleanuparr.Infrastructure/ # External integrations
+│   │   ├── Cleanuparr.Persistence/   # Database & EF Core
+│   │   ├── Cleanuparr.Shared/        # Shared utilities
+│   │   └── *.Tests/                  # Unit tests
+│   ├── frontend/                     # Angular 21 application
+│   ├── ui/                           # Built frontend assets
+│   ├── Dockerfile                    # Multi-stage Docker build
+│   ├── entrypoint.sh                 # Docker entrypoint
+│   └── Makefile                      # Build & migration helpers
+├── docs/                             # Docusaurus documentation
+├── Logo/                             # Branding assets
+├── .github/workflows/                # CI/CD pipelines
+├── blacklist                         # Default malware patterns
+├── blacklist_permissive              # Alternative blacklist
+├── whitelist                         # Safe file patterns
+└── CONTRIBUTING.md                   # Contribution guidelines
+```
+
+## Code Standards & Conventions
+
+**IMPORTANT:** Always study existing code in the relevant area before making changes. Match the existing style exactly.
+
+### Backend (C#)
+- Follow [Microsoft C# Coding Conventions](https://docs.microsoft.com/dotnet/csharp/fundamentals/coding-style/coding-conventions)
+- Use nullable reference types (`<Nullable>enable</Nullable>`)
+- Add XML documentation comments for public APIs
+- Write unit tests for business logic
+- Use meaningful names - avoid abbreviations unless widely understood
+- Keep services focused - single responsibility principle
+- **Study existing service implementations before creating new ones**
+
+### Frontend (TypeScript/Angular)
+- Follow [Angular Style Guide](https://angular.io/guide/styleguide)
+- Use TypeScript strict mode
+- All components must be **standalone** (no NgModules) with **ChangeDetectionStrategy.OnPush**
+- Use `input()` / `output()` function APIs (not `@Input()` / `@Output()` decorators)
+- Use Angular **signals** for reactive state (`signal()`, `computed()`, `effect()`)
+- Follow the 3-layer SCSS design system (`_variables` → `_tokens` → `_themes`) for styling
+- Component naming: `{feature}.component.ts`
+- Service naming: `{feature}.service.ts`
+- **Look at similar existing components before creating new ones**
+
+### Testing
+- Write unit tests for new features and bug fixes
+- Use descriptive test names that explain what is being tested
+- Backend: xUnit or NUnit conventions
+- Frontend: Jasmine/Karma
+- **Test that existing functionality still works after changes**
+
+### Git Commit Messages
+- Use clear, descriptive messages in imperative mood
+- Examples: "Add Discord notification support", "Fix memory leak in download client polling"
+- Reference issue numbers when applicable: "Fix #123: Handle null response from Radarr API"
+
+### Discovering Issues
+If you encounter potential gotchas, common mistakes, or areas that need special attention during development:
+- **Flag them to the maintainer immediately**
+- Document them if confirmed
+- Consider if they should be added to this guide
+
+## Database Migrations
+
+Cleanuparr uses two separate database contexts:
+- **DataContext**: Main application data
+- **EventsContext**: Event logging and audit trail
+
+### Creating Migrations
+From the `code` directory:
+
+```bash
+# Data migrations
+make migrate-data name=YourMigrationName
+
+# Events migrations
+make migrate-events name=YourMigrationName
+```
+
+Example:
+```bash
+make migrate-data name=AddDownloadClientConfig
+make migrate-events name=AddStrikeEvents
+```
+
+## Common Development Workflows
+
+### Adding a New *arr Application Integration
+1. Add integration in `Cleanuparr.Infrastructure/Arr/`
+2. Update domain models in `Cleanuparr.Domain/`
+3. Create/update services in `Cleanuparr.Application/`
+4. Add API endpoints in `Cleanuparr.Api/`
+5. Update frontend in `code/frontend/src/app/`
+6. Document in `docs/docs/`
+
+### Adding a New Download Client
+1. Add client implementation in `Cleanuparr.Infrastructure/DownloadClients/`
+2. Follow existing patterns (qBittorrent, Transmission, etc.)
+3. Add configuration models to `Cleanuparr.Domain/`
+4. Update API and frontend as above
+
+### Adding a New Notification Provider
+1. Add provider in `Cleanuparr.Infrastructure/Notifications/`
+2. Update configuration models
+3. Add UI configuration in frontend
+4. Test with actual service
+
+## Important Files
+
+### Configuration Files
+- `code/backend/Cleanuparr.Api/appsettings.json` - Backend configuration
+- `code/frontend/angular.json` - Angular build configuration
+- `code/Dockerfile` - Docker multi-stage build
+- `docs/docusaurus.config.ts` - Documentation site config
+
+### CI/CD Workflows
+- `.github/workflows/test.yml` - Run tests
+- `.github/workflows/build-docker.yml` - Build Docker images
+- `.github/workflows/build-executable.yml` - Build standalone executables
+- `.github/workflows/release.yml` - Create releases
+- `.github/workflows/docs.yml` - Deploy documentation
+
+### Malware Protection
+- `blacklist` - Default malware file patterns (strict)
+- `blacklist_permissive` - Less strict patterns
+- `whitelist` - Known safe file extensions
+- `whitelist_with_subtitles` - Includes subtitle formats
+
+## Contributing Guidelines
+
+### Before Starting Work
+1. **Announce your intent** - Comment on an issue or create a new one
+2. **Wait for approval** from maintainers
+3. Fork the repository and create a feature branch
+4. Make your changes following code standards
+5. Test thoroughly (both manual and automated tests)
+6. Submit a PR with clear description and testing notes
+
+### Pull Request Requirements
+- Link to related issue
+- Clear description of changes
+- Evidence of testing
+- Updated documentation if needed
+- No breaking changes without discussion
+
+## Docker Development
+
+### Build Local Docker Image
+```bash
+cd code
+docker build \
+  --build-arg PACKAGES_USERNAME=YOUR_GITHUB_USERNAME \
+  --build-arg PACKAGES_PAT=YOUR_GITHUB_PAT \
+  -t cleanuparr:local \
+  -f Dockerfile .
+```
+
+### Multi-Architecture Build
+```bash
+docker buildx build \
+  --platform linux/amd64,linux/arm64 \
+  --build-arg PACKAGES_USERNAME=YOUR_GITHUB_USERNAME \
+  --build-arg PACKAGES_PAT=YOUR_GITHUB_PAT \
+  -t cleanuparr:local \
+  -f Dockerfile .
+```
+
+## Environment Variables
+
+When running via Docker:
+- `PORT` - API port (default: 11011)
+- `PUID` - User ID for file permissions
+- `PGID` - Group ID for file permissions
+- `TZ` - Timezone (e.g., `America/New_York`)
+
+## Security & Safety
+
+- Never commit sensitive data (API keys, tokens, passwords)
+- All *arr and download client credentials are stored encrypted
+- The malware detection system uses pattern matching on file extensions and names
+- Always validate user input on both frontend and backend
+- Follow OWASP guidelines for web application security
+
+## Additional Resources
+
+- **Documentation**: https://cleanuparr.github.io/Cleanuparr/
+- **Discord**: https://discord.gg/SCtMCgtsc4
+- **GitHub Issues**: https://github.com/Cleanuparr/Cleanuparr/issues
+- **Releases**: https://github.com/Cleanuparr/Cleanuparr/releases
+
+## Working with Claude - IMPORTANT
+
+### Core Principles
+1. **When in doubt, ASK** - Don't assume, clarify with the maintainer first
+2. **Don't break existing functionality** - Everything is important and needs to work
+3. **Follow existing coding style** - Study the codebase patterns before making changes
+4. **Use current coding standards** - If you want to introduce something new, ask first
+
+### When Modifying Code
+- **ALWAYS read existing files before suggesting changes**
+- Understand the current architecture and patterns
+- Prefer editing existing files over creating new ones
+- Follow the established conventions in the codebase exactly
+- Test changes locally when possible
+- **If you're unsure about an approach, ask before implementing**
+
+### When Adding Features
+- Review similar existing features first to understand patterns
+- Maintain consistency with existing UI/UX patterns
+- Update both backend and frontend together
+- Add/update documentation
+- Consider backwards compatibility
+- **Ask about architectural decisions before implementing new patterns**
+
+### When Fixing Bugs
+- Understand the root cause before proposing a fix
+- **Be careful not to break other functionality** - test related areas
+- Add tests to prevent regression
+- Update relevant documentation if behavior changes
+- Consider if other parts of the codebase might have similar issues
+- **Flag any potential gotchas or issues you discover**
+
+## Notes
+
+- The project uses **Clean Architecture** - respect layer boundaries
+- Database migrations require both contexts - don't forget EventsContext
+- Frontend uses a **custom glassmorphism design system** - don't introduce external UI frameworks (no PrimeNG, Material, etc.)
+- All frontend components are **standalone** with **OnPush** change detection
+- All downloads from *arr apps are processed through a **strike system**
+- The malware blocker is a critical security feature - changes require careful testing
+- Cross-seed integration allows keeping torrents that are actively seeding
+- Real-time updates use **SignalR** - maintain websocket patterns when adding features
@@ -19,7 +19,7 @@ This helps us avoid redundant work, git conflicts, and contributions that may no

 ### Prerequisites

- [.NET 9.0 SDK](https://dotnet.microsoft.com/download/dotnet/9.0)
+- [.NET 10.0 SDK](https://dotnet.microsoft.com/download/dotnet/10.0)
 - [Node.js 18+](https://nodejs.org/)
 - [Git](https://git-scm.com/)
 - (Optional) [Make](https://www.gnu.org/software/make/) for database migrations
@@ -2,6 +2,11 @@ _Love this project? Give it a ⭐️ and let others know!_

 # <img width="24px" src="./Logo/256.png" alt="Cleanuparr"></img> Cleanuparr

+![Version](https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fcleanuparr-status.pages.dev%2Fstatus.json&query=%24.version&logo=git&label=version&color=blue)
+![Total Downloads](https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fghcr-badge.elias.eu.org%2Fapi%2FCleanuparr%2FCleanuparr%2Fcleanuparr&query=%24.downloadCount&style=flat&logo=docker&label=Total%20Downloads&color=blue)
+[![Tests](https://github.com/Cleanuparr/Cleanuparr/actions/workflows/test.yml/badge.svg?branch=main)](https://github.com/Cleanuparr/Cleanuparr/actions/workflows/test.yml)
+
+
 [![Discord](https://img.shields.io/discord/1306721212587573389?color=7289DA&label=Discord&style=for-the-badge&logo=discord)](https://discord.gg/SCtMCgtsc4)

 Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. It removes incomplete or blocked downloads, updates queues, and enforces blacklists or whitelists to manage file selection. After removing blocked content, Cleanuparr can also trigger a search to replace the deleted shows/movies.
@@ -23,24 +28,28 @@ Cleanuparr was created primarily to address malicious files, such as `*.lnk` or
 > - Notify on strike or download removal.
 > - Ignore certain torrent hashes, categories, tags or trackers from being processed by Cleanuparr.

+## Sponsored by GitAds
+[![Sponsored by GitAds](https://gitads.dev/v1/ad-serve?source=cleanuparr/cleanuparr@github)](https://gitads.dev/v1/ad-track?source=cleanuparr/cleanuparr@github)
+
 ## Screenshots

 https://cleanuparr.github.io/Cleanuparr/docs/screenshots

 ## 🎯 Supported Applications

-### *Arr Applications
+### *Arr Applications (latest version)
 - **Sonarr**
 - **Radarr**
 - **Lidarr**
 - **Readarr**
- **Whisparr**
+- **Whisparr v2**

-### Download Clients
+### Download Clients (latest version)
 - **qBittorrent**
 - **Transmission**
 - **Deluge**
 - **µTorrent**
+- **rTorrent**

 ### Platforms
 - **Docker**
@@ -93,14 +102,6 @@ We welcome contributions from the community! Whether it's bug fixes, new feature
 - **[Feature Requests](https://github.com/Cleanuparr/Cleanuparr/issues/new/choose)** - Share your ideas for new features
 - **[Help Test Features](https://discord.gg/SCtMCgtsc4)** - Join Discord to test pre-release features and provide feedback

-# <img style="vertical-align: middle;" width="24px" src="./Logo/256.png" alt="Cleanuparr"> <span style="vertical-align: middle;">Cleanuparr</span> <img src="https://raw.githubusercontent.com/FortAwesome/Font-Awesome/6.x/svgs/solid/x.svg" height="24px" width="30px" style="vertical-align: middle;"> <span style="vertical-align: middle;">Huntarr</span> <img style="vertical-align: middle;" width="24px" src="https://github.com/plexguide/Huntarr.io/blob/main/frontend/static/logo/512.png?raw=true" alt Huntarr></img>
-
-Think of **Cleanuparr** as the janitor of your server; it keeps your download queue spotless, removes clutter, and blocks malicious files. Now imagine combining that with **Huntarr**, the compulsive librarian who finds missing and upgradable media to complete your collection
-
-While **Huntarr** fills in the blanks and improves what you already have, **Cleanuparr** makes sure that only clean downloads get through. If you're aiming for a reliable and self-sufficient setup, **Cleanuparr** and **Huntarr** will take your automated media stack to another level.
-
-<span style="font-size:24px"> ➡️ [**Huntarr**](https://github.com/plexguide/Huntarr.io) <span style="vertical-align: middle">![Huntarr](https://img.shields.io/github/stars/plexguide/Huntarr.io?style=social)</span></span> 
-
 # Credits
 Special thanks for inspiration go to:
 - [ThijmenGThN/swaparr](https://github.com/ThijmenGThN/swaparr)
@@ -111,4 +112,4 @@ Special thanks for inspiration go to:
 # Buy me a coffee
 If I made your life just a tiny bit easier, consider buying me a coffee!

-<a href="https://buymeacoffee.com/flaminel" target="_blank"><img src="https://www.buymeacoffee.com/assets/img/custom_images/orange_img.png" alt="Buy Me A Coffee" style="height: 41px !important;width: 174px !important;box-shadow: 0px 3px 2px 0px rgba(190, 190, 190, 0.5) !important;-webkit-box-shadow: 0px 3px 2px 0px rgba(190, 190, 190, 0.5) !important;" ></a>
+<a href="https://buymeacoffee.com/flaminel" target="_blank"><img src="https://www.buymeacoffee.com/assets/img/custom_images/orange_img.png" alt="Buy Me A Coffee" style="height: 41px !important;width: 174px !important;box-shadow: 0px 3px 2px 0px rgba(190, 190, 190, 0.5) !important;-webkit-box-shadow: 0px 3px 2px 0px rgba(190, 190, 190, 0.5) !important;" ></a>
@@ -38,4 +38,50 @@ backend/**/Tests/

 # Development files
 docker-compose*.yml
-test/ 
+test/ 
+
+# ================================
+# Node and build output
+# ================================
+node_modules
+dist
+out-tsc
+.angular
+.cache
+.tmp
+
+# ================================
+# Testing & Coverage
+# ================================
+coverage
+jest
+cypress
+cypress/screenshots
+cypress/videos
+reports
+playwright-report
+.vite
+.vitepress
+
+# ================================
+# Environment & log files
+# ================================
+*.env*
+!*.env.production
+*.log
+*.tsbuildinfo
+
+# ================================
+# Docker & local orchestration
+# ================================
+Dockerfile
+Dockerfile.*
+.dockerignore
+docker-compose.yml
+docker-compose*.yml
+
+# ================================
+# Miscellaneous
+# ================================
+*.bak
+*.old
@@ -1,10 +1,12 @@
 # Build Angular frontend
-FROM --platform=$BUILDPLATFORM node:18-alpine AS frontend-build
+FROM --platform=$BUILDPLATFORM node:25-alpine AS frontend-build
 WORKDIR /app

 # Copy package files first for better layer caching
 COPY frontend/package*.json ./
-RUN npm ci && npm install -g @angular/cli
+# Use cache mount for npm to speed up builds
+RUN --mount=type=cache,target=/root/.npm \
+    npm ci && npm install -g @angular/cli

 # Copy source code
 COPY frontend/ .
@@ -13,7 +15,7 @@ COPY frontend/ .
 RUN npm run build

 # Build .NET backend
-FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:9.0-bookworm-slim AS build
+FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build
 ARG TARGETARCH
 ARG VERSION=0.0.1
 ARG PACKAGES_USERNAME
@@ -21,35 +23,42 @@ ARG PACKAGES_PAT
 WORKDIR /app
 EXPOSE 11011

-# Copy solution and project files first for better layer caching
-# COPY backend/*.sln ./backend/
-# COPY backend/*/*.csproj ./backend/*/
-
 # Copy source code
 COPY backend/ ./backend/

-# Restore dependencies
+# Add NuGet source
 RUN dotnet nuget add source --username ${PACKAGES_USERNAME} --password ${PACKAGES_PAT} --store-password-in-clear-text --name Cleanuparr https://nuget.pkg.github.com/Cleanuparr/index.json

-# Build and publish
-RUN dotnet publish ./backend/Cleanuparr.Api/Cleanuparr.Api.csproj \
+# Restore and publish with cache mount
+RUN --mount=type=cache,target=/root/.nuget/packages,sharing=locked \
+    dotnet restore ./backend/Cleanuparr.Api/Cleanuparr.Api.csproj -a $TARGETARCH && \
+    dotnet publish ./backend/Cleanuparr.Api/Cleanuparr.Api.csproj \
    -a $TARGETARCH \
    -c Release \
    -o /app/publish \
+    --no-restore \
    /p:Version=${VERSION} \
    /p:PublishSingleFile=true \
    /p:DebugSymbols=false

 # Runtime stage
-FROM mcr.microsoft.com/dotnet/aspnet:9.0-bookworm-slim
+FROM mcr.microsoft.com/dotnet/aspnet:10.0

-# Install required packages for user management and timezone support
-RUN apt-get update && apt-get install -y \
+# Install required packages for user management, timezone support, and Python for Apprise CLI
+RUN apt-get update && apt-get install -y --no-install-recommends \
    curl \
    tzdata \
    gosu \
+    python3 \
+    python3-venv \
    && rm -rf /var/lib/apt/lists/*

+# Create virtual environment and install Apprise CLI
+ENV VIRTUAL_ENV=/opt/apprise-venv
+RUN python3 -m venv $VIRTUAL_ENV
+ENV PATH="$VIRTUAL_ENV/bin:$PATH"
+RUN pip install --no-cache-dir apprise==1.9.6
+
 ENV PUID=1000 \
    PGID=1000 \
    UMASK=022 \
@@ -13,4 +13,30 @@ migrate-events:
 ifndef name
 	$(error name is required. Usage: make migrate-events name=YourMigrationName)
 endif
-	dotnet ef migrations add $(name) --context EventsContext --project backend/Cleanuparr.Persistence/Cleanuparr.Persistence.csproj --startup-project backend/Cleanuparr.Api/Cleanuparr.Api.csproj --output-dir Migrations/Events
+	dotnet ef migrations add $(name) --context EventsContext --project backend/Cleanuparr.Persistence/Cleanuparr.Persistence.csproj --startup-project backend/Cleanuparr.Api/Cleanuparr.Api.csproj --output-dir Migrations/Events
+
+migrate-users:
+ifndef name
+	$(error name is required. Usage: make migrate-users name=YourMigrationName)
+endif
+	dotnet ef migrations add $(name) --context UsersContext --project backend/Cleanuparr.Persistence/Cleanuparr.Persistence.csproj --startup-project backend/Cleanuparr.Api/Cleanuparr.Api.csproj --output-dir Migrations/Users
+
+docker-build:
+ifndef tag
+	$(error tag is required. Usage: make docker-build tag=latest version=1.0.0 user=... pat=...)
+endif
+ifndef version
+	$(error version is required. Usage: make docker-build tag=latest version=1.0.0 user=... pat=...)
+endif
+ifndef user
+	$(error user is required. Usage: make docker-build tag=latest version=1.0.0 user=... pat=...)
+endif
+ifndef pat
+	$(error pat is required. Usage: make docker-build tag=latest version=1.0.0 user=... pat=...)
+endif
+	DOCKER_BUILDKIT=1 docker build \
+		--build-arg VERSION=$(version) \
+		--build-arg PACKAGES_USERNAME=$(user) \
+		--build-arg PACKAGES_PAT=$(pat) \
+		-t cleanuparr:$(tag) \
+		.
@@ -0,0 +1,27 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="coverlet.collector" Version="6.0.4" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="Shouldly" Version="4.3.0" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Using Include="Xunit" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\Cleanuparr.Api\Cleanuparr.Api.csproj" />
+  </ItemGroup>
+
+</Project>
@@ -0,0 +1,61 @@
+using Cleanuparr.Persistence;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Mvc.Testing;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Cleanuparr.Api.Tests;
+
+/// <summary>
+/// Custom WebApplicationFactory that uses an isolated SQLite database for each test fixture.
+/// The database file is created in a temp directory so both DI and static contexts share the same data.
+/// </summary>
+public class CustomWebApplicationFactory : WebApplicationFactory<Program>
+{
+    private readonly string _tempDir;
+
+    public CustomWebApplicationFactory()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), $"cleanuparr-test-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(_tempDir);
+    }
+
+    protected override void ConfigureWebHost(IWebHostBuilder builder)
+    {
+        builder.UseEnvironment("Testing");
+
+        builder.ConfigureServices(services =>
+        {
+            // Remove the existing UsersContext registration
+            var descriptor = services.SingleOrDefault(d => d.ServiceType == typeof(DbContextOptions<UsersContext>));
+            if (descriptor != null) services.Remove(descriptor);
+
+            // Also remove the DbContext registration itself
+            var contextDescriptor = services.SingleOrDefault(d => d.ServiceType == typeof(UsersContext));
+            if (contextDescriptor != null) services.Remove(contextDescriptor);
+
+            var dbPath = Path.Combine(_tempDir, "users.db");
+
+            services.AddDbContext<UsersContext>(options =>
+            {
+                options.UseSqlite($"Data Source={dbPath}");
+            });
+
+            // Ensure DB is created
+            var sp = services.BuildServiceProvider();
+            using var scope = sp.CreateScope();
+            var db = scope.ServiceProvider.GetRequiredService<UsersContext>();
+            db.Database.EnsureCreated();
+        });
+    }
+
+    protected override void Dispose(bool disposing)
+    {
+        base.Dispose(disposing);
+
+        if (disposing && Directory.Exists(_tempDir))
+        {
+            try { Directory.Delete(_tempDir, true); } catch { /* best effort cleanup */ }
+        }
+    }
+}
@@ -0,0 +1,287 @@
+using System.Net;
+using System.Net.Http.Json;
+using System.Text.Json;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features.Auth;
+
+/// <summary>
+/// Integration tests for the authentication flow.
+/// Uses a single shared factory to avoid static state conflicts.
+/// Tests are ordered to build on each other: setup → login → protected endpoints.
+/// </summary>
+[TestCaseOrderer("Cleanuparr.Api.Tests.PriorityOrderer", "Cleanuparr.Api.Tests")]
+public class AuthControllerTests : IClassFixture<CustomWebApplicationFactory>
+{
+    private readonly HttpClient _client;
+
+    public AuthControllerTests(CustomWebApplicationFactory factory)
+    {
+        _client = factory.CreateClient();
+    }
+
+    [Fact, TestPriority(0)]
+    public async Task GetStatus_BeforeSetup_ReturnsNotCompleted()
+    {
+        var response = await _client.GetAsync("/api/auth/status");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("setupCompleted").GetBoolean().ShouldBeFalse();
+    }
+
+    [Fact, TestPriority(1)]
+    public async Task Setup_CreateAccount_ReturnsCreated()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/account", new
+        {
+            username = "admin",
+            password = "TestPassword123!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Created);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("userId").GetString().ShouldNotBeNullOrEmpty();
+    }
+
+    [Fact, TestPriority(2)]
+    public async Task Setup_CreateDuplicateAccount_ReturnsConflict()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/account", new
+        {
+            username = "another",
+            password = "TestPassword123!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Conflict);
+    }
+
+    [Fact, TestPriority(3)]
+    public async Task Setup_Generate2FA_ReturnsSecretAndRecoveryCodes()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/2fa/generate", new { });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("secret").GetString().ShouldNotBeNullOrEmpty();
+        body.GetProperty("qrCodeUri").GetString().ShouldNotBeNullOrEmpty();
+        body.GetProperty("recoveryCodes").GetArrayLength().ShouldBeGreaterThan(0);
+
+        // Store the secret for the next test
+        _totpSecret = body.GetProperty("secret").GetString()!;
+    }
+
+    [Fact, TestPriority(4)]
+    public async Task Setup_Verify2FA_WithValidCode_Succeeds()
+    {
+        // If we don't have the secret from the previous test, generate it again
+        if (string.IsNullOrEmpty(_totpSecret))
+        {
+            var genResponse = await _client.PostAsJsonAsync("/api/auth/setup/2fa/generate", new { });
+            var genBody = await genResponse.Content.ReadFromJsonAsync<JsonElement>();
+            _totpSecret = genBody.GetProperty("secret").GetString()!;
+        }
+
+        var code = GenerateTotpCode(_totpSecret);
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/2fa/verify", new { code });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+    }
+
+    [Fact, TestPriority(5)]
+    public async Task Setup_Complete_Succeeds()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/complete", new { });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+    }
+
+    [Fact, TestPriority(6)]
+    public async Task Login_ValidCredentials_RequiresTwoFactor()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "admin",
+            password = "TestPassword123!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("requiresTwoFactor").GetBoolean().ShouldBeTrue();
+        body.GetProperty("loginToken").GetString().ShouldNotBeNullOrEmpty();
+    }
+
+    [Fact, TestPriority(7)]
+    public async Task Login_InvalidCredentials_ReturnsUnauthorized()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "admin",
+            password = "WrongPassword!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Unauthorized);
+    }
+
+    [Fact, TestPriority(8)]
+    public async Task Login_BruteForce_ReturnsRetryAfter()
+    {
+        // Make multiple failed attempts
+        for (int i = 0; i < 3; i++)
+        {
+            await _client.PostAsJsonAsync("/api/auth/login", new
+            {
+                username = "admin",
+                password = "WrongPassword!"
+            });
+        }
+
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "admin",
+            password = "WrongPassword!"
+        });
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+
+        if (response.StatusCode == HttpStatusCode.TooManyRequests)
+        {
+            body.GetProperty("retryAfterSeconds").GetInt32().ShouldBeGreaterThan(0);
+        }
+        else
+        {
+            response.StatusCode.ShouldBe(HttpStatusCode.Unauthorized);
+            body.TryGetProperty("retryAfterSeconds", out var retry).ShouldBeTrue();
+            retry.GetInt32().ShouldBeGreaterThan(0);
+        }
+    }
+
+    [Fact, TestPriority(9)]
+    public async Task ProtectedEndpoint_WithoutAuth_DeniesAccess()
+    {
+        var response = await _client.GetAsync("/api/account");
+
+        // 401 (FallbackPolicy) or 403 (SetupGuardMiddleware) - both deny unauthenticated access
+        new[] { HttpStatusCode.Unauthorized, HttpStatusCode.Forbidden }
+            .ShouldContain(response.StatusCode);
+    }
+
+    [Fact, TestPriority(10)]
+    public async Task HealthEndpoint_WithoutAuth_Returns200()
+    {
+        var response = await _client.GetAsync("/health");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+    }
+
+    [Fact, TestPriority(11)]
+    public async Task Setup_2FAGenerate_AfterCompletion_IsBlocked()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/2fa/generate", new { });
+
+        // Blocked by middleware (403) or controller defense-in-depth (409)
+        new[] { HttpStatusCode.Forbidden, HttpStatusCode.Conflict }
+            .ShouldContain(response.StatusCode);
+    }
+
+    [Fact, TestPriority(12)]
+    public async Task Setup_PlexPin_AfterCompletion_IsBlocked()
+    {
+        var response = await _client.PostAsync("/api/auth/setup/plex/pin", null);
+
+        // Blocked by middleware (403) or controller defense-in-depth (409)
+        new[] { HttpStatusCode.Forbidden, HttpStatusCode.Conflict }
+            .ShouldContain(response.StatusCode);
+    }
+
+    [Fact, TestPriority(13)]
+    public async Task Setup_Complete_AfterCompletion_IsBlocked()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/complete", new { });
+
+        // Blocked by middleware (403) or controller defense-in-depth (409)
+        new[] { HttpStatusCode.Forbidden, HttpStatusCode.Conflict }
+            .ShouldContain(response.StatusCode);
+    }
+
+    [Fact, TestPriority(14)]
+    public async Task Login_NotBlockedByMiddleware_AfterSetupEndpointsBlocked()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "admin",
+            password = "TestPassword123!"
+        });
+
+        // Login endpoint must NOT be blocked by the middleware (403).
+        // It may return OK (200) or TooManyRequests (429) due to brute force lockout from earlier tests.
+        response.StatusCode.ShouldNotBe(HttpStatusCode.Forbidden);
+    }
+
+    [Fact, TestPriority(15)]
+    public async Task AuthStatus_StillWorks_AfterSetupEndpointsBlocked()
+    {
+        var response = await _client.GetAsync("/api/auth/status");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("setupCompleted").GetBoolean().ShouldBeTrue();
+    }
+
+    #region TOTP helpers
+
+    private static string _totpSecret = "";
+
+    private static string GenerateTotpCode(string base32Secret)
+    {
+        var key = Base32Decode(base32Secret);
+        var timestep = (long)(DateTime.UtcNow - DateTime.UnixEpoch).TotalSeconds / 30;
+        var timestepBytes = BitConverter.GetBytes(timestep);
+
+        if (BitConverter.IsLittleEndian)
+            Array.Reverse(timestepBytes);
+
+        using var hmac = new System.Security.Cryptography.HMACSHA1(key);
+        var hash = hmac.ComputeHash(timestepBytes);
+
+        var offset = hash[^1] & 0x0F;
+        var binaryCode =
+            ((hash[offset] & 0x7F) << 24) |
+            ((hash[offset + 1] & 0xFF) << 16) |
+            ((hash[offset + 2] & 0xFF) << 8) |
+            (hash[offset + 3] & 0xFF);
+
+        return (binaryCode % 1_000_000).ToString("D6");
+    }
+
+    private static byte[] Base32Decode(string base32)
+    {
+        const string alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+        base32 = base32.ToUpperInvariant().TrimEnd('=');
+
+        var bits = new List<byte>();
+        foreach (var c in base32)
+        {
+            var val = alphabet.IndexOf(c);
+            if (val < 0) continue;
+            for (var i = 4; i >= 0; i--)
+                bits.Add((byte)((val >> i) & 1));
+        }
+
+        var bytes = new byte[bits.Count / 8];
+        for (var i = 0; i < bytes.Length; i++)
+        {
+            for (var j = 0; j < 8; j++)
+                bytes[i] = (byte)((bytes[i] << 1) | bits[i * 8 + j]);
+        }
+
+        return bytes;
+    }
+
+    #endregion
+}
@@ -0,0 +1,78 @@
+using Cleanuparr.Shared.Helpers;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features.SensitiveData;
+
+public class SensitiveDataHelperTests
+{
+    [Fact]
+    public void IsPlaceholder_WithPlaceholder_ReturnsTrue()
+    {
+        SensitiveDataHelper.Placeholder.IsPlaceholder().ShouldBeTrue();
+    }
+
+    [Fact]
+    public void IsPlaceholder_WithAppriseStyledPlaceholder_ReturnsTrue()
+    {
+        $"discord://{SensitiveDataHelper.Placeholder}".IsPlaceholder().ShouldBeTrue();
+    }
+
+    [Fact]
+    public void IsPlaceholder_WithNull_ReturnsFalse()
+    {
+        ((string?)null).IsPlaceholder().ShouldBeFalse();
+    }
+
+    [Fact]
+    public void IsPlaceholder_WithEmptyString_ReturnsFalse()
+    {
+        "".IsPlaceholder().ShouldBeFalse();
+    }
+
+    [Fact]
+    public void IsPlaceholder_WithRealValue_ReturnsFalse()
+    {
+        "my-secret-api-key-123".IsPlaceholder().ShouldBeFalse();
+    }
+
+    [Theory]
+    [InlineData("discord://webhook_id/webhook_token", "discord://••••••••")]
+    [InlineData("slack://tokenA/tokenB/tokenC", "slack://••••••••")]
+    [InlineData("mailto://user:pass@gmail.com", "mailto://••••••••")]
+    [InlineData("json+http://user:pass@host/path", "json+http://••••••••")]
+    public void MaskAppriseUrls_SingleUrl_MasksCorrectly(string input, string expected)
+    {
+        SensitiveDataHelper.MaskAppriseUrls(input).ShouldBe(expected);
+    }
+
+    [Fact]
+    public void MaskAppriseUrls_MultipleUrls_MasksAll()
+    {
+        var input = "discord://token1 slack://tokenA/tokenB";
+        var result = SensitiveDataHelper.MaskAppriseUrls(input);
+
+        result.ShouldContain("discord://••••••••");
+        result.ShouldContain("slack://••••••••");
+        result.ShouldNotContain("token1");
+        result.ShouldNotContain("tokenA");
+    }
+
+    [Fact]
+    public void MaskAppriseUrls_MultilineUrls_MasksAll()
+    {
+        var input = "discord://token1\nslack://tokenA/tokenB";
+        var result = SensitiveDataHelper.MaskAppriseUrls(input);
+
+        result.ShouldContain("discord://••••••••");
+        result.ShouldContain("slack://••••••••");
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    public void MaskAppriseUrls_EmptyOrNull_ReturnsAsIs(string? input)
+    {
+        SensitiveDataHelper.MaskAppriseUrls(input).ShouldBe(input);
+    }
+}
@@ -0,0 +1,317 @@
+using Cleanuparr.Api.Features.Arr.Contracts.Requests;
+using Cleanuparr.Api.Features.DownloadClient.Contracts.Requests;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Persistence.Models.Configuration.Arr;
+using Cleanuparr.Persistence.Models.Configuration;
+using Cleanuparr.Shared.Helpers;
+using Shouldly;
+using ValidationException = Cleanuparr.Domain.Exceptions.ValidationException;
+
+namespace Cleanuparr.Api.Tests.Features.SensitiveData;
+
+/// <summary>
+/// Tests that placeholder values are correctly handled on the input side:
+/// - UPDATE operations preserve the existing DB value when a placeholder is sent
+/// - CREATE operations reject placeholder values
+/// - TEST operations reject placeholder values
+/// </summary>
+public class SensitiveDataInputTests
+{
+    private const string Placeholder = SensitiveDataHelper.Placeholder;
+
+    #region ArrInstanceRequest — UPDATE
+
+    [Fact]
+    public void ArrInstanceRequest_ApplyTo_WithPlaceholderApiKey_PreservesExistingValue()
+    {
+        var request = new ArrInstanceRequest
+        {
+            Name = "Updated Sonarr",
+            Url = "http://sonarr:8989",
+            ApiKey = Placeholder,
+            Version = 4,
+        };
+
+        var existingInstance = new ArrInstance
+        {
+            Name = "Sonarr",
+            Url = new Uri("http://sonarr:8989"),
+            ApiKey = "original-secret-key",
+            ArrConfigId = Guid.NewGuid(),
+            Version = 4,
+        };
+
+        request.ApplyTo(existingInstance);
+
+        existingInstance.ApiKey.ShouldBe("original-secret-key");
+        existingInstance.Name.ShouldBe("Updated Sonarr");
+    }
+
+    [Fact]
+    public void ArrInstanceRequest_ApplyTo_WithRealApiKey_UpdatesValue()
+    {
+        var request = new ArrInstanceRequest
+        {
+            Name = "Sonarr",
+            Url = "http://sonarr:8989",
+            ApiKey = "brand-new-api-key",
+            Version = 4,
+        };
+
+        var existingInstance = new ArrInstance
+        {
+            Name = "Sonarr",
+            Url = new Uri("http://sonarr:8989"),
+            ApiKey = "original-secret-key",
+            ArrConfigId = Guid.NewGuid(),
+            Version = 4,
+        };
+
+        request.ApplyTo(existingInstance);
+
+        existingInstance.ApiKey.ShouldBe("brand-new-api-key");
+    }
+
+    #endregion
+
+    #region ArrInstanceRequest — CREATE
+
+    [Fact]
+    public void ArrInstanceRequest_ToEntity_WithPlaceholderApiKey_ThrowsValidationException()
+    {
+        var request = new ArrInstanceRequest
+        {
+            Name = "Sonarr",
+            Url = "http://sonarr:8989",
+            ApiKey = Placeholder,
+            Version = 4,
+        };
+
+        Should.Throw<ValidationException>(() => request.ToEntity(Guid.NewGuid()));
+    }
+
+    [Fact]
+    public void ArrInstanceRequest_ToEntity_WithRealApiKey_Succeeds()
+    {
+        var request = new ArrInstanceRequest
+        {
+            Name = "Sonarr",
+            Url = "http://sonarr:8989",
+            ApiKey = "real-api-key-123",
+            Version = 4,
+        };
+
+        var entity = request.ToEntity(Guid.NewGuid());
+        entity.ApiKey.ShouldBe("real-api-key-123");
+    }
+
+    #endregion
+
+    #region TestArrInstanceRequest — TEST
+
+    [Fact]
+    public void TestArrInstanceRequest_ToTestInstance_WithPlaceholderApiKey_AndNoResolvedKey_ThrowsValidationException()
+    {
+        var request = new TestArrInstanceRequest
+        {
+            Url = "http://sonarr:8989",
+            ApiKey = Placeholder,
+            Version = 4,
+        };
+
+        Should.Throw<ValidationException>(() => request.ToTestInstance());
+    }
+
+    [Fact]
+    public void TestArrInstanceRequest_ToTestInstance_WithPlaceholderApiKey_AndResolvedKey_UsesResolvedKey()
+    {
+        var request = new TestArrInstanceRequest
+        {
+            Url = "http://sonarr:8989",
+            ApiKey = Placeholder,
+            Version = 4,
+            InstanceId = Guid.NewGuid(),
+        };
+
+        var instance = request.ToTestInstance("resolved-api-key-from-db");
+        instance.ApiKey.ShouldBe("resolved-api-key-from-db");
+    }
+
+    [Fact]
+    public void TestArrInstanceRequest_ToTestInstance_WithRealApiKey_Succeeds()
+    {
+        var request = new TestArrInstanceRequest
+        {
+            Url = "http://sonarr:8989",
+            ApiKey = "real-api-key",
+            Version = 4,
+        };
+
+        var instance = request.ToTestInstance();
+        instance.ApiKey.ShouldBe("real-api-key");
+    }
+
+    #endregion
+
+    #region UpdateDownloadClientRequest — UPDATE
+
+    [Fact]
+    public void UpdateDownloadClientRequest_ApplyTo_WithPlaceholderPassword_PreservesExistingValue()
+    {
+        var request = new UpdateDownloadClientRequest
+        {
+            Name = "Updated qBit",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Username = "admin",
+            Password = Placeholder,
+        };
+
+        var existing = new DownloadClientConfig
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = new Uri("http://qbit:8080"),
+            Username = "admin",
+            Password = "original-secret-password",
+        };
+
+        var result = request.ApplyTo(existing);
+
+        result.Password.ShouldBe("original-secret-password");
+        result.Name.ShouldBe("Updated qBit");
+    }
+
+    [Fact]
+    public void UpdateDownloadClientRequest_ApplyTo_WithRealPassword_UpdatesValue()
+    {
+        var request = new UpdateDownloadClientRequest
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Username = "admin",
+            Password = "new-password-123",
+        };
+
+        var existing = new DownloadClientConfig
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = new Uri("http://qbit:8080"),
+            Username = "admin",
+            Password = "original-secret-password",
+        };
+
+        var result = request.ApplyTo(existing);
+
+        result.Password.ShouldBe("new-password-123");
+    }
+
+    #endregion
+
+    #region CreateDownloadClientRequest — CREATE
+
+    [Fact]
+    public void CreateDownloadClientRequest_Validate_WithPlaceholderPassword_ThrowsValidationException()
+    {
+        var request = new CreateDownloadClientRequest
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Password = Placeholder,
+        };
+
+        Should.Throw<ValidationException>(() => request.Validate());
+    }
+
+    [Fact]
+    public void CreateDownloadClientRequest_Validate_WithRealPassword_Succeeds()
+    {
+        var request = new CreateDownloadClientRequest
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Password = "real-password",
+        };
+
+        Should.NotThrow(() => request.Validate());
+    }
+
+    [Fact]
+    public void CreateDownloadClientRequest_Validate_WithNullPassword_Succeeds()
+    {
+        var request = new CreateDownloadClientRequest
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Password = null,
+        };
+
+        Should.NotThrow(() => request.Validate());
+    }
+
+    #endregion
+
+    #region TestDownloadClientRequest — TEST
+
+    [Fact]
+    public void TestDownloadClientRequest_ToTestConfig_WithPlaceholderPassword_AndNoResolvedPassword_ThrowsValidationException()
+    {
+        var request = new TestDownloadClientRequest
+        {
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Password = Placeholder,
+        };
+
+        request.Validate();
+        Should.Throw<ValidationException>(() => request.ToTestConfig());
+    }
+
+    [Fact]
+    public void TestDownloadClientRequest_ToTestConfig_WithPlaceholderPassword_AndResolvedPassword_UsesResolvedPassword()
+    {
+        var request = new TestDownloadClientRequest
+        {
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Password = Placeholder,
+            ClientId = Guid.NewGuid(),
+        };
+
+        request.Validate();
+        var config = request.ToTestConfig("resolved-password-from-db");
+        config.Password.ShouldBe("resolved-password-from-db");
+    }
+
+    [Fact]
+    public void TestDownloadClientRequest_ToTestConfig_WithRealPassword_Succeeds()
+    {
+        var request = new TestDownloadClientRequest
+        {
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Password = "real-password",
+        };
+
+        request.Validate();
+        var config = request.ToTestConfig();
+        config.Password.ShouldBe("real-password");
+    }
+
+    #endregion
+}
@@ -0,0 +1,461 @@
+using System.Text.Json;
+using System.Text.Json.Serialization.Metadata;
+using Cleanuparr.Api.Json;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Features.Arr.Dtos;
+using Cleanuparr.Persistence.Models.Configuration;
+using Cleanuparr.Persistence.Models.Configuration.Arr;
+using Cleanuparr.Persistence.Models.Configuration.Notification;
+using Cleanuparr.Shared.Helpers;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features.SensitiveData;
+
+/// <summary>
+/// Tests that the SensitiveDataResolver correctly masks all [SensitiveData] properties
+/// during JSON serialization — this is what controls the API response output.
+/// </summary>
+public class SensitiveDataResolverTests
+{
+    private readonly JsonSerializerOptions _options;
+    private const string Placeholder = SensitiveDataHelper.Placeholder;
+
+    public SensitiveDataResolverTests()
+    {
+        _options = new JsonSerializerOptions
+        {
+            TypeInfoResolver = new SensitiveDataResolver(new DefaultJsonTypeInfoResolver()),
+            PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
+        };
+    }
+
+    #region ArrInstance
+
+    [Fact]
+    public void ArrInstance_ApiKey_IsMasked()
+    {
+        var instance = new ArrInstance
+        {
+            Name = "Sonarr",
+            Url = new Uri("http://sonarr:8989"),
+            ApiKey = "super-secret-api-key-12345",
+            ArrConfigId = Guid.NewGuid(),
+            Version = 4
+        };
+
+        var json = JsonSerializer.Serialize(instance, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("apiKey").GetString().ShouldBe(Placeholder);
+    }
+
+    [Fact]
+    public void ArrInstance_NonSensitiveFields_AreVisible()
+    {
+        var instance = new ArrInstance
+        {
+            Name = "Sonarr",
+            Url = new Uri("http://sonarr:8989"),
+            ExternalUrl = new Uri("https://sonarr.example.com"),
+            ApiKey = "super-secret-api-key-12345",
+            ArrConfigId = Guid.NewGuid(),
+            Version = 4
+        };
+
+        var json = JsonSerializer.Serialize(instance, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("name").GetString().ShouldBe("Sonarr");
+        doc.RootElement.GetProperty("url").GetString().ShouldBe("http://sonarr:8989");
+        doc.RootElement.GetProperty("externalUrl").GetString().ShouldBe("https://sonarr.example.com");
+    }
+
+    [Fact]
+    public void ArrInstance_NullApiKey_RemainsNull()
+    {
+        // ApiKey is required, but let's test with the DTO which might handle null
+        var dto = new ArrInstanceDto
+        {
+            Name = "Sonarr",
+            Url = "http://sonarr:8989",
+            ApiKey = null!,
+            Version = 4
+        };
+
+        var json = JsonSerializer.Serialize(dto, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("apiKey").ValueKind.ShouldBe(JsonValueKind.Null);
+    }
+
+    #endregion
+
+    #region ArrInstanceDto
+
+    [Fact]
+    public void ArrInstanceDto_ApiKey_IsMasked()
+    {
+        var dto = new ArrInstanceDto
+        {
+            Id = Guid.NewGuid(),
+            Name = "Radarr",
+            Url = "http://radarr:7878",
+            ApiKey = "dto-secret-api-key-67890",
+            Version = 5
+        };
+
+        var json = JsonSerializer.Serialize(dto, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("apiKey").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("name").GetString().ShouldBe("Radarr");
+        doc.RootElement.GetProperty("url").GetString().ShouldBe("http://radarr:7878");
+    }
+
+    #endregion
+
+    #region DownloadClientConfig
+
+    [Fact]
+    public void DownloadClientConfig_Password_IsMasked()
+    {
+        var config = new DownloadClientConfig
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = new Uri("http://qbit:8080"),
+            Username = "admin",
+            Password = "my-secret-password",
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("password").GetString().ShouldBe(Placeholder);
+    }
+
+    [Fact]
+    public void DownloadClientConfig_Username_IsVisible()
+    {
+        var config = new DownloadClientConfig
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = new Uri("http://qbit:8080"),
+            Username = "admin",
+            Password = "my-secret-password",
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("username").GetString().ShouldBe("admin");
+        doc.RootElement.GetProperty("name").GetString().ShouldBe("qBittorrent");
+    }
+
+    [Fact]
+    public void DownloadClientConfig_NullPassword_RemainsNull()
+    {
+        var config = new DownloadClientConfig
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = new Uri("http://qbit:8080"),
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("password").ValueKind.ShouldBe(JsonValueKind.Null);
+    }
+
+    #endregion
+
+    #region NotifiarrConfig
+
+    [Fact]
+    public void NotifiarrConfig_ApiKey_IsMasked()
+    {
+        var config = new NotifiarrConfig
+        {
+            ApiKey = "notifiarr-api-key-secret",
+            ChannelId = "123456789"
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("apiKey").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("channelId").GetString().ShouldBe("123456789");
+    }
+
+    #endregion
+
+    #region DiscordConfig
+
+    [Fact]
+    public void DiscordConfig_WebhookUrl_IsMasked()
+    {
+        var config = new DiscordConfig
+        {
+            WebhookUrl = "https://discord.com/api/webhooks/123456/secret-token",
+            Username = "Cleanuparr Bot",
+            AvatarUrl = "https://example.com/avatar.png"
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("webhookUrl").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("username").GetString().ShouldBe("Cleanuparr Bot");
+        doc.RootElement.GetProperty("avatarUrl").GetString().ShouldBe("https://example.com/avatar.png");
+    }
+
+    #endregion
+
+    #region TelegramConfig
+
+    [Fact]
+    public void TelegramConfig_BotToken_IsMasked()
+    {
+        var config = new TelegramConfig
+        {
+            BotToken = "1234567890:ABCdefGHIjklmnoPQRstuvWXyz",
+            ChatId = "-1001234567890",
+            TopicId = "42",
+            SendSilently = true
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("botToken").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("chatId").GetString().ShouldBe("-1001234567890");
+        doc.RootElement.GetProperty("topicId").GetString().ShouldBe("42");
+    }
+
+    #endregion
+
+    #region NtfyConfig
+
+    [Fact]
+    public void NtfyConfig_PasswordAndAccessToken_AreMasked()
+    {
+        var config = new NtfyConfig
+        {
+            ServerUrl = "https://ntfy.example.com",
+            Topics = ["test-topic"],
+            AuthenticationType = NtfyAuthenticationType.BasicAuth,
+            Username = "ntfy-user",
+            Password = "ntfy-secret-password",
+            AccessToken = "ntfy-access-token-secret",
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("password").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("accessToken").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("serverUrl").GetString().ShouldBe("https://ntfy.example.com");
+        doc.RootElement.GetProperty("username").GetString().ShouldBe("ntfy-user");
+    }
+
+    [Fact]
+    public void NtfyConfig_NullPasswordAndAccessToken_RemainNull()
+    {
+        var config = new NtfyConfig
+        {
+            ServerUrl = "https://ntfy.example.com",
+            Topics = ["test-topic"],
+            AuthenticationType = NtfyAuthenticationType.None,
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("password").ValueKind.ShouldBe(JsonValueKind.Null);
+        doc.RootElement.GetProperty("accessToken").ValueKind.ShouldBe(JsonValueKind.Null);
+    }
+
+    #endregion
+
+    #region PushoverConfig
+
+    [Fact]
+    public void PushoverConfig_ApiTokenAndUserKey_AreMasked()
+    {
+        var config = new PushoverConfig
+        {
+            ApiToken = "pushover-api-token-secret",
+            UserKey = "pushover-user-key-secret",
+            Priority = PushoverPriority.Normal,
+            Devices = ["iphone", "desktop"]
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("apiToken").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("userKey").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("devices").GetArrayLength().ShouldBe(2);
+    }
+
+    #endregion
+
+    #region GotifyConfig
+
+    [Fact]
+    public void GotifyConfig_ApplicationToken_IsMasked()
+    {
+        var config = new GotifyConfig
+        {
+            ServerUrl = "https://gotify.example.com",
+            ApplicationToken = "gotify-app-token-secret",
+            Priority = 5
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("applicationToken").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("serverUrl").GetString().ShouldBe("https://gotify.example.com");
+    }
+
+    #endregion
+
+    #region AppriseConfig
+
+    [Fact]
+    public void AppriseConfig_Key_IsMasked_WithFullMask()
+    {
+        var config = new AppriseConfig
+        {
+            Mode = AppriseMode.Api,
+            Url = "https://apprise.example.com",
+            Key = "apprise-config-key-secret",
+            Tags = "urgent",
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("key").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("url").GetString().ShouldBe("https://apprise.example.com");
+    }
+
+    [Fact]
+    public void AppriseConfig_ServiceUrls_IsMasked_WithAppriseUrlMask()
+    {
+        var config = new AppriseConfig
+        {
+            Mode = AppriseMode.Cli,
+            ServiceUrls = "discord://webhook_id/webhook_token slack://tokenA/tokenB/tokenC"
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        var maskedUrls = doc.RootElement.GetProperty("serviceUrls").GetString();
+        maskedUrls.ShouldContain("discord://••••••••");
+        maskedUrls.ShouldContain("slack://••••••••");
+        maskedUrls.ShouldNotContain("webhook_id");
+        maskedUrls.ShouldNotContain("webhook_token");
+        maskedUrls.ShouldNotContain("tokenA");
+    }
+
+    [Fact]
+    public void AppriseConfig_NullServiceUrls_RemainsNull()
+    {
+        var config = new AppriseConfig
+        {
+            Mode = AppriseMode.Api,
+            Url = "https://apprise.example.com",
+            Key = "some-key",
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("serviceUrls").ValueKind.ShouldBe(JsonValueKind.Null);
+    }
+
+    #endregion
+
+    #region Polymorphic serialization (as used in NotificationProviderResponse)
+
+    [Fact]
+    public void PolymorphicSerialization_NotifiarrConfig_StillMasked()
+    {
+        // The notification providers endpoint casts configs to `object`.
+        // Verify that the resolver still masks when serializing as a concrete type at runtime.
+        object config = new NotifiarrConfig
+        {
+            ApiKey = "my-secret-notifiarr-key",
+            ChannelId = "987654321"
+        };
+
+        var json = JsonSerializer.Serialize(config, config.GetType(), _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("apiKey").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("channelId").GetString().ShouldBe("987654321");
+    }
+
+    [Fact]
+    public void PolymorphicSerialization_DiscordConfig_StillMasked()
+    {
+        object config = new DiscordConfig
+        {
+            WebhookUrl = "https://discord.com/api/webhooks/123/secret",
+            Username = "Bot"
+        };
+
+        var json = JsonSerializer.Serialize(config, config.GetType(), _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("webhookUrl").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("username").GetString().ShouldBe("Bot");
+    }
+
+    #endregion
+
+    #region Edge cases
+
+    [Fact]
+    public void EmptySensitiveString_IsMasked_NotReturnedEmpty()
+    {
+        var config = new NotifiarrConfig
+        {
+            ApiKey = "",
+            ChannelId = "123"
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        // Even empty strings get masked to the placeholder
+        doc.RootElement.GetProperty("apiKey").GetString().ShouldBe(Placeholder);
+    }
+
+    [Fact]
+    public void MultipleSensitiveFields_AllMasked()
+    {
+        var config = new PushoverConfig
+        {
+            ApiToken = "token-abc-123",
+            UserKey = "user-key-xyz-789",
+            Priority = PushoverPriority.High,
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("apiToken").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("userKey").GetString().ShouldBe(Placeholder);
+    }
+
+    #endregion
+}
@@ -0,0 +1,37 @@
+using Xunit.Abstractions;
+using Xunit.Sdk;
+
+namespace Cleanuparr.Api.Tests;
+
+public sealed class PriorityOrderer : ITestCaseOrderer
+{
+    public IEnumerable<TTestCase> OrderTestCases<TTestCase>(IEnumerable<TTestCase> testCases)
+        where TTestCase : ITestCase
+    {
+        var sortedMethods = new SortedDictionary<int, List<TTestCase>>();
+
+        foreach (var testCase in testCases)
+        {
+            var priority = testCase.TestMethod.Method
+                .GetCustomAttributes(typeof(TestPriorityAttribute).AssemblyQualifiedName)
+                .FirstOrDefault()
+                ?.GetNamedArgument<int>("Priority") ?? 0;
+
+            if (!sortedMethods.TryGetValue(priority, out var list))
+            {
+                list = [];
+                sortedMethods[priority] = list;
+            }
+
+            list.Add(testCase);
+        }
+
+        foreach (var list in sortedMethods.Values)
+        {
+            foreach (var testCase in list)
+            {
+                yield return testCase;
+            }
+        }
+    }
+}
@@ -0,0 +1,12 @@
+namespace Cleanuparr.Api.Tests;
+
+[AttributeUsage(AttributeTargets.Method)]
+public sealed class TestPriorityAttribute : Attribute
+{
+    public int Priority { get; }
+
+    public TestPriorityAttribute(int priority)
+    {
+        Priority = priority;
+    }
+}
@@ -0,0 +1,69 @@
+using System.Security.Claims;
+using System.Text.Encodings.Web;
+using Cleanuparr.Persistence;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Options;
+
+namespace Cleanuparr.Api.Auth;
+
+public static class ApiKeyAuthenticationDefaults
+{
+    public const string AuthenticationScheme = "ApiKey";
+    public const string HeaderName = "X-Api-Key";
+    public const string QueryParameterName = "apikey";
+}
+
+public class ApiKeyAuthenticationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
+{
+    public ApiKeyAuthenticationHandler(
+        IOptionsMonitor<AuthenticationSchemeOptions> options,
+        ILoggerFactory logger,
+        UrlEncoder encoder)
+        : base(options, logger, encoder)
+    {
+    }
+
+    protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
+    {
+        // Try header first, then query string
+        string? apiKey = null;
+
+        if (Request.Headers.TryGetValue(ApiKeyAuthenticationDefaults.HeaderName, out var headerValue))
+        {
+            apiKey = headerValue.ToString();
+        }
+        else if (Request.Query.TryGetValue(ApiKeyAuthenticationDefaults.QueryParameterName, out var queryValue))
+        {
+            apiKey = queryValue.ToString();
+        }
+
+        if (string.IsNullOrWhiteSpace(apiKey))
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        await using var usersContext = UsersContext.CreateStaticInstance();
+        var user = await usersContext.Users
+            .AsNoTracking()
+            .FirstOrDefaultAsync(u => u.ApiKey == apiKey && u.SetupCompleted);
+
+        if (user is null)
+        {
+            return AuthenticateResult.Fail("Invalid API key");
+        }
+
+        var claims = new[]
+        {
+            new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
+            new Claim(ClaimTypes.Name, user.Username),
+            new Claim("auth_method", "apikey")
+        };
+
+        var identity = new ClaimsIdentity(claims, ApiKeyAuthenticationDefaults.AuthenticationScheme);
+        var principal = new ClaimsPrincipal(identity);
+        var ticket = new AuthenticationTicket(principal, ApiKeyAuthenticationDefaults.AuthenticationScheme);
+
+        return AuthenticateResult.Success(ticket);
+    }
+}
@@ -0,0 +1,192 @@
+using System.Net;
+using System.Security.Claims;
+using System.Text.Encodings.Web;
+using Cleanuparr.Infrastructure.Extensions;
+using Cleanuparr.Persistence;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Options;
+
+namespace Cleanuparr.Api.Auth;
+
+public static class TrustedNetworkAuthenticationDefaults
+{
+    public const string AuthenticationScheme = "TrustedNetwork";
+}
+
+public class TrustedNetworkAuthenticationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
+{
+    public TrustedNetworkAuthenticationHandler(
+        IOptionsMonitor<AuthenticationSchemeOptions> options,
+        ILoggerFactory logger,
+        UrlEncoder encoder)
+        : base(options, logger, encoder)
+    {
+    }
+
+    protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
+    {
+        // Load auth config from database
+        await using var dataContext = DataContext.CreateStaticInstance();
+        var config = await dataContext.GeneralConfigs.AsNoTracking().FirstOrDefaultAsync();
+
+        if (config is null || !config.Auth.DisableAuthForLocalAddresses)
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        // Determine client IP
+        var clientIp = GetClientIp(config.Auth.TrustForwardedHeaders);
+        if (clientIp is null)
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        // Check if the client IP is trusted
+        if (!IsTrustedAddress(clientIp, config.Auth.TrustedNetworks))
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        // Load the admin user
+        await using var usersContext = UsersContext.CreateStaticInstance();
+        var user = await usersContext.Users
+            .AsNoTracking()
+            .FirstOrDefaultAsync(u => u.SetupCompleted);
+
+        if (user is null)
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        var claims = new[]
+        {
+            new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
+            new Claim(ClaimTypes.Name, user.Username),
+            new Claim("auth_method", "trusted_network")
+        };
+
+        var identity = new ClaimsIdentity(claims, TrustedNetworkAuthenticationDefaults.AuthenticationScheme);
+        var principal = new ClaimsPrincipal(identity);
+        var ticket = new AuthenticationTicket(principal, TrustedNetworkAuthenticationDefaults.AuthenticationScheme);
+
+        return AuthenticateResult.Success(ticket);
+    }
+
+    private IPAddress? GetClientIp(bool trustForwardedHeaders) =>
+        ResolveClientIp(Context, trustForwardedHeaders);
+
+    public static IPAddress? ResolveClientIp(HttpContext httpContext, bool trustForwardedHeaders)
+    {
+        var remoteIp = httpContext.Connection.RemoteIpAddress;
+        if (remoteIp is null)
+        {
+            return null;
+        }
+
+        // Only trust forwarded headers if the direct connection is from a local address
+        if (trustForwardedHeaders && remoteIp.IsLocalAddress())
+        {
+            // Check X-Forwarded-For first, then X-Real-IP
+            var forwardedFor = httpContext.Request.Headers["X-Forwarded-For"].FirstOrDefault();
+            if (!string.IsNullOrEmpty(forwardedFor))
+            {
+                // X-Forwarded-For can contain multiple IPs: client, proxy1, proxy2
+                // The first one is the original client
+                var firstIp = forwardedFor.Split(',')[0].Trim();
+                if (IPAddress.TryParse(firstIp, out var parsedIp))
+                {
+                    return parsedIp;
+                }
+            }
+
+            var realIp = httpContext.Request.Headers["X-Real-IP"].FirstOrDefault();
+            if (!string.IsNullOrEmpty(realIp) && IPAddress.TryParse(realIp, out var realParsedIp))
+            {
+                return realParsedIp;
+            }
+        }
+
+        return remoteIp;
+    }
+
+    public static bool IsTrustedAddress(IPAddress clientIp, List<string> trustedNetworks)
+    {
+        // Normalize IPv4-mapped IPv6 addresses
+        if (clientIp.IsIPv4MappedToIPv6)
+        {
+            clientIp = clientIp.MapToIPv4();
+        }
+
+        // Check if it's a local address (built-in ranges)
+        if (clientIp.IsLocalAddress())
+        {
+            return true;
+        }
+
+        // Check against custom trusted networks
+        foreach (var network in trustedNetworks)
+        {
+            if (MatchesCidr(clientIp, network))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    public static bool MatchesCidr(IPAddress address, string cidr)
+    {
+        if (cidr.Contains('/'))
+        {
+            var parts = cidr.Split('/');
+            if (!IPAddress.TryParse(parts[0], out var networkAddress) ||
+                !int.TryParse(parts[1], out var prefixLength))
+            {
+                return false;
+            }
+
+            // Normalize both addresses
+            if (networkAddress.IsIPv4MappedToIPv6)
+                networkAddress = networkAddress.MapToIPv4();
+            if (address.IsIPv4MappedToIPv6)
+                address = address.MapToIPv4();
+
+            // Must be same address family
+            if (address.AddressFamily != networkAddress.AddressFamily)
+                return false;
+
+            var addressBytes = address.GetAddressBytes();
+            var networkBytes = networkAddress.GetAddressBytes();
+
+            // Compare bytes up to prefix length
+            var fullBytes = prefixLength / 8;
+            var remainingBits = prefixLength % 8;
+
+            for (var i = 0; i < fullBytes && i < addressBytes.Length; i++)
+            {
+                if (addressBytes[i] != networkBytes[i])
+                    return false;
+            }
+
+            if (remainingBits > 0 && fullBytes < addressBytes.Length)
+            {
+                var mask = (byte)(0xFF << (8 - remainingBits));
+                if ((addressBytes[fullBytes] & mask) != (networkBytes[fullBytes] & mask))
+                    return false;
+            }
+
+            return true;
+        }
+
+        // Plain IP match
+        if (!IPAddress.TryParse(cidr, out var singleIp))
+            return false;
+
+        if (singleIp.IsIPv4MappedToIPv6)
+            singleIp = singleIp.MapToIPv4();
+
+        return address.Equals(singleIp);
+    }
+}
@@ -3,7 +3,7 @@
    <PropertyGroup>
        <AssemblyName>Cleanuparr</AssemblyName>
        <Version Condition="'$(Version)' == ''">0.0.1</Version>
-        <TargetFramework>net9.0</TargetFramework>
+        <TargetFramework>net10.0</TargetFramework>
        <Nullable>enable</Nullable>
        <ImplicitUsings>enable</ImplicitUsings>
        <PublishReadyToRun>true</PublishReadyToRun>
@@ -23,27 +23,25 @@
    </ItemGroup>

    <ItemGroup>
-        <PackageReference Include="MassTransit" Version="8.4.1" />
-        <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="9.0.6">
+        <PackageReference Include="MassTransit" Version="8.5.7" />
+        <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.1" />
+        <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.1">
          <PrivateAssets>all</PrivateAssets>
          <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
        </PackageReference>
-        <PackageReference Include="Microsoft.Extensions.Hosting" Version="9.0.6" />
-        <PackageReference Include="Microsoft.Extensions.Hosting.WindowsServices" Version="9.0.6" />
-        <PackageReference Include="Microsoft.Extensions.Http" Version="9.0.6" />
-        <PackageReference Include="Microsoft.Extensions.Http.Polly" Version="9.0.6" />
-        <PackageReference Include="Quartz" Version="3.14.0" />
-        <PackageReference Include="Quartz.Extensions.DependencyInjection" Version="3.14.0" />
-        <PackageReference Include="Quartz.Extensions.Hosting" Version="3.14.0" />
+        <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.1" />
+        <PackageReference Include="Microsoft.Extensions.Hosting.WindowsServices" Version="10.0.1" />
+        <PackageReference Include="Microsoft.Extensions.Http" Version="10.0.1" />
+        <PackageReference Include="Microsoft.Extensions.Http.Polly" Version="10.0.1" />
+        <PackageReference Include="Quartz" Version="3.15.1" />
+        <PackageReference Include="Quartz.Extensions.DependencyInjection" Version="3.15.1" />
+        <PackageReference Include="Quartz.Extensions.Hosting" Version="3.15.1" />
        <PackageReference Include="Serilog" Version="4.3.0" />
        <PackageReference Include="Serilog.Expressions" Version="5.0.0" />
-        <PackageReference Include="Serilog.Extensions.Hosting" Version="9.0.0" />
-        <PackageReference Include="Serilog.Settings.Configuration" Version="9.0.0" />
-        <PackageReference Include="Serilog.Sinks.Console" Version="6.0.0" />
+        <PackageReference Include="Serilog.Extensions.Hosting" Version="10.0.0" />
+        <PackageReference Include="Serilog.Settings.Configuration" Version="10.0.0" />
+        <PackageReference Include="Serilog.Sinks.Console" Version="6.1.1" />
        <PackageReference Include="Serilog.Sinks.File" Version="7.0.0" />
-        <!-- API-related packages -->
-        <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="9.0.2" />
-        <PackageReference Include="Swashbuckle.AspNetCore" Version="6.5.0" />
    </ItemGroup>

 </Project>
@@ -1,9 +1,11 @@
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;

 namespace Cleanuparr.Api.Controllers;

 [ApiController]
 [Route("api")]
+[Authorize]
 public class ApiDocumentationController : ControllerBase
 {
    [HttpGet]
@@ -2,6 +2,7 @@ using System.Text.Json.Serialization;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Events;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;

@@ -9,6 +10,7 @@ namespace Cleanuparr.Api.Controllers;

 [ApiController]
 [Route("api/[controller]")]
+[Authorize]
 public class EventsController : ControllerBase
 {
    private readonly EventsContext _context;
@@ -29,12 +31,24 @@ public class EventsController : ControllerBase
        [FromQuery] string? eventType = null,
        [FromQuery] DateTime? fromDate = null,
        [FromQuery] DateTime? toDate = null,
-        [FromQuery] string? search = null)
+        [FromQuery] string? search = null,
+        [FromQuery] string? jobRunId = null)
    {
        // Validate pagination parameters
-        if (page < 1) page = 1;
-        if (pageSize < 1) pageSize = 100;
-        if (pageSize > 1000) pageSize = 1000; // Cap at 1000 for performance
+        if (page < 1)
+        {
+            page = 1;
+        }
+
+        if (pageSize < 1)
+        {
+            pageSize = 100;
+        }
+        
+        if (pageSize > 1000)
+        {
+            pageSize = 1000; // Cap at 1000 for performance
+        }
        
        var query = _context.Events.AsQueryable();

@@ -62,6 +76,12 @@ public class EventsController : ControllerBase
            query = query.Where(e => e.Timestamp <= toDate.Value);
        }

+        // Apply job run ID exact-match filter
+        if (!string.IsNullOrWhiteSpace(jobRunId) && Guid.TryParse(jobRunId, out var jobRunGuid))
+        {
+            query = query.Where(e => e.JobRunId == jobRunGuid);
+        }
+
        // Apply search filter if provided
        if (!string.IsNullOrWhiteSpace(search))
        {
@@ -69,7 +89,10 @@ public class EventsController : ControllerBase
            query = query.Where(e =>
                EF.Functions.Like(e.Message, pattern) ||
                EF.Functions.Like(e.Data, pattern) ||
-                EF.Functions.Like(e.TrackingId.ToString(), pattern)
+                EF.Functions.Like(e.TrackingId.ToString(), pattern) ||
+                EF.Functions.Like(e.InstanceUrl, pattern) ||
+                EF.Functions.Like(e.DownloadClientName, pattern) ||
+                EF.Functions.Like(e.JobRunId.ToString(), pattern)
            );
        }

@@ -128,33 +151,6 @@ public class EventsController : ControllerBase
        return Ok(events);
    }

-    /// <summary>
-    /// Gets event statistics
-    /// </summary>
-    [HttpGet("stats")]
-    public async Task<ActionResult<object>> GetEventStats()
-    {
-        var stats = new
-        {
-            TotalEvents = await _context.Events.CountAsync(),
-            EventsBySeverity = await _context.Events
-                .GroupBy(e => e.Severity)
-                .Select(g => new { Severity = g.Key.ToString(), Count = g.Count() })
-                .ToListAsync(),
-            EventsByType = await _context.Events
-                .GroupBy(e => e.EventType)
-                .Select(g => new { EventType = g.Key.ToString(), Count = g.Count() })
-                .OrderByDescending(x => x.Count)
-                .Take(10)
-                .ToListAsync(),
-            RecentEventsCount = await _context.Events
-                .Where(e => e.Timestamp > DateTime.UtcNow.AddHours(-24))
-                .CountAsync()
-        };
-
-        return Ok(stats);
-    }
-
    /// <summary>
    /// Manually triggers cleanup of old events
    /// </summary>
@@ -1,4 +1,5 @@
 using Cleanuparr.Infrastructure.Health;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;

 namespace Cleanuparr.Api.Controllers;
@@ -8,6 +9,7 @@ namespace Cleanuparr.Api.Controllers;
 /// </summary>
 [ApiController]
 [Route("api/health")]
+[Authorize]
 public class HealthCheckController : ControllerBase
 {
    private readonly ILogger<HealthCheckController> _logger;
@@ -1,3 +1,4 @@
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Diagnostics.HealthChecks;

@@ -8,6 +9,7 @@ namespace Cleanuparr.Api.Controllers;
 /// </summary>
 [ApiController]
 [Route("[controller]")]
+[Authorize]
 public class HealthController : ControllerBase
 {
    private readonly HealthCheckService _healthCheckService;
@@ -23,6 +25,7 @@ public class HealthController : ControllerBase
    /// Basic liveness probe - checks if the application is running
    /// Used by Docker HEALTHCHECK and Kubernetes liveness probes
    /// </summary>
+    [AllowAnonymous]
    [HttpGet]
    [Route("/health")]
    public async Task<IActionResult> GetHealth()
@@ -47,6 +50,7 @@ public class HealthController : ControllerBase
    /// Readiness probe - checks if the application is ready to serve traffic
    /// Used by Kubernetes readiness probes
    /// </summary>
+    [AllowAnonymous]
    [HttpGet]
    [Route("/health/ready")]
    public async Task<IActionResult> GetReadiness()
@@ -1,12 +1,15 @@
 using Cleanuparr.Api.Models;
+using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Models;
 using Cleanuparr.Infrastructure.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;

 namespace Cleanuparr.Api.Controllers;

 [ApiController]
 [Route("api/[controller]")]
+[Authorize]
 public class JobsController : ControllerBase
 {
    private readonly IJobManagementService _jobManagementService;
@@ -1,6 +1,7 @@
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Events;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;

@@ -8,6 +9,7 @@ namespace Cleanuparr.Api.Controllers;

 [ApiController]
 [Route("api/[controller]")]
+[Authorize]
 public class ManualEventsController : ControllerBase
 {
    private readonly EventsContext _context;
@@ -66,7 +68,9 @@ public class ManualEventsController : ControllerBase
            string pattern = EventsContext.GetLikePattern(search);
            query = query.Where(e =>
                EF.Functions.Like(e.Message, pattern) ||
-                EF.Functions.Like(e.Data, pattern)
+                EF.Functions.Like(e.Data, pattern) ||
+                EF.Functions.Like(e.InstanceUrl, pattern) ||
+                EF.Functions.Like(e.DownloadClientName, pattern)
            );
        }

@@ -0,0 +1,53 @@
+using Cleanuparr.Infrastructure.Stats;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace Cleanuparr.Api.Controllers;
+
+/// <summary>
+/// Aggregated statistics endpoint for dashboard integrations
+/// </summary>
+[ApiController]
+[Route("api/[controller]")]
+[Authorize]
+public class StatsController : ControllerBase
+{
+    private readonly ILogger<StatsController> _logger;
+    private readonly IStatsService _statsService;
+
+    public StatsController(
+        ILogger<StatsController> logger,
+        IStatsService statsService)
+    {
+        _logger = logger;
+        _statsService = statsService;
+    }
+
+    /// <summary>
+    /// Gets aggregated application statistics for the specified timeframe
+    /// </summary>
+    /// <param name="hours">Timeframe in hours (default 24, range 1-720)</param>
+    /// <param name="includeEvents">Number of recent events to include (0 = none, max 100)</param>
+    /// <param name="includeStrikes">Number of recent strikes to include (0 = none, max 100)</param>
+    [HttpGet]
+    public async Task<IActionResult> GetStats(
+        [FromQuery] int hours = 24,
+        [FromQuery] int includeEvents = 0,
+        [FromQuery] int includeStrikes = 0)
+    {
+        try
+        {
+            hours = Math.Clamp(hours, 1, 720);
+            includeEvents = Math.Clamp(includeEvents, 0, 100);
+            includeStrikes = Math.Clamp(includeStrikes, 0, 100);
+
+            var stats = await _statsService.GetStatsAsync(hours, includeEvents, includeStrikes);
+            return Ok(stats);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Error retrieving stats");
+            return StatusCode(500, new { Error = "An error occurred while retrieving stats" });
+        }
+    }
+}
@@ -1,8 +1,8 @@
 using System.Diagnostics;
 using Cleanuparr.Domain.Enums;
-using Cleanuparr.Infrastructure.Features.Arr;
-using Cleanuparr.Infrastructure.Features.DownloadClient;
+using Cleanuparr.Infrastructure.Features.Arr.Interfaces;
 using Cleanuparr.Persistence;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;

@@ -10,22 +10,20 @@ namespace Cleanuparr.Api.Controllers;

 [ApiController]
 [Route("api/[controller]")]
+[Authorize]
 public class StatusController : ControllerBase
 {
    private readonly ILogger<StatusController> _logger;
    private readonly DataContext _dataContext;
-    private readonly DownloadServiceFactory _downloadServiceFactory;
-    private readonly ArrClientFactory _arrClientFactory;
+    private readonly IArrClientFactory _arrClientFactory;

    public StatusController(
        ILogger<StatusController> logger,
        DataContext dataContext,
-        DownloadServiceFactory downloadServiceFactory,
-        ArrClientFactory arrClientFactory)
+        IArrClientFactory arrClientFactory)
    {
        _logger = logger;
        _dataContext = dataContext;
-        _downloadServiceFactory = downloadServiceFactory;
        _arrClientFactory = arrClientFactory;
    }

@@ -178,8 +176,8 @@ public class StatusController : ControllerBase
            {
                try
                {
-                    var sonarrClient = _arrClientFactory.GetClient(InstanceType.Sonarr);
-                    await sonarrClient.TestConnectionAsync(instance);
+                    var sonarrClient = _arrClientFactory.GetClient(InstanceType.Sonarr, instance.Version);
+                    await sonarrClient.HealthCheckAsync(instance);
                    
                    sonarrStatus.Add(new
                    {
@@ -210,8 +208,8 @@ public class StatusController : ControllerBase
            {
                try
                {
-                    var radarrClient = _arrClientFactory.GetClient(InstanceType.Radarr);
-                    await radarrClient.TestConnectionAsync(instance);
+                    var radarrClient = _arrClientFactory.GetClient(InstanceType.Radarr, instance.Version);
+                    await radarrClient.HealthCheckAsync(instance);
                    
                    radarrStatus.Add(new
                    {
@@ -242,8 +240,8 @@ public class StatusController : ControllerBase
            {
                try
                {
-                    var lidarrClient = _arrClientFactory.GetClient(InstanceType.Lidarr);
-                    await lidarrClient.TestConnectionAsync(instance);
+                    var lidarrClient = _arrClientFactory.GetClient(InstanceType.Lidarr, instance.Version);
+                    await lidarrClient.HealthCheckAsync(instance);
                    
                    lidarrStatus.Add(new
                    {
@@ -0,0 +1,191 @@
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.State;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Api.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+[Authorize]
+public class StrikesController : ControllerBase
+{
+    private readonly EventsContext _context;
+
+    public StrikesController(EventsContext context)
+    {
+        _context = context;
+    }
+
+    /// <summary>
+    /// Gets download items with their strikes (grouped), with pagination and filtering
+    /// </summary>
+    [HttpGet]
+    public async Task<ActionResult<PaginatedResult<DownloadItemStrikesDto>>> GetStrikes(
+        [FromQuery] int page = 1,
+        [FromQuery] int pageSize = 50,
+        [FromQuery] string? search = null,
+        [FromQuery] string? type = null)
+    {
+        if (page < 1) page = 1;
+        if (pageSize < 1) pageSize = 50;
+        if (pageSize > 100) pageSize = 100;
+
+        var query = _context.DownloadItems
+            .Include(d => d.Strikes)
+            .Where(d => d.Strikes.Any());
+
+        // Filter by strike type: only show items that have strikes of this type
+        if (!string.IsNullOrWhiteSpace(type))
+        {
+            if (Enum.TryParse<StrikeType>(type, true, out var strikeType))
+                query = query.Where(d => d.Strikes.Any(s => s.Type == strikeType));
+        }
+
+        // Apply search filter on title or download hash
+        if (!string.IsNullOrWhiteSpace(search))
+        {
+            string pattern = EventsContext.GetLikePattern(search);
+            query = query.Where(d =>
+                EF.Functions.Like(d.Title, pattern) ||
+                EF.Functions.Like(d.DownloadId, pattern));
+        }
+
+        var totalCount = await query.CountAsync();
+        var totalPages = (int)Math.Ceiling(totalCount / (double)pageSize);
+        var skip = (page - 1) * pageSize;
+
+        var items = await query
+            .OrderByDescending(d => d.Strikes.Max(s => s.CreatedAt))
+            .Skip(skip)
+            .Take(pageSize)
+            .ToListAsync();
+
+        var dtos = items.Select(d => new DownloadItemStrikesDto
+        {
+            DownloadItemId = d.Id,
+            DownloadId = d.DownloadId,
+            Title = d.Title,
+            TotalStrikes = d.Strikes.Count,
+            StrikesByType = d.Strikes
+                .GroupBy(s => s.Type)
+                .ToDictionary(g => g.Key.ToString(), g => g.Count()),
+            LatestStrikeAt = d.Strikes.Max(s => s.CreatedAt),
+            FirstStrikeAt = d.Strikes.Min(s => s.CreatedAt),
+            IsMarkedForRemoval = d.IsMarkedForRemoval,
+            IsRemoved = d.IsRemoved,
+            IsReturning = d.IsReturning,
+            Strikes = d.Strikes
+                .OrderByDescending(s => s.CreatedAt)
+                .Select(s => new StrikeDetailDto
+                {
+                    Id = s.Id,
+                    Type = s.Type.ToString(),
+                    CreatedAt = s.CreatedAt,
+                    LastDownloadedBytes = s.LastDownloadedBytes,
+                    JobRunId = s.JobRunId,
+                }).ToList(),
+        }).ToList();
+
+        return Ok(new PaginatedResult<DownloadItemStrikesDto>
+        {
+            Items = dtos,
+            Page = page,
+            PageSize = pageSize,
+            TotalCount = totalCount,
+            TotalPages = totalPages,
+        });
+    }
+
+    /// <summary>
+    /// Gets the most recent individual strikes with download item info (for dashboard)
+    /// </summary>
+    [HttpGet("recent")]
+    public async Task<ActionResult<List<RecentStrikeDto>>> GetRecentStrikes(
+        [FromQuery] int count = 5)
+    {
+        if (count < 1) count = 1;
+        if (count > 50) count = 50;
+
+        var strikes = await _context.Strikes
+            .Include(s => s.DownloadItem)
+            .OrderByDescending(s => s.CreatedAt)
+            .Take(count)
+            .Select(s => new RecentStrikeDto
+            {
+                Id = s.Id,
+                Type = s.Type.ToString(),
+                CreatedAt = s.CreatedAt,
+                DownloadId = s.DownloadItem.DownloadId,
+                Title = s.DownloadItem.Title,
+            })
+            .ToListAsync();
+
+        return Ok(strikes);
+    }
+
+    /// <summary>
+    /// Gets all available strike types
+    /// </summary>
+    [HttpGet("types")]
+    public ActionResult<List<string>> GetStrikeTypes()
+    {
+        var types = Enum.GetNames(typeof(StrikeType)).ToList();
+        return Ok(types);
+    }
+
+    /// <summary>
+    /// Deletes all strikes for a specific download item
+    /// </summary>
+    [HttpDelete("{downloadItemId:guid}")]
+    public async Task<IActionResult> DeleteStrikesForItem(Guid downloadItemId)
+    {
+        var item = await _context.DownloadItems
+            .Include(d => d.Strikes)
+            .FirstOrDefaultAsync(d => d.Id == downloadItemId);
+
+        if (item == null)
+            return NotFound();
+
+        _context.Strikes.RemoveRange(item.Strikes);
+        _context.DownloadItems.Remove(item);
+        await _context.SaveChangesAsync();
+
+        return NoContent();
+    }
+}
+
+public class DownloadItemStrikesDto
+{
+    public Guid DownloadItemId { get; set; }
+    public string DownloadId { get; set; } = string.Empty;
+    public string Title { get; set; } = string.Empty;
+    public int TotalStrikes { get; set; }
+    public Dictionary<string, int> StrikesByType { get; set; } = new();
+    public DateTime LatestStrikeAt { get; set; }
+    public DateTime FirstStrikeAt { get; set; }
+    public bool IsMarkedForRemoval { get; set; }
+    public bool IsRemoved { get; set; }
+    public bool IsReturning { get; set; }
+    public List<StrikeDetailDto> Strikes { get; set; } = [];
+}
+
+public class StrikeDetailDto
+{
+    public Guid Id { get; set; }
+    public string Type { get; set; } = string.Empty;
+    public DateTime CreatedAt { get; set; }
+    public long? LastDownloadedBytes { get; set; }
+    public Guid JobRunId { get; set; }
+}
+
+public class RecentStrikeDto
+{
+    public Guid Id { get; set; }
+    public string Type { get; set; } = string.Empty;
+    public DateTime CreatedAt { get; set; }
+    public string DownloadId { get; set; } = string.Empty;
+    public string Title { get; set; } = string.Empty;
+}
@@ -1,8 +1,9 @@
 using System.Text.Json.Serialization;
+using System.Text.Json.Serialization.Metadata;
+using Cleanuparr.Api.Json;
 using Cleanuparr.Infrastructure.Health;
 using Cleanuparr.Infrastructure.Hubs;
 using Microsoft.AspNetCore.Http.Json;
-using Microsoft.OpenApi.Models;
 using System.Text;
 using Cleanuparr.Api.Middleware;
 using Microsoft.Extensions.Options;
@@ -18,12 +19,14 @@ public static class ApiDI
            options.SerializerOptions.PropertyNameCaseInsensitive = true;
            options.SerializerOptions.Converters.Add(new JsonStringEnumConverter());
            options.SerializerOptions.ReferenceHandler = ReferenceHandler.IgnoreCycles;
+            options.SerializerOptions.TypeInfoResolver = new SensitiveDataResolver(
+                options.SerializerOptions.TypeInfoResolver ?? new DefaultJsonTypeInfoResolver());
        });
-        
+
        // Make JsonSerializerOptions available for injection
        services.AddSingleton(sp =>
            sp.GetRequiredService<IOptions<JsonOptions>>().Value.SerializerOptions);
-        
+
        // Add API-specific services
        services
            .AddControllers()
@@ -32,9 +35,11 @@ public static class ApiDI
                options.JsonSerializerOptions.PropertyNameCaseInsensitive = true;
                options.JsonSerializerOptions.Converters.Add(new JsonStringEnumConverter());
                options.JsonSerializerOptions.ReferenceHandler = ReferenceHandler.IgnoreCycles;
+                options.JsonSerializerOptions.TypeInfoResolver = new SensitiveDataResolver(
+                    options.JsonSerializerOptions.TypeInfoResolver ?? new DefaultJsonTypeInfoResolver());
            });
        services.AddEndpointsApiExplorer();
-        
+
        // Add SignalR for real-time updates
        services
            .AddSignalR()
@@ -42,24 +47,12 @@ public static class ApiDI
            {
                options.PayloadSerializerOptions.PropertyNameCaseInsensitive = true;
                options.PayloadSerializerOptions.Converters.Add(new JsonStringEnumConverter());
+                options.PayloadSerializerOptions.TypeInfoResolver = new SensitiveDataResolver(
+                    options.PayloadSerializerOptions.TypeInfoResolver ?? new DefaultJsonTypeInfoResolver());
            });
        
        // Add health status broadcaster
        services.AddHostedService<HealthStatusBroadcaster>();
-        
-        services.AddSwaggerGen(options =>
-        {
-            options.SwaggerDoc("v1", new OpenApiInfo
-            {
-                Title = "Cleanuparr API",
-                Version = "v1",
-                Description = "API for managing media downloads and cleanups",
-                Contact = new OpenApiContact
-                {
-                    Name = "Cleanuparr Team"
-                }
-            });
-        });

        return services;
    }
@@ -80,20 +73,13 @@ public static class ApiDI
        // Add the global exception handling middleware first
        app.UseMiddleware<ExceptionMiddleware>();

+        // Block non-auth requests until setup is complete
+        app.UseMiddleware<SetupGuardMiddleware>();
+
        app.UseCors("Any");
        app.UseRouting();

-        if (app.Environment.IsDevelopment())
-        {
-            app.UseSwagger();
-            app.UseSwaggerUI(options =>
-            {
-                options.SwaggerEndpoint("v1/swagger.json", "Cleanuparr API v1");
-                options.RoutePrefix = "swagger";
-                options.DocumentTitle = "Cleanuparr API Documentation";
-            });
-        }
-
+        app.UseAuthentication();
        app.UseAuthorization();
        app.MapControllers();
        
@@ -134,11 +120,11 @@ public static class ApiDI
            
            context.Response.ContentType = "text/html";
            await context.Response.WriteAsync(indexContent, Encoding.UTF8);
-        });
+        }).AllowAnonymous();
        
        // Map SignalR hubs
-        app.MapHub<HealthStatusHub>("/api/hubs/health");
-        app.MapHub<AppHub>("/api/hubs/app");
+        app.MapHub<HealthStatusHub>("/api/hubs/health").RequireAuthorization();
+        app.MapHub<AppHub>("/api/hubs/app").RequireAuthorization();
        
        app.MapGet("/manifest.webmanifest", (HttpContext context) =>
        {
@@ -150,12 +136,18 @@ public static class ApiDI
            {
                name = "Cleanuparr",
                short_name = "Cleanuparr",
+                description = "Automated cleanup for *arr applications and download clients",
                start_url = basePath,
                display = "standalone",
-                background_color = "#ffffff",
-                theme_color = "#ffffff",
+                background_color = "#0e0a1a",
+                theme_color = "#1a1135",
                icons = new[]
                {
+                    new {
+                        src = "icons/128.png",
+                        sizes = "128x128",
+                        type = "image/png"
+                    },
                    new {
                        src = "icons/icon-192x192.png",
                        sizes = "192x192",
@@ -170,7 +162,7 @@ public static class ApiDI
            };

            return Results.Json(manifest, contentType: "application/manifest+json");
-        });
+        }).AllowAnonymous();

        return app;
    }
@@ -0,0 +1,92 @@
+using Cleanuparr.Api.Auth;
+using Cleanuparr.Infrastructure.Features.Auth;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.IdentityModel.Tokens;
+
+namespace Cleanuparr.Api.DependencyInjection;
+
+public static class AuthDI
+{
+    private const string SmartScheme = "Smart";
+
+    public static IServiceCollection AddAuthServices(this IServiceCollection services)
+    {
+        // Get the signing key from the JwtService
+        var jwtService = new JwtService();
+        var signingKey = jwtService.GetOrCreateSigningKey();
+
+        services
+            .AddAuthentication(SmartScheme)
+            .AddPolicyScheme(SmartScheme, "JWT or API Key", options =>
+            {
+                // Route to the correct auth handler based on the request
+                options.ForwardDefaultSelector = context =>
+                {
+                    if (context.Request.Headers.ContainsKey(ApiKeyAuthenticationDefaults.HeaderName) ||
+                        context.Request.Query.ContainsKey(ApiKeyAuthenticationDefaults.QueryParameterName))
+                    {
+                        return ApiKeyAuthenticationDefaults.AuthenticationScheme;
+                    }
+
+                    // Check for Bearer token or SignalR access_token
+                    if (context.Request.Headers.ContainsKey("Authorization") ||
+                        (context.Request.Path.StartsWithSegments("/api/hubs") &&
+                         context.Request.Query.ContainsKey("access_token")))
+                    {
+                        return JwtBearerDefaults.AuthenticationScheme;
+                    }
+
+                    // Fall through to trusted network handler (returns NoResult if disabled)
+                    return TrustedNetworkAuthenticationDefaults.AuthenticationScheme;
+                };
+            })
+            .AddJwtBearer(options =>
+            {
+                options.TokenValidationParameters = new TokenValidationParameters
+                {
+                    ValidateIssuer = true,
+                    ValidIssuer = "Cleanuparr",
+                    ValidateAudience = true,
+                    ValidAudience = "Cleanuparr",
+                    ValidateLifetime = true,
+                    ValidateIssuerSigningKey = true,
+                    IssuerSigningKey = new SymmetricSecurityKey(signingKey),
+                    ClockSkew = TimeSpan.FromSeconds(30)
+                };
+
+                // Support SignalR token via query string
+                options.Events = new JwtBearerEvents
+                {
+                    OnMessageReceived = context =>
+                    {
+                        var accessToken = context.Request.Query["access_token"];
+                        var path = context.HttpContext.Request.Path;
+
+                        if (!string.IsNullOrEmpty(accessToken) && path.StartsWithSegments("/api/hubs"))
+                        {
+                            context.Token = accessToken;
+                        }
+
+                        return Task.CompletedTask;
+                    }
+                };
+            })
+            .AddScheme<AuthenticationSchemeOptions, ApiKeyAuthenticationHandler>(
+                ApiKeyAuthenticationDefaults.AuthenticationScheme, _ => { })
+            .AddScheme<AuthenticationSchemeOptions, TrustedNetworkAuthenticationHandler>(
+                TrustedNetworkAuthenticationDefaults.AuthenticationScheme, _ => { });
+
+        services.AddAuthorization(options =>
+        {
+            var defaultPolicy = new Microsoft.AspNetCore.Authorization.AuthorizationPolicyBuilder()
+                .RequireAuthenticatedUser()
+                .Build();
+
+            options.DefaultPolicy = defaultPolicy;
+            options.FallbackPolicy = defaultPolicy;
+        });
+
+        return services;
+    }
+}
@@ -56,8 +56,8 @@ public static class MainDI
                    {
                        e.ConfigureConsumer<DownloadRemoverConsumer<SearchItem>>(context);
                        e.ConfigureConsumer<DownloadRemoverConsumer<SeriesSearchItem>>(context);
-                        e.ConcurrentMessageLimit = 2;
-                        e.PrefetchCount = 2;
+                        e.ConcurrentMessageLimit = 1;
+                        e.PrefetchCount = 1;
                    });
                    
                    cfg.ReceiveEndpoint("download-hunter-queue", e =>
@@ -87,10 +87,13 @@ public static class MainDI
    {
        // Add the dynamic HTTP client system - this replaces all the previous static configurations
        services.AddDynamicHttpClients();
-        
+
        // Add the dynamic HTTP client provider that uses the new system
        services.AddSingleton<IDynamicHttpClientProvider, DynamicHttpClientProvider>();
-        
+
+        // Add HTTP client for Plex authentication
+        services.AddHttpClient("PlexAuth");
+
        return services;
    }

@@ -1,7 +1,11 @@
 using Cleanuparr.Infrastructure.Features.Notifications;
 using Cleanuparr.Infrastructure.Features.Notifications.Apprise;
+using Cleanuparr.Infrastructure.Features.Notifications.Discord;
 using Cleanuparr.Infrastructure.Features.Notifications.Notifiarr;
 using Cleanuparr.Infrastructure.Features.Notifications.Ntfy;
+using Cleanuparr.Infrastructure.Features.Notifications.Pushover;
+using Cleanuparr.Infrastructure.Features.Notifications.Telegram;
+using Cleanuparr.Infrastructure.Features.Notifications.Gotify;

 namespace Cleanuparr.Api.DependencyInjection;

@@ -11,7 +15,13 @@ public static class NotificationsDI
        services
            .AddScoped<INotifiarrProxy, NotifiarrProxy>()
            .AddScoped<IAppriseProxy, AppriseProxy>()
+            .AddScoped<IAppriseCliProxy, AppriseCliProxy>()
+            .AddSingleton<IAppriseCliDetector, AppriseCliDetector>()
            .AddScoped<INtfyProxy, NtfyProxy>()
+            .AddScoped<IPushoverProxy, PushoverProxy>()
+            .AddScoped<ITelegramProxy, TelegramProxy>()
+            .AddScoped<IDiscordProxy, DiscordProxy>()
+            .AddScoped<IGotifyProxy, GotifyProxy>()
            .AddScoped<INotificationConfigurationService, NotificationConfigurationService>()
            .AddScoped<INotificationProviderFactory, NotificationProviderFactory>()
            .AddScoped<NotificationProviderFactory>()
@@ -1,5 +1,8 @@
 using Cleanuparr.Infrastructure.Events;
+using Cleanuparr.Infrastructure.Events.Interfaces;
 using Cleanuparr.Infrastructure.Features.Arr;
+using Cleanuparr.Infrastructure.Features.Arr.Interfaces;
+using Cleanuparr.Infrastructure.Features.Auth;
 using Cleanuparr.Infrastructure.Features.BlacklistSync;
 using Cleanuparr.Infrastructure.Features.DownloadClient;
 using Cleanuparr.Infrastructure.Features.DownloadHunter;
@@ -10,11 +13,11 @@ using Cleanuparr.Infrastructure.Features.Files;
 using Cleanuparr.Infrastructure.Features.ItemStriker;
 using Cleanuparr.Infrastructure.Features.Jobs;
 using Cleanuparr.Infrastructure.Features.MalwareBlocker;
-using Cleanuparr.Infrastructure.Features.Security;
 using Cleanuparr.Infrastructure.Helpers;
 using Cleanuparr.Infrastructure.Interceptors;
 using Cleanuparr.Infrastructure.Services;
 using Cleanuparr.Infrastructure.Services.Interfaces;
+using Cleanuparr.Infrastructure.Stats;
 using Cleanuparr.Persistence;

 namespace Cleanuparr.Api.DependencyInjection;
@@ -23,20 +26,24 @@ public static class ServicesDI
 {
    public static IServiceCollection AddServices(this IServiceCollection services) =>
        services
-            .AddScoped<IEncryptionService, AesEncryptionService>()
-            .AddScoped<SensitiveDataJsonConverter>()
            .AddScoped<EventsContext>()
            .AddScoped<DataContext>()
-            .AddScoped<EventPublisher>()
+            .AddScoped<UsersContext>()
+            .AddSingleton<IJwtService, JwtService>()
+            .AddSingleton<IPasswordService, PasswordService>()
+            .AddSingleton<ITotpService, TotpService>()
+            .AddScoped<IPlexAuthService, PlexAuthService>()
+            .AddScoped<IEventPublisher, EventPublisher>()
            .AddHostedService<EventCleanupService>()
            .AddScoped<IDryRunInterceptor, DryRunInterceptor>()
            .AddScoped<CertificateValidationService>()
-            .AddScoped<SonarrClient>()
-            .AddScoped<RadarrClient>()
-            .AddScoped<LidarrClient>()
-            .AddScoped<ReadarrClient>()
-            .AddScoped<WhisparrClient>()
-            .AddScoped<ArrClientFactory>()
+            .AddScoped<ISonarrClient, SonarrClient>()
+            .AddScoped<IRadarrClient, RadarrClient>()
+            .AddScoped<ILidarrClient, LidarrClient>()
+            .AddScoped<IReadarrClient, ReadarrClient>()
+            .AddScoped<IWhisparrV2Client, WhisparrV2Client>()
+            .AddScoped<IWhisparrV3Client, WhisparrV3Client>()
+            .AddScoped<IArrClientFactory, ArrClientFactory>()
            .AddScoped<QueueCleaner>()
            .AddScoped<BlacklistSynchronizer>()
            .AddScoped<MalwareBlocker>()
@@ -45,17 +52,19 @@ public static class ServicesDI
            .AddScoped<IDownloadHunter, DownloadHunter>()
            .AddScoped<IFilenameEvaluator, FilenameEvaluator>()
            .AddScoped<IHardLinkFileService, HardLinkFileService>()
-            .AddScoped<UnixHardLinkFileService>()
-            .AddScoped<WindowsHardLinkFileService>()
-            .AddScoped<ArrQueueIterator>()
-            .AddScoped<DownloadServiceFactory>()
+            .AddScoped<IUnixHardLinkFileService, UnixHardLinkFileService>()
+            .AddScoped<IWindowsHardLinkFileService, WindowsHardLinkFileService>()
+            .AddScoped<IArrQueueIterator, ArrQueueIterator>()
+            .AddScoped<IDownloadServiceFactory, DownloadServiceFactory>()
            .AddScoped<IStriker, Striker>()
            .AddScoped<FileReader>()
            .AddScoped<IRuleManager, RuleManager>()
            .AddScoped<IRuleEvaluator, RuleEvaluator>()
            .AddScoped<IRuleIntervalValidator, RuleIntervalValidator>()
+            .AddScoped<IStatsService, StatsService>()
            .AddSingleton<IJobManagementService, JobManagementService>()
-            .AddSingleton<BlocklistProvider>()
+            .AddSingleton<IBlocklistProvider, BlocklistProvider>()
+            .AddSingleton(TimeProvider.System)
            .AddSingleton<AppStatusSnapshot>()
            .AddHostedService<AppStatusRefreshService>();
 }
@@ -1,7 +1,9 @@
 using System;
 using System.ComponentModel.DataAnnotations;

+using ValidationException = Cleanuparr.Domain.Exceptions.ValidationException;
 using Cleanuparr.Persistence.Models.Configuration.Arr;
+using Cleanuparr.Shared.Helpers;

 namespace Cleanuparr.Api.Features.Arr.Contracts.Requests;

@@ -18,20 +20,37 @@ public sealed record ArrInstanceRequest
    [Required]
    public required string ApiKey { get; init; }

-    public ArrInstance ToEntity(Guid configId) => new()
+    [Required]
+    public required float Version { get; init; }
+
+    public string? ExternalUrl { get; init; }
+
+    public ArrInstance ToEntity(Guid configId)
    {
-        Enabled = Enabled,
-        Name = Name,
-        Url = new Uri(Url),
-        ApiKey = ApiKey,
-        ArrConfigId = configId,
-    };
+        if (ApiKey.IsPlaceholder())
+        {
+            throw new ValidationException("API key is required when creating a new instance");
+        }
+
+        return new()
+        {
+            Enabled = Enabled,
+            Name = Name,
+            Url = new Uri(Url),
+            ExternalUrl = ExternalUrl is not null ? new Uri(ExternalUrl) : null,
+            ApiKey = ApiKey,
+            ArrConfigId = configId,
+            Version = Version,
+        };
+    }

    public void ApplyTo(ArrInstance instance)
    {
        instance.Enabled = Enabled;
        instance.Name = Name;
        instance.Url = new Uri(Url);
-        instance.ApiKey = ApiKey;
+        instance.ExternalUrl = ExternalUrl is not null ? new Uri(ExternalUrl) : null;
+        instance.ApiKey = ApiKey.IsPlaceholder() ? instance.ApiKey : ApiKey;
+        instance.Version = Version;
    }
 }
@@ -0,0 +1,42 @@
+using System;
+using System.ComponentModel.DataAnnotations;
+
+using ValidationException = Cleanuparr.Domain.Exceptions.ValidationException;
+using Cleanuparr.Persistence.Models.Configuration.Arr;
+using Cleanuparr.Shared.Helpers;
+
+namespace Cleanuparr.Api.Features.Arr.Contracts.Requests;
+
+public sealed record TestArrInstanceRequest
+{
+    [Required]
+    public required string Url { get; init; }
+
+    [Required]
+    public required string ApiKey { get; init; }
+
+    [Required]
+    public required float Version { get; init; }
+
+    public Guid? InstanceId { get; init; }
+
+    public ArrInstance ToTestInstance(string? resolvedApiKey = null)
+    {
+        var apiKey = resolvedApiKey ?? ApiKey;
+
+        if (apiKey.IsPlaceholder())
+        {
+            throw new ValidationException("API key cannot be a placeholder value");
+        }
+
+        return new()
+        {
+            Enabled = true,
+            Name = "Test Instance",
+            Url = new Uri(Url),
+            ApiKey = apiKey,
+            ArrConfigId = Guid.Empty,
+            Version = Version,
+        };
+    }
+}
@@ -1,32 +1,33 @@
-using System;
-using System.Linq;
-using System.Threading.Tasks;
-
 using Cleanuparr.Api.Features.Arr.Contracts.Requests;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Features.Arr.Dtos;
+using Cleanuparr.Infrastructure.Features.Arr.Interfaces;
 using Cleanuparr.Persistence;
-using Cleanuparr.Persistence.Models.Configuration.Arr;
+using Cleanuparr.Shared.Helpers;
 using Mapster;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
-using Microsoft.Extensions.Logging;

 namespace Cleanuparr.Api.Features.Arr.Controllers;

 [ApiController]
 [Route("api/configuration")]
+[Authorize]
 public sealed class ArrConfigController : ControllerBase
 {
    private readonly ILogger<ArrConfigController> _logger;
    private readonly DataContext _dataContext;
+    private readonly IArrClientFactory _arrClientFactory;

    public ArrConfigController(
        ILogger<ArrConfigController> logger,
-        DataContext dataContext)
+        DataContext dataContext,
+        IArrClientFactory arrClientFactory)
    {
        _logger = logger;
        _dataContext = dataContext;
+        _arrClientFactory = arrClientFactory;
    }

    [HttpGet("sonarr")]
@@ -124,6 +125,26 @@ public sealed class ArrConfigController : ControllerBase
    public Task<IActionResult> DeleteWhisparrInstance(Guid id)
        => DeleteArrInstance(InstanceType.Whisparr, id);

+    [HttpPost("sonarr/instances/test")]
+    public Task<IActionResult> TestSonarrInstance([FromBody] TestArrInstanceRequest request)
+        => TestArrInstance(InstanceType.Sonarr, request);
+
+    [HttpPost("radarr/instances/test")]
+    public Task<IActionResult> TestRadarrInstance([FromBody] TestArrInstanceRequest request)
+        => TestArrInstance(InstanceType.Radarr, request);
+
+    [HttpPost("lidarr/instances/test")]
+    public Task<IActionResult> TestLidarrInstance([FromBody] TestArrInstanceRequest request)
+        => TestArrInstance(InstanceType.Lidarr, request);
+
+    [HttpPost("readarr/instances/test")]
+    public Task<IActionResult> TestReadarrInstance([FromBody] TestArrInstanceRequest request)
+        => TestArrInstance(InstanceType.Readarr, request);
+
+    [HttpPost("whisparr/instances/test")]
+    public Task<IActionResult> TestWhisparrInstance([FromBody] TestArrInstanceRequest request)
+        => TestArrInstance(InstanceType.Whisparr, request);
+
    private async Task<IActionResult> GetArrConfig(InstanceType type)
    {
        await DataContext.Lock.WaitAsync();
@@ -260,6 +281,39 @@ public sealed class ArrConfigController : ControllerBase
        }
    }

+    private async Task<IActionResult> TestArrInstance(InstanceType type, TestArrInstanceRequest request)
+    {
+        try
+        {
+            string? resolvedApiKey = null;
+
+            if (request.ApiKey.IsPlaceholder() && request.InstanceId.HasValue)
+            {
+                var existingInstance = await _dataContext.ArrInstances
+                    .AsNoTracking()
+                    .FirstOrDefaultAsync(i => i.Id == request.InstanceId.Value);
+
+                if (existingInstance is null)
+                {
+                    return NotFound($"Instance with ID {request.InstanceId.Value} not found");
+                }
+
+                resolvedApiKey = existingInstance.ApiKey;
+            }
+
+            var testInstance = request.ToTestInstance(resolvedApiKey);
+            var client = _arrClientFactory.GetClient(type, request.Version);
+            await client.HealthCheckAsync(testInstance);
+
+            return Ok(new { Message = $"Connection to {type} instance successful" });
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to test {Type} instance connection", type);
+            return BadRequest(new { Message = $"Connection failed: {ex.Message}" });
+        }
+    }
+
    private static string GetConfigActionName(InstanceType type) => type switch
    {
        InstanceType.Sonarr => nameof(GetSonarrConfig),
@@ -0,0 +1,14 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record ChangePasswordRequest
+{
+    [Required]
+    public required string CurrentPassword { get; init; }
+
+    [Required]
+    [MinLength(8)]
+    [MaxLength(128)]
+    public required string NewPassword { get; init; }
+}
@@ -0,0 +1,16 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record CreateAccountRequest
+{
+    [Required]
+    [MinLength(3)]
+    [MaxLength(50)]
+    public required string Username { get; init; }
+
+    [Required]
+    [MinLength(8)]
+    [MaxLength(128)]
+    public required string Password { get; init; }
+}
@@ -0,0 +1,13 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record Disable2faRequest
+{
+    [Required]
+    public required string Password { get; init; }
+
+    [Required]
+    [StringLength(6, MinimumLength = 6)]
+    public required string TotpCode { get; init; }
+}
@@ -0,0 +1,9 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record Enable2faRequest
+{
+    [Required]
+    public required string Password { get; init; }
+}
@@ -0,0 +1,12 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record LoginRequest
+{
+    [Required]
+    public required string Username { get; init; }
+
+    [Required]
+    public required string Password { get; init; }
+}
@@ -0,0 +1,9 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record PlexPinRequest
+{
+    [Required]
+    public required int PinId { get; init; }
+}
@@ -0,0 +1,9 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record RefreshTokenRequest
+{
+    [Required]
+    public required string RefreshToken { get; init; }
+}
@@ -0,0 +1,13 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record Regenerate2faRequest
+{
+    [Required]
+    public required string Password { get; init; }
+
+    [Required]
+    [StringLength(6, MinimumLength = 6)]
+    public required string TotpCode { get; init; }
+}
@@ -0,0 +1,14 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record TwoFactorRequest
+{
+    [Required]
+    public required string LoginToken { get; init; }
+
+    [Required]
+    public required string Code { get; init; }
+
+    public bool IsRecoveryCode { get; init; }
+}
@@ -0,0 +1,10 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record VerifyTotpRequest
+{
+    [Required]
+    [StringLength(6, MinimumLength = 6)]
+    public required string Code { get; init; }
+}
@@ -0,0 +1,10 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record AccountInfoResponse
+{
+    public required string Username { get; init; }
+    public required bool PlexLinked { get; init; }
+    public string? PlexUsername { get; init; }
+    public required bool TwoFactorEnabled { get; init; }
+    public required string ApiKeyPreview { get; init; }
+}
@@ -0,0 +1,8 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record AuthStatusResponse
+{
+    public required bool SetupCompleted { get; init; }
+    public bool PlexLinked { get; init; }
+    public bool AuthBypassActive { get; init; }
+}
@@ -0,0 +1,8 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record LoginResponse
+{
+    public required bool RequiresTwoFactor { get; init; }
+    public string? LoginToken { get; init; }
+    public TokenResponse? Tokens { get; init; }
+}
@@ -0,0 +1,13 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record PlexPinStatusResponse
+{
+    public required int PinId { get; init; }
+    public required string AuthUrl { get; init; }
+}
+
+public sealed record PlexVerifyResponse
+{
+    public required bool Completed { get; init; }
+    public TokenResponse? Tokens { get; init; }
+}
@@ -0,0 +1,8 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record TokenResponse
+{
+    public required string AccessToken { get; init; }
+    public required string RefreshToken { get; init; }
+    public required int ExpiresIn { get; init; }
+}
@@ -0,0 +1,8 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record TotpSetupResponse
+{
+    public required string Secret { get; init; }
+    public required string QrCodeUri { get; init; }
+    public required List<string> RecoveryCodes { get; init; }
+}
@@ -0,0 +1,417 @@
+using System.Security.Claims;
+using System.Security.Cryptography;
+using Cleanuparr.Api.Features.Auth.Contracts.Requests;
+using Cleanuparr.Api.Features.Auth.Contracts.Responses;
+using Cleanuparr.Infrastructure.Features.Auth;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Auth;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Api.Features.Auth.Controllers;
+
+[ApiController]
+[Route("api/account")]
+[Authorize]
+public sealed class AccountController : ControllerBase
+{
+    private readonly UsersContext _usersContext;
+    private readonly IPasswordService _passwordService;
+    private readonly ITotpService _totpService;
+    private readonly IPlexAuthService _plexAuthService;
+    private readonly ILogger<AccountController> _logger;
+
+    public AccountController(
+        UsersContext usersContext,
+        IPasswordService passwordService,
+        ITotpService totpService,
+        IPlexAuthService plexAuthService,
+        ILogger<AccountController> logger)
+    {
+        _usersContext = usersContext;
+        _passwordService = passwordService;
+        _totpService = totpService;
+        _plexAuthService = plexAuthService;
+        _logger = logger;
+    }
+
+    [HttpGet]
+    public async Task<IActionResult> GetAccountInfo()
+    {
+        var user = await GetCurrentUser();
+        if (user is null) return Unauthorized();
+
+        return Ok(new AccountInfoResponse
+        {
+            Username = user.Username,
+            PlexLinked = user.PlexAccountId is not null,
+            PlexUsername = user.PlexUsername,
+            TwoFactorEnabled = user.TotpEnabled,
+            ApiKeyPreview = user.ApiKey[..8] + "..."
+        });
+    }
+
+    [HttpPut("password")]
+    public async Task<IActionResult> ChangePassword([FromBody] ChangePasswordRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser();
+            if (user is null) return Unauthorized();
+
+            if (!_passwordService.VerifyPassword(request.CurrentPassword, user.PasswordHash))
+            {
+                return BadRequest(new { error = "Current password is incorrect" });
+            }
+
+            DateTime now = DateTime.UtcNow;
+
+            user.PasswordHash = _passwordService.HashPassword(request.NewPassword);
+            user.UpdatedAt = now;
+
+            // Revoke all existing refresh tokens so old sessions can't be reused
+            var activeTokens = await _usersContext.RefreshTokens
+                .Where(r => r.UserId == user.Id && r.RevokedAt == null)
+                .ToListAsync();
+
+            foreach (var token in activeTokens)
+            {
+                token.RevokedAt = now;
+            }
+
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Password changed for user {Username}", user.Username);
+
+            return Ok(new { message = "Password changed" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("2fa/regenerate")]
+    public async Task<IActionResult> Regenerate2fa([FromBody] Regenerate2faRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser(includeRecoveryCodes: true);
+            if (user is null) return Unauthorized();
+
+            // Verify current credentials
+            if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash))
+            {
+                return BadRequest(new { error = "Incorrect password" });
+            }
+
+            if (!_totpService.ValidateCode(user.TotpSecret, request.TotpCode))
+            {
+                return BadRequest(new { error = "Invalid 2FA code" });
+            }
+
+            // Generate new TOTP
+            var secret = _totpService.GenerateSecret();
+            var qrUri = _totpService.GetQrCodeUri(secret, user.Username);
+            var recoveryCodes = _totpService.GenerateRecoveryCodes();
+
+            user.TotpSecret = secret;
+            user.UpdatedAt = DateTime.UtcNow;
+
+            // Replace recovery codes
+            _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
+
+            foreach (var code in recoveryCodes)
+            {
+                _usersContext.RecoveryCodes.Add(new RecoveryCode
+                {
+                    Id = Guid.NewGuid(),
+                    UserId = user.Id,
+                    CodeHash = _totpService.HashRecoveryCode(code),
+                    IsUsed = false
+                });
+            }
+
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("2FA regenerated for user {Username}", user.Username);
+
+            return Ok(new TotpSetupResponse
+            {
+                Secret = secret,
+                QrCodeUri = qrUri,
+                RecoveryCodes = recoveryCodes
+            });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("2fa/enable")]
+    public async Task<IActionResult> Enable2fa([FromBody] Enable2faRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser(includeRecoveryCodes: true);
+            if (user is null) return Unauthorized();
+
+            if (user.TotpEnabled)
+            {
+                return Conflict(new { error = "2FA is already enabled" });
+            }
+
+            if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash))
+            {
+                return BadRequest(new { error = "Incorrect password" });
+            }
+
+            // Generate new TOTP
+            var secret = _totpService.GenerateSecret();
+            var qrUri = _totpService.GetQrCodeUri(secret, user.Username);
+            var recoveryCodes = _totpService.GenerateRecoveryCodes();
+
+            user.TotpSecret = secret;
+            user.UpdatedAt = DateTime.UtcNow;
+
+            // Replace any existing recovery codes
+            _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
+
+            foreach (var code in recoveryCodes)
+            {
+                _usersContext.RecoveryCodes.Add(new RecoveryCode
+                {
+                    Id = Guid.NewGuid(),
+                    UserId = user.Id,
+                    CodeHash = _totpService.HashRecoveryCode(code),
+                    IsUsed = false
+                });
+            }
+
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("2FA setup generated for user {Username}", user.Username);
+
+            return Ok(new TotpSetupResponse
+            {
+                Secret = secret,
+                QrCodeUri = qrUri,
+                RecoveryCodes = recoveryCodes
+            });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("2fa/enable/verify")]
+    public async Task<IActionResult> VerifyEnable2fa([FromBody] VerifyTotpRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser();
+            if (user is null) return Unauthorized();
+
+            if (user.TotpEnabled)
+            {
+                return Conflict(new { error = "2FA is already enabled" });
+            }
+
+            if (string.IsNullOrEmpty(user.TotpSecret))
+            {
+                return BadRequest(new { error = "Generate 2FA setup first" });
+            }
+
+            if (!_totpService.ValidateCode(user.TotpSecret, request.Code))
+            {
+                return BadRequest(new { error = "Invalid verification code" });
+            }
+
+            user.TotpEnabled = true;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("2FA enabled for user {Username}", user.Username);
+
+            return Ok(new { message = "2FA enabled" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("2fa/disable")]
+    public async Task<IActionResult> Disable2fa([FromBody] Disable2faRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser(includeRecoveryCodes: true);
+            if (user is null) return Unauthorized();
+
+            if (!user.TotpEnabled)
+            {
+                return BadRequest(new { error = "2FA is not enabled" });
+            }
+
+            if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash))
+            {
+                return BadRequest(new { error = "Incorrect password" });
+            }
+
+            if (!_totpService.ValidateCode(user.TotpSecret, request.TotpCode))
+            {
+                return BadRequest(new { error = "Invalid 2FA code" });
+            }
+
+            user.TotpEnabled = false;
+            user.TotpSecret = string.Empty;
+            user.UpdatedAt = DateTime.UtcNow;
+
+            // Remove all recovery codes
+            _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
+
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("2FA disabled for user {Username}", user.Username);
+
+            return Ok(new { message = "2FA disabled" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpGet("api-key")]
+    public async Task<IActionResult> GetApiKey()
+    {
+        var user = await GetCurrentUser();
+        if (user is null) return Unauthorized();
+
+        return Ok(new { apiKey = user.ApiKey });
+    }
+
+    [HttpPost("api-key/regenerate")]
+    public async Task<IActionResult> RegenerateApiKey()
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser();
+            if (user is null) return Unauthorized();
+
+            var bytes = new byte[32];
+            using var rng = RandomNumberGenerator.Create();
+            rng.GetBytes(bytes);
+
+            user.ApiKey = Convert.ToHexString(bytes).ToLowerInvariant();
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("API key regenerated for user {Username}", user.Username);
+
+            return Ok(new { apiKey = user.ApiKey });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("plex/link")]
+    public async Task<IActionResult> StartPlexLink()
+    {
+        var pin = await _plexAuthService.RequestPin();
+
+        return Ok(new { pinId = pin.PinId, authUrl = pin.AuthUrl });
+    }
+
+    [HttpPost("plex/link/verify")]
+    public async Task<IActionResult> VerifyPlexLink([FromBody] PlexPinRequest request)
+    {
+        var pinResult = await _plexAuthService.CheckPin(request.PinId);
+
+        if (!pinResult.Completed || pinResult.AuthToken is null)
+        {
+            return Ok(new { completed = false });
+        }
+
+        var plexAccount = await _plexAuthService.GetAccount(pinResult.AuthToken);
+
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser();
+            if (user is null) return Unauthorized();
+
+            user.PlexAccountId = plexAccount.AccountId;
+            user.PlexUsername = plexAccount.Username;
+            user.PlexEmail = plexAccount.Email;
+            user.PlexAuthToken = pinResult.AuthToken;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Plex account linked for user {Username}: {PlexUsername}",
+                user.Username, plexAccount.Username);
+
+            return Ok(new { completed = true, plexUsername = plexAccount.Username });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpDelete("plex/link")]
+    public async Task<IActionResult> UnlinkPlex()
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser();
+            if (user is null) return Unauthorized();
+
+            user.PlexAccountId = null;
+            user.PlexUsername = null;
+            user.PlexEmail = null;
+            user.PlexAuthToken = null;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Plex account unlinked for user {Username}", user.Username);
+
+            return Ok(new { message = "Plex account unlinked" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    private async Task<User?> GetCurrentUser(bool includeRecoveryCodes = false)
+    {
+        var userIdClaim = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
+        if (userIdClaim is null || !Guid.TryParse(userIdClaim, out var userId))
+        {
+            return null;
+        }
+
+        var query = _usersContext.Users.AsQueryable();
+
+        if (includeRecoveryCodes)
+        {
+            query = query.Include(u => u.RecoveryCodes);
+        }
+
+        return await query.FirstOrDefaultAsync(u => u.Id == userId);
+    }
+}
@@ -0,0 +1,611 @@
+using System.Security.Cryptography;
+using Cleanuparr.Api.Auth;
+using Cleanuparr.Api.Features.Auth.Contracts.Requests;
+using Cleanuparr.Api.Features.Auth.Contracts.Responses;
+using Cleanuparr.Infrastructure.Features.Auth;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Auth;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Api.Features.Auth.Controllers;
+
+[ApiController]
+[Route("api/auth")]
+[AllowAnonymous]
+public sealed class AuthController : ControllerBase
+{
+    private readonly UsersContext _usersContext;
+    private readonly IJwtService _jwtService;
+    private readonly IPasswordService _passwordService;
+    private readonly ITotpService _totpService;
+    private readonly IPlexAuthService _plexAuthService;
+    private readonly ILogger<AuthController> _logger;
+
+    public AuthController(
+        UsersContext usersContext,
+        IJwtService jwtService,
+        IPasswordService passwordService,
+        ITotpService totpService,
+        IPlexAuthService plexAuthService,
+        ILogger<AuthController> logger)
+    {
+        _usersContext = usersContext;
+        _jwtService = jwtService;
+        _passwordService = passwordService;
+        _totpService = totpService;
+        _plexAuthService = plexAuthService;
+        _logger = logger;
+    }
+
+    [HttpGet("status")]
+    public async Task<IActionResult> GetStatus()
+    {
+        var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+
+        var authBypass = false;
+        await using var dataContext = DataContext.CreateStaticInstance();
+        var generalConfig = await dataContext.GeneralConfigs.AsNoTracking().FirstOrDefaultAsync();
+        if (generalConfig is { Auth.DisableAuthForLocalAddresses: true })
+        {
+            var clientIp = TrustedNetworkAuthenticationHandler.ResolveClientIp(
+                HttpContext, generalConfig.Auth.TrustForwardedHeaders);
+            if (clientIp is not null)
+            {
+                authBypass = TrustedNetworkAuthenticationHandler.IsTrustedAddress(
+                    clientIp, generalConfig.Auth.TrustedNetworks);
+            }
+        }
+
+        return Ok(new AuthStatusResponse
+        {
+            SetupCompleted = user is { SetupCompleted: true },
+            PlexLinked = user?.PlexAccountId is not null,
+            AuthBypassActive = authBypass
+        });
+    }
+
+    [HttpPost("setup/account")]
+    public async Task<IActionResult> CreateAccount([FromBody] CreateAccountRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var existingUser = await _usersContext.Users.FirstOrDefaultAsync();
+            if (existingUser is not null)
+            {
+                return Conflict(new { error = "Account already exists" });
+            }
+
+            var user = new User
+            {
+                Id = Guid.NewGuid(),
+                Username = request.Username,
+                PasswordHash = _passwordService.HashPassword(request.Password),
+                TotpSecret = string.Empty,
+                TotpEnabled = false,
+                ApiKey = GenerateApiKey(),
+                SetupCompleted = false,
+                CreatedAt = DateTime.UtcNow,
+                UpdatedAt = DateTime.UtcNow
+            };
+
+            _usersContext.Users.Add(user);
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Admin account created for user {Username}", request.Username);
+
+            return Created("", new { userId = user.Id });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("setup/2fa/generate")]
+    public async Task<IActionResult> GenerateTotpSetup()
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users
+                .Include(u => u.RecoveryCodes)
+                .FirstOrDefaultAsync();
+
+            if (user is null)
+            {
+                return BadRequest(new { error = "Create an account first" });
+            }
+
+            if (user.SetupCompleted)
+            {
+                return Conflict(new { error = "Setup already completed. Use account settings to manage 2FA." });
+            }
+
+            // Generate new TOTP secret
+            var secret = _totpService.GenerateSecret();
+            var qrUri = _totpService.GetQrCodeUri(secret, user.Username);
+
+            // Generate recovery codes
+            var recoveryCodes = _totpService.GenerateRecoveryCodes();
+
+            // Store secret (will be finalized on verify)
+            user.TotpSecret = secret;
+            user.UpdatedAt = DateTime.UtcNow;
+
+            // Remove old recovery codes and add new ones
+            _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
+
+            foreach (var code in recoveryCodes)
+            {
+                _usersContext.RecoveryCodes.Add(new RecoveryCode
+                {
+                    Id = Guid.NewGuid(),
+                    UserId = user.Id,
+                    CodeHash = _totpService.HashRecoveryCode(code),
+                    IsUsed = false
+                });
+            }
+
+            await _usersContext.SaveChangesAsync();
+
+            return Ok(new TotpSetupResponse
+            {
+                Secret = secret,
+                QrCodeUri = qrUri,
+                RecoveryCodes = recoveryCodes
+            });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("setup/2fa/verify")]
+    public async Task<IActionResult> VerifyTotpSetup([FromBody] VerifyTotpRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users.FirstOrDefaultAsync();
+            if (user is null)
+            {
+                return BadRequest(new { error = "Create an account first" });
+            }
+
+            if (user.SetupCompleted)
+            {
+                return Conflict(new { error = "Setup already completed. Use account settings to manage 2FA." });
+            }
+
+            if (string.IsNullOrEmpty(user.TotpSecret))
+            {
+                return BadRequest(new { error = "Generate 2FA setup first" });
+            }
+
+            if (!_totpService.ValidateCode(user.TotpSecret, request.Code))
+            {
+                return Unauthorized(new { error = "Invalid verification code" });
+            }
+
+            user.TotpEnabled = true;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("2FA enabled for user {Username}", user.Username);
+
+            return Ok(new { message = "2FA verified and enabled" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("setup/complete")]
+    public async Task<IActionResult> CompleteSetup()
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users.FirstOrDefaultAsync();
+            if (user is null)
+            {
+                return BadRequest(new { error = "Create an account first" });
+            }
+
+            if (user.SetupCompleted)
+            {
+                return Conflict(new { error = "Setup already completed" });
+            }
+
+            user.SetupCompleted = true;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Setup completed for user {Username}", user.Username);
+
+            return Ok(new { message = "Setup complete" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("login")]
+    public async Task<IActionResult> Login([FromBody] LoginRequest request)
+    {
+        var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+
+        if (user is null || !user.SetupCompleted)
+        {
+            return Unauthorized(new { error = "Invalid credentials" });
+        }
+
+        // Check lockout
+        if (user.LockoutEnd.HasValue && user.LockoutEnd.Value > DateTime.UtcNow)
+        {
+            var remaining = (int)(user.LockoutEnd.Value - DateTime.UtcNow).TotalSeconds;
+            return StatusCode(429, new { error = "Account is locked", retryAfterSeconds = remaining });
+        }
+
+        if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash) ||
+            !string.Equals(user.Username, request.Username, StringComparison.OrdinalIgnoreCase))
+        {
+            var retryAfterSeconds = await IncrementFailedAttempts(user.Id);
+            return Unauthorized(new { error = "Invalid credentials", retryAfterSeconds });
+        }
+
+        // Reset failed attempts on successful password verification
+        await ResetFailedAttempts(user.Id);
+
+        // If 2FA is not enabled, issue tokens directly
+        if (!user.TotpEnabled)
+        {
+            // Re-fetch with tracking since the query above used AsNoTracking
+            var trackedUser = await _usersContext.Users.FirstAsync(u => u.Id == user.Id);
+            var tokenResponse = await GenerateTokenResponse(trackedUser);
+
+            _logger.LogInformation("User {Username} logged in (2FA disabled)", user.Username);
+
+            return Ok(new LoginResponse
+            {
+                RequiresTwoFactor = false,
+                Tokens = tokenResponse
+            });
+        }
+
+        // Password valid - require 2FA
+        var loginToken = _jwtService.GenerateLoginToken(user.Id);
+
+        return Ok(new LoginResponse
+        {
+            RequiresTwoFactor = true,
+            LoginToken = loginToken
+        });
+    }
+
+    [HttpPost("login/2fa")]
+    public async Task<IActionResult> VerifyTwoFactor([FromBody] TwoFactorRequest request)
+    {
+        var userId = _jwtService.ValidateLoginToken(request.LoginToken);
+        if (userId is null)
+        {
+            return Unauthorized(new { error = "Invalid or expired login token" });
+        }
+
+        var user = await _usersContext.Users
+            .Include(u => u.RecoveryCodes)
+            .FirstOrDefaultAsync(u => u.Id == userId.Value);
+
+        if (user is null)
+        {
+            return Unauthorized(new { error = "Invalid login token" });
+        }
+
+        bool codeValid;
+
+        if (request.IsRecoveryCode)
+        {
+            codeValid = await TryUseRecoveryCode(user, request.Code);
+        }
+        else
+        {
+            codeValid = _totpService.ValidateCode(user.TotpSecret, request.Code);
+        }
+
+        if (!codeValid)
+        {
+            return Unauthorized(new { error = "Invalid verification code" });
+        }
+
+        return Ok(await GenerateTokenResponse(user));
+    }
+
+    [HttpPost("refresh")]
+    public async Task<IActionResult> RefreshToken([FromBody] RefreshTokenRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var tokenHash = HashRefreshToken(request.RefreshToken);
+
+            var storedToken = await _usersContext.RefreshTokens
+                .Include(r => r.User)
+                .FirstOrDefaultAsync(r => r.TokenHash == tokenHash && r.RevokedAt == null);
+
+            if (storedToken is null || storedToken.ExpiresAt < DateTime.UtcNow)
+            {
+                return Unauthorized(new { error = "Invalid or expired refresh token" });
+            }
+
+            // Revoke the old token (rotation)
+            storedToken.RevokedAt = DateTime.UtcNow;
+
+            // Generate new tokens
+            var response = await GenerateTokenResponse(storedToken.User);
+            await _usersContext.SaveChangesAsync();
+
+            return Ok(response);
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("logout")]
+    public async Task<IActionResult> Logout([FromBody] RefreshTokenRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var tokenHash = HashRefreshToken(request.RefreshToken);
+
+            var storedToken = await _usersContext.RefreshTokens
+                .FirstOrDefaultAsync(r => r.TokenHash == tokenHash && r.RevokedAt == null);
+
+            if (storedToken is not null)
+            {
+                storedToken.RevokedAt = DateTime.UtcNow;
+                await _usersContext.SaveChangesAsync();
+            }
+
+            return Ok(new { message = "Logged out" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("setup/plex/pin")]
+    public async Task<IActionResult> RequestSetupPlexPin()
+    {
+        var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+        if (user is null)
+        {
+            return BadRequest(new { error = "Create an account first" });
+        }
+
+        if (user.SetupCompleted)
+        {
+            return Conflict(new { error = "Setup already completed. Use account settings to manage Plex." });
+        }
+
+        var pin = await _plexAuthService.RequestPin();
+
+        return Ok(new PlexPinStatusResponse
+        {
+            PinId = pin.PinId,
+            AuthUrl = pin.AuthUrl
+        });
+    }
+
+    [HttpPost("setup/plex/verify")]
+    public async Task<IActionResult> VerifySetupPlexLink([FromBody] PlexPinRequest request)
+    {
+        var pinResult = await _plexAuthService.CheckPin(request.PinId);
+
+        if (!pinResult.Completed || pinResult.AuthToken is null)
+        {
+            return Ok(new PlexVerifyResponse { Completed = false });
+        }
+
+        var plexAccount = await _plexAuthService.GetAccount(pinResult.AuthToken);
+
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users.FirstOrDefaultAsync();
+            if (user is null)
+            {
+                return BadRequest(new { error = "Create an account first" });
+            }
+
+            if (user.SetupCompleted)
+            {
+                return Conflict(new { error = "Setup already completed. Use account settings to manage Plex." });
+            }
+
+            user.PlexAccountId = plexAccount.AccountId;
+            user.PlexUsername = plexAccount.Username;
+            user.PlexEmail = plexAccount.Email;
+            user.PlexAuthToken = pinResult.AuthToken;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Plex account linked during setup for user {Username}: {PlexUsername}",
+                user.Username, plexAccount.Username);
+
+            return Ok(new PlexVerifyResponse { Completed = true });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("login/plex/pin")]
+    public async Task<IActionResult> RequestPlexPin()
+    {
+        var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+        if (user is null || !user.SetupCompleted || user.PlexAccountId is null)
+        {
+            return BadRequest(new { error = "Plex login is not available" });
+        }
+
+        var pin = await _plexAuthService.RequestPin();
+
+        return Ok(new PlexPinStatusResponse
+        {
+            PinId = pin.PinId,
+            AuthUrl = pin.AuthUrl
+        });
+    }
+
+    [HttpPost("login/plex/verify")]
+    public async Task<IActionResult> VerifyPlexLogin([FromBody] PlexPinRequest request)
+    {
+        var user = await _usersContext.Users.FirstOrDefaultAsync();
+        if (user is null || !user.SetupCompleted || user.PlexAccountId is null)
+        {
+            return BadRequest(new { error = "Plex login is not available" });
+        }
+
+        var pinResult = await _plexAuthService.CheckPin(request.PinId);
+
+        if (!pinResult.Completed || pinResult.AuthToken is null)
+        {
+            return Ok(new PlexVerifyResponse { Completed = false });
+        }
+
+        // Verify the Plex account matches the linked one
+        var plexAccount = await _plexAuthService.GetAccount(pinResult.AuthToken);
+
+        if (plexAccount.AccountId != user.PlexAccountId)
+        {
+            return Unauthorized(new { error = "Plex account does not match the linked account" });
+        }
+
+        // Plex OAuth acts as a trusted identity provider — the user explicitly linked their
+        // Plex account during setup or via account settings (both require authentication).
+        // Since Plex login verifies the exact same Plex account ID that was linked,
+        // 2FA is not required for Plex login.
+        _logger.LogInformation("User {Username} logged in via Plex", user.Username);
+
+        var tokenResponse = await GenerateTokenResponse(user);
+
+        return Ok(new PlexVerifyResponse
+        {
+            Completed = true,
+            Tokens = tokenResponse
+        });
+    }
+
+    private async Task<TokenResponse> GenerateTokenResponse(User user)
+    {
+        var accessToken = _jwtService.GenerateAccessToken(user);
+        var refreshToken = _jwtService.GenerateRefreshToken();
+
+        _usersContext.RefreshTokens.Add(new RefreshToken
+        {
+            Id = Guid.NewGuid(),
+            UserId = user.Id,
+            TokenHash = HashRefreshToken(refreshToken),
+            ExpiresAt = DateTime.UtcNow.AddDays(7),
+            CreatedAt = DateTime.UtcNow
+        });
+
+        await _usersContext.SaveChangesAsync();
+
+        return new TokenResponse
+        {
+            AccessToken = accessToken,
+            RefreshToken = refreshToken,
+            ExpiresIn = 3600 // seconds
+        };
+    }
+
+    private async Task<bool> TryUseRecoveryCode(User user, string code)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            foreach (var recoveryCode in user.RecoveryCodes.Where(r => !r.IsUsed))
+            {
+                if (_totpService.VerifyRecoveryCode(code, recoveryCode.CodeHash))
+                {
+                    recoveryCode.IsUsed = true;
+                    recoveryCode.UsedAt = DateTime.UtcNow;
+                    await _usersContext.SaveChangesAsync();
+
+                    _logger.LogWarning("Recovery code used for user {Username}", user.Username);
+                    return true;
+                }
+            }
+
+            return false;
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    private async Task<int> IncrementFailedAttempts(Guid userId)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users.FirstAsync(u => u.Id == userId);
+            user.FailedLoginAttempts++;
+            user.LockoutEnd = DateTime.UtcNow.AddSeconds(user.FailedLoginAttempts * 2);
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogWarning("Failed login attempt {Attempts} for user {Username}, locked for {Seconds}s",
+                user.FailedLoginAttempts, user.Username, user.FailedLoginAttempts * 2);
+
+            return user.FailedLoginAttempts * 2;
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    private async Task ResetFailedAttempts(Guid userId)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users.FirstAsync(u => u.Id == userId);
+            user.FailedLoginAttempts = 0;
+            user.LockoutEnd = null;
+            await _usersContext.SaveChangesAsync();
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    private static string GenerateApiKey()
+    {
+        var bytes = new byte[32];
+        using var rng = RandomNumberGenerator.Create();
+        rng.GetBytes(bytes);
+        return Convert.ToHexString(bytes).ToLowerInvariant();
+    }
+
+    private static string HashRefreshToken(string token)
+    {
+        var bytes = System.Text.Encoding.UTF8.GetBytes(token);
+        var hash = SHA256.HashData(bytes);
+        return Convert.ToBase64String(hash);
+    }
+}
@@ -2,10 +2,11 @@ using System;
 using System.Threading.Tasks;

 using Cleanuparr.Api.Features.BlacklistSync.Contracts.Requests;
-using Cleanuparr.Infrastructure.Models;
+using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration.BlacklistSync;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
@@ -14,6 +15,7 @@ namespace Cleanuparr.Api.Features.BlacklistSync.Controllers;

 [ApiController]
 [Route("api/configuration")]
+[Authorize]
 public sealed class BlacklistSyncConfigController : ControllerBase
 {
    private readonly ILogger<BlacklistSyncConfigController> _logger;
@@ -0,0 +1,35 @@
+using System.ComponentModel.DataAnnotations;
+using Cleanuparr.Domain.Enums;
+
+namespace Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests;
+
+public record SeedingRuleRequest
+{
+    [Required]
+    public string Name { get; init; } = string.Empty;
+
+    /// <summary>
+    /// Which torrent privacy types this rule applies to.
+    /// </summary>
+    public TorrentPrivacyType PrivacyType { get; init; } = TorrentPrivacyType.Public;
+
+    /// <summary>
+    /// Max ratio before removing a download.
+    /// </summary>
+    public double MaxRatio { get; init; } = -1;
+
+    /// <summary>
+    /// Min number of hours to seed before removing a download, if the ratio has been met.
+    /// </summary>
+    public double MinSeedTime { get; init; }
+
+    /// <summary>
+    /// Number of hours to seed before removing a download.
+    /// </summary>
+    public double MaxSeedTime { get; init; } = -1;
+
+    /// <summary>
+    /// Whether to delete the source files when cleaning the download.
+    /// </summary>
+    public bool DeleteSourceFiles { get; init; } = true;
+}
@@ -1,8 +1,6 @@
-using System.ComponentModel.DataAnnotations;
-
 namespace Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests;

-public record UpdateDownloadCleanerConfigRequest
+public sealed record UpdateDownloadCleanerConfigRequest
 {
    public bool Enabled { get; init; }

@@ -13,10 +11,8 @@ public record UpdateDownloadCleanerConfigRequest
    /// </summary>
    public bool UseAdvancedScheduling { get; init; }

-    public List<CleanCategoryRequest> Categories { get; init; } = [];
+    public List<SeedingRuleRequest> Categories { get; init; } = [];

-    public bool DeletePrivate { get; init; }
-    
    /// <summary>
    /// Indicates whether unlinked download handling is enabled.
    /// </summary>
@@ -26,30 +22,9 @@ public record UpdateDownloadCleanerConfigRequest

    public bool UnlinkedUseTag { get; init; }

-    public string UnlinkedIgnoredRootDir { get; init; } = string.Empty;
+    public List<string> UnlinkedIgnoredRootDirs { get; init; } = [];
    
    public List<string> UnlinkedCategories { get; init; } = [];

    public List<string> IgnoredDownloads { get; init; } = [];
 }
-
-public record CleanCategoryRequest
-{
-    [Required]
-    public string Name { get; init; } = string.Empty;
-    
-    /// <summary>
-    /// Max ratio before removing a download.
-    /// </summary>
-    public double MaxRatio { get; init; } = -1;
-
-    /// <summary>
-    /// Min number of hours to seed before removing a download, if the ratio has been met.
-    /// </summary>
-    public double MinSeedTime { get; init; }
-
-    /// <summary>
-    /// Number of hours to seed before removing a download.
-    /// </summary>
-    public double MaxSeedTime { get; init; } = -1;
-}
@@ -3,12 +3,13 @@ using System.IO;
 using System.Linq;

 using Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests;
-using Cleanuparr.Infrastructure.Models;
+using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Cleanuparr.Infrastructure.Utilities;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration;
 using Cleanuparr.Persistence.Models.Configuration.DownloadCleaner;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
@@ -17,6 +18,7 @@ namespace Cleanuparr.Api.Features.DownloadCleaner.Controllers;

 [ApiController]
 [Route("api/configuration")]
+[Authorize]
 public sealed class DownloadCleanerConfigController : ControllerBase
 {
    private readonly ILogger<DownloadCleanerConfigController> _logger;
@@ -62,65 +64,13 @@ public sealed class DownloadCleanerConfigController : ControllerBase
                throw new ValidationException("Request body cannot be null");
            }

+            // Validate cron expression format
            if (!string.IsNullOrEmpty(newConfigDto.CronExpression))
            {
                CronValidationHelper.ValidateCronExpression(newConfigDto.CronExpression);
            }

-            if (newConfigDto.Enabled && newConfigDto.Categories.Any())
-            {
-                if (newConfigDto.Categories.GroupBy(x => x.Name).Any(x => x.Count() > 1))
-                {
-                    throw new ValidationException("Duplicate category names found");
-                }
-
-                foreach (var categoryDto in newConfigDto.Categories)
-                {
-                    if (string.IsNullOrWhiteSpace(categoryDto.Name))
-                    {
-                        throw new ValidationException("Category name cannot be empty");
-                    }
-
-                    if (categoryDto is { MaxRatio: < 0, MaxSeedTime: < 0 })
-                    {
-                        throw new ValidationException("Either max ratio or max seed time must be enabled");
-                    }
-
-                    if (categoryDto.MinSeedTime < 0)
-                    {
-                        throw new ValidationException("Min seed time cannot be negative");
-                    }
-                }
-            }
-
-            if (newConfigDto.UnlinkedEnabled)
-            {
-                if (string.IsNullOrWhiteSpace(newConfigDto.UnlinkedTargetCategory))
-                {
-                    throw new ValidationException("Unlinked target category cannot be empty");
-                }
-
-                if (newConfigDto.UnlinkedCategories?.Count is null or 0)
-                {
-                    throw new ValidationException("Unlinked categories cannot be empty");
-                }
-
-                if (newConfigDto.UnlinkedCategories.Contains(newConfigDto.UnlinkedTargetCategory))
-                {
-                    throw new ValidationException("The unlinked target category should not be present in unlinked categories");
-                }
-
-                if (newConfigDto.UnlinkedCategories.Any(string.IsNullOrWhiteSpace))
-                {
-                    throw new ValidationException("Empty unlinked category filter found");
-                }
-
-                if (!string.IsNullOrEmpty(newConfigDto.UnlinkedIgnoredRootDir) && !Directory.Exists(newConfigDto.UnlinkedIgnoredRootDir))
-                {
-                    throw new ValidationException($"{newConfigDto.UnlinkedIgnoredRootDir} root directory does not exist");
-                }
-            }
-
+            // Get existing configuration
            var oldConfig = await _dataContext.DownloadCleanerConfigs
                .Include(x => x.Categories)
                .FirstAsync();
@@ -128,29 +78,33 @@ public sealed class DownloadCleanerConfigController : ControllerBase
            oldConfig.Enabled = newConfigDto.Enabled;
            oldConfig.CronExpression = newConfigDto.CronExpression;
            oldConfig.UseAdvancedScheduling = newConfigDto.UseAdvancedScheduling;
-            oldConfig.DeletePrivate = newConfigDto.DeletePrivate;
            oldConfig.UnlinkedEnabled = newConfigDto.UnlinkedEnabled;
            oldConfig.UnlinkedTargetCategory = newConfigDto.UnlinkedTargetCategory;
            oldConfig.UnlinkedUseTag = newConfigDto.UnlinkedUseTag;
-            oldConfig.UnlinkedIgnoredRootDir = newConfigDto.UnlinkedIgnoredRootDir;
+            oldConfig.UnlinkedIgnoredRootDirs = newConfigDto.UnlinkedIgnoredRootDirs;
            oldConfig.UnlinkedCategories = newConfigDto.UnlinkedCategories;
            oldConfig.IgnoredDownloads = newConfigDto.IgnoredDownloads;
+            oldConfig.Categories.Clear();

-            _dataContext.CleanCategories.RemoveRange(oldConfig.Categories);
+            _dataContext.SeedingRules.RemoveRange(oldConfig.Categories);
            _dataContext.DownloadCleanerConfigs.Update(oldConfig);

            foreach (var categoryDto in newConfigDto.Categories)
            {
-                _dataContext.CleanCategories.Add(new CleanCategory
+                _dataContext.SeedingRules.Add(new SeedingRule
                {
                    Name = categoryDto.Name,
+                    PrivacyType = categoryDto.PrivacyType,
                    MaxRatio = categoryDto.MaxRatio,
                    MinSeedTime = categoryDto.MinSeedTime,
                    MaxSeedTime = categoryDto.MaxSeedTime,
+                    DeleteSourceFiles = categoryDto.DeleteSourceFiles,
                    DownloadCleanerConfigId = oldConfig.Id
                });
            }

+            oldConfig.Validate();
+
            await _dataContext.SaveChangesAsync();

            await UpdateJobSchedule(oldConfig, JobType.DownloadCleaner);
@@ -3,6 +3,7 @@ using System;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Domain.Exceptions;
 using Cleanuparr.Persistence.Models.Configuration;
+using Cleanuparr.Shared.Helpers;

 namespace Cleanuparr.Api.Features.DownloadClient.Contracts.Requests;

@@ -16,7 +17,7 @@ public sealed record CreateDownloadClientRequest

    public DownloadClientType Type { get; init; }

-    public Uri? Host { get; init; }
+    public string? Host { get; init; }

    public string? Username { get; init; }

@@ -24,6 +25,8 @@ public sealed record CreateDownloadClientRequest

    public string? UrlBase { get; init; }

+    public string? ExternalUrl { get; init; }
+
    public void Validate()
    {
        if (string.IsNullOrWhiteSpace(Name))
@@ -31,10 +34,25 @@ public sealed record CreateDownloadClientRequest
            throw new ValidationException("Client name cannot be empty");
        }

-        if (Host is null)
+        if (string.IsNullOrWhiteSpace(Host))
        {
            throw new ValidationException("Host cannot be empty");
        }
+
+        if (!Uri.TryCreate(Host, UriKind.RelativeOrAbsolute, out _))
+        {
+            throw new ValidationException("Host is not a valid URL");
+        }
+
+        if (!string.IsNullOrWhiteSpace(ExternalUrl) && !Uri.TryCreate(ExternalUrl, UriKind.RelativeOrAbsolute, out _))
+        {
+            throw new ValidationException("External URL is not a valid URL");
+        }
+
+        if (Password.IsPlaceholder())
+        {
+            throw new ValidationException("Password cannot be a placeholder value");
+        }
    }

    public DownloadClientConfig ToEntity() => new()
@@ -43,9 +61,10 @@ public sealed record CreateDownloadClientRequest
        Name = Name,
        TypeName = TypeName,
        Type = Type,
-        Host = Host,
+        Host = new Uri(Host!, UriKind.RelativeOrAbsolute),
        Username = Username,
        Password = Password,
        UrlBase = UrlBase,
+        ExternalUrl = !string.IsNullOrWhiteSpace(ExternalUrl) ? new Uri(ExternalUrl, UriKind.RelativeOrAbsolute) : null,
    };
 }
@@ -0,0 +1,61 @@
+using System;
+
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Domain.Exceptions;
+using Cleanuparr.Persistence.Models.Configuration;
+using Cleanuparr.Shared.Helpers;
+
+namespace Cleanuparr.Api.Features.DownloadClient.Contracts.Requests;
+
+public sealed record TestDownloadClientRequest
+{
+    public DownloadClientTypeName TypeName { get; init; }
+
+    public DownloadClientType Type { get; init; }
+
+    public string? Host { get; init; }
+
+    public string? Username { get; init; }
+
+    public string? Password { get; init; }
+
+    public string? UrlBase { get; init; }
+
+    public Guid? ClientId { get; init; }
+
+    public void Validate()
+    {
+        if (string.IsNullOrWhiteSpace(Host))
+        {
+            throw new ValidationException("Host cannot be empty");
+        }
+
+        if (!Uri.TryCreate(Host, UriKind.RelativeOrAbsolute, out _))
+        {
+            throw new ValidationException("Host is not a valid URL");
+        }
+    }
+
+    public DownloadClientConfig ToTestConfig(string? resolvedPassword = null)
+    {
+        var password = resolvedPassword ?? Password;
+
+        if (password.IsPlaceholder())
+        {
+            throw new ValidationException("Password cannot be a placeholder value");
+        }
+
+        return new()
+        {
+            Id = Guid.NewGuid(),
+            Enabled = true,
+            Name = "Test Client",
+            TypeName = TypeName,
+            Type = Type,
+            Host = new Uri(Host!, UriKind.RelativeOrAbsolute),
+            Username = Username,
+            Password = password,
+            UrlBase = UrlBase,
+        };
+    }
+}
@@ -3,6 +3,7 @@ using System;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Domain.Exceptions;
 using Cleanuparr.Persistence.Models.Configuration;
+using Cleanuparr.Shared.Helpers;

 namespace Cleanuparr.Api.Features.DownloadClient.Contracts.Requests;

@@ -16,7 +17,7 @@ public sealed record UpdateDownloadClientRequest

    public DownloadClientType Type { get; init; }

-    public Uri? Host { get; init; }
+    public string? Host { get; init; }

    public string? Username { get; init; }

@@ -24,6 +25,8 @@ public sealed record UpdateDownloadClientRequest

    public string? UrlBase { get; init; }

+    public string? ExternalUrl { get; init; }
+
    public void Validate()
    {
        if (string.IsNullOrWhiteSpace(Name))
@@ -31,10 +34,20 @@ public sealed record UpdateDownloadClientRequest
            throw new ValidationException("Client name cannot be empty");
        }

-        if (Host is null)
+        if (string.IsNullOrWhiteSpace(Host))
        {
            throw new ValidationException("Host cannot be empty");
        }
+
+        if (!Uri.TryCreate(Host, UriKind.RelativeOrAbsolute, out _))
+        {
+            throw new ValidationException("Host is not a valid URL");
+        }
+
+        if (!string.IsNullOrWhiteSpace(ExternalUrl) && !Uri.TryCreate(ExternalUrl, UriKind.RelativeOrAbsolute, out _))
+        {
+            throw new ValidationException("External URL is not a valid URL");
+        }
    }

    public DownloadClientConfig ApplyTo(DownloadClientConfig existing) => existing with
@@ -43,9 +56,10 @@ public sealed record UpdateDownloadClientRequest
        Name = Name,
        TypeName = TypeName,
        Type = Type,
-        Host = Host,
+        Host = new Uri(Host!, UriKind.RelativeOrAbsolute),
        Username = Username,
-        Password = Password,
+        Password = Password.IsPlaceholder() ? existing.Password : Password,
        UrlBase = UrlBase,
+        ExternalUrl = !string.IsNullOrWhiteSpace(ExternalUrl) ? new Uri(ExternalUrl, UriKind.RelativeOrAbsolute) : null,
    };
 }
@@ -2,31 +2,36 @@ using System;
 using System.Linq;

 using Cleanuparr.Api.Features.DownloadClient.Contracts.Requests;
+using Cleanuparr.Infrastructure.Features.DownloadClient;
 using Cleanuparr.Infrastructure.Http.DynamicHttpClientSystem;
 using Cleanuparr.Persistence;
-using Cleanuparr.Persistence.Models.Configuration;
+using Cleanuparr.Shared.Helpers;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
-using Microsoft.Extensions.Logging;

 namespace Cleanuparr.Api.Features.DownloadClient.Controllers;

 [ApiController]
 [Route("api/configuration")]
+[Authorize]
 public sealed class DownloadClientController : ControllerBase
 {
    private readonly ILogger<DownloadClientController> _logger;
    private readonly DataContext _dataContext;
    private readonly IDynamicHttpClientFactory _dynamicHttpClientFactory;
+    private readonly IDownloadServiceFactory _downloadServiceFactory;

    public DownloadClientController(
        ILogger<DownloadClientController> logger,
        DataContext dataContext,
-        IDynamicHttpClientFactory dynamicHttpClientFactory)
+        IDynamicHttpClientFactory dynamicHttpClientFactory,
+        IDownloadServiceFactory downloadServiceFactory)
    {
        _logger = logger;
        _dataContext = dataContext;
        _dynamicHttpClientFactory = dynamicHttpClientFactory;
+        _downloadServiceFactory = downloadServiceFactory;
    }

    [HttpGet("download_client")]
@@ -146,4 +151,49 @@ public sealed class DownloadClientController : ControllerBase
            DataContext.Lock.Release();
        }
    }
+
+    [HttpPost("download_client/test")]
+    public async Task<IActionResult> TestDownloadClient([FromBody] TestDownloadClientRequest request)
+    {
+        try
+        {
+            request.Validate();
+
+            string? resolvedPassword = null;
+
+            if (request.Password.IsPlaceholder() && request.ClientId.HasValue)
+            {
+                var existingClient = await _dataContext.DownloadClients
+                    .AsNoTracking()
+                    .FirstOrDefaultAsync(c => c.Id == request.ClientId.Value);
+
+                if (existingClient is null)
+                {
+                    return NotFound($"Download client with ID {request.ClientId.Value} not found");
+                }
+
+                resolvedPassword = existingClient.Password;
+            }
+
+            var testConfig = request.ToTestConfig(resolvedPassword);
+            using var downloadService = _downloadServiceFactory.GetDownloadService(testConfig);
+            var healthResult = await downloadService.HealthCheckAsync();
+
+            if (healthResult.IsHealthy)
+            {
+                return Ok(new
+                {
+                    Message = $"Connection to {request.TypeName} successful",
+                    ResponseTime = healthResult.ResponseTime.TotalMilliseconds
+                });
+            }
+
+            return BadRequest(new { Message = healthResult.ErrorMessage ?? "Connection failed" });
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to test {TypeName} client connection", request.TypeName);
+            return BadRequest(new { Message = $"Connection failed: {ex.Message}" });
+        }
+    }
 }
@@ -24,12 +24,18 @@ public sealed record UpdateGeneralConfigRequest

    public ushort SearchDelay { get; init; } = Constants.DefaultSearchDelaySeconds;

+    public bool StatusCheckEnabled { get; init; } = true;
+
    public string EncryptionKey { get; init; } = Guid.NewGuid().ToString();

    public List<string> IgnoredDownloads { get; init; } = [];

+    public ushort StrikeInactivityWindowHours { get; init; } = 24;
+
    public UpdateLoggingConfigRequest Log { get; init; } = new();

+    public UpdateAuthConfigRequest Auth { get; init; } = new();
+
    public GeneralConfig ApplyTo(GeneralConfig existingConfig, IServiceProvider services, ILogger logger)
    {
        existingConfig.DisplaySupportBanner = DisplaySupportBanner;
@@ -39,10 +45,13 @@ public sealed record UpdateGeneralConfigRequest
        existingConfig.HttpCertificateValidation = HttpCertificateValidation;
        existingConfig.SearchEnabled = SearchEnabled;
        existingConfig.SearchDelay = SearchDelay;
+        existingConfig.StatusCheckEnabled = StatusCheckEnabled;
        existingConfig.EncryptionKey = EncryptionKey;
        existingConfig.IgnoredDownloads = IgnoredDownloads;
+        existingConfig.StrikeInactivityWindowHours = StrikeInactivityWindowHours;

        bool loggingChanged = Log.ApplyTo(existingConfig.Log);
+        Auth.ApplyTo(existingConfig.Auth);

        Validate(existingConfig);

@@ -58,7 +67,18 @@ public sealed record UpdateGeneralConfigRequest
            throw new ValidationException("HTTP_TIMEOUT must be greater than 0");
        }

+        if (config.StrikeInactivityWindowHours is 0)
+        {
+            throw new ValidationException("STRIKE_INACTIVITY_WINDOW_HOURS must be greater than 0");
+        }
+
+        if (config.StrikeInactivityWindowHours > 168)
+        {
+            throw new ValidationException("STRIKE_INACTIVITY_WINDOW_HOURS must be less than or equal to 168");
+        }
+
        config.Log.Validate();
+        config.Auth.Validate();
    }

    private void ApplySideEffects(GeneralConfig config, IServiceProvider services, ILogger logger, bool loggingChanged)
@@ -129,3 +149,19 @@ public sealed record UpdateLoggingConfigRequest

    public bool LevelOnlyChange { get; private set; }
 }
+
+public sealed record UpdateAuthConfigRequest
+{
+    public bool DisableAuthForLocalAddresses { get; init; }
+
+    public bool TrustForwardedHeaders { get; init; }
+
+    public List<string> TrustedNetworks { get; init; } = [];
+
+    public void ApplyTo(AuthConfig existingConfig)
+    {
+        existingConfig.DisableAuthForLocalAddresses = DisableAuthForLocalAddresses;
+        existingConfig.TrustForwardedHeaders = TrustForwardedHeaders;
+        existingConfig.TrustedNetworks = TrustedNetworks;
+    }
+}
@@ -3,32 +3,28 @@ using System.Linq;
 using System.Threading.Tasks;

 using Cleanuparr.Api.Features.General.Contracts.Requests;
-using Cleanuparr.Domain.Enums;
 using Cleanuparr.Persistence;
-using Cleanuparr.Persistence.Models.Configuration.General;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
-using Microsoft.Extensions.Caching.Memory;
 using Microsoft.Extensions.Logging;

 namespace Cleanuparr.Api.Features.General.Controllers;

 [ApiController]
 [Route("api/configuration")]
+[Authorize]
 public sealed class GeneralConfigController : ControllerBase
 {
    private readonly ILogger<GeneralConfigController> _logger;
    private readonly DataContext _dataContext;
-    private readonly MemoryCache _cache;

    public GeneralConfigController(
        ILogger<GeneralConfigController> logger,
-        DataContext dataContext,
-        MemoryCache cache)
+        DataContext dataContext)
    {
        _logger = logger;
        _dataContext = dataContext;
-        _cache = cache;
    }

    [HttpGet("general")]
@@ -49,7 +45,9 @@ public sealed class GeneralConfigController : ControllerBase
    }

    [HttpPut("general")]
-    public async Task<IActionResult> UpdateGeneralConfig([FromBody] UpdateGeneralConfigRequest request)
+    public async Task<IActionResult> UpdateGeneralConfig(
+        [FromBody] UpdateGeneralConfigRequest request,
+        [FromServices] EventsContext eventsContext)
    {
        await DataContext.Lock.WaitAsync();
        try
@@ -63,7 +61,17 @@ public sealed class GeneralConfigController : ControllerBase

            await _dataContext.SaveChangesAsync();

-            ClearStrikesCacheIfNeeded(wasDryRun, config.DryRun);
+            if (wasDryRun && !config.DryRun)
+            {
+                var deletedStrikes = await eventsContext.Strikes.ExecuteDeleteAsync();
+                var deletedItems = await eventsContext.DownloadItems
+                    .Where(d => !d.Strikes.Any())
+                    .ExecuteDeleteAsync();
+
+                _logger.LogWarning(
+                    "Dry run disabled — purged all strikes: {Strikes} strikes, {Items} download items removed",
+                    deletedStrikes, deletedItems);
+            }

            return Ok(new { Message = "General configuration updated successfully" });
        }
@@ -78,38 +86,18 @@ public sealed class GeneralConfigController : ControllerBase
        }
    }

-    private void ClearStrikesCacheIfNeeded(bool wasDryRun, bool isDryRun)
+    [HttpPost("strikes/purge")]
+    public async Task<IActionResult> PurgeAllStrikes(
+        [FromServices] EventsContext eventsContext)
    {
-        if (!wasDryRun || isDryRun)
-        {
-            return;
-        }
+        var deletedStrikes = await eventsContext.Strikes.ExecuteDeleteAsync();
+        var deletedItems = await eventsContext.DownloadItems
+            .Where(d => !d.Strikes.Any())
+            .ExecuteDeleteAsync();

-        List<object> keys;
+        _logger.LogWarning("Purged all strikes: {strikes} strikes, {items} download items removed",
+            deletedStrikes, deletedItems);

-        // Remove strikes
-        foreach (string strikeType in Enum.GetNames(typeof(StrikeType)))
-        {
-            keys = _cache.Keys
-                .Where(key => key.ToString()?.StartsWith(strikeType, StringComparison.InvariantCultureIgnoreCase) is true)
-                .ToList();
-
-            foreach (object key in keys)
-            {
-                _cache.Remove(key);
-            }
-
-            _logger.LogTrace("Removed all cache entries for strike type: {StrikeType}", strikeType);
-        }
-
-        // Remove strike cache items
-        keys = _cache.Keys
-            .Where(key => key.ToString()?.StartsWith("item_", StringComparison.InvariantCultureIgnoreCase) is true)
-            .ToList();
-        
-        foreach (object key in keys)
-        {
-            _cache.Remove(key);
-        }
+        return Ok(new { DeletedStrikes = deletedStrikes, DeletedItems = deletedItems });
    }
 }
@@ -2,12 +2,13 @@ using System.ComponentModel.DataAnnotations;
 using System.Threading.Tasks;

 using Cleanuparr.Api.Features.MalwareBlocker.Contracts.Requests;
-using Cleanuparr.Infrastructure.Models;
+using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Cleanuparr.Infrastructure.Utilities;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration;
 using Cleanuparr.Persistence.Models.Configuration.MalwareBlocker;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
@@ -16,6 +17,7 @@ namespace Cleanuparr.Api.Features.MalwareBlocker.Controllers;

 [ApiController]
 [Route("api/configuration")]
+[Authorize]
 public sealed class MalwareBlockerConfigController : ControllerBase
 {
    private readonly ILogger<MalwareBlockerConfigController> _logger;
@@ -1,10 +1,18 @@
+using Cleanuparr.Domain.Enums;
+
 namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;

 public record CreateAppriseProviderRequest : CreateNotificationProviderRequestBase
 {
+    public AppriseMode Mode { get; init; } = AppriseMode.Api;
+
+    // API mode fields
    public string Url { get; init; } = string.Empty;
-    
+
    public string Key { get; init; } = string.Empty;
-    
+
    public string Tags { get; init; } = string.Empty;
+
+    // CLI mode fields
+    public string? ServiceUrls { get; init; }
 }
@@ -0,0 +1,10 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record CreateDiscordProviderRequest : CreateNotificationProviderRequestBase
+{
+    public string WebhookUrl { get; init; } = string.Empty;
+
+    public string Username { get; init; } = string.Empty;
+
+    public string AvatarUrl { get; init; } = string.Empty;
+}
@@ -0,0 +1,10 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record CreateGotifyProviderRequest : CreateNotificationProviderRequestBase
+{
+    public string ServerUrl { get; init; } = string.Empty;
+
+    public string ApplicationToken { get; init; } = string.Empty;
+
+    public int Priority { get; init; } = 5;
+}
@@ -0,0 +1,22 @@
+using Cleanuparr.Domain.Enums;
+
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record CreatePushoverProviderRequest : CreateNotificationProviderRequestBase
+{
+    public string ApiToken { get; init; } = string.Empty;
+
+    public string UserKey { get; init; } = string.Empty;
+
+    public List<string> Devices { get; init; } = [];
+
+    public PushoverPriority Priority { get; init; } = PushoverPriority.Normal;
+
+    public string? Sound { get; init; }
+
+    public int? Retry { get; init; }
+
+    public int? Expire { get; init; }
+
+    public List<string> Tags { get; init; } = [];
+}
@@ -0,0 +1,12 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public sealed record CreateTelegramProviderRequest : CreateNotificationProviderRequestBase
+{
+    public string BotToken { get; init; } = string.Empty;
+
+    public string ChatId { get; init; } = string.Empty;
+
+    public string? TopicId { get; init; }
+
+    public bool SendSilently { get; init; }
+}
@@ -1,10 +1,20 @@
+using Cleanuparr.Domain.Enums;
+
 namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;

 public record TestAppriseProviderRequest
 {
+    public AppriseMode Mode { get; init; } = AppriseMode.Api;
+
+    // API mode fields
    public string Url { get; init; } = string.Empty;
-    
+
    public string Key { get; init; } = string.Empty;
-    
+
    public string Tags { get; init; } = string.Empty;
+
+    // CLI mode fields
+    public string? ServiceUrls { get; init; }
+
+    public Guid? ProviderId { get; init; }
 }
@@ -0,0 +1,12 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record TestDiscordProviderRequest
+{
+    public string WebhookUrl { get; init; } = string.Empty;
+
+    public string Username { get; init; } = string.Empty;
+
+    public string AvatarUrl { get; init; } = string.Empty;
+
+    public Guid? ProviderId { get; init; }
+}
@@ -0,0 +1,12 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record TestGotifyProviderRequest
+{
+    public string ServerUrl { get; init; } = string.Empty;
+
+    public string ApplicationToken { get; init; } = string.Empty;
+
+    public int Priority { get; init; } = 5;
+
+    public Guid? ProviderId { get; init; }
+}
@@ -3,6 +3,8 @@ namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
 public record TestNotifiarrProviderRequest
 {
    public string ApiKey { get; init; } = string.Empty;
-    
+
    public string ChannelId { get; init; } = string.Empty;
+
+    public Guid? ProviderId { get; init; }
 }
@@ -19,4 +19,6 @@ public record TestNtfyProviderRequest
    public NtfyPriority Priority { get; init; } = NtfyPriority.Default;
    
    public List<string> Tags { get; init; } = [];
+
+    public Guid? ProviderId { get; init; }
 }
@@ -0,0 +1,24 @@
+using Cleanuparr.Domain.Enums;
+
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record TestPushoverProviderRequest
+{
+    public string ApiToken { get; init; } = string.Empty;
+
+    public string UserKey { get; init; } = string.Empty;
+
+    public List<string> Devices { get; init; } = [];
+
+    public PushoverPriority Priority { get; init; } = PushoverPriority.Normal;
+
+    public string? Sound { get; init; }
+
+    public int? Retry { get; init; }
+
+    public int? Expire { get; init; }
+
+    public List<string> Tags { get; init; } = [];
+
+    public Guid? ProviderId { get; init; }
+}
@@ -0,0 +1,14 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public sealed record TestTelegramProviderRequest
+{
+    public string BotToken { get; init; } = string.Empty;
+
+    public string ChatId { get; init; } = string.Empty;
+
+    public string? TopicId { get; init; }
+
+    public bool SendSilently { get; init; }
+
+    public Guid? ProviderId { get; init; }
+}
@@ -1,10 +1,18 @@
+using Cleanuparr.Domain.Enums;
+
 namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;

 public record UpdateAppriseProviderRequest : UpdateNotificationProviderRequestBase
 {
+    public AppriseMode Mode { get; init; } = AppriseMode.Api;
+
+    // API mode fields
    public string Url { get; init; } = string.Empty;
-    
+
    public string Key { get; init; } = string.Empty;
-    
+
    public string Tags { get; init; } = string.Empty;
+
+    // CLI mode fields
+    public string? ServiceUrls { get; init; }
 }
@@ -0,0 +1,10 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record UpdateDiscordProviderRequest : UpdateNotificationProviderRequestBase
+{
+    public string WebhookUrl { get; init; } = string.Empty;
+
+    public string Username { get; init; } = string.Empty;
+
+    public string AvatarUrl { get; init; } = string.Empty;
+}
@@ -0,0 +1,10 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record UpdateGotifyProviderRequest : UpdateNotificationProviderRequestBase
+{
+    public string ServerUrl { get; init; } = string.Empty;
+
+    public string ApplicationToken { get; init; } = string.Empty;
+
+    public int Priority { get; init; } = 5;
+}
@@ -0,0 +1,22 @@
+using Cleanuparr.Domain.Enums;
+
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record UpdatePushoverProviderRequest : UpdateNotificationProviderRequestBase
+{
+    public string ApiToken { get; init; } = string.Empty;
+
+    public string UserKey { get; init; } = string.Empty;
+
+    public List<string> Devices { get; init; } = [];
+
+    public PushoverPriority Priority { get; init; } = PushoverPriority.Normal;
+
+    public string? Sound { get; init; }
+
+    public int? Retry { get; init; }
+
+    public int? Expire { get; init; }
+
+    public List<string> Tags { get; init; } = [];
+}
@@ -0,0 +1,12 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public sealed record UpdateTelegramProviderRequest : CreateNotificationProviderRequestBase
+{
+    public string BotToken { get; init; } = string.Empty;
+
+    public string ChatId { get; init; } = string.Empty;
+
+    public string? TopicId { get; init; }
+
+    public bool SendSilently { get; init; }
+}
@@ -1,12 +1,13 @@
 using System.ComponentModel.DataAnnotations;

 using Cleanuparr.Api.Features.QueueCleaner.Contracts.Requests;
-using Cleanuparr.Infrastructure.Models;
+using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Cleanuparr.Infrastructure.Utilities;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration;
 using Cleanuparr.Persistence.Models.Configuration.QueueCleaner;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
@@ -15,6 +16,7 @@ namespace Cleanuparr.Api.Features.QueueCleaner.Controllers;

 [ApiController]
 [Route("api/configuration")]
+[Authorize]
 public sealed class QueueCleanerConfigController : ControllerBase
 {
    private readonly ILogger<QueueCleanerConfigController> _logger;
@@ -59,8 +61,6 @@ public sealed class QueueCleanerConfigController : ControllerBase
                CronValidationHelper.ValidateCronExpression(newConfigDto.CronExpression);
            }

-            newConfigDto.FailedImport.Validate();
-
            var oldConfig = await _dataContext.QueueCleanerConfigs
                .FirstAsync();

@@ -70,6 +70,8 @@ public sealed class QueueCleanerConfigController : ControllerBase
            oldConfig.FailedImport = newConfigDto.FailedImport;
            oldConfig.DownloadingMetadataMaxStrikes = newConfigDto.DownloadingMetadataMaxStrikes;
            oldConfig.IgnoredDownloads = newConfigDto.IgnoredDownloads;
+            
+            oldConfig.Validate();

            await _dataContext.SaveChangesAsync();

@@ -3,6 +3,7 @@ using Cleanuparr.Domain.Exceptions;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration.QueueCleaner;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
@@ -11,6 +12,7 @@ namespace Cleanuparr.Api.Features.QueueCleaner.Controllers;

 [ApiController]
 [Route("api/queue-rules")]
+[Authorize]
 public class QueueRulesController : ControllerBase
 {
    private readonly ILogger<QueueRulesController> _logger;
@@ -63,7 +63,14 @@ public static class HostExtensions
        {
            await configContext.Database.MigrateAsync();
        }
-        
+
+        // Apply users db migrations
+        await using var usersContext = UsersContext.CreateStaticInstance();
+        if ((await usersContext.Database.GetPendingMigrationsAsync()).Any())
+        {
+            await usersContext.Database.MigrateAsync();
+        }
+
        return builder;
    }
 }
@@ -1,7 +1,12 @@
-using Cleanuparr.Infrastructure.Features.Jobs;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Features.Context;
+using Cleanuparr.Infrastructure.Features.Jobs;
+using Cleanuparr.Infrastructure.Helpers;
 using Cleanuparr.Infrastructure.Hubs;
 using Cleanuparr.Infrastructure.Models;
 using Cleanuparr.Infrastructure.Services.Interfaces;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.State;
 using Microsoft.AspNetCore.SignalR;
 using Quartz;
 using Serilog.Context;
@@ -14,48 +19,73 @@ public sealed class GenericJob<T> : IJob
 {
    private readonly ILogger<GenericJob<T>> _logger;
    private readonly IServiceScopeFactory _scopeFactory;
-    
+
    public GenericJob(ILogger<GenericJob<T>> logger, IServiceScopeFactory scopeFactory)
    {
        _logger = logger;
        _scopeFactory = scopeFactory;
    }
-    
+
    public async Task Execute(IJobExecutionContext context)
    {
        using var _ = LogContext.PushProperty("JobName", typeof(T).Name);
-        
+
+        Guid jobRunId = Guid.CreateVersion7();
+        JobType jobType = Enum.Parse<JobType>(typeof(T).Name);
+        JobRunStatus? status = null;
+
        try
        {
            await using var scope = _scopeFactory.CreateAsyncScope();
+            var eventsContext = scope.ServiceProvider.GetRequiredService<EventsContext>();
            var hubContext = scope.ServiceProvider.GetRequiredService<IHubContext<AppHub>>();
            var jobManagementService = scope.ServiceProvider.GetRequiredService<IJobManagementService>();
-            
-            await BroadcastJobStatus(hubContext, jobManagementService, false);
-            
+
+            var jobRun = new JobRun { Id = jobRunId, Type = jobType };
+            eventsContext.JobRuns.Add(jobRun);
+            await eventsContext.SaveChangesAsync();
+
+            ContextProvider.SetJobRunId(jobRunId);
+            using var __ = LogContext.PushProperty(LogProperties.JobRunId, jobRunId.ToString());
+
+            await BroadcastJobStatus(hubContext, jobManagementService, jobType, false);
+
            var handler = scope.ServiceProvider.GetRequiredService<T>();
            await handler.ExecuteAsync();
-            
-            await BroadcastJobStatus(hubContext, jobManagementService, true);
+
+            status = JobRunStatus.Completed;
+            await BroadcastJobStatus(hubContext, jobManagementService, jobType, true);
        }
        catch (Exception ex)
        {
            _logger.LogError(ex, "{name} failed", typeof(T).Name);
+            status = JobRunStatus.Failed;
+        }
+        finally
+        {
+            await using var finalScope = _scopeFactory.CreateAsyncScope();
+            var eventsContext = finalScope.ServiceProvider.GetRequiredService<EventsContext>();
+            var jobRun = await eventsContext.JobRuns.FindAsync(jobRunId);
+            if (jobRun is not null)
+            {
+                jobRun.CompletedAt = DateTime.UtcNow;
+                jobRun.Status = status;
+                await eventsContext.SaveChangesAsync();
+            }
        }
    }
-    
-    private async Task BroadcastJobStatus(IHubContext<AppHub> hubContext, IJobManagementService jobManagementService, bool isFinished)
+
+    private async Task BroadcastJobStatus(IHubContext<AppHub> hubContext, IJobManagementService jobManagementService, JobType jobType, bool isFinished)
    {
        try
        {
-            JobType jobType = Enum.Parse<JobType>(typeof(T).Name);
            JobInfo jobInfo = await jobManagementService.GetJob(jobType);

            if (isFinished)
            {
                jobInfo.Status = "Scheduled";
            }
-            
+
            await hubContext.Clients.All.SendAsync("JobStatusUpdate", jobInfo);
        }
        catch (Exception ex)
@@ -0,0 +1,70 @@
+using System.Reflection;
+using System.Text.Json;
+using System.Text.Json.Serialization.Metadata;
+
+using Cleanuparr.Shared.Attributes;
+using Cleanuparr.Shared.Helpers;
+
+namespace Cleanuparr.Api.Json;
+
+/// <summary>
+/// JSON type info resolver that masks properties decorated with <see cref="SensitiveDataAttribute"/>
+/// by replacing their serialized values with the appropriate placeholder during serialization.
+/// </summary>
+public sealed class SensitiveDataResolver : IJsonTypeInfoResolver
+{
+    private readonly IJsonTypeInfoResolver _innerResolver;
+
+    public SensitiveDataResolver(IJsonTypeInfoResolver innerResolver)
+    {
+        _innerResolver = innerResolver;
+    }
+
+    public JsonTypeInfo? GetTypeInfo(Type type, JsonSerializerOptions options)
+    {
+        var typeInfo = _innerResolver.GetTypeInfo(type, options);
+
+        if (typeInfo?.Kind != JsonTypeInfoKind.Object)
+            return typeInfo;
+
+        foreach (var property in typeInfo.Properties)
+        {
+            if (property.AttributeProvider is not PropertyInfo propertyInfo)
+                continue;
+
+            var sensitiveAttr = propertyInfo.GetCustomAttribute<SensitiveDataAttribute>();
+            if (sensitiveAttr is null)
+                continue;
+
+            ApplyMasking(property, sensitiveAttr.Type);
+        }
+
+        return typeInfo;
+    }
+
+    private static void ApplyMasking(JsonPropertyInfo property, SensitiveDataType maskType)
+    {
+        var originalGet = property.Get;
+        if (originalGet is null)
+        {
+            return;
+        }
+
+        property.Get = maskType switch
+        {
+            SensitiveDataType.Full => obj =>
+            {
+                var value = originalGet(obj);
+                return value is string ? SensitiveDataHelper.Placeholder : value;
+            },
+
+            SensitiveDataType.AppriseUrl => obj =>
+            {
+                var value = originalGet(obj);
+                return value is string s ? SensitiveDataHelper.MaskAppriseUrls(s) : value;
+            },
+
+            _ => originalGet,
+        };
+    }
+}
@@ -0,0 +1,89 @@
+using Cleanuparr.Persistence;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Api.Middleware;
+
+public class SetupGuardMiddleware
+{
+    private readonly RequestDelegate _next;
+    private volatile bool _setupCompleted;
+
+    public SetupGuardMiddleware(RequestDelegate next)
+    {
+        _next = next;
+    }
+
+    public async Task InvokeAsync(HttpContext context)
+    {
+        string path = context.Request.Path.Value?.ToLowerInvariant() ?? "";
+
+        // Always allow health checks and non-API paths (static files, SPA, etc.)
+        if (path.StartsWith("/health") || !path.StartsWith("/api/"))
+        {
+            await _next(context);
+            return;
+        }
+
+        // Setup-only paths (/api/auth/setup/*) require setup to NOT be complete
+        if (IsSetupOnlyPath(path))
+        {
+            if (await IsSetupCompleted())
+            {
+                context.Response.StatusCode = StatusCodes.Status403Forbidden;
+                context.Response.ContentType = "application/json";
+                await context.Response.WriteAsJsonAsync(new { error = "Setup already completed" });
+                return;
+            }
+
+            await _next(context);
+            return;
+        }
+
+        // Non-setup auth paths (login, refresh, logout, status) are always allowed
+        if (path.StartsWith("/api/auth/") || path == "/api/auth")
+        {
+            await _next(context);
+            return;
+        }
+
+        // All other API paths require setup to be complete
+        if (!await IsSetupCompleted())
+        {
+            context.Response.StatusCode = StatusCodes.Status403Forbidden;
+            context.Response.ContentType = "application/json";
+            await context.Response.WriteAsJsonAsync(new { error = "Setup required" });
+            return;
+        }
+
+        await _next(context);
+    }
+
+    public void ResetSetupState()
+    {
+        _setupCompleted = false;
+    }
+
+    private async Task<bool> IsSetupCompleted()
+    {
+        if (_setupCompleted)
+        {
+            return true;
+        }
+
+        await using var usersContext = UsersContext.CreateStaticInstance();
+        var user = await usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+
+        if (user is { SetupCompleted: true })
+        {
+            _setupCompleted = true;
+            return true;
+        }
+
+        return false;
+    }
+
+    private static bool IsSetupOnlyPath(string path)
+    {
+        return path.StartsWith("/api/auth/setup/") || path == "/api/auth/setup";
+    }
+}
@@ -1,23 +0,0 @@
-using System.Diagnostics.CodeAnalysis;
-
-using Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests;
-
-namespace Cleanuparr.Api.Models;
-
-/// <summary>
-/// Legacy namespace shim; prefer <see cref="UpdateDownloadCleanerConfigRequest"/> from
-/// <c>Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests</c>.
-/// </summary>
-[Obsolete("Use Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests.UpdateDownloadCleanerConfigRequest instead")]
-[SuppressMessage("Design", "CA1000", Justification = "Temporary alias during refactor")]
-[SuppressMessage("Usage", "CA2225", Justification = "Alias type")]
-public record UpdateDownloadCleanerConfigDto : UpdateDownloadCleanerConfigRequest;
-
-/// <summary>
-/// Legacy namespace shim; prefer <see cref="CleanCategoryRequest"/> from
-/// <c>Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests</c>.
-/// </summary>
-[Obsolete("Use Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests.CleanCategoryRequest instead")]
-[SuppressMessage("Design", "CA1000", Justification = "Temporary alias during refactor")]
-[SuppressMessage("Usage", "CA2225", Justification = "Alias type")]
-public record CleanCategoryDto : CleanCategoryRequest;
Author	SHA1	Message	Date
Flaminel	33d1756fdd	Revoke all refresh tokens on password change (#486 )	2026-03-02 14:58:19 +02:00
Flaminel	63931763c4	Fix session invalidation for local auth bypass (#487 )	2026-03-02 13:34:20 +02:00
Flaminel	bdb956ec84	Add guards against exposing passwords to the UI (#477 )	2026-03-02 13:11:34 +02:00
Flaminel	41b48d1104	Enforce authorize attribute explicitely (#485 )	2026-03-02 13:00:23 +02:00
Flaminel	57fef26726	Add missing rTorrent and Whisparr v3 docs (#484 )	2026-03-02 12:45:52 +02:00
Flaminel	ea94dc4548	Fix reveal button being pressed on Enter instead of login (#483 )	2026-03-02 12:41:35 +02:00
Flaminel	13a7232bc5	Update frontend packages (#478 )	2026-02-28 04:16:11 +02:00
Flaminel	5fea8a0041	Add Docker multistep build (#475 )	2026-02-27 20:42:27 +02:00
Flaminel	2333c86a08	Increase access token lifetime to 1 hour (#474 )	2026-02-27 15:13:08 +02:00
Flaminel	cbfc1b2875	Fix the Malware Blocker page not displaying validation errors (#473 )	2026-02-25 22:28:49 +02:00
Flaminel	62e10afe7b	Fix the Download Cleaner page not displaying validation errors (#472 )	2026-02-25 22:20:49 +02:00
Flaminel	d542c716f9	Add support for rootless Docker container (#471 )	2026-02-24 19:03:01 +02:00
Flaminel	7eeaefaa65	Fix some auth endpoints not checking if user setup is complete (#468 )	2026-02-23 20:33:22 +02:00
Flaminel	bd55356881	Remove Huntarr because it's too hot right now (#467 )	2026-02-23 19:11:08 +02:00
Flaminel	df986a2e36	Redirect to base path from root path (#466 )	2026-02-23 17:24:48 +02:00
Flaminel	8a2aca79f7	Add local auth bypass and make 2FA optional (#461 )	2026-02-23 11:49:55 +02:00
Flaminel	e1cc0dba28	Add rTorrent support (#446 )	2026-02-22 19:49:14 +02:00
Flaminel	660dce0fa7	Fix strikes not being reset when disabling dry run (#456 )	2026-02-22 19:37:03 +02:00
Flaminel	ee343ba469	Fixed failed imports input being invalid when strikes are set to 0 (#454 )	2026-02-22 19:00:52 +02:00
Flaminel	d038738008	Add seeding rule privacy type (#449 )	2026-02-22 00:55:22 +02:00
Flaminel	70f9995041	Add stats endpoint used for dashboards (#453 )	2026-02-21 02:27:15 +02:00
Flaminel	6a1aaec7c2	Add seconds to the jobs next run in the dashboard (#451 )	2026-02-20 19:18:22 +02:00
Flaminel	50e486bf5f	Add authentication (#444 )	2026-02-20 18:09:29 +02:00
Flaminel	bc15a9a934	Fix PWA installation (#450 )	2026-02-20 16:27:22 +02:00
Flaminel	573dbcf882	Fix modal transparency (#448 )	2026-02-17 00:23:31 +02:00
Flaminel	94acd9afa4	Fix download client inputs (#442 )	2026-02-15 04:06:28 +02:00
Flaminel	65d25a72a9	Fix failed import reason display for events (#443 )	2026-02-15 03:59:40 +02:00
Flaminel	97eb2fce44	Add strikes page (#438 )	2026-02-15 03:57:14 +02:00
Flaminel	701829001c	Fix speed and size inputs for queue rules (#440 )	2026-02-15 01:19:32 +02:00
Flaminel	8aeeca111c	Add strike persistency (#437 )	2026-02-14 04:00:05 +02:00
Flaminel	c43936ce81	Remove testing download path (#436 )	2026-02-13 11:52:53 +02:00
Flaminel	f35eb0c922	Add full message for logs on the UI (#435 )	2026-02-13 02:05:39 +02:00
Flaminel	b2b0626b44	Add external url for notifications (#434 )	2026-02-13 02:04:27 +02:00
Flaminel	40f108d7ca	Add app status setting to general settings (#433 )	2026-02-12 23:12:26 +02:00
Flaminel	6570f74b7e	Fix Deluge failing on empty password (#432 )	2026-02-12 22:29:55 +02:00
Flaminel	16f216cf84	Add Gotify notification provider (#420 )	2026-02-12 18:17:09 +02:00
Flaminel	69551edeff	Revamp UI (#429 )	2026-02-12 17:51:30 +02:00
Flaminel	7192796e89	Update frontend packages (#422 )	2026-01-14 14:17:04 +02:00
Flaminel	1d1ee7972f	Use CDN to deliver logos (#421 )	2026-01-14 13:51:25 +02:00
Flaminel	8bd6b86018	Add Discord notification provider (#417 )	2026-01-13 18:53:40 +02:00
Flaminel	6abb542271	Fix Servarr version dropdown (#414 )	2026-01-11 02:33:16 +02:00
Flaminel	2aceae3078	Fix package lock file being out of sync (#411 )	2026-01-09 00:05:34 +02:00
Flaminel	65b200a68e	Fix MacOS build (#409 )	2026-01-07 02:57:52 +02:00
Flaminel	de0c881944	Fix inode count duplication when looking for hardlinks (#407 )	2026-01-07 02:27:27 +02:00
Flaminel	d0ef01d79b	Add images for Apprise CLI notifications (#408 )	2026-01-07 02:11:59 +02:00
Flaminel	9457236e99	Update packages and dotnet version (#398 )	2026-01-07 00:27:20 +02:00
Flaminel	d43b4fc1c4	Add Whisparr v3 support (#405 )	2026-01-03 23:34:21 +02:00
Flaminel	e9750429eb	Add Telegram notification provider (#400 )	2026-01-03 23:34:05 +02:00
Flaminel	b71b268b08	Add configurable bind address (#404 )	2025-12-31 04:40:43 +02:00
Flaminel	a708d22b27	Add GitAds to README (#403 )	2025-12-31 03:35:35 +02:00
Flaminel	a9a3b08ad6	Add item name for dashboard events (#402 )	2025-12-31 02:35:55 +02:00
Flaminel	1d1e8679e4	Add supported apps version disclaimer (#399 )	2025-12-30 00:26:16 +02:00
Flaminel	142d445ed0	Add Apprise CLI notification provider (#387 )	2025-12-25 22:05:23 +02:00
Flaminel	375094862c	Add test button for arrs and download clients (#391 )	2025-12-20 17:06:03 +02:00
Flaminel	58a72cef0f	Add option for multiple ignored root directories (#390 )	2025-12-20 17:04:36 +02:00
Flaminel	4ceff127a7	Add option to keep source files when cleaning downloads (#388 )	2025-12-19 23:52:59 +02:00
Flaminel	c07b811cf8	Fix Transmission torrent fetch (#389 )	2025-12-19 23:35:23 +02:00
Flaminel	b16fa70774	Add Pushover notification provider (#385 )	2025-12-13 21:24:34 +02:00
Flaminel	b343165644	Fix Download Cleaner making too many requests (#368 )	2025-12-10 09:22:51 +02:00
Flaminel	02dff0bb9b	Fix manual release workflows (#380 )	2025-12-01 23:42:22 +02:00
Flaminel	ac3be75082	Fix workflow dispatch defaulting to dev version (#379 )	2025-11-30 22:53:23 +02:00
Flaminel	a1663b865a	Improve workflow dispatch (#378 )	2025-11-30 22:27:40 +02:00
Flaminel	c97a416d1e	Fix windows workflow (#377 )	2025-11-30 16:22:21 +02:00
Flaminel	d28ab42303	Fix frontend workflow using assets instead of cache (#376 )	2025-11-30 15:48:53 +02:00
Flaminel	fbb2bba3b6	Update packages (#375 )	2025-11-30 13:14:29 +02:00
Flaminel	08eda22587	Add test workflow and improve workflow parallelization (#369 )	2025-11-25 23:05:28 +02:00
Flaminel	a4045eebd3	Add downloads volume to detailed installation docs (#365 )	2025-11-22 22:15:37 +02:00
Flaminel	a57cbccbb4	Improve UI validations (#366 )	2025-11-22 22:14:50 +02:00
Flaminel	2221f118bb	Fix qBittorrent tracker check (#363 )	2025-11-09 19:03:48 +02:00