lowered the token lifetime for testing

This reverts commit 197bd0d444.

.github/workflows/build-docker.yml

@@ -11,6 +11,11 @@ on:
         type: boolean
         required: false
         default: true
+      app_version:
+        description: 'Application version'
+        type: string
+        required: false
+        default: ''
 
 # Cancel in-progress runs for the same PR
 concurrency:
@@ -34,18 +39,32 @@ jobs:
         timeout-minutes: 1
         run: |
           githubHeadRef=${{ env.githubHeadRef }}
+          inputVersion="${{ inputs.app_version }}"
           latestDockerTag=""
           versionDockerTag=""
           majorVersionDockerTag=""
           minorVersionDockerTag=""
           version="0.0.1"
 
-          if [[ "$githubRef" =~ ^"refs/tags/" ]]; then
+          if [[ -n "$inputVersion" ]]; then
+            # Version provided via input (manual release)
+            branch="main"
+            latestDockerTag="latest"
+            versionDockerTag="$inputVersion"
+            version="$inputVersion"
+
+            # Extract major and minor versions for additional tags
+            if [[ "$versionDockerTag" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+) ]]; then
+              majorVersionDockerTag="${BASH_REMATCH[1]}"
+              minorVersionDockerTag="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}"
+            fi
+          elif [[ "$githubRef" =~ ^"refs/tags/" ]]; then
+            # Tag push
             branch=${githubRef##*/}
             latestDockerTag="latest"
             versionDockerTag=${branch#v}
             version=${branch#v}
-            
+
             # Extract major and minor versions for additional tags
             if [[ "$versionDockerTag" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+) ]]; then
               majorVersionDockerTag="${BASH_REMATCH[1]}"
@@ -136,12 +155,10 @@ jobs:
             VERSION=${{ env.version }}
             PACKAGES_USERNAME=${{ secrets.PACKAGES_USERNAME }}
             PACKAGES_PAT=${{ env.PACKAGES_PAT }}
-          outputs: |
-            type=image
           platforms: |
             linux/amd64
             linux/arm64
-          push: ${{ inputs.push_docker }}
+          push: ${{ github.event_name == 'pull_request' || inputs.push_docker == true }}
           tags: |
             ${{ env.githubTags }}
           # Enable BuildKit cache for faster builds

.github/workflows/build-executable.yml

@@ -76,7 +76,7 @@ jobs:
       - name: Setup dotnet
         uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: 9.0.x
+          dotnet-version: 10.0.x
 
       - name: Cache NuGet packages
         uses: actions/cache@v4
@@ -124,27 +124,3 @@ jobs:
           name: executable-${{ matrix.platform }}
           path: ./artifacts/*.zip
           retention-days: 30
-
-  # Consolidate all executable artifacts
-  consolidate:
-    needs: build-platform
-    runs-on: ubuntu-latest
-    steps:
-      - name: Download all platform artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: executable-*
-          path: ./artifacts
-          merge-multiple: true
-
-      - name: List downloaded artifacts
-        run: |
-          echo "Consolidated executable artifacts:"
-          find ./artifacts -type f -name "*.zip" | sort
-
-      - name: Upload consolidated artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: cleanuparr-executables
-          path: ./artifacts/*.zip
-          retention-days: 30

.github/workflows/build-macos-installer.yml

@@ -21,12 +21,12 @@ jobs:
       matrix:
         include:
           - arch: Intel
-            runner: macos-13
+            runner: macos-15-intel
             runtime: osx-x64
             min_os_version: "10.15"
             artifact_suffix: intel
           - arch: ARM
-            runner: macos-14
+            runner: macos-15
             runtime: osx-arm64
             min_os_version: "11.0"
             artifact_suffix: arm64
@@ -86,7 +86,7 @@ jobs:
       - name: Setup .NET
         uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: 9.0.x
+          dotnet-version: 10.0.x
 
       - name: Restore .NET dependencies
         run: |
@@ -350,8 +350,8 @@ jobs:
           # Copy uninstall script to app bundle for user access
           cp scripts/uninstall_cleanuparr.sh dist/Cleanuparr.app/Contents/Resources/
 
-          # Determine package name
-          if [[ "${{ github.ref }}" =~ ^refs/tags/ ]]; then
+          # Determine package name - if app_version input was provided, it's a release build
+          if [[ -n "${{ inputs.app_version }}" ]] || [[ "${{ github.ref }}" =~ ^refs/tags/ ]]; then
             pkg_name="Cleanuparr-${{ env.appVersion }}-macos-${{ matrix.artifact_suffix }}.pkg"
           else
             pkg_name="Cleanuparr-${{ env.appVersion }}-macos-${{ matrix.artifact_suffix }}-dev.pkg"

.github/workflows/build-windows-installer.yml

@@ -70,7 +70,7 @@ jobs:
       - name: Setup .NET
         uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: 9.0.x
+          dotnet-version: 10.0.x
 
       - name: Restore .NET dependencies
         run: |

.github/workflows/release.yml

@@ -8,8 +8,7 @@ on:
     inputs:
       version:
         description: 'Version to release (e.g., 1.0.0)'
-        required: false
-        default: ''
+        required: true
       runTests:
         description: 'Run test suite'
         type: boolean
@@ -57,25 +56,38 @@ jobs:
             release_version=${GITHUB_REF##refs/tags/}
             app_version=${release_version#v}
             is_tag=true
-          elif [[ -n "${{ github.event.inputs.version }}" ]]; then
+          else
             # Manual workflow with version
             app_version="${{ github.event.inputs.version }}"
-            release_version="v$app_version"
-            is_tag=false
-          else
-            # Manual workflow without version
-            app_version="0.0.1-dev-$(date +%Y%m%d-%H%M%S)"
+
+            # Validate version format (x.x.x)
+            if ! [[ "$app_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+              echo "Error: Version must be in format x.x.x (e.g., 1.0.0)"
+              echo "Provided version: $app_version"
+              exit 1
+            fi
+
             release_version="v$app_version"
             is_tag=false
           fi
-          
+
           echo "app_version=$app_version" >> $GITHUB_OUTPUT
           echo "release_version=$release_version" >> $GITHUB_OUTPUT
           echo "is_tag=$is_tag" >> $GITHUB_OUTPUT
 
-          echo "🏷️ Release Version: $release_version"
-          echo "📱 App Version: $app_version"
-          echo "🔖 Is Tag: $is_tag"
+          echo "Release Version: $release_version"
+          echo "App Version: $app_version"
+          echo "Is Tag: $is_tag"
+
+      - name: Check if release already exists
+        run: |
+          if gh release view "${{ steps.version.outputs.release_version }}" &>/dev/null; then
+            echo "❌ Release ${{ steps.version.outputs.release_version }} already exists. Stopping workflow."
+            exit 1
+          fi
+          echo "✅ Release ${{ steps.version.outputs.release_version }} does not exist. Proceeding."
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   # Run tests
   test:
@@ -148,6 +160,7 @@ jobs:
     uses: ./.github/workflows/build-docker.yml
     with:
       push_docker: ${{ needs.validate.outputs.is_tag == 'true' || github.event.inputs.pushDocker == 'true' }}
+      app_version: ${{ needs.validate.outputs.app_version }}
     secrets: inherit
 
   # Create GitHub release
@@ -176,15 +189,32 @@ jobs:
           secrets:
             secrets/data/github repo_readonly_pat | REPO_READONLY_PAT
 
-      - name: Download all artifacts
+      - name: Download executable artifacts
         uses: actions/download-artifact@v4
         with:
+          pattern: executable-*
           path: ./artifacts
+          merge-multiple: true
+
+      - name: Download Windows installer
+        uses: actions/download-artifact@v4
+        with:
+          name: Cleanuparr-windows-installer
+          path: ./artifacts
+
+      - name: Download macOS installers
+        uses: actions/download-artifact@v4
+        with:
+          pattern: Cleanuparr-macos-*-installer
+          path: ./artifacts
+          merge-multiple: true
 
       - name: List downloaded artifacts
         run: |
-          echo "📦 Downloaded artifacts:"
-          find ./artifacts -type f -name "*.zip" -o -name "*.pkg" -o -name "*.exe" | sort
+          echo "Downloaded artifacts:"
+          find ./artifacts -type f \( -name "*.zip" -o -name "*.pkg" -o -name "*.exe" \) | sort
+          echo ""
+          echo "Total files: $(find ./artifacts -type f \( -name "*.zip" -o -name "*.pkg" -o -name "*.exe" \) | wc -l)"
 
       - name: Create release
         uses: softprops/action-gh-release@v2
@@ -196,9 +226,9 @@ jobs:
           target_commitish: main
           generate_release_notes: true
           files: |
-            ./artifacts/**/*.zip
-            ./artifacts/**/*.pkg
-            ./artifacts/**/*.exe
+            ./artifacts/*.zip
+            ./artifacts/*.pkg
+            ./artifacts/*.exe
 
   # Summary job
   summary:

.github/workflows/test.yml

@@ -31,7 +31,7 @@ jobs:
       - name: Setup .NET
         uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: 9.0.x
+          dotnet-version: 10.0.x
 
       - name: Cache NuGet packages
         uses: actions/cache@v4
@@ -61,7 +61,7 @@ jobs:
 
       - name: Run tests
         id: run-tests
-        run: dotnet test code/backend/cleanuparr.sln --configuration Release --no-build --verbosity normal --logger trx --collect:"XPlat Code Coverage" --results-directory ./coverage
+        run: dotnet test code/backend/cleanuparr.sln --configuration Release --no-build --verbosity normal --logger trx --collect:"XPlat Code Coverage" --settings code/backend/coverage.runsettings --results-directory ./coverage
 
       - name: Upload test results
         uses: actions/upload-artifact@v4

CLAUDE.md

@@ -0,0 +1,350 @@
+# Cleanuparr - Claude AI Rules
+
+## 🚨 Critical Guidelines
+
+**READ THIS FIRST:**
+1. ⚠️ **DO NOT break existing functionality** - All features are critical and must continue to work
+2. ❓ **When in doubt, ASK** - Always clarify before implementing uncertain changes
+3. 📋 **Follow existing patterns** - Study the codebase style before making changes
+4. 🆕 **Ask before introducing new patterns** - Use current coding standards or get approval first
+
+## Project Overview
+
+Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, Lidarr, Readarr, Whisparr and supported download clients like qBittorrent, Transmission, Deluge, and µTorrent. It provides malware protection, automated cleanup, and queue management for *arr applications.
+
+**Key Features:**
+- Strike system for bad downloads
+- Malware detection and blocking
+- Automatic search triggering after removal
+- Orphaned download cleanup with cross-seed support
+- Support for multiple notification providers (Discord, etc.)
+
+## Architecture & Tech Stack
+
+### Backend
+- **.NET 10.0** (C#) with ASP.NET Core
+- **Architecture**: Clean Architecture pattern
+  - `Cleanuparr.Domain` - Domain models and business logic
+  - `Cleanuparr.Application` - Application services and use cases
+  - `Cleanuparr.Infrastructure` - External integrations (*arr apps, download clients)
+  - `Cleanuparr.Persistence` - Data access with EF Core (SQLite)
+  - `Cleanuparr.Api` - REST API and web host
+  - `Cleanuparr.Shared` - Shared utilities
+- **Database**: SQLite with Entity Framework Core 10.0
+  - Two separate contexts: `DataContext` and `EventsContext`
+- **Key Libraries**:
+  - MassTransit (messaging)
+  - Quartz.NET (scheduling)
+  - Serilog (logging)
+  - SignalR (real-time communication)
+
+### Frontend
+- **Angular 21** with TypeScript 5.9 (standalone components, zoneless, OnPush)
+- **UI**: Custom glassmorphism design system (no external UI frameworks)
+- **Icons**: @ng-icons/core + @ng-icons/tabler-icons
+- **Design System**: 3-layer SCSS (`_variables` → `_tokens` → `_themes`), dark/light themes
+- **State Management**: @ngrx/signals (Angular signals-based)
+- **Real-time Updates**: SignalR (@microsoft/signalr)
+- **PWA**: Service Worker support enabled
+
+### Documentation
+- **Docusaurus** (TypeScript-based static site)
+- Hosted at https://cleanuparr.github.io/Cleanuparr/
+
+### Deployment
+- **Docker** (primary distribution method)
+- Standalone executables for Windows, macOS, and Linux
+- Platform installers for Windows (.exe) and macOS (.pkg)
+
+## Development Setup
+
+### Prerequisites
+- .NET 10.0 SDK
+- Node.js 18+
+- Git
+- (Optional) Make for database migrations
+- (Optional) JetBrains Rider or Visual Studio
+
+### GitHub Packages Authentication
+Cleanuparr uses GitHub Packages for NuGet dependencies. Configure access:
+
+```bash
+dotnet nuget add source \
+  --username YOUR_GITHUB_USERNAME \
+  --password YOUR_GITHUB_PAT \
+  --store-password-in-clear-text \
+  --name Cleanuparr \
+  https://nuget.pkg.github.com/Cleanuparr/index.json
+```
+
+You need a GitHub PAT with `read:packages` permission.
+
+### Running the Backend
+```bash
+cd code/backend
+dotnet build Cleanuparr.Api/Cleanuparr.Api.csproj
+dotnet run --project Cleanuparr.Api/Cleanuparr.Api.csproj
+```
+API runs at http://localhost:5000
+
+### Running the Frontend
+```bash
+cd code/frontend
+npm install
+npm start
+```
+UI runs at http://localhost:4200
+
+### Running Tests
+```bash
+cd code/backend
+dotnet test
+```
+
+### Running Documentation
+```bash
+cd docs
+npm install
+npm start
+```
+Docs run at http://localhost:3000
+
+## Project Structure
+
+```
+Cleanuparr/
+├── code/
+│   ├── backend/
+│   │   ├── Cleanuparr.Api/           # API entry point
+│   │   ├── Cleanuparr.Application/   # Business logic layer
+│   │   ├── Cleanuparr.Domain/        # Domain models
+│   │   ├── Cleanuparr.Infrastructure/ # External integrations
+│   │   ├── Cleanuparr.Persistence/   # Database & EF Core
+│   │   ├── Cleanuparr.Shared/        # Shared utilities
+│   │   └── *.Tests/                  # Unit tests
+│   ├── frontend/                     # Angular 21 application
+│   ├── ui/                           # Built frontend assets
+│   ├── Dockerfile                    # Multi-stage Docker build
+│   ├── entrypoint.sh                 # Docker entrypoint
+│   └── Makefile                      # Build & migration helpers
+├── docs/                             # Docusaurus documentation
+├── Logo/                             # Branding assets
+├── .github/workflows/                # CI/CD pipelines
+├── blacklist                         # Default malware patterns
+├── blacklist_permissive              # Alternative blacklist
+├── whitelist                         # Safe file patterns
+└── CONTRIBUTING.md                   # Contribution guidelines
+```
+
+## Code Standards & Conventions
+
+**IMPORTANT:** Always study existing code in the relevant area before making changes. Match the existing style exactly.
+
+### Backend (C#)
+- Follow [Microsoft C# Coding Conventions](https://docs.microsoft.com/dotnet/csharp/fundamentals/coding-style/coding-conventions)
+- Use nullable reference types (`<Nullable>enable</Nullable>`)
+- Add XML documentation comments for public APIs
+- Write unit tests for business logic
+- Use meaningful names - avoid abbreviations unless widely understood
+- Keep services focused - single responsibility principle
+- **Study existing service implementations before creating new ones**
+
+### Frontend (TypeScript/Angular)
+- Follow [Angular Style Guide](https://angular.io/guide/styleguide)
+- Use TypeScript strict mode
+- All components must be **standalone** (no NgModules) with **ChangeDetectionStrategy.OnPush**
+- Use `input()` / `output()` function APIs (not `@Input()` / `@Output()` decorators)
+- Use Angular **signals** for reactive state (`signal()`, `computed()`, `effect()`)
+- Follow the 3-layer SCSS design system (`_variables` → `_tokens` → `_themes`) for styling
+- Component naming: `{feature}.component.ts`
+- Service naming: `{feature}.service.ts`
+- **Look at similar existing components before creating new ones**
+
+### Testing
+- Write unit tests for new features and bug fixes
+- Use descriptive test names that explain what is being tested
+- Backend: xUnit or NUnit conventions
+- Frontend: Jasmine/Karma
+- **Test that existing functionality still works after changes**
+
+### Git Commit Messages
+- Use clear, descriptive messages in imperative mood
+- Examples: "Add Discord notification support", "Fix memory leak in download client polling"
+- Reference issue numbers when applicable: "Fix #123: Handle null response from Radarr API"
+
+### Discovering Issues
+If you encounter potential gotchas, common mistakes, or areas that need special attention during development:
+- **Flag them to the maintainer immediately**
+- Document them if confirmed
+- Consider if they should be added to this guide
+
+## Database Migrations
+
+Cleanuparr uses two separate database contexts:
+- **DataContext**: Main application data
+- **EventsContext**: Event logging and audit trail
+
+### Creating Migrations
+From the `code` directory:
+
+```bash
+# Data migrations
+make migrate-data name=YourMigrationName
+
+# Events migrations
+make migrate-events name=YourMigrationName
+```
+
+Example:
+```bash
+make migrate-data name=AddDownloadClientConfig
+make migrate-events name=AddStrikeEvents
+```
+
+## Common Development Workflows
+
+### Adding a New *arr Application Integration
+1. Add integration in `Cleanuparr.Infrastructure/Arr/`
+2. Update domain models in `Cleanuparr.Domain/`
+3. Create/update services in `Cleanuparr.Application/`
+4. Add API endpoints in `Cleanuparr.Api/`
+5. Update frontend in `code/frontend/src/app/`
+6. Document in `docs/docs/`
+
+### Adding a New Download Client
+1. Add client implementation in `Cleanuparr.Infrastructure/DownloadClients/`
+2. Follow existing patterns (qBittorrent, Transmission, etc.)
+3. Add configuration models to `Cleanuparr.Domain/`
+4. Update API and frontend as above
+
+### Adding a New Notification Provider
+1. Add provider in `Cleanuparr.Infrastructure/Notifications/`
+2. Update configuration models
+3. Add UI configuration in frontend
+4. Test with actual service
+
+## Important Files
+
+### Configuration Files
+- `code/backend/Cleanuparr.Api/appsettings.json` - Backend configuration
+- `code/frontend/angular.json` - Angular build configuration
+- `code/Dockerfile` - Docker multi-stage build
+- `docs/docusaurus.config.ts` - Documentation site config
+
+### CI/CD Workflows
+- `.github/workflows/test.yml` - Run tests
+- `.github/workflows/build-docker.yml` - Build Docker images
+- `.github/workflows/build-executable.yml` - Build standalone executables
+- `.github/workflows/release.yml` - Create releases
+- `.github/workflows/docs.yml` - Deploy documentation
+
+### Malware Protection
+- `blacklist` - Default malware file patterns (strict)
+- `blacklist_permissive` - Less strict patterns
+- `whitelist` - Known safe file extensions
+- `whitelist_with_subtitles` - Includes subtitle formats
+
+## Contributing Guidelines
+
+### Before Starting Work
+1. **Announce your intent** - Comment on an issue or create a new one
+2. **Wait for approval** from maintainers
+3. Fork the repository and create a feature branch
+4. Make your changes following code standards
+5. Test thoroughly (both manual and automated tests)
+6. Submit a PR with clear description and testing notes
+
+### Pull Request Requirements
+- Link to related issue
+- Clear description of changes
+- Evidence of testing
+- Updated documentation if needed
+- No breaking changes without discussion
+
+## Docker Development
+
+### Build Local Docker Image
+```bash
+cd code
+docker build \
+  --build-arg PACKAGES_USERNAME=YOUR_GITHUB_USERNAME \
+  --build-arg PACKAGES_PAT=YOUR_GITHUB_PAT \
+  -t cleanuparr:local \
+  -f Dockerfile .
+```
+
+### Multi-Architecture Build
+```bash
+docker buildx build \
+  --platform linux/amd64,linux/arm64 \
+  --build-arg PACKAGES_USERNAME=YOUR_GITHUB_USERNAME \
+  --build-arg PACKAGES_PAT=YOUR_GITHUB_PAT \
+  -t cleanuparr:local \
+  -f Dockerfile .
+```
+
+## Environment Variables
+
+When running via Docker:
+- `PORT` - API port (default: 11011)
+- `PUID` - User ID for file permissions
+- `PGID` - Group ID for file permissions
+- `TZ` - Timezone (e.g., `America/New_York`)
+
+## Security & Safety
+
+- Never commit sensitive data (API keys, tokens, passwords)
+- All *arr and download client credentials are stored encrypted
+- The malware detection system uses pattern matching on file extensions and names
+- Always validate user input on both frontend and backend
+- Follow OWASP guidelines for web application security
+
+## Additional Resources
+
+- **Documentation**: https://cleanuparr.github.io/Cleanuparr/
+- **Discord**: https://discord.gg/SCtMCgtsc4
+- **GitHub Issues**: https://github.com/Cleanuparr/Cleanuparr/issues
+- **Releases**: https://github.com/Cleanuparr/Cleanuparr/releases
+
+## Working with Claude - IMPORTANT
+
+### Core Principles
+1. **When in doubt, ASK** - Don't assume, clarify with the maintainer first
+2. **Don't break existing functionality** - Everything is important and needs to work
+3. **Follow existing coding style** - Study the codebase patterns before making changes
+4. **Use current coding standards** - If you want to introduce something new, ask first
+
+### When Modifying Code
+- **ALWAYS read existing files before suggesting changes**
+- Understand the current architecture and patterns
+- Prefer editing existing files over creating new ones
+- Follow the established conventions in the codebase exactly
+- Test changes locally when possible
+- **If you're unsure about an approach, ask before implementing**
+
+### When Adding Features
+- Review similar existing features first to understand patterns
+- Maintain consistency with existing UI/UX patterns
+- Update both backend and frontend together
+- Add/update documentation
+- Consider backwards compatibility
+- **Ask about architectural decisions before implementing new patterns**
+
+### When Fixing Bugs
+- Understand the root cause before proposing a fix
+- **Be careful not to break other functionality** - test related areas
+- Add tests to prevent regression
+- Update relevant documentation if behavior changes
+- Consider if other parts of the codebase might have similar issues
+- **Flag any potential gotchas or issues you discover**
+
+## Notes
+
+- The project uses **Clean Architecture** - respect layer boundaries
+- Database migrations require both contexts - don't forget EventsContext
+- Frontend uses a **custom glassmorphism design system** - don't introduce external UI frameworks (no PrimeNG, Material, etc.)
+- All frontend components are **standalone** with **OnPush** change detection
+- All downloads from *arr apps are processed through a **strike system**
+- The malware blocker is a critical security feature - changes require careful testing
+- Cross-seed integration allows keeping torrents that are actively seeding
+- Real-time updates use **SignalR** - maintain websocket patterns when adding features

CONTRIBUTING.md

@@ -19,7 +19,7 @@ This helps us avoid redundant work, git conflicts, and contributions that may no
 
 ### Prerequisites
 
-- [.NET 9.0 SDK](https://dotnet.microsoft.com/download/dotnet/9.0)
+- [.NET 10.0 SDK](https://dotnet.microsoft.com/download/dotnet/10.0)
 - [Node.js 18+](https://nodejs.org/)
 - [Git](https://git-scm.com/)
 - (Optional) [Make](https://www.gnu.org/software/make/) for database migrations

README.md

@@ -28,20 +28,23 @@ Cleanuparr was created primarily to address malicious files, such as `*.lnk` or
 > - Notify on strike or download removal.
 > - Ignore certain torrent hashes, categories, tags or trackers from being processed by Cleanuparr.
 
+## Sponsored by GitAds
+[![Sponsored by GitAds](https://gitads.dev/v1/ad-serve?source=cleanuparr/cleanuparr@github)](https://gitads.dev/v1/ad-track?source=cleanuparr/cleanuparr@github)
+
 ## Screenshots
 
 https://cleanuparr.github.io/Cleanuparr/docs/screenshots
 
 ## 🎯 Supported Applications
 
-### *Arr Applications
+### *Arr Applications (latest version)
 - **Sonarr**
 - **Radarr**
 - **Lidarr**
 - **Readarr**
-- **Whisparr**
+- **Whisparr v2**
 
-### Download Clients
+### Download Clients (latest version)
 - **qBittorrent**
 - **Transmission**
 - **Deluge**
@@ -116,4 +119,4 @@ Special thanks for inspiration go to:
 # Buy me a coffee
 If I made your life just a tiny bit easier, consider buying me a coffee!
 
-<a href="https://buymeacoffee.com/flaminel" target="_blank"><img src="https://www.buymeacoffee.com/assets/img/custom_images/orange_img.png" alt="Buy Me A Coffee" style="height: 41px !important;width: 174px !important;box-shadow: 0px 3px 2px 0px rgba(190, 190, 190, 0.5) !important;-webkit-box-shadow: 0px 3px 2px 0px rgba(190, 190, 190, 0.5) !important;" ></a>
+<a href="https://buymeacoffee.com/flaminel" target="_blank"><img src="https://www.buymeacoffee.com/assets/img/custom_images/orange_img.png" alt="Buy Me A Coffee" style="height: 41px !important;width: 174px !important;box-shadow: 0px 3px 2px 0px rgba(190, 190, 190, 0.5) !important;-webkit-box-shadow: 0px 3px 2px 0px rgba(190, 190, 190, 0.5) !important;" ></a>

code/.dockerignore

@@ -38,4 +38,50 @@ backend/**/Tests/
 
 # Development files
 docker-compose*.yml
-test/ 
+test/ 
+
+# ================================
+# Node and build output
+# ================================
+node_modules
+dist
+out-tsc
+.angular
+.cache
+.tmp
+
+# ================================
+# Testing & Coverage
+# ================================
+coverage
+jest
+cypress
+cypress/screenshots
+cypress/videos
+reports
+playwright-report
+.vite
+.vitepress
+
+# ================================
+# Environment & log files
+# ================================
+*.env*
+!*.env.production
+*.log
+*.tsbuildinfo
+
+# ================================
+# Docker & local orchestration
+# ================================
+Dockerfile
+Dockerfile.*
+.dockerignore
+docker-compose.yml
+docker-compose*.yml
+
+# ================================
+# Miscellaneous
+# ================================
+*.bak
+*.old

code/Dockerfile

@@ -1,5 +1,5 @@
 # Build Angular frontend
-FROM --platform=$BUILDPLATFORM node:24-alpine AS frontend-build
+FROM --platform=$BUILDPLATFORM node:25-alpine AS frontend-build
 WORKDIR /app
 
 # Copy package files first for better layer caching
@@ -15,7 +15,7 @@ COPY frontend/ .
 RUN npm run build
 
 # Build .NET backend
-FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:9.0-bookworm-slim AS build
+FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:10.0 AS build
 ARG TARGETARCH
 ARG VERSION=0.0.1
 ARG PACKAGES_USERNAME
@@ -23,10 +23,6 @@ ARG PACKAGES_PAT
 WORKDIR /app
 EXPOSE 11011
 
-# Copy solution and project files first for better layer caching
-# COPY backend/*.sln ./backend/
-# COPY backend/*/*.csproj ./backend/*/
-
 # Copy source code
 COPY backend/ ./backend/
 
@@ -46,15 +42,23 @@ RUN --mount=type=cache,target=/root/.nuget/packages,sharing=locked \
     /p:DebugSymbols=false
 
 # Runtime stage
-FROM mcr.microsoft.com/dotnet/aspnet:9.0-bookworm-slim
+FROM mcr.microsoft.com/dotnet/aspnet:10.0
 
-# Install required packages for user management and timezone support
-RUN apt-get update && apt-get install -y \
+# Install required packages for user management, timezone support, and Python for Apprise CLI
+RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
     tzdata \
     gosu \
+    python3 \
+    python3-venv \
     && rm -rf /var/lib/apt/lists/*
 
+# Create virtual environment and install Apprise CLI
+ENV VIRTUAL_ENV=/opt/apprise-venv
+RUN python3 -m venv $VIRTUAL_ENV
+ENV PATH="$VIRTUAL_ENV/bin:$PATH"
+RUN pip install --no-cache-dir apprise==1.9.6
+
 ENV PUID=1000 \
     PGID=1000 \
     UMASK=022 \

code/Makefile

@@ -13,4 +13,30 @@ migrate-events:
 ifndef name
 	$(error name is required. Usage: make migrate-events name=YourMigrationName)
 endif
-	dotnet ef migrations add $(name) --context EventsContext --project backend/Cleanuparr.Persistence/Cleanuparr.Persistence.csproj --startup-project backend/Cleanuparr.Api/Cleanuparr.Api.csproj --output-dir Migrations/Events
+	dotnet ef migrations add $(name) --context EventsContext --project backend/Cleanuparr.Persistence/Cleanuparr.Persistence.csproj --startup-project backend/Cleanuparr.Api/Cleanuparr.Api.csproj --output-dir Migrations/Events
+
+migrate-users:
+ifndef name
+	$(error name is required. Usage: make migrate-users name=YourMigrationName)
+endif
+	dotnet ef migrations add $(name) --context UsersContext --project backend/Cleanuparr.Persistence/Cleanuparr.Persistence.csproj --startup-project backend/Cleanuparr.Api/Cleanuparr.Api.csproj --output-dir Migrations/Users
+
+docker-build:
+ifndef tag
+	$(error tag is required. Usage: make docker-build tag=latest version=1.0.0 user=... pat=...)
+endif
+ifndef version
+	$(error version is required. Usage: make docker-build tag=latest version=1.0.0 user=... pat=...)
+endif
+ifndef user
+	$(error user is required. Usage: make docker-build tag=latest version=1.0.0 user=... pat=...)
+endif
+ifndef pat
+	$(error pat is required. Usage: make docker-build tag=latest version=1.0.0 user=... pat=...)
+endif
+	DOCKER_BUILDKIT=1 docker build \
+		--build-arg VERSION=$(version) \
+		--build-arg PACKAGES_USERNAME=$(user) \
+		--build-arg PACKAGES_PAT=$(pat) \
+		-t cleanuparr:$(tag) \
+		.

code/backend/Cleanuparr.Api.Tests/Cleanuparr.Api.Tests.csproj

@@ -0,0 +1,27 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="coverlet.collector" Version="6.0.4" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="Shouldly" Version="4.3.0" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Using Include="Xunit" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\Cleanuparr.Api\Cleanuparr.Api.csproj" />
+  </ItemGroup>
+
+</Project>

code/backend/Cleanuparr.Api.Tests/CustomWebApplicationFactory.cs

@@ -0,0 +1,61 @@
+using Cleanuparr.Persistence;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Mvc.Testing;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Cleanuparr.Api.Tests;
+
+/// <summary>
+/// Custom WebApplicationFactory that uses an isolated SQLite database for each test fixture.
+/// The database file is created in a temp directory so both DI and static contexts share the same data.
+/// </summary>
+public class CustomWebApplicationFactory : WebApplicationFactory<Program>
+{
+    private readonly string _tempDir;
+
+    public CustomWebApplicationFactory()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), $"cleanuparr-test-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(_tempDir);
+    }
+
+    protected override void ConfigureWebHost(IWebHostBuilder builder)
+    {
+        builder.UseEnvironment("Testing");
+
+        builder.ConfigureServices(services =>
+        {
+            // Remove the existing UsersContext registration
+            var descriptor = services.SingleOrDefault(d => d.ServiceType == typeof(DbContextOptions<UsersContext>));
+            if (descriptor != null) services.Remove(descriptor);
+
+            // Also remove the DbContext registration itself
+            var contextDescriptor = services.SingleOrDefault(d => d.ServiceType == typeof(UsersContext));
+            if (contextDescriptor != null) services.Remove(contextDescriptor);
+
+            var dbPath = Path.Combine(_tempDir, "users.db");
+
+            services.AddDbContext<UsersContext>(options =>
+            {
+                options.UseSqlite($"Data Source={dbPath}");
+            });
+
+            // Ensure DB is created
+            var sp = services.BuildServiceProvider();
+            using var scope = sp.CreateScope();
+            var db = scope.ServiceProvider.GetRequiredService<UsersContext>();
+            db.Database.EnsureCreated();
+        });
+    }
+
+    protected override void Dispose(bool disposing)
+    {
+        base.Dispose(disposing);
+
+        if (disposing && Directory.Exists(_tempDir))
+        {
+            try { Directory.Delete(_tempDir, true); } catch { /* best effort cleanup */ }
+        }
+    }
+}

code/backend/Cleanuparr.Api.Tests/Features/Auth/AuthControllerTests.cs

@@ -0,0 +1,232 @@
+using System.Net;
+using System.Net.Http.Json;
+using System.Text.Json;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features.Auth;
+
+/// <summary>
+/// Integration tests for the authentication flow.
+/// Uses a single shared factory to avoid static state conflicts.
+/// Tests are ordered to build on each other: setup → login → protected endpoints.
+/// </summary>
+[TestCaseOrderer("Cleanuparr.Api.Tests.PriorityOrderer", "Cleanuparr.Api.Tests")]
+public class AuthControllerTests : IClassFixture<CustomWebApplicationFactory>
+{
+    private readonly HttpClient _client;
+
+    public AuthControllerTests(CustomWebApplicationFactory factory)
+    {
+        _client = factory.CreateClient();
+    }
+
+    [Fact, TestPriority(0)]
+    public async Task GetStatus_BeforeSetup_ReturnsNotCompleted()
+    {
+        var response = await _client.GetAsync("/api/auth/status");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("setupCompleted").GetBoolean().ShouldBeFalse();
+    }
+
+    [Fact, TestPriority(1)]
+    public async Task Setup_CreateAccount_ReturnsCreated()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/account", new
+        {
+            username = "admin",
+            password = "TestPassword123!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Created);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("userId").GetString().ShouldNotBeNullOrEmpty();
+    }
+
+    [Fact, TestPriority(2)]
+    public async Task Setup_CreateDuplicateAccount_ReturnsConflict()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/account", new
+        {
+            username = "another",
+            password = "TestPassword123!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Conflict);
+    }
+
+    [Fact, TestPriority(3)]
+    public async Task Setup_Generate2FA_ReturnsSecretAndRecoveryCodes()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/2fa/generate", new { });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("secret").GetString().ShouldNotBeNullOrEmpty();
+        body.GetProperty("qrCodeUri").GetString().ShouldNotBeNullOrEmpty();
+        body.GetProperty("recoveryCodes").GetArrayLength().ShouldBeGreaterThan(0);
+
+        // Store the secret for the next test
+        _totpSecret = body.GetProperty("secret").GetString()!;
+    }
+
+    [Fact, TestPriority(4)]
+    public async Task Setup_Verify2FA_WithValidCode_Succeeds()
+    {
+        // If we don't have the secret from the previous test, generate it again
+        if (string.IsNullOrEmpty(_totpSecret))
+        {
+            var genResponse = await _client.PostAsJsonAsync("/api/auth/setup/2fa/generate", new { });
+            var genBody = await genResponse.Content.ReadFromJsonAsync<JsonElement>();
+            _totpSecret = genBody.GetProperty("secret").GetString()!;
+        }
+
+        var code = GenerateTotpCode(_totpSecret);
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/2fa/verify", new { code });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+    }
+
+    [Fact, TestPriority(5)]
+    public async Task Setup_Complete_Succeeds()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/complete", new { });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+    }
+
+    [Fact, TestPriority(6)]
+    public async Task Login_ValidCredentials_RequiresTwoFactor()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "admin",
+            password = "TestPassword123!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("requiresTwoFactor").GetBoolean().ShouldBeTrue();
+        body.GetProperty("loginToken").GetString().ShouldNotBeNullOrEmpty();
+    }
+
+    [Fact, TestPriority(7)]
+    public async Task Login_InvalidCredentials_ReturnsUnauthorized()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "admin",
+            password = "WrongPassword!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Unauthorized);
+    }
+
+    [Fact, TestPriority(8)]
+    public async Task Login_BruteForce_ReturnsRetryAfter()
+    {
+        // Make multiple failed attempts
+        for (int i = 0; i < 3; i++)
+        {
+            await _client.PostAsJsonAsync("/api/auth/login", new
+            {
+                username = "admin",
+                password = "WrongPassword!"
+            });
+        }
+
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "admin",
+            password = "WrongPassword!"
+        });
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+
+        if (response.StatusCode == HttpStatusCode.TooManyRequests)
+        {
+            body.GetProperty("retryAfterSeconds").GetInt32().ShouldBeGreaterThan(0);
+        }
+        else
+        {
+            response.StatusCode.ShouldBe(HttpStatusCode.Unauthorized);
+            body.TryGetProperty("retryAfterSeconds", out var retry).ShouldBeTrue();
+            retry.GetInt32().ShouldBeGreaterThan(0);
+        }
+    }
+
+    [Fact, TestPriority(9)]
+    public async Task ProtectedEndpoint_WithoutAuth_DeniesAccess()
+    {
+        var response = await _client.GetAsync("/api/account");
+
+        // 401 (FallbackPolicy) or 403 (SetupGuardMiddleware) - both deny unauthenticated access
+        new[] { HttpStatusCode.Unauthorized, HttpStatusCode.Forbidden }
+            .ShouldContain(response.StatusCode);
+    }
+
+    [Fact, TestPriority(10)]
+    public async Task HealthEndpoint_WithoutAuth_Returns200()
+    {
+        var response = await _client.GetAsync("/health");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+    }
+
+    #region TOTP helpers
+
+    private static string _totpSecret = "";
+
+    private static string GenerateTotpCode(string base32Secret)
+    {
+        var key = Base32Decode(base32Secret);
+        var timestep = (long)(DateTime.UtcNow - DateTime.UnixEpoch).TotalSeconds / 30;
+        var timestepBytes = BitConverter.GetBytes(timestep);
+
+        if (BitConverter.IsLittleEndian)
+            Array.Reverse(timestepBytes);
+
+        using var hmac = new System.Security.Cryptography.HMACSHA1(key);
+        var hash = hmac.ComputeHash(timestepBytes);
+
+        var offset = hash[^1] & 0x0F;
+        var binaryCode =
+            ((hash[offset] & 0x7F) << 24) |
+            ((hash[offset + 1] & 0xFF) << 16) |
+            ((hash[offset + 2] & 0xFF) << 8) |
+            (hash[offset + 3] & 0xFF);
+
+        return (binaryCode % 1_000_000).ToString("D6");
+    }
+
+    private static byte[] Base32Decode(string base32)
+    {
+        const string alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+        base32 = base32.ToUpperInvariant().TrimEnd('=');
+
+        var bits = new List<byte>();
+        foreach (var c in base32)
+        {
+            var val = alphabet.IndexOf(c);
+            if (val < 0) continue;
+            for (var i = 4; i >= 0; i--)
+                bits.Add((byte)((val >> i) & 1));
+        }
+
+        var bytes = new byte[bits.Count / 8];
+        for (var i = 0; i < bytes.Length; i++)
+        {
+            for (var j = 0; j < 8; j++)
+                bytes[i] = (byte)((bytes[i] << 1) | bits[i * 8 + j]);
+        }
+
+        return bytes;
+    }
+
+    #endregion
+}

code/backend/Cleanuparr.Api.Tests/PriorityOrderer.cs

@@ -0,0 +1,37 @@
+using Xunit.Abstractions;
+using Xunit.Sdk;
+
+namespace Cleanuparr.Api.Tests;
+
+public sealed class PriorityOrderer : ITestCaseOrderer
+{
+    public IEnumerable<TTestCase> OrderTestCases<TTestCase>(IEnumerable<TTestCase> testCases)
+        where TTestCase : ITestCase
+    {
+        var sortedMethods = new SortedDictionary<int, List<TTestCase>>();
+
+        foreach (var testCase in testCases)
+        {
+            var priority = testCase.TestMethod.Method
+                .GetCustomAttributes(typeof(TestPriorityAttribute).AssemblyQualifiedName)
+                .FirstOrDefault()
+                ?.GetNamedArgument<int>("Priority") ?? 0;
+
+            if (!sortedMethods.TryGetValue(priority, out var list))
+            {
+                list = [];
+                sortedMethods[priority] = list;
+            }
+
+            list.Add(testCase);
+        }
+
+        foreach (var list in sortedMethods.Values)
+        {
+            foreach (var testCase in list)
+            {
+                yield return testCase;
+            }
+        }
+    }
+}

code/backend/Cleanuparr.Api.Tests/TestPriorityAttribute.cs

@@ -0,0 +1,12 @@
+namespace Cleanuparr.Api.Tests;
+
+[AttributeUsage(AttributeTargets.Method)]
+public sealed class TestPriorityAttribute : Attribute
+{
+    public int Priority { get; }
+
+    public TestPriorityAttribute(int priority)
+    {
+        Priority = priority;
+    }
+}

code/backend/Cleanuparr.Api/Auth/ApiKeyAuthenticationHandler.cs

@@ -0,0 +1,69 @@
+using System.Security.Claims;
+using System.Text.Encodings.Web;
+using Cleanuparr.Persistence;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Options;
+
+namespace Cleanuparr.Api.Auth;
+
+public static class ApiKeyAuthenticationDefaults
+{
+    public const string AuthenticationScheme = "ApiKey";
+    public const string HeaderName = "X-Api-Key";
+    public const string QueryParameterName = "apikey";
+}
+
+public class ApiKeyAuthenticationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
+{
+    public ApiKeyAuthenticationHandler(
+        IOptionsMonitor<AuthenticationSchemeOptions> options,
+        ILoggerFactory logger,
+        UrlEncoder encoder)
+        : base(options, logger, encoder)
+    {
+    }
+
+    protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
+    {
+        // Try header first, then query string
+        string? apiKey = null;
+
+        if (Request.Headers.TryGetValue(ApiKeyAuthenticationDefaults.HeaderName, out var headerValue))
+        {
+            apiKey = headerValue.ToString();
+        }
+        else if (Request.Query.TryGetValue(ApiKeyAuthenticationDefaults.QueryParameterName, out var queryValue))
+        {
+            apiKey = queryValue.ToString();
+        }
+
+        if (string.IsNullOrWhiteSpace(apiKey))
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        await using var usersContext = UsersContext.CreateStaticInstance();
+        var user = await usersContext.Users
+            .AsNoTracking()
+            .FirstOrDefaultAsync(u => u.ApiKey == apiKey && u.SetupCompleted);
+
+        if (user is null)
+        {
+            return AuthenticateResult.Fail("Invalid API key");
+        }
+
+        var claims = new[]
+        {
+            new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
+            new Claim(ClaimTypes.Name, user.Username),
+            new Claim("auth_method", "apikey")
+        };
+
+        var identity = new ClaimsIdentity(claims, ApiKeyAuthenticationDefaults.AuthenticationScheme);
+        var principal = new ClaimsPrincipal(identity);
+        var ticket = new AuthenticationTicket(principal, ApiKeyAuthenticationDefaults.AuthenticationScheme);
+
+        return AuthenticateResult.Success(ticket);
+    }
+}

code/backend/Cleanuparr.Api/Cleanuparr.Api.csproj

@@ -3,7 +3,7 @@
     <PropertyGroup>
         <AssemblyName>Cleanuparr</AssemblyName>
         <Version Condition="'$(Version)' == ''">0.0.1</Version>
-        <TargetFramework>net9.0</TargetFramework>
+        <TargetFramework>net10.0</TargetFramework>
         <Nullable>enable</Nullable>
         <ImplicitUsings>enable</ImplicitUsings>
         <PublishReadyToRun>true</PublishReadyToRun>
@@ -24,14 +24,15 @@
 
     <ItemGroup>
         <PackageReference Include="MassTransit" Version="8.5.7" />
-        <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="9.0.6">
+        <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.1" />
+        <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.1">
           <PrivateAssets>all</PrivateAssets>
           <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
         </PackageReference>
-        <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.0" />
-        <PackageReference Include="Microsoft.Extensions.Hosting.WindowsServices" Version="10.0.0" />
-        <PackageReference Include="Microsoft.Extensions.Http" Version="10.0.0" />
-        <PackageReference Include="Microsoft.Extensions.Http.Polly" Version="10.0.0" />
+        <PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.1" />
+        <PackageReference Include="Microsoft.Extensions.Hosting.WindowsServices" Version="10.0.1" />
+        <PackageReference Include="Microsoft.Extensions.Http" Version="10.0.1" />
+        <PackageReference Include="Microsoft.Extensions.Http.Polly" Version="10.0.1" />
         <PackageReference Include="Quartz" Version="3.15.1" />
         <PackageReference Include="Quartz.Extensions.DependencyInjection" Version="3.15.1" />
         <PackageReference Include="Quartz.Extensions.Hosting" Version="3.15.1" />

code/backend/Cleanuparr.Api/Controllers/EventsController.cs

@@ -29,12 +29,24 @@ public class EventsController : ControllerBase
         [FromQuery] string? eventType = null,
         [FromQuery] DateTime? fromDate = null,
         [FromQuery] DateTime? toDate = null,
-        [FromQuery] string? search = null)
+        [FromQuery] string? search = null,
+        [FromQuery] string? jobRunId = null)
     {
         // Validate pagination parameters
-        if (page < 1) page = 1;
-        if (pageSize < 1) pageSize = 100;
-        if (pageSize > 1000) pageSize = 1000; // Cap at 1000 for performance
+        if (page < 1)
+        {
+            page = 1;
+        }
+
+        if (pageSize < 1)
+        {
+            pageSize = 100;
+        }
+        
+        if (pageSize > 1000)
+        {
+            pageSize = 1000; // Cap at 1000 for performance
+        }
         
         var query = _context.Events.AsQueryable();
 
@@ -62,6 +74,12 @@ public class EventsController : ControllerBase
             query = query.Where(e => e.Timestamp <= toDate.Value);
         }
 
+        // Apply job run ID exact-match filter
+        if (!string.IsNullOrWhiteSpace(jobRunId) && Guid.TryParse(jobRunId, out var jobRunGuid))
+        {
+            query = query.Where(e => e.JobRunId == jobRunGuid);
+        }
+
         // Apply search filter if provided
         if (!string.IsNullOrWhiteSpace(search))
         {
@@ -69,7 +87,10 @@ public class EventsController : ControllerBase
             query = query.Where(e =>
                 EF.Functions.Like(e.Message, pattern) ||
                 EF.Functions.Like(e.Data, pattern) ||
-                EF.Functions.Like(e.TrackingId.ToString(), pattern)
+                EF.Functions.Like(e.TrackingId.ToString(), pattern) ||
+                EF.Functions.Like(e.InstanceUrl, pattern) ||
+                EF.Functions.Like(e.DownloadClientName, pattern) ||
+                EF.Functions.Like(e.JobRunId.ToString(), pattern)
             );
         }
 

code/backend/Cleanuparr.Api/Controllers/JobsController.cs

@@ -1,4 +1,5 @@
 using Cleanuparr.Api.Models;
+using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Models;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;

code/backend/Cleanuparr.Api/Controllers/ManualEventsController.cs

@@ -66,7 +66,9 @@ public class ManualEventsController : ControllerBase
             string pattern = EventsContext.GetLikePattern(search);
             query = query.Where(e =>
                 EF.Functions.Like(e.Message, pattern) ||
-                EF.Functions.Like(e.Data, pattern)
+                EF.Functions.Like(e.Data, pattern) ||
+                EF.Functions.Like(e.InstanceUrl, pattern) ||
+                EF.Functions.Like(e.DownloadClientName, pattern)
             );
         }
 

code/backend/Cleanuparr.Api/Controllers/StatusController.cs

@@ -1,7 +1,6 @@
 using System.Diagnostics;
 using Cleanuparr.Domain.Enums;
-using Cleanuparr.Infrastructure.Features.Arr;
-using Cleanuparr.Infrastructure.Features.DownloadClient;
+using Cleanuparr.Infrastructure.Features.Arr.Interfaces;
 using Cleanuparr.Persistence;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
@@ -14,18 +13,15 @@ public class StatusController : ControllerBase
 {
     private readonly ILogger<StatusController> _logger;
     private readonly DataContext _dataContext;
-    private readonly DownloadServiceFactory _downloadServiceFactory;
-    private readonly ArrClientFactory _arrClientFactory;
+    private readonly IArrClientFactory _arrClientFactory;
 
     public StatusController(
         ILogger<StatusController> logger,
         DataContext dataContext,
-        DownloadServiceFactory downloadServiceFactory,
-        ArrClientFactory arrClientFactory)
+        IArrClientFactory arrClientFactory)
     {
         _logger = logger;
         _dataContext = dataContext;
-        _downloadServiceFactory = downloadServiceFactory;
         _arrClientFactory = arrClientFactory;
     }
 
@@ -178,8 +174,8 @@ public class StatusController : ControllerBase
             {
                 try
                 {
-                    var sonarrClient = _arrClientFactory.GetClient(InstanceType.Sonarr);
-                    await sonarrClient.TestConnectionAsync(instance);
+                    var sonarrClient = _arrClientFactory.GetClient(InstanceType.Sonarr, instance.Version);
+                    await sonarrClient.HealthCheckAsync(instance);
                     
                     sonarrStatus.Add(new
                     {
@@ -210,8 +206,8 @@ public class StatusController : ControllerBase
             {
                 try
                 {
-                    var radarrClient = _arrClientFactory.GetClient(InstanceType.Radarr);
-                    await radarrClient.TestConnectionAsync(instance);
+                    var radarrClient = _arrClientFactory.GetClient(InstanceType.Radarr, instance.Version);
+                    await radarrClient.HealthCheckAsync(instance);
                     
                     radarrStatus.Add(new
                     {
@@ -242,8 +238,8 @@ public class StatusController : ControllerBase
             {
                 try
                 {
-                    var lidarrClient = _arrClientFactory.GetClient(InstanceType.Lidarr);
-                    await lidarrClient.TestConnectionAsync(instance);
+                    var lidarrClient = _arrClientFactory.GetClient(InstanceType.Lidarr, instance.Version);
+                    await lidarrClient.HealthCheckAsync(instance);
                     
                     lidarrStatus.Add(new
                     {

code/backend/Cleanuparr.Api/Controllers/StrikesController.cs

@@ -0,0 +1,189 @@
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.State;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Api.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class StrikesController : ControllerBase
+{
+    private readonly EventsContext _context;
+
+    public StrikesController(EventsContext context)
+    {
+        _context = context;
+    }
+
+    /// <summary>
+    /// Gets download items with their strikes (grouped), with pagination and filtering
+    /// </summary>
+    [HttpGet]
+    public async Task<ActionResult<PaginatedResult<DownloadItemStrikesDto>>> GetStrikes(
+        [FromQuery] int page = 1,
+        [FromQuery] int pageSize = 50,
+        [FromQuery] string? search = null,
+        [FromQuery] string? type = null)
+    {
+        if (page < 1) page = 1;
+        if (pageSize < 1) pageSize = 50;
+        if (pageSize > 100) pageSize = 100;
+
+        var query = _context.DownloadItems
+            .Include(d => d.Strikes)
+            .Where(d => d.Strikes.Any());
+
+        // Filter by strike type: only show items that have strikes of this type
+        if (!string.IsNullOrWhiteSpace(type))
+        {
+            if (Enum.TryParse<StrikeType>(type, true, out var strikeType))
+                query = query.Where(d => d.Strikes.Any(s => s.Type == strikeType));
+        }
+
+        // Apply search filter on title or download hash
+        if (!string.IsNullOrWhiteSpace(search))
+        {
+            string pattern = EventsContext.GetLikePattern(search);
+            query = query.Where(d =>
+                EF.Functions.Like(d.Title, pattern) ||
+                EF.Functions.Like(d.DownloadId, pattern));
+        }
+
+        var totalCount = await query.CountAsync();
+        var totalPages = (int)Math.Ceiling(totalCount / (double)pageSize);
+        var skip = (page - 1) * pageSize;
+
+        var items = await query
+            .OrderByDescending(d => d.Strikes.Max(s => s.CreatedAt))
+            .Skip(skip)
+            .Take(pageSize)
+            .ToListAsync();
+
+        var dtos = items.Select(d => new DownloadItemStrikesDto
+        {
+            DownloadItemId = d.Id,
+            DownloadId = d.DownloadId,
+            Title = d.Title,
+            TotalStrikes = d.Strikes.Count,
+            StrikesByType = d.Strikes
+                .GroupBy(s => s.Type)
+                .ToDictionary(g => g.Key.ToString(), g => g.Count()),
+            LatestStrikeAt = d.Strikes.Max(s => s.CreatedAt),
+            FirstStrikeAt = d.Strikes.Min(s => s.CreatedAt),
+            IsMarkedForRemoval = d.IsMarkedForRemoval,
+            IsRemoved = d.IsRemoved,
+            IsReturning = d.IsReturning,
+            Strikes = d.Strikes
+                .OrderByDescending(s => s.CreatedAt)
+                .Select(s => new StrikeDetailDto
+                {
+                    Id = s.Id,
+                    Type = s.Type.ToString(),
+                    CreatedAt = s.CreatedAt,
+                    LastDownloadedBytes = s.LastDownloadedBytes,
+                    JobRunId = s.JobRunId,
+                }).ToList(),
+        }).ToList();
+
+        return Ok(new PaginatedResult<DownloadItemStrikesDto>
+        {
+            Items = dtos,
+            Page = page,
+            PageSize = pageSize,
+            TotalCount = totalCount,
+            TotalPages = totalPages,
+        });
+    }
+
+    /// <summary>
+    /// Gets the most recent individual strikes with download item info (for dashboard)
+    /// </summary>
+    [HttpGet("recent")]
+    public async Task<ActionResult<List<RecentStrikeDto>>> GetRecentStrikes(
+        [FromQuery] int count = 5)
+    {
+        if (count < 1) count = 1;
+        if (count > 50) count = 50;
+
+        var strikes = await _context.Strikes
+            .Include(s => s.DownloadItem)
+            .OrderByDescending(s => s.CreatedAt)
+            .Take(count)
+            .Select(s => new RecentStrikeDto
+            {
+                Id = s.Id,
+                Type = s.Type.ToString(),
+                CreatedAt = s.CreatedAt,
+                DownloadId = s.DownloadItem.DownloadId,
+                Title = s.DownloadItem.Title,
+            })
+            .ToListAsync();
+
+        return Ok(strikes);
+    }
+
+    /// <summary>
+    /// Gets all available strike types
+    /// </summary>
+    [HttpGet("types")]
+    public ActionResult<List<string>> GetStrikeTypes()
+    {
+        var types = Enum.GetNames(typeof(StrikeType)).ToList();
+        return Ok(types);
+    }
+
+    /// <summary>
+    /// Deletes all strikes for a specific download item
+    /// </summary>
+    [HttpDelete("{downloadItemId:guid}")]
+    public async Task<IActionResult> DeleteStrikesForItem(Guid downloadItemId)
+    {
+        var item = await _context.DownloadItems
+            .Include(d => d.Strikes)
+            .FirstOrDefaultAsync(d => d.Id == downloadItemId);
+
+        if (item == null)
+            return NotFound();
+
+        _context.Strikes.RemoveRange(item.Strikes);
+        _context.DownloadItems.Remove(item);
+        await _context.SaveChangesAsync();
+
+        return NoContent();
+    }
+}
+
+public class DownloadItemStrikesDto
+{
+    public Guid DownloadItemId { get; set; }
+    public string DownloadId { get; set; } = string.Empty;
+    public string Title { get; set; } = string.Empty;
+    public int TotalStrikes { get; set; }
+    public Dictionary<string, int> StrikesByType { get; set; } = new();
+    public DateTime LatestStrikeAt { get; set; }
+    public DateTime FirstStrikeAt { get; set; }
+    public bool IsMarkedForRemoval { get; set; }
+    public bool IsRemoved { get; set; }
+    public bool IsReturning { get; set; }
+    public List<StrikeDetailDto> Strikes { get; set; } = [];
+}
+
+public class StrikeDetailDto
+{
+    public Guid Id { get; set; }
+    public string Type { get; set; } = string.Empty;
+    public DateTime CreatedAt { get; set; }
+    public long? LastDownloadedBytes { get; set; }
+    public Guid JobRunId { get; set; }
+}
+
+public class RecentStrikeDto
+{
+    public Guid Id { get; set; }
+    public string Type { get; set; } = string.Empty;
+    public DateTime CreatedAt { get; set; }
+    public string DownloadId { get; set; } = string.Empty;
+    public string Title { get; set; } = string.Empty;
+}

code/backend/Cleanuparr.Api/DependencyInjection/ApiDI.cs

@@ -65,9 +65,13 @@ public static class ApiDI
         // Add the global exception handling middleware first
         app.UseMiddleware<ExceptionMiddleware>();
 
+        // Block non-auth requests until setup is complete
+        app.UseMiddleware<SetupGuardMiddleware>();
+
         app.UseCors("Any");
         app.UseRouting();
 
+        app.UseAuthentication();
         app.UseAuthorization();
         app.MapControllers();
         
@@ -108,11 +112,11 @@ public static class ApiDI
             
             context.Response.ContentType = "text/html";
             await context.Response.WriteAsync(indexContent, Encoding.UTF8);
-        });
+        }).AllowAnonymous();
         
         // Map SignalR hubs
-        app.MapHub<HealthStatusHub>("/api/hubs/health");
-        app.MapHub<AppHub>("/api/hubs/app");
+        app.MapHub<HealthStatusHub>("/api/hubs/health").RequireAuthorization();
+        app.MapHub<AppHub>("/api/hubs/app").RequireAuthorization();
         
         app.MapGet("/manifest.webmanifest", (HttpContext context) =>
         {
@@ -144,7 +148,7 @@ public static class ApiDI
             };
 
             return Results.Json(manifest, contentType: "application/manifest+json");
-        });
+        }).AllowAnonymous();
 
         return app;
     }

code/backend/Cleanuparr.Api/DependencyInjection/AuthDI.cs

@@ -0,0 +1,81 @@
+using Cleanuparr.Api.Auth;
+using Cleanuparr.Infrastructure.Features.Auth;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.IdentityModel.Tokens;
+
+namespace Cleanuparr.Api.DependencyInjection;
+
+public static class AuthDI
+{
+    private const string SmartScheme = "Smart";
+
+    public static IServiceCollection AddAuthServices(this IServiceCollection services)
+    {
+        // Get the signing key from the JwtService
+        var jwtService = new JwtService();
+        var signingKey = jwtService.GetOrCreateSigningKey();
+
+        services
+            .AddAuthentication(SmartScheme)
+            .AddPolicyScheme(SmartScheme, "JWT or API Key", options =>
+            {
+                // Route to the correct auth handler based on the request
+                options.ForwardDefaultSelector = context =>
+                {
+                    if (context.Request.Headers.ContainsKey(ApiKeyAuthenticationDefaults.HeaderName) ||
+                        context.Request.Query.ContainsKey(ApiKeyAuthenticationDefaults.QueryParameterName))
+                    {
+                        return ApiKeyAuthenticationDefaults.AuthenticationScheme;
+                    }
+
+                    return JwtBearerDefaults.AuthenticationScheme;
+                };
+            })
+            .AddJwtBearer(options =>
+            {
+                options.TokenValidationParameters = new TokenValidationParameters
+                {
+                    ValidateIssuer = true,
+                    ValidIssuer = "Cleanuparr",
+                    ValidateAudience = true,
+                    ValidAudience = "Cleanuparr",
+                    ValidateLifetime = true,
+                    ValidateIssuerSigningKey = true,
+                    IssuerSigningKey = new SymmetricSecurityKey(signingKey),
+                    ClockSkew = TimeSpan.FromSeconds(30)
+                };
+
+                // Support SignalR token via query string
+                options.Events = new JwtBearerEvents
+                {
+                    OnMessageReceived = context =>
+                    {
+                        var accessToken = context.Request.Query["access_token"];
+                        var path = context.HttpContext.Request.Path;
+
+                        if (!string.IsNullOrEmpty(accessToken) && path.StartsWithSegments("/api/hubs"))
+                        {
+                            context.Token = accessToken;
+                        }
+
+                        return Task.CompletedTask;
+                    }
+                };
+            })
+            .AddScheme<AuthenticationSchemeOptions, ApiKeyAuthenticationHandler>(
+                ApiKeyAuthenticationDefaults.AuthenticationScheme, _ => { });
+
+        services.AddAuthorization(options =>
+        {
+            var defaultPolicy = new Microsoft.AspNetCore.Authorization.AuthorizationPolicyBuilder()
+                .RequireAuthenticatedUser()
+                .Build();
+
+            options.DefaultPolicy = defaultPolicy;
+            options.FallbackPolicy = defaultPolicy;
+        });
+
+        return services;
+    }
+}

code/backend/Cleanuparr.Api/DependencyInjection/MainDI.cs

@@ -87,10 +87,13 @@ public static class MainDI
     {
         // Add the dynamic HTTP client system - this replaces all the previous static configurations
         services.AddDynamicHttpClients();
-        
+
         // Add the dynamic HTTP client provider that uses the new system
         services.AddSingleton<IDynamicHttpClientProvider, DynamicHttpClientProvider>();
-        
+
+        // Add HTTP client for Plex authentication
+        services.AddHttpClient("PlexAuth");
+
         return services;
     }
 

code/backend/Cleanuparr.Api/DependencyInjection/NotificationsDI.cs

@@ -1,7 +1,11 @@
 using Cleanuparr.Infrastructure.Features.Notifications;
 using Cleanuparr.Infrastructure.Features.Notifications.Apprise;
+using Cleanuparr.Infrastructure.Features.Notifications.Discord;
 using Cleanuparr.Infrastructure.Features.Notifications.Notifiarr;
 using Cleanuparr.Infrastructure.Features.Notifications.Ntfy;
+using Cleanuparr.Infrastructure.Features.Notifications.Pushover;
+using Cleanuparr.Infrastructure.Features.Notifications.Telegram;
+using Cleanuparr.Infrastructure.Features.Notifications.Gotify;
 
 namespace Cleanuparr.Api.DependencyInjection;
 
@@ -11,7 +15,13 @@ public static class NotificationsDI
         services
             .AddScoped<INotifiarrProxy, NotifiarrProxy>()
             .AddScoped<IAppriseProxy, AppriseProxy>()
+            .AddScoped<IAppriseCliProxy, AppriseCliProxy>()
+            .AddSingleton<IAppriseCliDetector, AppriseCliDetector>()
             .AddScoped<INtfyProxy, NtfyProxy>()
+            .AddScoped<IPushoverProxy, PushoverProxy>()
+            .AddScoped<ITelegramProxy, TelegramProxy>()
+            .AddScoped<IDiscordProxy, DiscordProxy>()
+            .AddScoped<IGotifyProxy, GotifyProxy>()
             .AddScoped<INotificationConfigurationService, NotificationConfigurationService>()
             .AddScoped<INotificationProviderFactory, NotificationProviderFactory>()
             .AddScoped<NotificationProviderFactory>()

code/backend/Cleanuparr.Api/DependencyInjection/ServicesDI.cs

@@ -1,5 +1,8 @@
 using Cleanuparr.Infrastructure.Events;
+using Cleanuparr.Infrastructure.Events.Interfaces;
 using Cleanuparr.Infrastructure.Features.Arr;
+using Cleanuparr.Infrastructure.Features.Arr.Interfaces;
+using Cleanuparr.Infrastructure.Features.Auth;
 using Cleanuparr.Infrastructure.Features.BlacklistSync;
 using Cleanuparr.Infrastructure.Features.DownloadClient;
 using Cleanuparr.Infrastructure.Features.DownloadHunter;
@@ -10,7 +13,6 @@ using Cleanuparr.Infrastructure.Features.Files;
 using Cleanuparr.Infrastructure.Features.ItemStriker;
 using Cleanuparr.Infrastructure.Features.Jobs;
 using Cleanuparr.Infrastructure.Features.MalwareBlocker;
-using Cleanuparr.Infrastructure.Features.Security;
 using Cleanuparr.Infrastructure.Helpers;
 using Cleanuparr.Infrastructure.Interceptors;
 using Cleanuparr.Infrastructure.Services;
@@ -23,20 +25,24 @@ public static class ServicesDI
 {
     public static IServiceCollection AddServices(this IServiceCollection services) =>
         services
-            .AddScoped<IEncryptionService, AesEncryptionService>()
-            .AddScoped<SensitiveDataJsonConverter>()
             .AddScoped<EventsContext>()
             .AddScoped<DataContext>()
-            .AddScoped<EventPublisher>()
+            .AddScoped<UsersContext>()
+            .AddSingleton<IJwtService, JwtService>()
+            .AddSingleton<IPasswordService, PasswordService>()
+            .AddSingleton<ITotpService, TotpService>()
+            .AddScoped<IPlexAuthService, PlexAuthService>()
+            .AddScoped<IEventPublisher, EventPublisher>()
             .AddHostedService<EventCleanupService>()
             .AddScoped<IDryRunInterceptor, DryRunInterceptor>()
             .AddScoped<CertificateValidationService>()
-            .AddScoped<SonarrClient>()
-            .AddScoped<RadarrClient>()
-            .AddScoped<LidarrClient>()
-            .AddScoped<ReadarrClient>()
-            .AddScoped<WhisparrClient>()
-            .AddScoped<ArrClientFactory>()
+            .AddScoped<ISonarrClient, SonarrClient>()
+            .AddScoped<IRadarrClient, RadarrClient>()
+            .AddScoped<ILidarrClient, LidarrClient>()
+            .AddScoped<IReadarrClient, ReadarrClient>()
+            .AddScoped<IWhisparrV2Client, WhisparrV2Client>()
+            .AddScoped<IWhisparrV3Client, WhisparrV3Client>()
+            .AddScoped<IArrClientFactory, ArrClientFactory>()
             .AddScoped<QueueCleaner>()
             .AddScoped<BlacklistSynchronizer>()
             .AddScoped<MalwareBlocker>()
@@ -45,17 +51,18 @@ public static class ServicesDI
             .AddScoped<IDownloadHunter, DownloadHunter>()
             .AddScoped<IFilenameEvaluator, FilenameEvaluator>()
             .AddScoped<IHardLinkFileService, HardLinkFileService>()
-            .AddScoped<UnixHardLinkFileService>()
-            .AddScoped<WindowsHardLinkFileService>()
-            .AddScoped<ArrQueueIterator>()
-            .AddScoped<DownloadServiceFactory>()
+            .AddScoped<IUnixHardLinkFileService, UnixHardLinkFileService>()
+            .AddScoped<IWindowsHardLinkFileService, WindowsHardLinkFileService>()
+            .AddScoped<IArrQueueIterator, ArrQueueIterator>()
+            .AddScoped<IDownloadServiceFactory, DownloadServiceFactory>()
             .AddScoped<IStriker, Striker>()
             .AddScoped<FileReader>()
             .AddScoped<IRuleManager, RuleManager>()
             .AddScoped<IRuleEvaluator, RuleEvaluator>()
             .AddScoped<IRuleIntervalValidator, RuleIntervalValidator>()
             .AddSingleton<IJobManagementService, JobManagementService>()
-            .AddSingleton<BlocklistProvider>()
+            .AddSingleton<IBlocklistProvider, BlocklistProvider>()
+            .AddSingleton(TimeProvider.System)
             .AddSingleton<AppStatusSnapshot>()
             .AddHostedService<AppStatusRefreshService>();
 }

code/backend/Cleanuparr.Api/Features/Arr/Contracts/Requests/ArrInstanceRequest.cs

@@ -18,13 +18,20 @@ public sealed record ArrInstanceRequest
     [Required]
     public required string ApiKey { get; init; }
 
+    [Required]
+    public required float Version { get; init; }
+
+    public string? ExternalUrl { get; init; }
+
     public ArrInstance ToEntity(Guid configId) => new()
     {
         Enabled = Enabled,
         Name = Name,
         Url = new Uri(Url),
+        ExternalUrl = ExternalUrl is not null ? new Uri(ExternalUrl) : null,
         ApiKey = ApiKey,
         ArrConfigId = configId,
+        Version = Version,
     };
 
     public void ApplyTo(ArrInstance instance)
@@ -32,6 +39,8 @@ public sealed record ArrInstanceRequest
         instance.Enabled = Enabled;
         instance.Name = Name;
         instance.Url = new Uri(Url);
+        instance.ExternalUrl = ExternalUrl is not null ? new Uri(ExternalUrl) : null;
         instance.ApiKey = ApiKey;
+        instance.Version = Version;
     }
 }

code/backend/Cleanuparr.Api/Features/Arr/Contracts/Requests/TestArrInstanceRequest.cs

@@ -0,0 +1,28 @@
+using System;
+using System.ComponentModel.DataAnnotations;
+
+using Cleanuparr.Persistence.Models.Configuration.Arr;
+
+namespace Cleanuparr.Api.Features.Arr.Contracts.Requests;
+
+public sealed record TestArrInstanceRequest
+{
+    [Required]
+    public required string Url { get; init; }
+
+    [Required]
+    public required string ApiKey { get; init; }
+    
+    [Required]
+    public required float Version { get; init; }
+
+    public ArrInstance ToTestInstance() => new()
+    {
+        Enabled = true,
+        Name = "Test Instance",
+        Url = new Uri(Url),
+        ApiKey = ApiKey,
+        ArrConfigId = Guid.Empty,
+        Version = Version,
+    };
+}

code/backend/Cleanuparr.Api/Features/Arr/Controllers/ArrConfigController.cs

@@ -1,16 +1,11 @@
-using System;
-using System.Linq;
-using System.Threading.Tasks;
-
 using Cleanuparr.Api.Features.Arr.Contracts.Requests;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Features.Arr.Dtos;
+using Cleanuparr.Infrastructure.Features.Arr.Interfaces;
 using Cleanuparr.Persistence;
-using Cleanuparr.Persistence.Models.Configuration.Arr;
 using Mapster;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
-using Microsoft.Extensions.Logging;
 
 namespace Cleanuparr.Api.Features.Arr.Controllers;
 
@@ -20,13 +15,16 @@ public sealed class ArrConfigController : ControllerBase
 {
     private readonly ILogger<ArrConfigController> _logger;
     private readonly DataContext _dataContext;
+    private readonly IArrClientFactory _arrClientFactory;
 
     public ArrConfigController(
         ILogger<ArrConfigController> logger,
-        DataContext dataContext)
+        DataContext dataContext,
+        IArrClientFactory arrClientFactory)
     {
         _logger = logger;
         _dataContext = dataContext;
+        _arrClientFactory = arrClientFactory;
     }
 
     [HttpGet("sonarr")]
@@ -124,6 +122,26 @@ public sealed class ArrConfigController : ControllerBase
     public Task<IActionResult> DeleteWhisparrInstance(Guid id)
         => DeleteArrInstance(InstanceType.Whisparr, id);
 
+    [HttpPost("sonarr/instances/test")]
+    public Task<IActionResult> TestSonarrInstance([FromBody] TestArrInstanceRequest request)
+        => TestArrInstance(InstanceType.Sonarr, request);
+
+    [HttpPost("radarr/instances/test")]
+    public Task<IActionResult> TestRadarrInstance([FromBody] TestArrInstanceRequest request)
+        => TestArrInstance(InstanceType.Radarr, request);
+
+    [HttpPost("lidarr/instances/test")]
+    public Task<IActionResult> TestLidarrInstance([FromBody] TestArrInstanceRequest request)
+        => TestArrInstance(InstanceType.Lidarr, request);
+
+    [HttpPost("readarr/instances/test")]
+    public Task<IActionResult> TestReadarrInstance([FromBody] TestArrInstanceRequest request)
+        => TestArrInstance(InstanceType.Readarr, request);
+
+    [HttpPost("whisparr/instances/test")]
+    public Task<IActionResult> TestWhisparrInstance([FromBody] TestArrInstanceRequest request)
+        => TestArrInstance(InstanceType.Whisparr, request);
+
     private async Task<IActionResult> GetArrConfig(InstanceType type)
     {
         await DataContext.Lock.WaitAsync();
@@ -260,6 +278,23 @@ public sealed class ArrConfigController : ControllerBase
         }
     }
 
+    private async Task<IActionResult> TestArrInstance(InstanceType type, TestArrInstanceRequest request)
+    {
+        try
+        {
+            var testInstance = request.ToTestInstance();
+            var client = _arrClientFactory.GetClient(type, request.Version);
+            await client.HealthCheckAsync(testInstance);
+
+            return Ok(new { Message = $"Connection to {type} instance successful" });
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to test {Type} instance connection", type);
+            return BadRequest(new { Message = $"Connection failed: {ex.Message}" });
+        }
+    }
+
     private static string GetConfigActionName(InstanceType type) => type switch
     {
         InstanceType.Sonarr => nameof(GetSonarrConfig),

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/ChangePasswordRequest.cs

@@ -0,0 +1,14 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record ChangePasswordRequest
+{
+    [Required]
+    public required string CurrentPassword { get; init; }
+
+    [Required]
+    [MinLength(8)]
+    [MaxLength(128)]
+    public required string NewPassword { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/CreateAccountRequest.cs

@@ -0,0 +1,16 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record CreateAccountRequest
+{
+    [Required]
+    [MinLength(3)]
+    [MaxLength(50)]
+    public required string Username { get; init; }
+
+    [Required]
+    [MinLength(8)]
+    [MaxLength(128)]
+    public required string Password { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/LoginRequest.cs

@@ -0,0 +1,12 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record LoginRequest
+{
+    [Required]
+    public required string Username { get; init; }
+
+    [Required]
+    public required string Password { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/PlexPinRequest.cs

@@ -0,0 +1,9 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record PlexPinRequest
+{
+    [Required]
+    public required int PinId { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/RefreshTokenRequest.cs

@@ -0,0 +1,9 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record RefreshTokenRequest
+{
+    [Required]
+    public required string RefreshToken { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/Regenerate2faRequest.cs

@@ -0,0 +1,13 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record Regenerate2faRequest
+{
+    [Required]
+    public required string Password { get; init; }
+
+    [Required]
+    [StringLength(6, MinimumLength = 6)]
+    public required string TotpCode { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/TwoFactorRequest.cs

@@ -0,0 +1,14 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record TwoFactorRequest
+{
+    [Required]
+    public required string LoginToken { get; init; }
+
+    [Required]
+    public required string Code { get; init; }
+
+    public bool IsRecoveryCode { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/VerifyTotpRequest.cs

@@ -0,0 +1,10 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record VerifyTotpRequest
+{
+    [Required]
+    [StringLength(6, MinimumLength = 6)]
+    public required string Code { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Responses/AccountInfoResponse.cs

@@ -0,0 +1,10 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record AccountInfoResponse
+{
+    public required string Username { get; init; }
+    public required bool PlexLinked { get; init; }
+    public string? PlexUsername { get; init; }
+    public required bool TwoFactorEnabled { get; init; }
+    public required string ApiKeyPreview { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Responses/AuthStatusResponse.cs

@@ -0,0 +1,7 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record AuthStatusResponse
+{
+    public required bool SetupCompleted { get; init; }
+    public bool PlexLinked { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Responses/LoginResponse.cs

@@ -0,0 +1,7 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record LoginResponse
+{
+    public required bool RequiresTwoFactor { get; init; }
+    public string? LoginToken { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Responses/PlexPinResponse.cs

@@ -0,0 +1,13 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record PlexPinStatusResponse
+{
+    public required int PinId { get; init; }
+    public required string AuthUrl { get; init; }
+}
+
+public sealed record PlexVerifyResponse
+{
+    public required bool Completed { get; init; }
+    public TokenResponse? Tokens { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Responses/TokenResponse.cs

@@ -0,0 +1,8 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record TokenResponse
+{
+    public required string AccessToken { get; init; }
+    public required string RefreshToken { get; init; }
+    public required int ExpiresIn { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Responses/TotpSetupResponse.cs

@@ -0,0 +1,8 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record TotpSetupResponse
+{
+    public required string Secret { get; init; }
+    public required string QrCodeUri { get; init; }
+    public required List<string> RecoveryCodes { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Controllers/AccountController.cs

@@ -0,0 +1,265 @@
+using System.Security.Claims;
+using System.Security.Cryptography;
+using Cleanuparr.Api.Features.Auth.Contracts.Requests;
+using Cleanuparr.Api.Features.Auth.Contracts.Responses;
+using Cleanuparr.Infrastructure.Features.Auth;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Auth;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Api.Features.Auth.Controllers;
+
+[ApiController]
+[Route("api/account")]
+[Authorize]
+public sealed class AccountController : ControllerBase
+{
+    private readonly UsersContext _usersContext;
+    private readonly IPasswordService _passwordService;
+    private readonly ITotpService _totpService;
+    private readonly IPlexAuthService _plexAuthService;
+    private readonly ILogger<AccountController> _logger;
+
+    public AccountController(
+        UsersContext usersContext,
+        IPasswordService passwordService,
+        ITotpService totpService,
+        IPlexAuthService plexAuthService,
+        ILogger<AccountController> logger)
+    {
+        _usersContext = usersContext;
+        _passwordService = passwordService;
+        _totpService = totpService;
+        _plexAuthService = plexAuthService;
+        _logger = logger;
+    }
+
+    [HttpGet]
+    public async Task<IActionResult> GetAccountInfo()
+    {
+        var user = await GetCurrentUser();
+        if (user is null) return Unauthorized();
+
+        return Ok(new AccountInfoResponse
+        {
+            Username = user.Username,
+            PlexLinked = user.PlexAccountId is not null,
+            PlexUsername = user.PlexUsername,
+            TwoFactorEnabled = user.TotpEnabled,
+            ApiKeyPreview = user.ApiKey[..8] + "..."
+        });
+    }
+
+    [HttpPut("password")]
+    public async Task<IActionResult> ChangePassword([FromBody] ChangePasswordRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser();
+            if (user is null) return Unauthorized();
+
+            if (!_passwordService.VerifyPassword(request.CurrentPassword, user.PasswordHash))
+            {
+                return BadRequest(new { error = "Current password is incorrect" });
+            }
+
+            user.PasswordHash = _passwordService.HashPassword(request.NewPassword);
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Password changed for user {Username}", user.Username);
+
+            return Ok(new { message = "Password changed" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("2fa/regenerate")]
+    public async Task<IActionResult> Regenerate2fa([FromBody] Regenerate2faRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser(includeRecoveryCodes: true);
+            if (user is null) return Unauthorized();
+
+            // Verify current credentials
+            if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash))
+            {
+                return BadRequest(new { error = "Incorrect password" });
+            }
+
+            if (!_totpService.ValidateCode(user.TotpSecret, request.TotpCode))
+            {
+                return BadRequest(new { error = "Invalid 2FA code" });
+            }
+
+            // Generate new TOTP
+            var secret = _totpService.GenerateSecret();
+            var qrUri = _totpService.GetQrCodeUri(secret, user.Username);
+            var recoveryCodes = _totpService.GenerateRecoveryCodes();
+
+            user.TotpSecret = secret;
+            user.UpdatedAt = DateTime.UtcNow;
+
+            // Replace recovery codes
+            _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
+
+            foreach (var code in recoveryCodes)
+            {
+                _usersContext.RecoveryCodes.Add(new RecoveryCode
+                {
+                    Id = Guid.NewGuid(),
+                    UserId = user.Id,
+                    CodeHash = _totpService.HashRecoveryCode(code),
+                    IsUsed = false
+                });
+            }
+
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("2FA regenerated for user {Username}", user.Username);
+
+            return Ok(new TotpSetupResponse
+            {
+                Secret = secret,
+                QrCodeUri = qrUri,
+                RecoveryCodes = recoveryCodes
+            });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpGet("api-key")]
+    public async Task<IActionResult> GetApiKey()
+    {
+        var user = await GetCurrentUser();
+        if (user is null) return Unauthorized();
+
+        return Ok(new { apiKey = user.ApiKey });
+    }
+
+    [HttpPost("api-key/regenerate")]
+    public async Task<IActionResult> RegenerateApiKey()
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser();
+            if (user is null) return Unauthorized();
+
+            var bytes = new byte[32];
+            using var rng = RandomNumberGenerator.Create();
+            rng.GetBytes(bytes);
+
+            user.ApiKey = Convert.ToHexString(bytes).ToLowerInvariant();
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("API key regenerated for user {Username}", user.Username);
+
+            return Ok(new { apiKey = user.ApiKey });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("plex/link")]
+    public async Task<IActionResult> StartPlexLink()
+    {
+        var pin = await _plexAuthService.RequestPin();
+
+        return Ok(new { pinId = pin.PinId, authUrl = pin.AuthUrl });
+    }
+
+    [HttpPost("plex/link/verify")]
+    public async Task<IActionResult> VerifyPlexLink([FromBody] PlexPinRequest request)
+    {
+        var pinResult = await _plexAuthService.CheckPin(request.PinId);
+
+        if (!pinResult.Completed || pinResult.AuthToken is null)
+        {
+            return Ok(new { completed = false });
+        }
+
+        var plexAccount = await _plexAuthService.GetAccount(pinResult.AuthToken);
+
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser();
+            if (user is null) return Unauthorized();
+
+            user.PlexAccountId = plexAccount.AccountId;
+            user.PlexUsername = plexAccount.Username;
+            user.PlexEmail = plexAccount.Email;
+            user.PlexAuthToken = pinResult.AuthToken;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Plex account linked for user {Username}: {PlexUsername}",
+                user.Username, plexAccount.Username);
+
+            return Ok(new { completed = true, plexUsername = plexAccount.Username });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpDelete("plex/link")]
+    public async Task<IActionResult> UnlinkPlex()
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser();
+            if (user is null) return Unauthorized();
+
+            user.PlexAccountId = null;
+            user.PlexUsername = null;
+            user.PlexEmail = null;
+            user.PlexAuthToken = null;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Plex account unlinked for user {Username}", user.Username);
+
+            return Ok(new { message = "Plex account unlinked" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    private async Task<User?> GetCurrentUser(bool includeRecoveryCodes = false)
+    {
+        var userIdClaim = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
+        if (userIdClaim is null || !Guid.TryParse(userIdClaim, out var userId))
+        {
+            return null;
+        }
+
+        var query = _usersContext.Users.AsQueryable();
+
+        if (includeRecoveryCodes)
+        {
+            query = query.Include(u => u.RecoveryCodes);
+        }
+
+        return await query.FirstOrDefaultAsync(u => u.Id == userId);
+    }
+}

code/backend/Cleanuparr.Api/Features/Auth/Controllers/AuthController.cs

@@ -0,0 +1,561 @@
+using System.Security.Cryptography;
+using Cleanuparr.Api.Features.Auth.Contracts.Requests;
+using Cleanuparr.Api.Features.Auth.Contracts.Responses;
+using Cleanuparr.Infrastructure.Features.Auth;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Auth;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Api.Features.Auth.Controllers;
+
+[ApiController]
+[Route("api/auth")]
+[AllowAnonymous]
+public sealed class AuthController : ControllerBase
+{
+    private readonly UsersContext _usersContext;
+    private readonly IJwtService _jwtService;
+    private readonly IPasswordService _passwordService;
+    private readonly ITotpService _totpService;
+    private readonly IPlexAuthService _plexAuthService;
+    private readonly ILogger<AuthController> _logger;
+
+    public AuthController(
+        UsersContext usersContext,
+        IJwtService jwtService,
+        IPasswordService passwordService,
+        ITotpService totpService,
+        IPlexAuthService plexAuthService,
+        ILogger<AuthController> logger)
+    {
+        _usersContext = usersContext;
+        _jwtService = jwtService;
+        _passwordService = passwordService;
+        _totpService = totpService;
+        _plexAuthService = plexAuthService;
+        _logger = logger;
+    }
+
+    [HttpGet("status")]
+    public async Task<IActionResult> GetStatus()
+    {
+        var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+
+        return Ok(new AuthStatusResponse
+        {
+            SetupCompleted = user is { SetupCompleted: true },
+            PlexLinked = user?.PlexAccountId is not null
+        });
+    }
+
+    [HttpPost("setup/account")]
+    public async Task<IActionResult> CreateAccount([FromBody] CreateAccountRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var existingUser = await _usersContext.Users.FirstOrDefaultAsync();
+            if (existingUser is not null)
+            {
+                return Conflict(new { error = "Account already exists" });
+            }
+
+            var user = new User
+            {
+                Id = Guid.NewGuid(),
+                Username = request.Username,
+                PasswordHash = _passwordService.HashPassword(request.Password),
+                TotpSecret = string.Empty,
+                TotpEnabled = false,
+                ApiKey = GenerateApiKey(),
+                SetupCompleted = false,
+                CreatedAt = DateTime.UtcNow,
+                UpdatedAt = DateTime.UtcNow
+            };
+
+            _usersContext.Users.Add(user);
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Admin account created for user {Username}", request.Username);
+
+            return Created("", new { userId = user.Id });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("setup/2fa/generate")]
+    public async Task<IActionResult> GenerateTotpSetup()
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users
+                .Include(u => u.RecoveryCodes)
+                .FirstOrDefaultAsync();
+
+            if (user is null)
+            {
+                return BadRequest(new { error = "Create an account first" });
+            }
+
+            if (user.SetupCompleted && user.TotpEnabled)
+            {
+                return Conflict(new { error = "2FA is already configured" });
+            }
+
+            // Generate new TOTP secret
+            var secret = _totpService.GenerateSecret();
+            var qrUri = _totpService.GetQrCodeUri(secret, user.Username);
+
+            // Generate recovery codes
+            var recoveryCodes = _totpService.GenerateRecoveryCodes();
+
+            // Store secret (will be finalized on verify)
+            user.TotpSecret = secret;
+            user.UpdatedAt = DateTime.UtcNow;
+
+            // Remove old recovery codes and add new ones
+            _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
+
+            foreach (var code in recoveryCodes)
+            {
+                _usersContext.RecoveryCodes.Add(new RecoveryCode
+                {
+                    Id = Guid.NewGuid(),
+                    UserId = user.Id,
+                    CodeHash = _totpService.HashRecoveryCode(code),
+                    IsUsed = false
+                });
+            }
+
+            await _usersContext.SaveChangesAsync();
+
+            return Ok(new TotpSetupResponse
+            {
+                Secret = secret,
+                QrCodeUri = qrUri,
+                RecoveryCodes = recoveryCodes
+            });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("setup/2fa/verify")]
+    public async Task<IActionResult> VerifyTotpSetup([FromBody] VerifyTotpRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users.FirstOrDefaultAsync();
+            if (user is null)
+            {
+                return BadRequest(new { error = "Create an account first" });
+            }
+
+            if (string.IsNullOrEmpty(user.TotpSecret))
+            {
+                return BadRequest(new { error = "Generate 2FA setup first" });
+            }
+
+            if (!_totpService.ValidateCode(user.TotpSecret, request.Code))
+            {
+                return Unauthorized(new { error = "Invalid verification code" });
+            }
+
+            user.TotpEnabled = true;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("2FA enabled for user {Username}", user.Username);
+
+            return Ok(new { message = "2FA verified and enabled" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("setup/complete")]
+    public async Task<IActionResult> CompleteSetup()
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users.FirstOrDefaultAsync();
+            if (user is null)
+            {
+                return BadRequest(new { error = "Create an account first" });
+            }
+
+            if (!user.TotpEnabled)
+            {
+                return BadRequest(new { error = "2FA must be configured before completing setup" });
+            }
+
+            user.SetupCompleted = true;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Setup completed for user {Username}", user.Username);
+
+            return Ok(new { message = "Setup complete" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("login")]
+    public async Task<IActionResult> Login([FromBody] LoginRequest request)
+    {
+        var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+
+        if (user is null || !user.SetupCompleted)
+        {
+            return Unauthorized(new { error = "Invalid credentials" });
+        }
+
+        // Check lockout
+        if (user.LockoutEnd.HasValue && user.LockoutEnd.Value > DateTime.UtcNow)
+        {
+            var remaining = (int)(user.LockoutEnd.Value - DateTime.UtcNow).TotalSeconds;
+            return StatusCode(429, new { error = "Account is locked", retryAfterSeconds = remaining });
+        }
+
+        if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash) ||
+            !string.Equals(user.Username, request.Username, StringComparison.OrdinalIgnoreCase))
+        {
+            var retryAfterSeconds = await IncrementFailedAttempts(user.Id);
+            return Unauthorized(new { error = "Invalid credentials", retryAfterSeconds });
+        }
+
+        // Reset failed attempts on successful password verification
+        await ResetFailedAttempts(user.Id);
+
+        // Password valid - require 2FA
+        var loginToken = _jwtService.GenerateLoginToken(user.Id);
+
+        return Ok(new LoginResponse
+        {
+            RequiresTwoFactor = true,
+            LoginToken = loginToken
+        });
+    }
+
+    [HttpPost("login/2fa")]
+    public async Task<IActionResult> VerifyTwoFactor([FromBody] TwoFactorRequest request)
+    {
+        var userId = _jwtService.ValidateLoginToken(request.LoginToken);
+        if (userId is null)
+        {
+            return Unauthorized(new { error = "Invalid or expired login token" });
+        }
+
+        var user = await _usersContext.Users
+            .Include(u => u.RecoveryCodes)
+            .FirstOrDefaultAsync(u => u.Id == userId.Value);
+
+        if (user is null)
+        {
+            return Unauthorized(new { error = "Invalid login token" });
+        }
+
+        bool codeValid;
+
+        if (request.IsRecoveryCode)
+        {
+            codeValid = await TryUseRecoveryCode(user, request.Code);
+        }
+        else
+        {
+            codeValid = _totpService.ValidateCode(user.TotpSecret, request.Code);
+        }
+
+        if (!codeValid)
+        {
+            return Unauthorized(new { error = "Invalid verification code" });
+        }
+
+        return Ok(await GenerateTokenResponse(user));
+    }
+
+    [HttpPost("refresh")]
+    public async Task<IActionResult> RefreshToken([FromBody] RefreshTokenRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var tokenHash = HashRefreshToken(request.RefreshToken);
+
+            var storedToken = await _usersContext.RefreshTokens
+                .Include(r => r.User)
+                .FirstOrDefaultAsync(r => r.TokenHash == tokenHash && r.RevokedAt == null);
+
+            if (storedToken is null || storedToken.ExpiresAt < DateTime.UtcNow)
+            {
+                return Unauthorized(new { error = "Invalid or expired refresh token" });
+            }
+
+            // Revoke the old token (rotation)
+            storedToken.RevokedAt = DateTime.UtcNow;
+
+            // Generate new tokens
+            var response = await GenerateTokenResponse(storedToken.User);
+            await _usersContext.SaveChangesAsync();
+
+            return Ok(response);
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("logout")]
+    public async Task<IActionResult> Logout([FromBody] RefreshTokenRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var tokenHash = HashRefreshToken(request.RefreshToken);
+
+            var storedToken = await _usersContext.RefreshTokens
+                .FirstOrDefaultAsync(r => r.TokenHash == tokenHash && r.RevokedAt == null);
+
+            if (storedToken is not null)
+            {
+                storedToken.RevokedAt = DateTime.UtcNow;
+                await _usersContext.SaveChangesAsync();
+            }
+
+            return Ok(new { message = "Logged out" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("setup/plex/pin")]
+    public async Task<IActionResult> RequestSetupPlexPin()
+    {
+        var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+        if (user is null)
+        {
+            return BadRequest(new { error = "Create an account first" });
+        }
+
+        var pin = await _plexAuthService.RequestPin();
+
+        return Ok(new PlexPinStatusResponse
+        {
+            PinId = pin.PinId,
+            AuthUrl = pin.AuthUrl
+        });
+    }
+
+    [HttpPost("setup/plex/verify")]
+    public async Task<IActionResult> VerifySetupPlexLink([FromBody] PlexPinRequest request)
+    {
+        var pinResult = await _plexAuthService.CheckPin(request.PinId);
+
+        if (!pinResult.Completed || pinResult.AuthToken is null)
+        {
+            return Ok(new PlexVerifyResponse { Completed = false });
+        }
+
+        var plexAccount = await _plexAuthService.GetAccount(pinResult.AuthToken);
+
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users.FirstOrDefaultAsync();
+            if (user is null)
+            {
+                return BadRequest(new { error = "Create an account first" });
+            }
+
+            user.PlexAccountId = plexAccount.AccountId;
+            user.PlexUsername = plexAccount.Username;
+            user.PlexEmail = plexAccount.Email;
+            user.PlexAuthToken = pinResult.AuthToken;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Plex account linked during setup for user {Username}: {PlexUsername}",
+                user.Username, plexAccount.Username);
+
+            return Ok(new PlexVerifyResponse { Completed = true });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("login/plex/pin")]
+    public async Task<IActionResult> RequestPlexPin()
+    {
+        var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+        if (user is null || !user.SetupCompleted || user.PlexAccountId is null)
+        {
+            return BadRequest(new { error = "Plex login is not available" });
+        }
+
+        var pin = await _plexAuthService.RequestPin();
+
+        return Ok(new PlexPinStatusResponse
+        {
+            PinId = pin.PinId,
+            AuthUrl = pin.AuthUrl
+        });
+    }
+
+    [HttpPost("login/plex/verify")]
+    public async Task<IActionResult> VerifyPlexLogin([FromBody] PlexPinRequest request)
+    {
+        var user = await _usersContext.Users.FirstOrDefaultAsync();
+        if (user is null || !user.SetupCompleted || user.PlexAccountId is null)
+        {
+            return BadRequest(new { error = "Plex login is not available" });
+        }
+
+        var pinResult = await _plexAuthService.CheckPin(request.PinId);
+
+        if (!pinResult.Completed || pinResult.AuthToken is null)
+        {
+            return Ok(new PlexVerifyResponse { Completed = false });
+        }
+
+        // Verify the Plex account matches the linked one
+        var plexAccount = await _plexAuthService.GetAccount(pinResult.AuthToken);
+
+        if (plexAccount.AccountId != user.PlexAccountId)
+        {
+            return Unauthorized(new { error = "Plex account does not match the linked account" });
+        }
+
+        // Plex login bypasses 2FA
+        _logger.LogInformation("User {Username} logged in via Plex", user.Username);
+
+        var tokenResponse = await GenerateTokenResponse(user);
+
+        return Ok(new PlexVerifyResponse
+        {
+            Completed = true,
+            Tokens = tokenResponse
+        });
+    }
+
+    private async Task<TokenResponse> GenerateTokenResponse(User user)
+    {
+        var accessToken = _jwtService.GenerateAccessToken(user);
+        var refreshToken = _jwtService.GenerateRefreshToken();
+
+        _usersContext.RefreshTokens.Add(new RefreshToken
+        {
+            Id = Guid.NewGuid(),
+            UserId = user.Id,
+            TokenHash = HashRefreshToken(refreshToken),
+            ExpiresAt = DateTime.UtcNow.AddDays(7),
+            CreatedAt = DateTime.UtcNow
+        });
+
+        await _usersContext.SaveChangesAsync();
+
+        return new TokenResponse
+        {
+            AccessToken = accessToken,
+            RefreshToken = refreshToken,
+            ExpiresIn = 60 // seconds
+        };
+    }
+
+    private async Task<bool> TryUseRecoveryCode(User user, string code)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            foreach (var recoveryCode in user.RecoveryCodes.Where(r => !r.IsUsed))
+            {
+                if (_totpService.VerifyRecoveryCode(code, recoveryCode.CodeHash))
+                {
+                    recoveryCode.IsUsed = true;
+                    recoveryCode.UsedAt = DateTime.UtcNow;
+                    await _usersContext.SaveChangesAsync();
+
+                    _logger.LogWarning("Recovery code used for user {Username}", user.Username);
+                    return true;
+                }
+            }
+
+            return false;
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    private async Task<int> IncrementFailedAttempts(Guid userId)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users.FirstAsync(u => u.Id == userId);
+            user.FailedLoginAttempts++;
+            user.LockoutEnd = DateTime.UtcNow.AddSeconds(user.FailedLoginAttempts * 2);
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogWarning("Failed login attempt {Attempts} for user {Username}, locked for {Seconds}s",
+                user.FailedLoginAttempts, user.Username, user.FailedLoginAttempts * 2);
+
+            return user.FailedLoginAttempts * 2;
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    private async Task ResetFailedAttempts(Guid userId)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users.FirstAsync(u => u.Id == userId);
+            user.FailedLoginAttempts = 0;
+            user.LockoutEnd = null;
+            await _usersContext.SaveChangesAsync();
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    private static string GenerateApiKey()
+    {
+        var bytes = new byte[32];
+        using var rng = RandomNumberGenerator.Create();
+        rng.GetBytes(bytes);
+        return Convert.ToHexString(bytes).ToLowerInvariant();
+    }
+
+    private static string HashRefreshToken(string token)
+    {
+        var bytes = System.Text.Encoding.UTF8.GetBytes(token);
+        var hash = SHA256.HashData(bytes);
+        return Convert.ToBase64String(hash);
+    }
+}

code/backend/Cleanuparr.Api/Features/BlacklistSync/Controllers/BlacklistSyncConfigController.cs

@@ -2,7 +2,7 @@ using System;
 using System.Threading.Tasks;
 
 using Cleanuparr.Api.Features.BlacklistSync.Contracts.Requests;
-using Cleanuparr.Infrastructure.Models;
+using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration.BlacklistSync;

code/backend/Cleanuparr.Api/Features/DownloadCleaner/Contracts/Requests/SeedingRuleRequest.cs

@@ -0,0 +1,29 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests;
+
+public record SeedingRuleRequest
+{
+    [Required]
+    public string Name { get; init; } = string.Empty;
+    
+    /// <summary>
+    /// Max ratio before removing a download.
+    /// </summary>
+    public double MaxRatio { get; init; } = -1;
+
+    /// <summary>
+    /// Min number of hours to seed before removing a download, if the ratio has been met.
+    /// </summary>
+    public double MinSeedTime { get; init; }
+
+    /// <summary>
+    /// Number of hours to seed before removing a download.
+    /// </summary>
+    public double MaxSeedTime { get; init; } = -1;
+
+    /// <summary>
+    /// Whether to delete the source files when cleaning the download.
+    /// </summary>
+    public bool DeleteSourceFiles { get; init; } = true;
+}

code/backend/Cleanuparr.Api/Features/DownloadCleaner/Contracts/Requests/UpdateDownloadCleanerConfigRequest.cs

@@ -1,8 +1,6 @@
-using System.ComponentModel.DataAnnotations;
-
 namespace Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests;
 
-public record UpdateDownloadCleanerConfigRequest
+public sealed record UpdateDownloadCleanerConfigRequest
 {
     public bool Enabled { get; init; }
 
@@ -13,7 +11,7 @@ public record UpdateDownloadCleanerConfigRequest
     /// </summary>
     public bool UseAdvancedScheduling { get; init; }
 
-    public List<CleanCategoryRequest> Categories { get; init; } = [];
+    public List<SeedingRuleRequest> Categories { get; init; } = [];
 
     public bool DeletePrivate { get; init; }
     
@@ -26,30 +24,9 @@ public record UpdateDownloadCleanerConfigRequest
 
     public bool UnlinkedUseTag { get; init; }
 
-    public string UnlinkedIgnoredRootDir { get; init; } = string.Empty;
+    public List<string> UnlinkedIgnoredRootDirs { get; init; } = [];
     
     public List<string> UnlinkedCategories { get; init; } = [];
 
     public List<string> IgnoredDownloads { get; init; } = [];
 }
-
-public record CleanCategoryRequest
-{
-    [Required]
-    public string Name { get; init; } = string.Empty;
-    
-    /// <summary>
-    /// Max ratio before removing a download.
-    /// </summary>
-    public double MaxRatio { get; init; } = -1;
-
-    /// <summary>
-    /// Min number of hours to seed before removing a download, if the ratio has been met.
-    /// </summary>
-    public double MinSeedTime { get; init; }
-
-    /// <summary>
-    /// Number of hours to seed before removing a download.
-    /// </summary>
-    public double MaxSeedTime { get; init; } = -1;
-}

code/backend/Cleanuparr.Api/Features/DownloadCleaner/Controllers/DownloadCleanerConfigController.cs

@@ -3,7 +3,7 @@ using System.IO;
 using System.Linq;
 
 using Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests;
-using Cleanuparr.Infrastructure.Models;
+using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Cleanuparr.Infrastructure.Utilities;
 using Cleanuparr.Persistence;
@@ -80,22 +80,23 @@ public sealed class DownloadCleanerConfigController : ControllerBase
             oldConfig.UnlinkedEnabled = newConfigDto.UnlinkedEnabled;
             oldConfig.UnlinkedTargetCategory = newConfigDto.UnlinkedTargetCategory;
             oldConfig.UnlinkedUseTag = newConfigDto.UnlinkedUseTag;
-            oldConfig.UnlinkedIgnoredRootDir = newConfigDto.UnlinkedIgnoredRootDir;
+            oldConfig.UnlinkedIgnoredRootDirs = newConfigDto.UnlinkedIgnoredRootDirs;
             oldConfig.UnlinkedCategories = newConfigDto.UnlinkedCategories;
             oldConfig.IgnoredDownloads = newConfigDto.IgnoredDownloads;
             oldConfig.Categories.Clear();
 
-            _dataContext.CleanCategories.RemoveRange(oldConfig.Categories);
+            _dataContext.SeedingRules.RemoveRange(oldConfig.Categories);
             _dataContext.DownloadCleanerConfigs.Update(oldConfig);
 
             foreach (var categoryDto in newConfigDto.Categories)
             {
-                _dataContext.CleanCategories.Add(new CleanCategory
+                _dataContext.SeedingRules.Add(new SeedingRule
                 {
                     Name = categoryDto.Name,
                     MaxRatio = categoryDto.MaxRatio,
                     MinSeedTime = categoryDto.MinSeedTime,
                     MaxSeedTime = categoryDto.MaxSeedTime,
+                    DeleteSourceFiles = categoryDto.DeleteSourceFiles,
                     DownloadCleanerConfigId = oldConfig.Id
                 });
             }

code/backend/Cleanuparr.Api/Features/DownloadClient/Contracts/Requests/CreateDownloadClientRequest.cs

@@ -16,7 +16,7 @@ public sealed record CreateDownloadClientRequest
 
     public DownloadClientType Type { get; init; }
 
-    public Uri? Host { get; init; }
+    public string? Host { get; init; }
 
     public string? Username { get; init; }
 
@@ -24,6 +24,8 @@ public sealed record CreateDownloadClientRequest
 
     public string? UrlBase { get; init; }
 
+    public string? ExternalUrl { get; init; }
+
     public void Validate()
     {
         if (string.IsNullOrWhiteSpace(Name))
@@ -31,10 +33,20 @@ public sealed record CreateDownloadClientRequest
             throw new ValidationException("Client name cannot be empty");
         }
 
-        if (Host is null)
+        if (string.IsNullOrWhiteSpace(Host))
         {
             throw new ValidationException("Host cannot be empty");
         }
+
+        if (!Uri.TryCreate(Host, UriKind.RelativeOrAbsolute, out _))
+        {
+            throw new ValidationException("Host is not a valid URL");
+        }
+
+        if (!string.IsNullOrWhiteSpace(ExternalUrl) && !Uri.TryCreate(ExternalUrl, UriKind.RelativeOrAbsolute, out _))
+        {
+            throw new ValidationException("External URL is not a valid URL");
+        }
     }
 
     public DownloadClientConfig ToEntity() => new()
@@ -43,9 +55,10 @@ public sealed record CreateDownloadClientRequest
         Name = Name,
         TypeName = TypeName,
         Type = Type,
-        Host = Host,
+        Host = new Uri(Host!, UriKind.RelativeOrAbsolute),
         Username = Username,
         Password = Password,
         UrlBase = UrlBase,
+        ExternalUrl = !string.IsNullOrWhiteSpace(ExternalUrl) ? new Uri(ExternalUrl, UriKind.RelativeOrAbsolute) : null,
     };
 }

code/backend/Cleanuparr.Api/Features/DownloadClient/Contracts/Requests/TestDownloadClientRequest.cs

@@ -0,0 +1,48 @@
+using System;
+
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Domain.Exceptions;
+using Cleanuparr.Persistence.Models.Configuration;
+
+namespace Cleanuparr.Api.Features.DownloadClient.Contracts.Requests;
+
+public sealed record TestDownloadClientRequest
+{
+    public DownloadClientTypeName TypeName { get; init; }
+
+    public DownloadClientType Type { get; init; }
+
+    public string? Host { get; init; }
+
+    public string? Username { get; init; }
+
+    public string? Password { get; init; }
+
+    public string? UrlBase { get; init; }
+
+    public void Validate()
+    {
+        if (string.IsNullOrWhiteSpace(Host))
+        {
+            throw new ValidationException("Host cannot be empty");
+        }
+
+        if (!Uri.TryCreate(Host, UriKind.RelativeOrAbsolute, out _))
+        {
+            throw new ValidationException("Host is not a valid URL");
+        }
+    }
+
+    public DownloadClientConfig ToTestConfig() => new()
+    {
+        Id = Guid.NewGuid(),
+        Enabled = true,
+        Name = "Test Client",
+        TypeName = TypeName,
+        Type = Type,
+        Host = new Uri(Host!, UriKind.RelativeOrAbsolute),
+        Username = Username,
+        Password = Password,
+        UrlBase = UrlBase,
+    };
+}

code/backend/Cleanuparr.Api/Features/DownloadClient/Contracts/Requests/UpdateDownloadClientRequest.cs

@@ -16,7 +16,7 @@ public sealed record UpdateDownloadClientRequest
 
     public DownloadClientType Type { get; init; }
 
-    public Uri? Host { get; init; }
+    public string? Host { get; init; }
 
     public string? Username { get; init; }
 
@@ -24,6 +24,8 @@ public sealed record UpdateDownloadClientRequest
 
     public string? UrlBase { get; init; }
 
+    public string? ExternalUrl { get; init; }
+
     public void Validate()
     {
         if (string.IsNullOrWhiteSpace(Name))
@@ -31,10 +33,20 @@ public sealed record UpdateDownloadClientRequest
             throw new ValidationException("Client name cannot be empty");
         }
 
-        if (Host is null)
+        if (string.IsNullOrWhiteSpace(Host))
         {
             throw new ValidationException("Host cannot be empty");
         }
+
+        if (!Uri.TryCreate(Host, UriKind.RelativeOrAbsolute, out _))
+        {
+            throw new ValidationException("Host is not a valid URL");
+        }
+
+        if (!string.IsNullOrWhiteSpace(ExternalUrl) && !Uri.TryCreate(ExternalUrl, UriKind.RelativeOrAbsolute, out _))
+        {
+            throw new ValidationException("External URL is not a valid URL");
+        }
     }
 
     public DownloadClientConfig ApplyTo(DownloadClientConfig existing) => existing with
@@ -43,9 +55,10 @@ public sealed record UpdateDownloadClientRequest
         Name = Name,
         TypeName = TypeName,
         Type = Type,
-        Host = Host,
+        Host = new Uri(Host!, UriKind.RelativeOrAbsolute),
         Username = Username,
         Password = Password,
         UrlBase = UrlBase,
+        ExternalUrl = !string.IsNullOrWhiteSpace(ExternalUrl) ? new Uri(ExternalUrl, UriKind.RelativeOrAbsolute) : null,
     };
 }

code/backend/Cleanuparr.Api/Features/DownloadClient/Controllers/DownloadClientController.cs

@@ -2,12 +2,11 @@ using System;
 using System.Linq;
 
 using Cleanuparr.Api.Features.DownloadClient.Contracts.Requests;
+using Cleanuparr.Infrastructure.Features.DownloadClient;
 using Cleanuparr.Infrastructure.Http.DynamicHttpClientSystem;
 using Cleanuparr.Persistence;
-using Cleanuparr.Persistence.Models.Configuration;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
-using Microsoft.Extensions.Logging;
 
 namespace Cleanuparr.Api.Features.DownloadClient.Controllers;
 
@@ -18,15 +17,18 @@ public sealed class DownloadClientController : ControllerBase
     private readonly ILogger<DownloadClientController> _logger;
     private readonly DataContext _dataContext;
     private readonly IDynamicHttpClientFactory _dynamicHttpClientFactory;
+    private readonly IDownloadServiceFactory _downloadServiceFactory;
 
     public DownloadClientController(
         ILogger<DownloadClientController> logger,
         DataContext dataContext,
-        IDynamicHttpClientFactory dynamicHttpClientFactory)
+        IDynamicHttpClientFactory dynamicHttpClientFactory,
+        IDownloadServiceFactory downloadServiceFactory)
     {
         _logger = logger;
         _dataContext = dataContext;
         _dynamicHttpClientFactory = dynamicHttpClientFactory;
+        _downloadServiceFactory = downloadServiceFactory;
     }
 
     [HttpGet("download_client")]
@@ -146,4 +148,33 @@ public sealed class DownloadClientController : ControllerBase
             DataContext.Lock.Release();
         }
     }
+
+    [HttpPost("download_client/test")]
+    public async Task<IActionResult> TestDownloadClient([FromBody] TestDownloadClientRequest request)
+    {
+        try
+        {
+            request.Validate();
+
+            var testConfig = request.ToTestConfig();
+            using var downloadService = _downloadServiceFactory.GetDownloadService(testConfig);
+            var healthResult = await downloadService.HealthCheckAsync();
+
+            if (healthResult.IsHealthy)
+            {
+                return Ok(new
+                {
+                    Message = $"Connection to {request.TypeName} successful",
+                    ResponseTime = healthResult.ResponseTime.TotalMilliseconds
+                });
+            }
+
+            return BadRequest(new { Message = healthResult.ErrorMessage ?? "Connection failed" });
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to test {TypeName} client connection", request.TypeName);
+            return BadRequest(new { Message = $"Connection failed: {ex.Message}" });
+        }
+    }
 }

code/backend/Cleanuparr.Api/Features/General/Contracts/Requests/UpdateGeneralConfigRequest.cs

@@ -24,10 +24,14 @@ public sealed record UpdateGeneralConfigRequest
 
     public ushort SearchDelay { get; init; } = Constants.DefaultSearchDelaySeconds;
 
+    public bool StatusCheckEnabled { get; init; } = true;
+
     public string EncryptionKey { get; init; } = Guid.NewGuid().ToString();
 
     public List<string> IgnoredDownloads { get; init; } = [];
 
+    public ushort StrikeInactivityWindowHours { get; init; } = 24;
+
     public UpdateLoggingConfigRequest Log { get; init; } = new();
 
     public GeneralConfig ApplyTo(GeneralConfig existingConfig, IServiceProvider services, ILogger logger)
@@ -39,8 +43,10 @@ public sealed record UpdateGeneralConfigRequest
         existingConfig.HttpCertificateValidation = HttpCertificateValidation;
         existingConfig.SearchEnabled = SearchEnabled;
         existingConfig.SearchDelay = SearchDelay;
+        existingConfig.StatusCheckEnabled = StatusCheckEnabled;
         existingConfig.EncryptionKey = EncryptionKey;
         existingConfig.IgnoredDownloads = IgnoredDownloads;
+        existingConfig.StrikeInactivityWindowHours = StrikeInactivityWindowHours;
 
         bool loggingChanged = Log.ApplyTo(existingConfig.Log);
 
@@ -58,6 +64,16 @@ public sealed record UpdateGeneralConfigRequest
             throw new ValidationException("HTTP_TIMEOUT must be greater than 0");
         }
 
+        if (config.StrikeInactivityWindowHours is 0)
+        {
+            throw new ValidationException("STRIKE_INACTIVITY_WINDOW_HOURS must be greater than 0");
+        }
+
+        if (config.StrikeInactivityWindowHours > 168)
+        {
+            throw new ValidationException("STRIKE_INACTIVITY_WINDOW_HOURS must be less than or equal to 168");
+        }
+
         config.Log.Validate();
     }
 

code/backend/Cleanuparr.Api/Features/General/Controllers/GeneralConfigController.cs

@@ -78,6 +78,21 @@ public sealed class GeneralConfigController : ControllerBase
         }
     }
 
+    [HttpPost("strikes/purge")]
+    public async Task<IActionResult> PurgeAllStrikes(
+        [FromServices] EventsContext eventsContext)
+    {
+        var deletedStrikes = await eventsContext.Strikes.ExecuteDeleteAsync();
+        var deletedItems = await eventsContext.DownloadItems
+            .Where(d => !d.Strikes.Any())
+            .ExecuteDeleteAsync();
+
+        _logger.LogWarning("Purged all strikes: {strikes} strikes, {items} download items removed",
+            deletedStrikes, deletedItems);
+
+        return Ok(new { DeletedStrikes = deletedStrikes, DeletedItems = deletedItems });
+    }
+
     private void ClearStrikesCacheIfNeeded(bool wasDryRun, bool isDryRun)
     {
         if (!wasDryRun || isDryRun)

code/backend/Cleanuparr.Api/Features/MalwareBlocker/Controllers/MalwareBlockerConfigController.cs

@@ -2,7 +2,7 @@ using System.ComponentModel.DataAnnotations;
 using System.Threading.Tasks;
 
 using Cleanuparr.Api.Features.MalwareBlocker.Contracts.Requests;
-using Cleanuparr.Infrastructure.Models;
+using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Cleanuparr.Infrastructure.Utilities;
 using Cleanuparr.Persistence;

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/CreateAppriseProviderRequest.cs

@@ -1,10 +1,18 @@
+using Cleanuparr.Domain.Enums;
+
 namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
 
 public record CreateAppriseProviderRequest : CreateNotificationProviderRequestBase
 {
+    public AppriseMode Mode { get; init; } = AppriseMode.Api;
+
+    // API mode fields
     public string Url { get; init; } = string.Empty;
-    
+
     public string Key { get; init; } = string.Empty;
-    
+
     public string Tags { get; init; } = string.Empty;
+
+    // CLI mode fields
+    public string? ServiceUrls { get; init; }
 }

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/CreateDiscordProviderRequest.cs

@@ -0,0 +1,10 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record CreateDiscordProviderRequest : CreateNotificationProviderRequestBase
+{
+    public string WebhookUrl { get; init; } = string.Empty;
+
+    public string Username { get; init; } = string.Empty;
+
+    public string AvatarUrl { get; init; } = string.Empty;
+}

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/CreateGotifyProviderRequest.cs

@@ -0,0 +1,10 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record CreateGotifyProviderRequest : CreateNotificationProviderRequestBase
+{
+    public string ServerUrl { get; init; } = string.Empty;
+
+    public string ApplicationToken { get; init; } = string.Empty;
+
+    public int Priority { get; init; } = 5;
+}

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/CreatePushoverProviderRequest.cs

@@ -0,0 +1,22 @@
+using Cleanuparr.Domain.Enums;
+
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record CreatePushoverProviderRequest : CreateNotificationProviderRequestBase
+{
+    public string ApiToken { get; init; } = string.Empty;
+
+    public string UserKey { get; init; } = string.Empty;
+
+    public List<string> Devices { get; init; } = [];
+
+    public PushoverPriority Priority { get; init; } = PushoverPriority.Normal;
+
+    public string? Sound { get; init; }
+
+    public int? Retry { get; init; }
+
+    public int? Expire { get; init; }
+
+    public List<string> Tags { get; init; } = [];
+}

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/CreateTelegramProviderRequest.cs

@@ -0,0 +1,12 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public sealed record CreateTelegramProviderRequest : CreateNotificationProviderRequestBase
+{
+    public string BotToken { get; init; } = string.Empty;
+
+    public string ChatId { get; init; } = string.Empty;
+
+    public string? TopicId { get; init; }
+
+    public bool SendSilently { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/TestAppriseProviderRequest.cs

@@ -1,10 +1,18 @@
+using Cleanuparr.Domain.Enums;
+
 namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
 
 public record TestAppriseProviderRequest
 {
+    public AppriseMode Mode { get; init; } = AppriseMode.Api;
+
+    // API mode fields
     public string Url { get; init; } = string.Empty;
-    
+
     public string Key { get; init; } = string.Empty;
-    
+
     public string Tags { get; init; } = string.Empty;
+
+    // CLI mode fields
+    public string? ServiceUrls { get; init; }
 }

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/TestDiscordProviderRequest.cs

@@ -0,0 +1,10 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record TestDiscordProviderRequest
+{
+    public string WebhookUrl { get; init; } = string.Empty;
+
+    public string Username { get; init; } = string.Empty;
+
+    public string AvatarUrl { get; init; } = string.Empty;
+}

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/TestGotifyProviderRequest.cs

@@ -0,0 +1,10 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record TestGotifyProviderRequest
+{
+    public string ServerUrl { get; init; } = string.Empty;
+
+    public string ApplicationToken { get; init; } = string.Empty;
+
+    public int Priority { get; init; } = 5;
+}

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/TestPushoverProviderRequest.cs

@@ -0,0 +1,22 @@
+using Cleanuparr.Domain.Enums;
+
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record TestPushoverProviderRequest
+{
+    public string ApiToken { get; init; } = string.Empty;
+
+    public string UserKey { get; init; } = string.Empty;
+
+    public List<string> Devices { get; init; } = [];
+
+    public PushoverPriority Priority { get; init; } = PushoverPriority.Normal;
+
+    public string? Sound { get; init; }
+
+    public int? Retry { get; init; }
+
+    public int? Expire { get; init; }
+
+    public List<string> Tags { get; init; } = [];
+}

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/TestTelegramProviderRequest.cs

@@ -0,0 +1,12 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public sealed record TestTelegramProviderRequest
+{
+    public string BotToken { get; init; } = string.Empty;
+
+    public string ChatId { get; init; } = string.Empty;
+
+    public string? TopicId { get; init; }
+
+    public bool SendSilently { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/UpdateAppriseProviderRequest.cs

@@ -1,10 +1,18 @@
+using Cleanuparr.Domain.Enums;
+
 namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
 
 public record UpdateAppriseProviderRequest : UpdateNotificationProviderRequestBase
 {
+    public AppriseMode Mode { get; init; } = AppriseMode.Api;
+
+    // API mode fields
     public string Url { get; init; } = string.Empty;
-    
+
     public string Key { get; init; } = string.Empty;
-    
+
     public string Tags { get; init; } = string.Empty;
+
+    // CLI mode fields
+    public string? ServiceUrls { get; init; }
 }

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/UpdateDiscordProviderRequest.cs

@@ -0,0 +1,10 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record UpdateDiscordProviderRequest : UpdateNotificationProviderRequestBase
+{
+    public string WebhookUrl { get; init; } = string.Empty;
+
+    public string Username { get; init; } = string.Empty;
+
+    public string AvatarUrl { get; init; } = string.Empty;
+}

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/UpdateGotifyProviderRequest.cs

@@ -0,0 +1,10 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record UpdateGotifyProviderRequest : UpdateNotificationProviderRequestBase
+{
+    public string ServerUrl { get; init; } = string.Empty;
+
+    public string ApplicationToken { get; init; } = string.Empty;
+
+    public int Priority { get; init; } = 5;
+}

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/UpdatePushoverProviderRequest.cs

@@ -0,0 +1,22 @@
+using Cleanuparr.Domain.Enums;
+
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record UpdatePushoverProviderRequest : UpdateNotificationProviderRequestBase
+{
+    public string ApiToken { get; init; } = string.Empty;
+
+    public string UserKey { get; init; } = string.Empty;
+
+    public List<string> Devices { get; init; } = [];
+
+    public PushoverPriority Priority { get; init; } = PushoverPriority.Normal;
+
+    public string? Sound { get; init; }
+
+    public int? Retry { get; init; }
+
+    public int? Expire { get; init; }
+
+    public List<string> Tags { get; init; } = [];
+}

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/UpdateTelegramProviderRequest.cs

@@ -0,0 +1,12 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public sealed record UpdateTelegramProviderRequest : CreateNotificationProviderRequestBase
+{
+    public string BotToken { get; init; } = string.Empty;
+
+    public string ChatId { get; init; } = string.Empty;
+
+    public string? TopicId { get; init; }
+
+    public bool SendSilently { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Notifications/Controllers/NotificationProvidersController.cs

@@ -1,15 +1,18 @@
+using System.Net;
 using Cleanuparr.Api.Features.Notifications.Contracts.Requests;
 using Cleanuparr.Api.Features.Notifications.Contracts.Responses;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Domain.Exceptions;
 using Cleanuparr.Infrastructure.Features.Notifications;
+using Cleanuparr.Infrastructure.Features.Notifications.Apprise;
+using Cleanuparr.Infrastructure.Features.Notifications.Discord;
 using Cleanuparr.Infrastructure.Features.Notifications.Models;
-using Cleanuparr.Infrastructure.Services.Interfaces;
+using Cleanuparr.Infrastructure.Features.Notifications.Telegram;
+using Cleanuparr.Infrastructure.Features.Notifications.Gotify;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration.Notification;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
-using Microsoft.Extensions.Logging;
 
 namespace Cleanuparr.Api.Features.Notifications.Controllers;
 
@@ -21,17 +24,20 @@ public sealed class NotificationProvidersController : ControllerBase
     private readonly DataContext _dataContext;
     private readonly INotificationConfigurationService _notificationConfigurationService;
     private readonly NotificationService _notificationService;
+    private readonly IAppriseCliDetector _appriseCliDetector;
 
     public NotificationProvidersController(
         ILogger<NotificationProvidersController> logger,
         DataContext dataContext,
         INotificationConfigurationService notificationConfigurationService,
-        NotificationService notificationService)
+        NotificationService notificationService,
+        IAppriseCliDetector appriseCliDetector)
     {
         _logger = logger;
         _dataContext = dataContext;
         _notificationConfigurationService = notificationConfigurationService;
         _notificationService = notificationService;
+        _appriseCliDetector = appriseCliDetector;
     }
 
     [HttpGet]
@@ -44,6 +50,10 @@ public sealed class NotificationProvidersController : ControllerBase
                 .Include(p => p.NotifiarrConfiguration)
                 .Include(p => p.AppriseConfiguration)
                 .Include(p => p.NtfyConfiguration)
+                .Include(p => p.PushoverConfiguration)
+                .Include(p => p.TelegramConfiguration)
+                .Include(p => p.DiscordConfiguration)
+                .Include(p => p.GotifyConfiguration)
                 .AsNoTracking()
                 .ToListAsync();
 
@@ -68,6 +78,10 @@ public sealed class NotificationProvidersController : ControllerBase
                         NotificationProviderType.Notifiarr => p.NotifiarrConfiguration ?? new object(),
                         NotificationProviderType.Apprise => p.AppriseConfiguration ?? new object(),
                         NotificationProviderType.Ntfy => p.NtfyConfiguration ?? new object(),
+                        NotificationProviderType.Pushover => p.PushoverConfiguration ?? new object(),
+                        NotificationProviderType.Telegram => p.TelegramConfiguration ?? new object(),
+                        NotificationProviderType.Discord => p.DiscordConfiguration ?? new object(),
+                        NotificationProviderType.Gotify => p.GotifyConfiguration ?? new object(),
                         _ => new object()
                     }
                 })
@@ -84,6 +98,18 @@ public sealed class NotificationProvidersController : ControllerBase
         }
     }
 
+    [HttpGet("apprise/cli-status")]
+    public async Task<IActionResult> GetAppriseCliStatus()
+    {
+        string? version = await _appriseCliDetector.GetAppriseVersionAsync();
+
+        return Ok(new
+        {
+            Available = version is not null,
+            Version = version
+        });
+    }
+
     [HttpPost("notifiarr")]
     public async Task<IActionResult> CreateNotifiarrProvider([FromBody] CreateNotifiarrProviderRequest newProvider)
     {
@@ -160,9 +186,11 @@ public sealed class NotificationProvidersController : ControllerBase
 
             var appriseConfig = new AppriseConfig
             {
+                Mode = newProvider.Mode,
                 Url = newProvider.Url,
                 Key = newProvider.Key,
-                Tags = newProvider.Tags
+                Tags = newProvider.Tags,
+                ServiceUrls = newProvider.ServiceUrls
             };
             appriseConfig.Validate();
 
@@ -270,6 +298,69 @@ public sealed class NotificationProvidersController : ControllerBase
         }
     }
 
+    [HttpPost("telegram")]
+    public async Task<IActionResult> CreateTelegramProvider([FromBody] CreateTelegramProviderRequest newProvider)
+    {
+        await DataContext.Lock.WaitAsync();
+        try
+        {
+            if (string.IsNullOrWhiteSpace(newProvider.Name))
+            {
+                return BadRequest("Provider name is required");
+            }
+
+            var duplicateConfig = await _dataContext.NotificationConfigs.CountAsync(x => x.Name == newProvider.Name);
+            if (duplicateConfig > 0)
+            {
+                return BadRequest("A provider with this name already exists");
+            }
+
+            var telegramConfig = new TelegramConfig
+            {
+                BotToken = newProvider.BotToken,
+                ChatId = newProvider.ChatId,
+                TopicId = newProvider.TopicId,
+                SendSilently = newProvider.SendSilently
+            };
+            telegramConfig.Validate();
+
+            var provider = new NotificationConfig
+            {
+                Name = newProvider.Name,
+                Type = NotificationProviderType.Telegram,
+                IsEnabled = newProvider.IsEnabled,
+                OnFailedImportStrike = newProvider.OnFailedImportStrike,
+                OnStalledStrike = newProvider.OnStalledStrike,
+                OnSlowStrike = newProvider.OnSlowStrike,
+                OnQueueItemDeleted = newProvider.OnQueueItemDeleted,
+                OnDownloadCleaned = newProvider.OnDownloadCleaned,
+                OnCategoryChanged = newProvider.OnCategoryChanged,
+                TelegramConfiguration = telegramConfig
+            };
+
+            _dataContext.NotificationConfigs.Add(provider);
+            await _dataContext.SaveChangesAsync();
+
+            await _notificationConfigurationService.InvalidateCacheAsync();
+
+            var providerDto = MapProvider(provider);
+            return CreatedAtAction(nameof(GetNotificationProviders), new { id = provider.Id }, providerDto);
+        }
+        catch (ValidationException ex)
+        {
+            return BadRequest(ex.Message);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to create Telegram provider");
+            throw;
+        }
+        finally
+        {
+            DataContext.Lock.Release();
+        }
+    }
+
     [HttpPut("notifiarr/{id:guid}")]
     public async Task<IActionResult> UpdateNotifiarrProvider(Guid id, [FromBody] UpdateNotifiarrProviderRequest updatedProvider)
     {
@@ -380,9 +471,11 @@ public sealed class NotificationProvidersController : ControllerBase
 
             var appriseConfig = new AppriseConfig
             {
+                Mode = updatedProvider.Mode,
                 Url = updatedProvider.Url,
                 Key = updatedProvider.Key,
-                Tags = updatedProvider.Tags
+                Tags = updatedProvider.Tags,
+                ServiceUrls = updatedProvider.ServiceUrls
             };
 
             if (existingProvider.AppriseConfiguration != null)
@@ -514,6 +607,87 @@ public sealed class NotificationProvidersController : ControllerBase
         }
     }
 
+    [HttpPut("telegram/{id:guid}")]
+    public async Task<IActionResult> UpdateTelegramProvider(Guid id, [FromBody] UpdateTelegramProviderRequest updatedProvider)
+    {
+        await DataContext.Lock.WaitAsync();
+        try
+        {
+            var existingProvider = await _dataContext.NotificationConfigs
+                .Include(p => p.TelegramConfiguration)
+                .FirstOrDefaultAsync(p => p.Id == id && p.Type == NotificationProviderType.Telegram);
+
+            if (existingProvider == null)
+            {
+                return NotFound($"Telegram provider with ID {id} not found");
+            }
+
+            if (string.IsNullOrWhiteSpace(updatedProvider.Name))
+            {
+                return BadRequest("Provider name is required");
+            }
+
+            var duplicateConfig = await _dataContext.NotificationConfigs
+                .Where(x => x.Id != id)
+                .Where(x => x.Name == updatedProvider.Name)
+                .CountAsync();
+            if (duplicateConfig > 0)
+            {
+                return BadRequest("A provider with this name already exists");
+            }
+
+            var telegramConfig = new TelegramConfig
+            {
+                BotToken = updatedProvider.BotToken,
+                ChatId = updatedProvider.ChatId,
+                TopicId = updatedProvider.TopicId,
+                SendSilently = updatedProvider.SendSilently
+            };
+
+            if (existingProvider.TelegramConfiguration != null)
+            {
+                telegramConfig = telegramConfig with { Id = existingProvider.TelegramConfiguration.Id };
+            }
+            telegramConfig.Validate();
+
+            var newProvider = existingProvider with
+            {
+                Name = updatedProvider.Name,
+                IsEnabled = updatedProvider.IsEnabled,
+                OnFailedImportStrike = updatedProvider.OnFailedImportStrike,
+                OnStalledStrike = updatedProvider.OnStalledStrike,
+                OnSlowStrike = updatedProvider.OnSlowStrike,
+                OnQueueItemDeleted = updatedProvider.OnQueueItemDeleted,
+                OnDownloadCleaned = updatedProvider.OnDownloadCleaned,
+                OnCategoryChanged = updatedProvider.OnCategoryChanged,
+                TelegramConfiguration = telegramConfig,
+                UpdatedAt = DateTime.UtcNow
+            };
+
+            _dataContext.NotificationConfigs.Remove(existingProvider);
+            _dataContext.NotificationConfigs.Add(newProvider);
+
+            await _dataContext.SaveChangesAsync();
+            await _notificationConfigurationService.InvalidateCacheAsync();
+
+            var providerDto = MapProvider(newProvider);
+            return Ok(providerDto);
+        }
+        catch (ValidationException ex)
+        {
+            return BadRequest(ex.Message);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to update Telegram provider with ID {Id}", id);
+            throw;
+        }
+        finally
+        {
+            DataContext.Lock.Release();
+        }
+    }
+
     [HttpDelete("{id:guid}")]
     public async Task<IActionResult> DeleteNotificationProvider(Guid id)
     {
@@ -524,6 +698,10 @@ public sealed class NotificationProvidersController : ControllerBase
                 .Include(p => p.NotifiarrConfiguration)
                 .Include(p => p.AppriseConfiguration)
                 .Include(p => p.NtfyConfiguration)
+                .Include(p => p.PushoverConfiguration)
+                .Include(p => p.TelegramConfiguration)
+                .Include(p => p.DiscordConfiguration)
+                .Include(p => p.GotifyConfiguration)
                 .FirstOrDefaultAsync(p => p.Id == id);
 
             if (existingProvider == null)
@@ -583,12 +761,12 @@ public sealed class NotificationProvidersController : ControllerBase
             };
 
             await _notificationService.SendTestNotificationAsync(providerDto);
-            return Ok(new { Message = "Test notification sent successfully", Success = true });
+            return Ok(new { Message = "Test notification sent successfully" });
         }
         catch (Exception ex)
         {
             _logger.LogError(ex, "Failed to test Notifiarr provider");
-            throw;
+            return BadRequest(new { Message = $"Test failed: {ex.Message}" });
         }
     }
 
@@ -599,9 +777,11 @@ public sealed class NotificationProvidersController : ControllerBase
         {
             var appriseConfig = new AppriseConfig
             {
+                Mode = testRequest.Mode,
                 Url = testRequest.Url,
                 Key = testRequest.Key,
-                Tags = testRequest.Tags
+                Tags = testRequest.Tags,
+                ServiceUrls = testRequest.ServiceUrls
             };
             appriseConfig.Validate();
 
@@ -624,12 +804,16 @@ public sealed class NotificationProvidersController : ControllerBase
             };
 
             await _notificationService.SendTestNotificationAsync(providerDto);
-            return Ok(new { Message = "Test notification sent successfully", Success = true });
+            return Ok(new { Message = "Test notification sent successfully" });
+        }
+        catch (AppriseException exception)
+        {
+            return StatusCode((int)HttpStatusCode.InternalServerError, exception.Message);
         }
         catch (Exception ex)
         {
             _logger.LogError(ex, "Failed to test Apprise provider");
-            throw;
+            return BadRequest(new { Message = $"Test failed: {ex.Message}" });
         }
     }
 
@@ -670,12 +854,59 @@ public sealed class NotificationProvidersController : ControllerBase
             };
 
             await _notificationService.SendTestNotificationAsync(providerDto);
-            return Ok(new { Message = "Test notification sent successfully", Success = true });
+            return Ok(new { Message = "Test notification sent successfully" });
         }
         catch (Exception ex)
         {
             _logger.LogError(ex, "Failed to test Ntfy provider");
-            throw;
+            return BadRequest(new { Message = $"Test failed: {ex.Message}" });
+        }
+    }
+
+    [HttpPost("telegram/test")]
+    public async Task<IActionResult> TestTelegramProvider([FromBody] TestTelegramProviderRequest testRequest)
+    {
+        try
+        {
+            var telegramConfig = new TelegramConfig
+            {
+                BotToken = testRequest.BotToken,
+                ChatId = testRequest.ChatId,
+                TopicId = testRequest.TopicId,
+                SendSilently = testRequest.SendSilently
+            };
+            telegramConfig.Validate();
+
+            var providerDto = new NotificationProviderDto
+            {
+                Id = Guid.NewGuid(),
+                Name = "Test Provider",
+                Type = NotificationProviderType.Telegram,
+                IsEnabled = true,
+                Events = new NotificationEventFlags
+                {
+                    OnFailedImportStrike = true,
+                    OnStalledStrike = false,
+                    OnSlowStrike = false,
+                    OnQueueItemDeleted = false,
+                    OnDownloadCleaned = false,
+                    OnCategoryChanged = false
+                },
+                Configuration = telegramConfig
+            };
+
+            await _notificationService.SendTestNotificationAsync(providerDto);
+            return Ok(new { Message = "Test notification sent successfully" });
+        }
+        catch (TelegramException ex)
+        {
+            _logger.LogWarning(ex, "Failed to test Telegram provider");
+            return BadRequest(new { Message = $"Test failed: {ex.Message}" });
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to test Telegram provider");
+            return BadRequest(new { Message = $"Test failed: {ex.Message}" });
         }
     }
 
@@ -701,8 +932,586 @@ public sealed class NotificationProvidersController : ControllerBase
                 NotificationProviderType.Notifiarr => provider.NotifiarrConfiguration ?? new object(),
                 NotificationProviderType.Apprise => provider.AppriseConfiguration ?? new object(),
                 NotificationProviderType.Ntfy => provider.NtfyConfiguration ?? new object(),
+                NotificationProviderType.Pushover => provider.PushoverConfiguration ?? new object(),
+                NotificationProviderType.Telegram => provider.TelegramConfiguration ?? new object(),
+                NotificationProviderType.Discord => provider.DiscordConfiguration ?? new object(),
+                NotificationProviderType.Gotify => provider.GotifyConfiguration ?? new object(),
                 _ => new object()
             }
         };
     }
+
+    [HttpPost("discord")]
+    public async Task<IActionResult> CreateDiscordProvider([FromBody] CreateDiscordProviderRequest newProvider)
+    {
+        await DataContext.Lock.WaitAsync();
+        try
+        {
+            if (string.IsNullOrWhiteSpace(newProvider.Name))
+            {
+                return BadRequest("Provider name is required");
+            }
+
+            var duplicateConfig = await _dataContext.NotificationConfigs.CountAsync(x => x.Name == newProvider.Name);
+            if (duplicateConfig > 0)
+            {
+                return BadRequest("A provider with this name already exists");
+            }
+
+            var discordConfig = new DiscordConfig
+            {
+                WebhookUrl = newProvider.WebhookUrl,
+                Username = newProvider.Username,
+                AvatarUrl = newProvider.AvatarUrl
+            };
+            discordConfig.Validate();
+
+            var provider = new NotificationConfig
+            {
+                Name = newProvider.Name,
+                Type = NotificationProviderType.Discord,
+                IsEnabled = newProvider.IsEnabled,
+                OnFailedImportStrike = newProvider.OnFailedImportStrike,
+                OnStalledStrike = newProvider.OnStalledStrike,
+                OnSlowStrike = newProvider.OnSlowStrike,
+                OnQueueItemDeleted = newProvider.OnQueueItemDeleted,
+                OnDownloadCleaned = newProvider.OnDownloadCleaned,
+                OnCategoryChanged = newProvider.OnCategoryChanged,
+                DiscordConfiguration = discordConfig
+            };
+
+            _dataContext.NotificationConfigs.Add(provider);
+            await _dataContext.SaveChangesAsync();
+
+            await _notificationConfigurationService.InvalidateCacheAsync();
+
+            var providerDto = MapProvider(provider);
+            return CreatedAtAction(nameof(GetNotificationProviders), new { id = provider.Id }, providerDto);
+        }
+        catch (ValidationException ex)
+        {
+            return BadRequest(ex.Message);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to create Discord provider");
+            throw;
+        }
+        finally
+        {
+            DataContext.Lock.Release();
+        }
+    }
+
+    [HttpPut("discord/{id:guid}")]
+    public async Task<IActionResult> UpdateDiscordProvider(Guid id, [FromBody] UpdateDiscordProviderRequest updatedProvider)
+    {
+        await DataContext.Lock.WaitAsync();
+        try
+        {
+            var existingProvider = await _dataContext.NotificationConfigs
+                .Include(p => p.DiscordConfiguration)
+                .FirstOrDefaultAsync(p => p.Id == id && p.Type == NotificationProviderType.Discord);
+
+            if (existingProvider == null)
+            {
+                return NotFound($"Discord provider with ID {id} not found");
+            }
+
+            if (string.IsNullOrWhiteSpace(updatedProvider.Name))
+            {
+                return BadRequest("Provider name is required");
+            }
+
+            var duplicateConfig = await _dataContext.NotificationConfigs
+                .Where(x => x.Id != id)
+                .Where(x => x.Name == updatedProvider.Name)
+                .CountAsync();
+            if (duplicateConfig > 0)
+            {
+                return BadRequest("A provider with this name already exists");
+            }
+
+            var discordConfig = new DiscordConfig
+            {
+                WebhookUrl = updatedProvider.WebhookUrl,
+                Username = updatedProvider.Username,
+                AvatarUrl = updatedProvider.AvatarUrl
+            };
+
+            if (existingProvider.DiscordConfiguration != null)
+            {
+                discordConfig = discordConfig with { Id = existingProvider.DiscordConfiguration.Id };
+            }
+            discordConfig.Validate();
+
+            var newProvider = existingProvider with
+            {
+                Name = updatedProvider.Name,
+                IsEnabled = updatedProvider.IsEnabled,
+                OnFailedImportStrike = updatedProvider.OnFailedImportStrike,
+                OnStalledStrike = updatedProvider.OnStalledStrike,
+                OnSlowStrike = updatedProvider.OnSlowStrike,
+                OnQueueItemDeleted = updatedProvider.OnQueueItemDeleted,
+                OnDownloadCleaned = updatedProvider.OnDownloadCleaned,
+                OnCategoryChanged = updatedProvider.OnCategoryChanged,
+                DiscordConfiguration = discordConfig,
+                UpdatedAt = DateTime.UtcNow
+            };
+
+            _dataContext.NotificationConfigs.Remove(existingProvider);
+            _dataContext.NotificationConfigs.Add(newProvider);
+
+            await _dataContext.SaveChangesAsync();
+            await _notificationConfigurationService.InvalidateCacheAsync();
+
+            var providerDto = MapProvider(newProvider);
+            return Ok(providerDto);
+        }
+        catch (ValidationException ex)
+        {
+            return BadRequest(ex.Message);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to update Discord provider with ID {Id}", id);
+            throw;
+        }
+        finally
+        {
+            DataContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("discord/test")]
+    public async Task<IActionResult> TestDiscordProvider([FromBody] TestDiscordProviderRequest testRequest)
+    {
+        try
+        {
+            var discordConfig = new DiscordConfig
+            {
+                WebhookUrl = testRequest.WebhookUrl,
+                Username = testRequest.Username,
+                AvatarUrl = testRequest.AvatarUrl
+            };
+            discordConfig.Validate();
+
+            var providerDto = new NotificationProviderDto
+            {
+                Id = Guid.NewGuid(),
+                Name = "Test Provider",
+                Type = NotificationProviderType.Discord,
+                IsEnabled = true,
+                Events = new NotificationEventFlags
+                {
+                    OnFailedImportStrike = true,
+                    OnStalledStrike = false,
+                    OnSlowStrike = false,
+                    OnQueueItemDeleted = false,
+                    OnDownloadCleaned = false,
+                    OnCategoryChanged = false
+                },
+                Configuration = discordConfig
+            };
+
+            await _notificationService.SendTestNotificationAsync(providerDto);
+            return Ok(new { Message = "Test notification sent successfully" });
+        }
+        catch (DiscordException ex)
+        {
+            _logger.LogWarning(ex, "Failed to test Discord provider");
+            return BadRequest(new { Message = $"Test failed: {ex.Message}" });
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to test Discord provider");
+            return BadRequest(new { Message = $"Test failed: {ex.Message}" });
+        }
+    }
+
+    [HttpPost("pushover")]
+    public async Task<IActionResult> CreatePushoverProvider([FromBody] CreatePushoverProviderRequest newProvider)
+    {
+        await DataContext.Lock.WaitAsync();
+        try
+        {
+            if (string.IsNullOrWhiteSpace(newProvider.Name))
+            {
+                return BadRequest("Provider name is required");
+            }
+
+            var duplicateConfig = await _dataContext.NotificationConfigs.CountAsync(x => x.Name == newProvider.Name);
+            if (duplicateConfig > 0)
+            {
+                return BadRequest("A provider with this name already exists");
+            }
+
+            var pushoverConfig = new PushoverConfig
+            {
+                ApiToken = newProvider.ApiToken,
+                UserKey = newProvider.UserKey,
+                Devices = newProvider.Devices,
+                Priority = newProvider.Priority,
+                Sound = newProvider.Sound,
+                Retry = newProvider.Retry,
+                Expire = newProvider.Expire,
+                Tags = newProvider.Tags
+            };
+            pushoverConfig.Validate();
+
+            var provider = new NotificationConfig
+            {
+                Name = newProvider.Name,
+                Type = NotificationProviderType.Pushover,
+                IsEnabled = newProvider.IsEnabled,
+                OnFailedImportStrike = newProvider.OnFailedImportStrike,
+                OnStalledStrike = newProvider.OnStalledStrike,
+                OnSlowStrike = newProvider.OnSlowStrike,
+                OnQueueItemDeleted = newProvider.OnQueueItemDeleted,
+                OnDownloadCleaned = newProvider.OnDownloadCleaned,
+                OnCategoryChanged = newProvider.OnCategoryChanged,
+                PushoverConfiguration = pushoverConfig
+            };
+
+            _dataContext.NotificationConfigs.Add(provider);
+            await _dataContext.SaveChangesAsync();
+
+            await _notificationConfigurationService.InvalidateCacheAsync();
+
+            var providerDto = MapProvider(provider);
+            return CreatedAtAction(nameof(GetNotificationProviders), new { id = provider.Id }, providerDto);
+        }
+        catch (ValidationException ex)
+        {
+            return BadRequest(ex.Message);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to create Pushover provider");
+            throw;
+        }
+        finally
+        {
+            DataContext.Lock.Release();
+        }
+    }
+
+    [HttpPut("pushover/{id:guid}")]
+    public async Task<IActionResult> UpdatePushoverProvider(Guid id, [FromBody] UpdatePushoverProviderRequest updatedProvider)
+    {
+        await DataContext.Lock.WaitAsync();
+        try
+        {
+            var existingProvider = await _dataContext.NotificationConfigs
+                .Include(p => p.PushoverConfiguration)
+                .FirstOrDefaultAsync(p => p.Id == id && p.Type == NotificationProviderType.Pushover);
+
+            if (existingProvider == null)
+            {
+                return NotFound($"Pushover provider with ID {id} not found");
+            }
+
+            if (string.IsNullOrWhiteSpace(updatedProvider.Name))
+            {
+                return BadRequest("Provider name is required");
+            }
+
+            var duplicateConfig = await _dataContext.NotificationConfigs
+                .Where(x => x.Id != id)
+                .Where(x => x.Name == updatedProvider.Name)
+                .CountAsync();
+            if (duplicateConfig > 0)
+            {
+                return BadRequest("A provider with this name already exists");
+            }
+
+            var pushoverConfig = new PushoverConfig
+            {
+                ApiToken = updatedProvider.ApiToken,
+                UserKey = updatedProvider.UserKey,
+                Devices = updatedProvider.Devices,
+                Priority = updatedProvider.Priority,
+                Sound = updatedProvider.Sound,
+                Retry = updatedProvider.Retry,
+                Expire = updatedProvider.Expire,
+                Tags = updatedProvider.Tags
+            };
+
+            if (existingProvider.PushoverConfiguration != null)
+            {
+                pushoverConfig = pushoverConfig with { Id = existingProvider.PushoverConfiguration.Id };
+            }
+            pushoverConfig.Validate();
+
+            var newProvider = existingProvider with
+            {
+                Name = updatedProvider.Name,
+                IsEnabled = updatedProvider.IsEnabled,
+                OnFailedImportStrike = updatedProvider.OnFailedImportStrike,
+                OnStalledStrike = updatedProvider.OnStalledStrike,
+                OnSlowStrike = updatedProvider.OnSlowStrike,
+                OnQueueItemDeleted = updatedProvider.OnQueueItemDeleted,
+                OnDownloadCleaned = updatedProvider.OnDownloadCleaned,
+                OnCategoryChanged = updatedProvider.OnCategoryChanged,
+                PushoverConfiguration = pushoverConfig,
+                UpdatedAt = DateTime.UtcNow
+            };
+
+            _dataContext.NotificationConfigs.Remove(existingProvider);
+            _dataContext.NotificationConfigs.Add(newProvider);
+
+            await _dataContext.SaveChangesAsync();
+            await _notificationConfigurationService.InvalidateCacheAsync();
+
+            var providerDto = MapProvider(newProvider);
+            return Ok(providerDto);
+        }
+        catch (ValidationException ex)
+        {
+            return BadRequest(ex.Message);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to update Pushover provider with ID {Id}", id);
+            throw;
+        }
+        finally
+        {
+            DataContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("pushover/test")]
+    public async Task<IActionResult> TestPushoverProvider([FromBody] TestPushoverProviderRequest testRequest)
+    {
+        try
+        {
+            var pushoverConfig = new PushoverConfig
+            {
+                ApiToken = testRequest.ApiToken,
+                UserKey = testRequest.UserKey,
+                Devices = testRequest.Devices,
+                Priority = testRequest.Priority,
+                Sound = testRequest.Sound,
+                Retry = testRequest.Retry,
+                Expire = testRequest.Expire,
+                Tags = testRequest.Tags
+            };
+            pushoverConfig.Validate();
+
+            var providerDto = new NotificationProviderDto
+            {
+                Id = Guid.NewGuid(),
+                Name = "Test Provider",
+                Type = NotificationProviderType.Pushover,
+                IsEnabled = true,
+                Events = new NotificationEventFlags
+                {
+                    OnFailedImportStrike = true,
+                    OnStalledStrike = false,
+                    OnSlowStrike = false,
+                    OnQueueItemDeleted = false,
+                    OnDownloadCleaned = false,
+                    OnCategoryChanged = false
+                },
+                Configuration = pushoverConfig
+            };
+
+            await _notificationService.SendTestNotificationAsync(providerDto);
+            return Ok(new { Message = "Test notification sent successfully" });
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to test Pushover provider");
+            return BadRequest(new { Message = $"Test failed: {ex.Message}" });
+        }
+    }
+
+    [HttpPost("gotify")]
+    public async Task<IActionResult> CreateGotifyProvider([FromBody] CreateGotifyProviderRequest newProvider)
+    {
+        await DataContext.Lock.WaitAsync();
+        try
+        {
+            if (string.IsNullOrWhiteSpace(newProvider.Name))
+            {
+                return BadRequest("Provider name is required");
+            }
+
+            var duplicateConfig = await _dataContext.NotificationConfigs.CountAsync(x => x.Name == newProvider.Name);
+            if (duplicateConfig > 0)
+            {
+                return BadRequest("A provider with this name already exists");
+            }
+
+            var gotifyConfig = new GotifyConfig
+            {
+                ServerUrl = newProvider.ServerUrl,
+                ApplicationToken = newProvider.ApplicationToken,
+                Priority = newProvider.Priority
+            };
+            gotifyConfig.Validate();
+
+            var provider = new NotificationConfig
+            {
+                Name = newProvider.Name,
+                Type = NotificationProviderType.Gotify,
+                IsEnabled = newProvider.IsEnabled,
+                OnFailedImportStrike = newProvider.OnFailedImportStrike,
+                OnStalledStrike = newProvider.OnStalledStrike,
+                OnSlowStrike = newProvider.OnSlowStrike,
+                OnQueueItemDeleted = newProvider.OnQueueItemDeleted,
+                OnDownloadCleaned = newProvider.OnDownloadCleaned,
+                OnCategoryChanged = newProvider.OnCategoryChanged,
+                GotifyConfiguration = gotifyConfig
+            };
+
+            _dataContext.NotificationConfigs.Add(provider);
+            await _dataContext.SaveChangesAsync();
+
+            await _notificationConfigurationService.InvalidateCacheAsync();
+
+            var providerDto = MapProvider(provider);
+            return CreatedAtAction(nameof(GetNotificationProviders), new { id = provider.Id }, providerDto);
+        }
+        catch (ValidationException ex)
+        {
+            return BadRequest(ex.Message);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to create Gotify provider");
+            throw;
+        }
+        finally
+        {
+            DataContext.Lock.Release();
+        }
+    }
+
+    [HttpPut("gotify/{id:guid}")]
+    public async Task<IActionResult> UpdateGotifyProvider(Guid id, [FromBody] UpdateGotifyProviderRequest updatedProvider)
+    {
+        await DataContext.Lock.WaitAsync();
+        try
+        {
+            var existingProvider = await _dataContext.NotificationConfigs
+                .Include(p => p.GotifyConfiguration)
+                .FirstOrDefaultAsync(p => p.Id == id && p.Type == NotificationProviderType.Gotify);
+
+            if (existingProvider == null)
+            {
+                return NotFound($"Gotify provider with ID {id} not found");
+            }
+
+            if (string.IsNullOrWhiteSpace(updatedProvider.Name))
+            {
+                return BadRequest("Provider name is required");
+            }
+
+            var duplicateConfig = await _dataContext.NotificationConfigs
+                .Where(x => x.Id != id)
+                .Where(x => x.Name == updatedProvider.Name)
+                .CountAsync();
+            if (duplicateConfig > 0)
+            {
+                return BadRequest("A provider with this name already exists");
+            }
+
+            var gotifyConfig = new GotifyConfig
+            {
+                ServerUrl = updatedProvider.ServerUrl,
+                ApplicationToken = updatedProvider.ApplicationToken,
+                Priority = updatedProvider.Priority
+            };
+
+            if (existingProvider.GotifyConfiguration != null)
+            {
+                gotifyConfig = gotifyConfig with { Id = existingProvider.GotifyConfiguration.Id };
+            }
+            gotifyConfig.Validate();
+
+            var newProvider = existingProvider with
+            {
+                Name = updatedProvider.Name,
+                IsEnabled = updatedProvider.IsEnabled,
+                OnFailedImportStrike = updatedProvider.OnFailedImportStrike,
+                OnStalledStrike = updatedProvider.OnStalledStrike,
+                OnSlowStrike = updatedProvider.OnSlowStrike,
+                OnQueueItemDeleted = updatedProvider.OnQueueItemDeleted,
+                OnDownloadCleaned = updatedProvider.OnDownloadCleaned,
+                OnCategoryChanged = updatedProvider.OnCategoryChanged,
+                GotifyConfiguration = gotifyConfig,
+                UpdatedAt = DateTime.UtcNow
+            };
+
+            _dataContext.NotificationConfigs.Remove(existingProvider);
+            _dataContext.NotificationConfigs.Add(newProvider);
+
+            await _dataContext.SaveChangesAsync();
+            await _notificationConfigurationService.InvalidateCacheAsync();
+
+            var providerDto = MapProvider(newProvider);
+            return Ok(providerDto);
+        }
+        catch (ValidationException ex)
+        {
+            return BadRequest(ex.Message);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to update Gotify provider with ID {Id}", id);
+            throw;
+        }
+        finally
+        {
+            DataContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("gotify/test")]
+    public async Task<IActionResult> TestGotifyProvider([FromBody] TestGotifyProviderRequest testRequest)
+    {
+        try
+        {
+            var gotifyConfig = new GotifyConfig
+            {
+                ServerUrl = testRequest.ServerUrl,
+                ApplicationToken = testRequest.ApplicationToken,
+                Priority = testRequest.Priority
+            };
+            gotifyConfig.Validate();
+
+            var providerDto = new NotificationProviderDto
+            {
+                Id = Guid.NewGuid(),
+                Name = "Test Provider",
+                Type = NotificationProviderType.Gotify,
+                IsEnabled = true,
+                Events = new NotificationEventFlags
+                {
+                    OnFailedImportStrike = true,
+                    OnStalledStrike = false,
+                    OnSlowStrike = false,
+                    OnQueueItemDeleted = false,
+                    OnDownloadCleaned = false,
+                    OnCategoryChanged = false
+                },
+                Configuration = gotifyConfig
+            };
+
+            await _notificationService.SendTestNotificationAsync(providerDto);
+            return Ok(new { Message = "Test notification sent successfully" });
+        }
+        catch (GotifyException ex)
+        {
+            _logger.LogWarning(ex, "Failed to test Gotify provider");
+            return BadRequest(new { Message = $"Test failed: {ex.Message}" });
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to test Gotify provider");
+            return BadRequest(new { Message = $"Test failed: {ex.Message}" });
+        }
+    }
 }

code/backend/Cleanuparr.Api/Features/QueueCleaner/Controllers/QueueCleanerConfigController.cs

@@ -1,7 +1,7 @@
 using System.ComponentModel.DataAnnotations;
 
 using Cleanuparr.Api.Features.QueueCleaner.Contracts.Requests;
-using Cleanuparr.Infrastructure.Models;
+using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Cleanuparr.Infrastructure.Utilities;
 using Cleanuparr.Persistence;

code/backend/Cleanuparr.Api/HostExtensions.cs

@@ -63,7 +63,14 @@ public static class HostExtensions
         {
             await configContext.Database.MigrateAsync();
         }
-        
+
+        // Apply users db migrations
+        await using var usersContext = UsersContext.CreateStaticInstance();
+        if ((await usersContext.Database.GetPendingMigrationsAsync()).Any())
+        {
+            await usersContext.Database.MigrateAsync();
+        }
+
         return builder;
     }
 }

code/backend/Cleanuparr.Api/Jobs/GenericJob.cs

@@ -1,7 +1,12 @@
-using Cleanuparr.Infrastructure.Features.Jobs;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Features.Context;
+using Cleanuparr.Infrastructure.Features.Jobs;
+using Cleanuparr.Infrastructure.Helpers;
 using Cleanuparr.Infrastructure.Hubs;
 using Cleanuparr.Infrastructure.Models;
 using Cleanuparr.Infrastructure.Services.Interfaces;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.State;
 using Microsoft.AspNetCore.SignalR;
 using Quartz;
 using Serilog.Context;
@@ -14,48 +19,73 @@ public sealed class GenericJob<T> : IJob
 {
     private readonly ILogger<GenericJob<T>> _logger;
     private readonly IServiceScopeFactory _scopeFactory;
-    
+
     public GenericJob(ILogger<GenericJob<T>> logger, IServiceScopeFactory scopeFactory)
     {
         _logger = logger;
         _scopeFactory = scopeFactory;
     }
-    
+
     public async Task Execute(IJobExecutionContext context)
     {
         using var _ = LogContext.PushProperty("JobName", typeof(T).Name);
-        
+
+        Guid jobRunId = Guid.CreateVersion7();
+        JobType jobType = Enum.Parse<JobType>(typeof(T).Name);
+        JobRunStatus? status = null;
+
         try
         {
             await using var scope = _scopeFactory.CreateAsyncScope();
+            var eventsContext = scope.ServiceProvider.GetRequiredService<EventsContext>();
             var hubContext = scope.ServiceProvider.GetRequiredService<IHubContext<AppHub>>();
             var jobManagementService = scope.ServiceProvider.GetRequiredService<IJobManagementService>();
-            
-            await BroadcastJobStatus(hubContext, jobManagementService, false);
-            
+
+            var jobRun = new JobRun { Id = jobRunId, Type = jobType };
+            eventsContext.JobRuns.Add(jobRun);
+            await eventsContext.SaveChangesAsync();
+
+            ContextProvider.SetJobRunId(jobRunId);
+            using var __ = LogContext.PushProperty(LogProperties.JobRunId, jobRunId.ToString());
+
+            await BroadcastJobStatus(hubContext, jobManagementService, jobType, false);
+
             var handler = scope.ServiceProvider.GetRequiredService<T>();
             await handler.ExecuteAsync();
-            
-            await BroadcastJobStatus(hubContext, jobManagementService, true);
+
+            status = JobRunStatus.Completed;
+            await BroadcastJobStatus(hubContext, jobManagementService, jobType, true);
         }
         catch (Exception ex)
         {
             _logger.LogError(ex, "{name} failed", typeof(T).Name);
+            status = JobRunStatus.Failed;
+        }
+        finally
+        {
+            await using var finalScope = _scopeFactory.CreateAsyncScope();
+            var eventsContext = finalScope.ServiceProvider.GetRequiredService<EventsContext>();
+            var jobRun = await eventsContext.JobRuns.FindAsync(jobRunId);
+            if (jobRun is not null)
+            {
+                jobRun.CompletedAt = DateTime.UtcNow;
+                jobRun.Status = status;
+                await eventsContext.SaveChangesAsync();
+            }
         }
     }
-    
-    private async Task BroadcastJobStatus(IHubContext<AppHub> hubContext, IJobManagementService jobManagementService, bool isFinished)
+
+    private async Task BroadcastJobStatus(IHubContext<AppHub> hubContext, IJobManagementService jobManagementService, JobType jobType, bool isFinished)
     {
         try
         {
-            JobType jobType = Enum.Parse<JobType>(typeof(T).Name);
             JobInfo jobInfo = await jobManagementService.GetJob(jobType);
 
             if (isFinished)
             {
                 jobInfo.Status = "Scheduled";
             }
-            
+
             await hubContext.Clients.All.SendAsync("JobStatusUpdate", jobInfo);
         }
         catch (Exception ex)

code/backend/Cleanuparr.Api/Middleware/SetupGuardMiddleware.cs

@@ -0,0 +1,66 @@
+using Cleanuparr.Persistence;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Api.Middleware;
+
+public class SetupGuardMiddleware
+{
+    private readonly RequestDelegate _next;
+    private volatile bool _setupCompleted;
+
+    public SetupGuardMiddleware(RequestDelegate next)
+    {
+        _next = next;
+    }
+
+    public async Task InvokeAsync(HttpContext context)
+    {
+        // Fast path: setup already completed
+        if (_setupCompleted)
+        {
+            await _next(context);
+            return;
+        }
+
+        var path = context.Request.Path.Value?.ToLowerInvariant() ?? "";
+
+        // Always allow these paths regardless of setup state
+        if (IsAllowedPath(path))
+        {
+            await _next(context);
+            return;
+        }
+
+        // Check database for setup completion
+        await using var usersContext = UsersContext.CreateStaticInstance();
+        var user = await usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+
+        if (user is { SetupCompleted: true })
+        {
+            _setupCompleted = true;
+            await _next(context);
+            return;
+        }
+
+        // Setup not complete - block non-auth requests
+        context.Response.StatusCode = StatusCodes.Status403Forbidden;
+        context.Response.ContentType = "application/json";
+        await context.Response.WriteAsJsonAsync(new { error = "Setup required" });
+    }
+
+    /// <summary>
+    /// Resets the cached setup state. Call this if the user database is reset.
+    /// </summary>
+    public void ResetSetupState()
+    {
+        _setupCompleted = false;
+    }
+
+    private static bool IsAllowedPath(string path)
+    {
+        return path.StartsWith("/api/auth/")
+               || path == "/api/auth"
+               || path.StartsWith("/health")
+               || !path.StartsWith("/api/");
+    }
+}

code/backend/Cleanuparr.Api/Models/UpdateDownloadCleanerConfigDto.cs

@@ -1,23 +0,0 @@
-using System.Diagnostics.CodeAnalysis;
-
-using Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests;
-
-namespace Cleanuparr.Api.Models;
-
-/// <summary>
-/// Legacy namespace shim; prefer <see cref="UpdateDownloadCleanerConfigRequest"/> from
-/// <c>Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests</c>.
-/// </summary>
-[Obsolete("Use Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests.UpdateDownloadCleanerConfigRequest instead")]
-[SuppressMessage("Design", "CA1000", Justification = "Temporary alias during refactor")]
-[SuppressMessage("Usage", "CA2225", Justification = "Alias type")]
-public record UpdateDownloadCleanerConfigDto : UpdateDownloadCleanerConfigRequest;
-
-/// <summary>
-/// Legacy namespace shim; prefer <see cref="CleanCategoryRequest"/> from
-/// <c>Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests</c>.
-/// </summary>
-[Obsolete("Use Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests.CleanCategoryRequest instead")]
-[SuppressMessage("Design", "CA1000", Justification = "Temporary alias during refactor")]
-[SuppressMessage("Usage", "CA2225", Justification = "Alias type")]
-public record CleanCategoryDto : CleanCategoryRequest;

code/backend/Cleanuparr.Api/Program.cs

@@ -1,7 +1,9 @@
+using System.Net;
 using System.Runtime.InteropServices;
 using System.Text.Json.Serialization;
 using Cleanuparr.Api;
 using Cleanuparr.Api.DependencyInjection;
+using Microsoft.AspNetCore.DataProtection;
 using Cleanuparr.Infrastructure.Hubs;
 using Cleanuparr.Infrastructure.Logging;
 using Cleanuparr.Shared.Helpers;
@@ -33,12 +35,24 @@ builder.Configuration
 int.TryParse(builder.Configuration.GetValue<string>("PORT"), out int port);
 port = port is 0 ? 11011 : port;
 
+string? bindAddress = builder.Configuration.GetValue<string>("BIND_ADDRESS");
+
 if (!builder.Environment.IsDevelopment())
 {
-    // If no port is configured, default to 11011
     builder.WebHost.ConfigureKestrel(options =>
     {
-        options.ListenAnyIP(port);
+        if (string.IsNullOrEmpty(bindAddress) || bindAddress is "0.0.0.0" || bindAddress is "*")
+        {
+            options.ListenAnyIP(port);
+        }
+        else if (IPAddress.TryParse(bindAddress, out var ipAddress))
+        {
+            options.Listen(ipAddress, port);
+        }
+        else
+        {
+            throw new ArgumentException($"Invalid BIND_ADDRESS: '{bindAddress}'");
+        }
     });
 }
 
@@ -57,12 +71,19 @@ builder.Services.ConfigureHttpJsonOptions(options =>
 // Add services to the container
 builder.Services
     .AddInfrastructure(builder.Configuration)
-    .AddApiServices();
+    .AddApiServices()
+    .AddAuthServices();
+
+// Persist Data Protection keys to the config directory
+builder.Services
+    .AddDataProtection()
+    .PersistKeysToFileSystem(new DirectoryInfo(Path.Combine(ConfigurationPathProvider.GetConfigPath(), "DataProtection-Keys")))
+    .SetApplicationName("Cleanuparr");
 
 // Add CORS before SignalR
-builder.Services.AddCors(options => 
+builder.Services.AddCors(options =>
 {
-    options.AddPolicy("Any", policy => 
+    options.AddPolicy("Any", policy =>
     {
         policy
             // https://github.com/dotnet/aspnetcore/issues/4457#issuecomment-465669576
@@ -124,7 +145,7 @@ if (basePath is not null)
     }
 }
 
-logger.LogInformation("Server configuration: PORT={port}, BASE_PATH={basePath}", port, basePath ?? "/");
+logger.LogInformation("Server configuration: BIND_ADDRESS={bindAddress}, PORT={port}, BASE_PATH={basePath}", bindAddress ?? "0.0.0.0", port, basePath ?? "/");
 
 // Initialize the host
 app.Init();
@@ -133,14 +154,14 @@ app.Init();
 var appHub = app.Services.GetRequiredService<IHubContext<AppHub>>();
 SignalRLogSink.Instance.SetAppHubContext(appHub);
 
-// Configure health check endpoints before the API configuration
-app.MapHealthChecks("/health", new HealthCheckOptions
+// Configure health check endpoints as middleware (before auth pipeline) so they don't require authentication
+app.UseHealthChecks("/health", new HealthCheckOptions
 {
     Predicate = registration => registration.Tags.Contains("liveness"),
     ResponseWriter = HealthCheckResponseWriter.WriteMinimalPlaintext
 });
 
-app.MapHealthChecks("/health/ready", new HealthCheckOptions
+app.UseHealthChecks("/health/ready", new HealthCheckOptions
 {
     Predicate = registration => registration.Tags.Contains("readiness"),
     ResponseWriter = HealthCheckResponseWriter.WriteMinimalPlaintext

code/backend/Cleanuparr.Domain/Cleanuparr.Domain.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
     <PropertyGroup>
-        <TargetFramework>net9.0</TargetFramework>
+        <TargetFramework>net10.0</TargetFramework>
         <ImplicitUsings>enable</ImplicitUsings>
         <Nullable>enable</Nullable>
     </PropertyGroup>

code/backend/Cleanuparr.Domain/Entities/Arr/Queue/QueueRecord.cs

@@ -2,17 +2,17 @@ namespace Cleanuparr.Domain.Entities.Arr.Queue;
 
 public sealed record QueueRecord
 {
-    // Sonarr and Whisparr
+    // Sonarr and Whisparr v2
     public long SeriesId { get; init; }
     public long EpisodeId { get; init; }
     public long SeasonNumber { get; init; }
     
     public QueueSeries? Series { get; init; }
     
-    // Radarr
+    // Radarr and Whisparr v3
     public long MovieId { get; init; }
     
-    public QueueSeries? Movie { get; init; }
+    public QueueMovie? Movie { get; init; }
     
     // Lidarr
     public long ArtistId { get; init; }

code/backend/Cleanuparr.Domain/Entities/HealthCheck/HealthCheckResult.cs

@@ -0,0 +1,10 @@
+namespace Cleanuparr.Domain.Entities.HealthCheck;
+
+public sealed record HealthCheckResult
+{
+    public bool IsHealthy { get; set; }
+    
+    public string? ErrorMessage { get; set; }
+    
+    public TimeSpan ResponseTime { get; set; }
+}

code/backend/Cleanuparr.Domain/Entities/ITorrentItemWrapper.cs

@@ -4,49 +4,34 @@ namespace Cleanuparr.Domain.Entities;
 /// Universal abstraction for a torrent item across all download clients.
 /// Provides a unified interface for accessing torrent properties and state.
 /// </summary>
-public interface ITorrentItem
+public interface ITorrentItemWrapper
 {
-    // Basic identification
     string Hash { get; }
+    
     string Name { get; }
 
-    // Privacy and tracking
     bool IsPrivate { get; }
-    IReadOnlyList<string> Trackers { get; }
 
-    // Size and progress
     long Size { get; }
+    
     double CompletionPercentage { get; }
+    
     long DownloadedBytes { get; }
-    long TotalUploaded { get; }
 
-    // Speed and transfer rates
     long DownloadSpeed { get; }
-    long UploadSpeed { get; }
+    
     double Ratio { get; }
 
-    // Time tracking
     long Eta { get; }
-    DateTime? DateAdded { get; }
-    DateTime? DateCompleted { get; }
+    
     long SeedingTimeSeconds { get; }
 
-    // Categories and tags
-    string? Category { get; }
-    IReadOnlyList<string> Tags { get; }
+    string? Category { get; set; }
 
-    // State checking methods
     bool IsDownloading();
+    
     bool IsStalled();
-    bool IsSeeding();
-    bool IsCompleted();
-    bool IsPaused();
-    bool IsQueued();
-    bool IsChecking();
-    bool IsAllocating();
-    bool IsMetadataDownloading();
 
-    // Filtering methods
     /// <summary>
     /// Determines if this torrent should be ignored based on the provided patterns.
     /// Checks if any pattern matches the torrent name, hash, or tracker.

code/backend/Cleanuparr.Domain/Entities/Whisparr/WhisparrV2Command.cs

@@ -2,7 +2,7 @@ using Cleanuparr.Domain.Enums;
 
 namespace Cleanuparr.Domain.Entities.Whisparr;
 
-public sealed record WhisparrCommand
+public sealed record WhisparrV2Command
 {
     public string Name { get; set; }
 

code/backend/Cleanuparr.Domain/Entities/Whisparr/WhisparrV3Command.cs

@@ -0,0 +1,8 @@
+namespace Cleanuparr.Domain.Entities.Whisparr;
+
+public sealed record WhisparrV3Command
+{
+    public required string Name { get; init; }
+    
+    public required List<long> MovieIds { get; init; }
+}

code/backend/Cleanuparr.Domain/Enums/AppriseMode.cs

@@ -0,0 +1,7 @@
+namespace Cleanuparr.Domain.Enums;
+
+public enum AppriseMode
+{
+    Api,
+    Cli
+}

code/backend/Cleanuparr.Domain/Enums/JobRunStatus.cs

@@ -0,0 +1,7 @@
+namespace Cleanuparr.Domain.Enums;
+
+public enum JobRunStatus
+{
+    Completed,
+    Failed
+}

code/backend/Cleanuparr.Domain/Enums/JobType.cs

@@ -0,0 +1,9 @@
+namespace Cleanuparr.Domain.Enums;
+
+public enum JobType
+{
+    QueueCleaner,
+    MalwareBlocker,
+    DownloadCleaner,
+    BlacklistSynchronizer,
+}

code/backend/Cleanuparr.Domain/Enums/NotificationProviderType.cs

@@ -4,5 +4,9 @@ public enum NotificationProviderType
 {
     Notifiarr,
     Apprise,
-    Ntfy
+    Ntfy,
+    Pushover,
+    Telegram,
+    Discord,
+    Gotify,
 }

code/backend/Cleanuparr.Domain/Enums/PushoverPriority.cs

@@ -0,0 +1,10 @@
+namespace Cleanuparr.Domain.Enums;
+
+public enum PushoverPriority
+{
+    Lowest = -2,
+    Low = -1,
+    Normal = 0,
+    High = 1,
+    Emergency = 2
+}

code/backend/Cleanuparr.Domain/Enums/PushoverSound.cs

@@ -0,0 +1,36 @@
+namespace Cleanuparr.Domain.Enums;
+
+public static class PushoverSounds
+{
+    public const string Pushover = "pushover";
+    public const string Bike = "bike";
+    public const string Bugle = "bugle";
+    public const string Cashregister = "cashregister";
+    public const string Classical = "classical";
+    public const string Cosmic = "cosmic";
+    public const string Falling = "falling";
+    public const string Gamelan = "gamelan";
+    public const string Incoming = "incoming";
+    public const string Intermission = "intermission";
+    public const string Magic = "magic";
+    public const string Mechanical = "mechanical";
+    public const string Pianobar = "pianobar";
+    public const string Siren = "siren";
+    public const string Spacealarm = "spacealarm";
+    public const string Tugboat = "tugboat";
+    public const string Alien = "alien";
+    public const string Climb = "climb";
+    public const string Persistent = "persistent";
+    public const string Echo = "echo";
+    public const string Updown = "updown";
+    public const string Vibrate = "vibrate";
+    public const string None = "none";
+
+    public static readonly string[] All =
+    [
+        Pushover, Bike, Bugle, Cashregister, Classical, Cosmic, Falling,
+        Gamelan, Incoming, Intermission, Magic, Mechanical, Pianobar,
+        Siren, Spacealarm, Tugboat, Alien, Climb, Persistent, Echo,
+        Updown, Vibrate, None
+    ];
+}

code/backend/Cleanuparr.Infrastructure.Tests/Cleanuparr.Infrastructure.Tests.csproj

@@ -1,11 +1,15 @@
-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
 
     <PropertyGroup>
-        <TargetFramework>net9.0</TargetFramework>
+        <TargetFramework>net10.0</TargetFramework>
         <ImplicitUsings>enable</ImplicitUsings>
         <Nullable>enable</Nullable>
     </PropertyGroup>
 
+    <ItemGroup>
+        <Content Include="xunit.runner.json" CopyToOutputDirectory="PreserveNewest" />
+    </ItemGroup>
+
     <ItemGroup>
       <ProjectReference Include="..\Cleanuparr.Infrastructure\Cleanuparr.Infrastructure.csproj" />
     </ItemGroup>
@@ -15,8 +19,9 @@
             <PrivateAssets>all</PrivateAssets>
             <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
         </PackageReference>
-        <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="9.0.6" />
-        <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.0" />
+        <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.1" />
+        <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.1" />
+        <PackageReference Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.0.1" />
         <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.0.1" />
         <PackageReference Include="Moq" Version="4.20.72" />
         <PackageReference Include="NSubstitute" Version="5.3.0" />
@@ -26,6 +31,10 @@
         <PackageReference Include="Serilog.Sinks.File" Version="7.0.0" />
         <PackageReference Include="Shouldly" Version="4.3.0" />
         <PackageReference Include="xunit" Version="2.9.3" />
+        <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
+            <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+            <PrivateAssets>all</PrivateAssets>
+        </PackageReference>
     </ItemGroup>
 
 </Project>

code/backend/Cleanuparr.Infrastructure.Tests/Events/EventCleanupServiceIntegrationTests.cs

@@ -0,0 +1,130 @@
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Events;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Events;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Moq;
+using Xunit;
+
+namespace Cleanuparr.Infrastructure.Tests.Events;
+
+/// <summary>
+/// Integration tests for the cleanup logic that actually deletes events
+/// </summary>
+public class EventCleanupServiceIntegrationTests : IDisposable
+{
+    private readonly EventsContext _context;
+    private readonly Mock<ILogger<EventCleanupService>> _loggerMock;
+    private readonly IServiceProvider _serviceProvider;
+    private readonly string _dbName;
+
+    public EventCleanupServiceIntegrationTests()
+    {
+        _dbName = Guid.NewGuid().ToString();
+        var services = new ServiceCollection();
+
+        // Setup in-memory database
+        services.AddDbContext<EventsContext>(options =>
+            options.UseInMemoryDatabase(databaseName: _dbName));
+
+        _serviceProvider = services.BuildServiceProvider();
+        _loggerMock = new Mock<ILogger<EventCleanupService>>();
+
+        using var scope = _serviceProvider.CreateScope();
+        _context = scope.ServiceProvider.GetRequiredService<EventsContext>();
+    }
+
+    public void Dispose()
+    {
+        using var scope = _serviceProvider.CreateScope();
+        var context = scope.ServiceProvider.GetRequiredService<EventsContext>();
+        context.Database.EnsureDeleted();
+    }
+
+    [Fact]
+    public async Task CleanupService_PreservesRecentEvents()
+    {
+        // Arrange - Add recent events (within retention period)
+        using (var scope = _serviceProvider.CreateScope())
+        {
+            var context = scope.ServiceProvider.GetRequiredService<EventsContext>();
+
+            context.Events.Add(new AppEvent
+            {
+                Id = Guid.NewGuid(),
+                EventType = EventType.QueueItemDeleted,
+                Message = "Recent event 1",
+                Severity = EventSeverity.Information,
+                Timestamp = DateTime.UtcNow.AddDays(-5)
+            });
+            context.Events.Add(new AppEvent
+            {
+                Id = Guid.NewGuid(),
+                EventType = EventType.DownloadCleaned,
+                Message = "Recent event 2",
+                Severity = EventSeverity.Important,
+                Timestamp = DateTime.UtcNow.AddDays(-10)
+            });
+
+            await context.SaveChangesAsync();
+        }
+
+        // Verify events exist
+        using (var scope = _serviceProvider.CreateScope())
+        {
+            var context = scope.ServiceProvider.GetRequiredService<EventsContext>();
+            var count = await context.Events.CountAsync();
+            Assert.Equal(2, count);
+        }
+    }
+
+    [Fact]
+    public async Task EventCleanupService_CanStartAndStop()
+    {
+        // Arrange
+        var scopeFactory = _serviceProvider.GetRequiredService<IServiceScopeFactory>();
+        var service = new EventCleanupService(_loggerMock.Object, scopeFactory);
+        var cts = new CancellationTokenSource();
+
+        // Act
+        cts.CancelAfter(100);
+        await service.StartAsync(cts.Token);
+
+        // Give some time for the service to process
+        await Task.Delay(150);
+
+        await service.StopAsync(CancellationToken.None);
+
+        // Assert - the service should complete without throwing
+        Assert.True(true);
+    }
+
+    [Fact]
+    public async Task EventCleanupService_HandlesExceptionsGracefully()
+    {
+        // Arrange
+        // Note: In-memory provider doesn't support ExecuteDeleteAsync,
+        // so the cleanup will fail. This test verifies the service handles errors gracefully.
+        var scopeFactory = _serviceProvider.GetRequiredService<IServiceScopeFactory>();
+        var service = new EventCleanupService(_loggerMock.Object, scopeFactory);
+        var cts = new CancellationTokenSource();
+
+        // Act
+        cts.CancelAfter(100);
+        await service.StartAsync(cts.Token);
+        await Task.Delay(150);
+        await service.StopAsync(CancellationToken.None);
+
+        // Assert - the service should handle the error and continue (log it but not crash)
+        _loggerMock.Verify(
+            x => x.Log(
+                LogLevel.Error,
+                It.IsAny<EventId>(),
+                It.Is<It.IsAnyType>((v, t) => v.ToString()!.Contains("Failed to perform event cleanup")),
+                It.IsAny<Exception>(),
+                It.IsAny<Func<It.IsAnyType, Exception?, string>>()),
+            Times.AtLeastOnce);
+    }
+}

code/backend/Cleanuparr.Infrastructure.Tests/Events/EventCleanupServiceTests.cs

@@ -0,0 +1,130 @@
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Events;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Events;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Moq;
+using Xunit;
+
+namespace Cleanuparr.Infrastructure.Tests.Events;
+
+public class EventCleanupServiceTests : IDisposable
+{
+    private readonly Mock<ILogger<EventCleanupService>> _loggerMock;
+    private readonly ServiceCollection _services;
+    private readonly IServiceProvider _serviceProvider;
+    private readonly string _dbName;
+
+    public EventCleanupServiceTests()
+    {
+        _loggerMock = new Mock<ILogger<EventCleanupService>>();
+        _services = new ServiceCollection();
+        _dbName = Guid.NewGuid().ToString();
+
+        // Setup in-memory database for testing
+        _services.AddDbContext<EventsContext>(options =>
+            options.UseInMemoryDatabase(databaseName: _dbName));
+
+        _serviceProvider = _services.BuildServiceProvider();
+    }
+
+    public void Dispose()
+    {
+        // Cleanup the in-memory database
+        using var scope = _serviceProvider.CreateScope();
+        var context = scope.ServiceProvider.GetRequiredService<EventsContext>();
+        context.Database.EnsureDeleted();
+    }
+
+    [Fact]
+    public async Task ExecuteAsync_LogsStartMessage()
+    {
+        // Arrange
+        var scopeFactory = _serviceProvider.GetRequiredService<IServiceScopeFactory>();
+        var service = new EventCleanupService(_loggerMock.Object, scopeFactory);
+        var cts = new CancellationTokenSource();
+
+        // Act - start and immediately cancel
+        cts.CancelAfter(100);
+        await service.StartAsync(cts.Token);
+        await Task.Delay(200); // Give it time to process
+        await service.StopAsync(CancellationToken.None);
+
+        // Assert
+        _loggerMock.Verify(
+            x => x.Log(
+                LogLevel.Information,
+                It.IsAny<EventId>(),
+                It.Is<It.IsAnyType>((v, t) => v.ToString()!.Contains("started")),
+                It.IsAny<Exception>(),
+                It.IsAny<Func<It.IsAnyType, Exception?, string>>()),
+            Times.Once);
+    }
+
+    [Fact]
+    public async Task StopAsync_LogsStopMessage()
+    {
+        // Arrange
+        var scopeFactory = _serviceProvider.GetRequiredService<IServiceScopeFactory>();
+        var service = new EventCleanupService(_loggerMock.Object, scopeFactory);
+        var cts = new CancellationTokenSource();
+
+        // Act
+        cts.CancelAfter(50);
+        await service.StartAsync(cts.Token);
+        await Task.Delay(100);
+        await service.StopAsync(CancellationToken.None);
+
+        // Assert
+        _loggerMock.Verify(
+            x => x.Log(
+                LogLevel.Information,
+                It.IsAny<EventId>(),
+                It.Is<It.IsAnyType>((v, t) => v.ToString()!.Contains("stopping")),
+                It.IsAny<Exception>(),
+                It.IsAny<Func<It.IsAnyType, Exception?, string>>()),
+            Times.Once);
+    }
+
+    [Fact]
+    public void Constructor_InitializesWithCorrectParameters()
+    {
+        // Arrange
+        var scopeFactory = _serviceProvider.GetRequiredService<IServiceScopeFactory>();
+
+        // Act
+        var service = new EventCleanupService(_loggerMock.Object, scopeFactory);
+
+        // Assert - service should be created without exception
+        Assert.NotNull(service);
+    }
+
+    [Fact]
+    public async Task ExecuteAsync_GracefullyHandlesCancellation()
+    {
+        // Arrange
+        var scopeFactory = _serviceProvider.GetRequiredService<IServiceScopeFactory>();
+        var service = new EventCleanupService(_loggerMock.Object, scopeFactory);
+        var cts = new CancellationTokenSource();
+
+        // Act - cancel immediately
+        cts.Cancel();
+
+        // Start should not throw
+        await service.StartAsync(cts.Token);
+        await Task.Delay(50);
+        await service.StopAsync(CancellationToken.None);
+
+        // Assert - should have logged stopped message
+        _loggerMock.Verify(
+            x => x.Log(
+                LogLevel.Information,
+                It.IsAny<EventId>(),
+                It.Is<It.IsAnyType>((v, t) => v.ToString()!.Contains("stopped")),
+                It.IsAny<Exception>(),
+                It.IsAny<Func<It.IsAnyType, Exception?, string>>()),
+            Times.Once);
+    }
+}

code/backend/Cleanuparr.Infrastructure.Tests/Events/EventPublisherTests.cs

@@ -0,0 +1,526 @@
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Events;
+using Cleanuparr.Infrastructure.Features.Context;
+using Cleanuparr.Infrastructure.Features.Notifications;
+using Cleanuparr.Infrastructure.Hubs;
+using Cleanuparr.Infrastructure.Interceptors;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Configuration.Arr;
+using Cleanuparr.Persistence.Models.Events;
+using Microsoft.AspNetCore.SignalR;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging;
+using Moq;
+using Xunit;
+
+namespace Cleanuparr.Infrastructure.Tests.Events;
+
+public class EventPublisherTests : IDisposable
+{
+    private readonly EventsContext _context;
+    private readonly Mock<IHubContext<AppHub>> _hubContextMock;
+    private readonly Mock<ILogger<EventPublisher>> _loggerMock;
+    private readonly Mock<INotificationPublisher> _notificationPublisherMock;
+    private readonly Mock<IDryRunInterceptor> _dryRunInterceptorMock;
+    private readonly Mock<IClientProxy> _clientProxyMock;
+    private readonly EventPublisher _publisher;
+
+    public EventPublisherTests()
+    {
+        // Setup in-memory database
+        var options = new DbContextOptionsBuilder<EventsContext>()
+            .UseInMemoryDatabase(databaseName: Guid.NewGuid().ToString())
+            .Options;
+        _context = new EventsContext(options);
+
+        // Setup mocks
+        _hubContextMock = new Mock<IHubContext<AppHub>>();
+        _loggerMock = new Mock<ILogger<EventPublisher>>();
+        _notificationPublisherMock = new Mock<INotificationPublisher>();
+        _dryRunInterceptorMock = new Mock<IDryRunInterceptor>();
+        _clientProxyMock = new Mock<IClientProxy>();
+
+        // Setup HubContext to return client proxy
+        var clientsMock = new Mock<IHubClients>();
+        clientsMock.Setup(c => c.All).Returns(_clientProxyMock.Object);
+        _hubContextMock.Setup(h => h.Clients).Returns(clientsMock.Object);
+
+        // Setup dry run interceptor to execute the delegate
+        _dryRunInterceptorMock.Setup(d => d.InterceptAsync(It.IsAny<Delegate>(), It.IsAny<object[]>()))
+            .Returns<Delegate, object[]>(async (del, args) =>
+            {
+                if (del is Func<AppEvent, Task> func && args.Length > 0 && args[0] is AppEvent appEvent)
+                {
+                    await func(appEvent);
+                }
+                else if (del is Func<ManualEvent, Task> manualFunc && args.Length > 0 && args[0] is ManualEvent manualEvent)
+                {
+                    await manualFunc(manualEvent);
+                }
+            });
+
+        _publisher = new EventPublisher(
+            _context,
+            _hubContextMock.Object,
+            _loggerMock.Object,
+            _notificationPublisherMock.Object,
+            _dryRunInterceptorMock.Object);
+
+        // Setup JobRunId in context for tests
+        ContextProvider.SetJobRunId(Guid.NewGuid());
+    }
+
+    public void Dispose()
+    {
+        _context.Database.EnsureDeleted();
+        _context.Dispose();
+    }
+
+    #region PublishAsync Tests
+
+    [Fact]
+    public async Task PublishAsync_SavesEventToDatabase()
+    {
+        // Arrange
+        var eventType = EventType.QueueItemDeleted;
+        var message = "Test message";
+        var severity = EventSeverity.Important;
+
+        // Act
+        await _publisher.PublishAsync(eventType, message, severity);
+
+        // Assert
+        var savedEvent = await _context.Events.FirstOrDefaultAsync();
+        Assert.NotNull(savedEvent);
+        Assert.Equal(eventType, savedEvent.EventType);
+        Assert.Equal(message, savedEvent.Message);
+        Assert.Equal(severity, savedEvent.Severity);
+    }
+
+    [Fact]
+    public async Task PublishAsync_WithData_SerializesDataToJson()
+    {
+        // Arrange
+        var eventType = EventType.DownloadCleaned;
+        var message = "Download cleaned";
+        var severity = EventSeverity.Information;
+        var data = new { Name = "TestDownload", Hash = "abc123" };
+
+        // Act
+        await _publisher.PublishAsync(eventType, message, severity, data);
+
+        // Assert
+        var savedEvent = await _context.Events.FirstOrDefaultAsync();
+        Assert.NotNull(savedEvent);
+        Assert.NotNull(savedEvent.Data);
+        Assert.Contains("TestDownload", savedEvent.Data);
+        Assert.Contains("abc123", savedEvent.Data);
+    }
+
+    [Fact]
+    public async Task PublishAsync_WithTrackingId_SavesTrackingId()
+    {
+        // Arrange
+        var eventType = EventType.StalledStrike;
+        var message = "Strike received";
+        var severity = EventSeverity.Warning;
+        var trackingId = Guid.NewGuid();
+
+        // Act
+        await _publisher.PublishAsync(eventType, message, severity, trackingId: trackingId);
+
+        // Assert
+        var savedEvent = await _context.Events.FirstOrDefaultAsync();
+        Assert.NotNull(savedEvent);
+        Assert.Equal(trackingId, savedEvent.TrackingId);
+    }
+
+    [Fact]
+    public async Task PublishAsync_NotifiesSignalRClients()
+    {
+        // Arrange
+        var eventType = EventType.CategoryChanged;
+        var message = "Category changed";
+        var severity = EventSeverity.Information;
+
+        // Act
+        await _publisher.PublishAsync(eventType, message, severity);
+
+        // Assert
+        _clientProxyMock.Verify(c => c.SendCoreAsync(
+            "EventReceived",
+            It.Is<object[]>(args => args.Length == 1 && args[0] is AppEvent),
+            It.IsAny<CancellationToken>()), Times.Once);
+    }
+
+    [Fact]
+    public async Task PublishAsync_WhenSignalRFails_LogsError()
+    {
+        // Arrange
+        var eventType = EventType.QueueItemDeleted;
+        var message = "Test message";
+        var severity = EventSeverity.Important;
+
+        _clientProxyMock.Setup(c => c.SendCoreAsync(
+                It.IsAny<string>(),
+                It.IsAny<object[]>(),
+                It.IsAny<CancellationToken>()))
+            .ThrowsAsync(new Exception("SignalR connection failed"));
+
+        // Act - should not throw
+        await _publisher.PublishAsync(eventType, message, severity);
+
+        // Assert - verify event was still saved
+        var savedEvent = await _context.Events.FirstOrDefaultAsync();
+        Assert.NotNull(savedEvent);
+    }
+
+    [Fact]
+    public async Task PublishAsync_NullData_DoesNotSerialize()
+    {
+        // Arrange
+        var eventType = EventType.DownloadCleaned;
+        var message = "Test";
+        var severity = EventSeverity.Information;
+
+        // Act
+        await _publisher.PublishAsync(eventType, message, severity, data: null);
+
+        // Assert
+        var savedEvent = await _context.Events.FirstOrDefaultAsync();
+        Assert.NotNull(savedEvent);
+        Assert.Null(savedEvent.Data);
+    }
+
+    #endregion
+
+    #region PublishManualAsync Tests
+
+    [Fact]
+    public async Task PublishManualAsync_SavesManualEventToDatabase()
+    {
+        // Arrange
+        var message = "Manual event message";
+        var severity = EventSeverity.Warning;
+
+        // Act
+        await _publisher.PublishManualAsync(message, severity);
+
+        // Assert
+        var savedEvent = await _context.ManualEvents.FirstOrDefaultAsync();
+        Assert.NotNull(savedEvent);
+        Assert.Equal(message, savedEvent.Message);
+        Assert.Equal(severity, savedEvent.Severity);
+    }
+
+    [Fact]
+    public async Task PublishManualAsync_WithData_SerializesDataToJson()
+    {
+        // Arrange
+        var message = "Manual event";
+        var severity = EventSeverity.Important;
+        var data = new { ItemName = "TestItem", Count = 5 };
+
+        // Act
+        await _publisher.PublishManualAsync(message, severity, data);
+
+        // Assert
+        var savedEvent = await _context.ManualEvents.FirstOrDefaultAsync();
+        Assert.NotNull(savedEvent);
+        Assert.NotNull(savedEvent.Data);
+        Assert.Contains("TestItem", savedEvent.Data);
+        Assert.Contains("5", savedEvent.Data);
+    }
+
+    [Fact]
+    public async Task PublishManualAsync_NotifiesSignalRClients()
+    {
+        // Arrange
+        var message = "Manual event";
+        var severity = EventSeverity.Information;
+
+        // Act
+        await _publisher.PublishManualAsync(message, severity);
+
+        // Assert
+        _clientProxyMock.Verify(c => c.SendCoreAsync(
+            "ManualEventReceived",
+            It.Is<object[]>(args => args.Length == 1 && args[0] is ManualEvent),
+            It.IsAny<CancellationToken>()), Times.Once);
+    }
+
+    #endregion
+
+    #region DryRun Interceptor Tests
+
+    [Fact]
+    public async Task PublishAsync_UsesDryRunInterceptor()
+    {
+        // Arrange
+        var eventType = EventType.StalledStrike;
+        var message = "Test";
+        var severity = EventSeverity.Warning;
+
+        // Act
+        await _publisher.PublishAsync(eventType, message, severity);
+
+        // Assert
+        _dryRunInterceptorMock.Verify(d => d.InterceptAsync(
+            It.IsAny<Delegate>(),
+            It.IsAny<object[]>()), Times.Once);
+    }
+
+    [Fact]
+    public async Task PublishManualAsync_UsesDryRunInterceptor()
+    {
+        // Arrange
+        var message = "Manual test";
+        var severity = EventSeverity.Important;
+
+        // Act
+        await _publisher.PublishManualAsync(message, severity);
+
+        // Assert
+        _dryRunInterceptorMock.Verify(d => d.InterceptAsync(
+            It.IsAny<Delegate>(),
+            It.IsAny<object[]>()), Times.Once);
+    }
+
+    #endregion
+
+    #region Data Serialization Tests
+
+    [Fact]
+    public async Task PublishAsync_SerializesEnumsAsStrings()
+    {
+        // Arrange
+        var eventType = EventType.QueueItemDeleted;
+        var message = "Test";
+        var severity = EventSeverity.Important;
+        var data = new { Reason = DeleteReason.Stalled };
+
+        // Act
+        await _publisher.PublishAsync(eventType, message, severity, data);
+
+        // Assert
+        var savedEvent = await _context.Events.FirstOrDefaultAsync();
+        Assert.NotNull(savedEvent);
+        Assert.NotNull(savedEvent.Data);
+        Assert.Contains("Stalled", savedEvent.Data);
+    }
+
+    [Fact]
+    public async Task PublishAsync_HandlesComplexData()
+    {
+        // Arrange
+        var eventType = EventType.DownloadCleaned;
+        var message = "Test";
+        var severity = EventSeverity.Information;
+        var data = new
+        {
+            Items = new[] { "item1", "item2" },
+            Nested = new { Value = 123 },
+            NullableValue = (string?)null
+        };
+
+        // Act
+        await _publisher.PublishAsync(eventType, message, severity, data);
+
+        // Assert
+        var savedEvent = await _context.Events.FirstOrDefaultAsync();
+        Assert.NotNull(savedEvent);
+        Assert.NotNull(savedEvent.Data);
+        Assert.Contains("item1", savedEvent.Data);
+        Assert.Contains("123", savedEvent.Data);
+    }
+
+    #endregion
+
+    #region PublishQueueItemDeleted Tests
+
+    [Fact]
+    public async Task PublishQueueItemDeleted_SavesEventWithContextData()
+    {
+        // Arrange
+        ContextProvider.Set(ContextProvider.Keys.ItemName, "Test Download");
+        ContextProvider.Set(ContextProvider.Keys.Hash, "abc123");
+
+        // Act
+        await _publisher.PublishQueueItemDeleted(removeFromClient: true, DeleteReason.Stalled);
+
+        // Assert
+        var savedEvent = await _context.Events.FirstOrDefaultAsync();
+        Assert.NotNull(savedEvent);
+        Assert.Equal(EventType.QueueItemDeleted, savedEvent.EventType);
+        Assert.Equal(EventSeverity.Important, savedEvent.Severity);
+        Assert.NotNull(savedEvent.Data);
+        Assert.Contains("Test Download", savedEvent.Data);
+        Assert.Contains("abc123", savedEvent.Data);
+        Assert.Contains("Stalled", savedEvent.Data);
+    }
+
+    [Fact]
+    public async Task PublishQueueItemDeleted_SendsNotification()
+    {
+        // Arrange
+        ContextProvider.Set(ContextProvider.Keys.ItemName, "Test Download");
+        ContextProvider.Set(ContextProvider.Keys.Hash, "abc123");
+
+        // Act
+        await _publisher.PublishQueueItemDeleted(removeFromClient: false, DeleteReason.FailedImport);
+
+        // Assert
+        _notificationPublisherMock.Verify(n => n.NotifyQueueItemDeleted(false, DeleteReason.FailedImport), Times.Once);
+    }
+
+    #endregion
+
+    #region PublishDownloadCleaned Tests
+
+    [Fact]
+    public async Task PublishDownloadCleaned_SavesEventWithContextData()
+    {
+        // Arrange
+        ContextProvider.Set(ContextProvider.Keys.ItemName, "Cleaned Download");
+        ContextProvider.Set(ContextProvider.Keys.Hash, "def456");
+
+        // Act
+        await _publisher.PublishDownloadCleaned(
+            ratio: 2.5,
+            seedingTime: TimeSpan.FromHours(48),
+            categoryName: "movies",
+            reason: CleanReason.MaxSeedTimeReached);
+
+        // Assert
+        var savedEvent = await _context.Events.FirstOrDefaultAsync();
+        Assert.NotNull(savedEvent);
+        Assert.Equal(EventType.DownloadCleaned, savedEvent.EventType);
+        Assert.Equal(EventSeverity.Important, savedEvent.Severity);
+        Assert.NotNull(savedEvent.Data);
+        Assert.Contains("Cleaned Download", savedEvent.Data);
+        Assert.Contains("def456", savedEvent.Data);
+        Assert.Contains("movies", savedEvent.Data);
+        Assert.Contains("MaxSeedTimeReached", savedEvent.Data);
+    }
+
+    [Fact]
+    public async Task PublishDownloadCleaned_SendsNotification()
+    {
+        // Arrange
+        ContextProvider.Set(ContextProvider.Keys.ItemName, "Test");
+        ContextProvider.Set(ContextProvider.Keys.Hash, "xyz");
+
+        var ratio = 1.5;
+        var seedingTime = TimeSpan.FromHours(24);
+        var categoryName = "tv";
+        var reason = CleanReason.MaxRatioReached;
+
+        // Act
+        await _publisher.PublishDownloadCleaned(ratio, seedingTime, categoryName, reason);
+
+        // Assert
+        _notificationPublisherMock.Verify(n => n.NotifyDownloadCleaned(ratio, seedingTime, categoryName, reason), Times.Once);
+    }
+
+    #endregion
+
+    #region PublishSearchNotTriggered Tests
+
+    [Fact]
+    public async Task PublishSearchNotTriggered_SavesManualEvent()
+    {
+        // Arrange
+        ContextProvider.Set(nameof(InstanceType), (object)InstanceType.Sonarr);
+        ContextProvider.Set(ContextProvider.Keys.ArrInstanceUrl, new Uri("http://localhost:8989"));
+
+        // Act
+        await _publisher.PublishSearchNotTriggered("abc123", "Test Item");
+
+        // Assert
+        var savedEvent = await _context.ManualEvents.FirstOrDefaultAsync();
+        Assert.NotNull(savedEvent);
+        Assert.Equal(EventSeverity.Warning, savedEvent.Severity);
+        Assert.Contains("Replacement search was not triggered", savedEvent.Message);
+        Assert.NotNull(savedEvent.Data);
+        Assert.Contains("Test Item", savedEvent.Data);
+        Assert.Contains("abc123", savedEvent.Data);
+    }
+
+    #endregion
+
+    #region PublishRecurringItem Tests
+
+    [Fact]
+    public async Task PublishRecurringItem_SavesManualEvent()
+    {
+        // Arrange
+        ContextProvider.Set(nameof(InstanceType), (object)InstanceType.Radarr);
+        ContextProvider.Set(ContextProvider.Keys.ArrInstanceUrl, new Uri("http://localhost:7878"));
+
+        // Act
+        await _publisher.PublishRecurringItem("hash123", "Recurring Item", 5);
+
+        // Assert
+        var savedEvent = await _context.ManualEvents.FirstOrDefaultAsync();
+        Assert.NotNull(savedEvent);
+        Assert.Equal(EventSeverity.Important, savedEvent.Severity);
+        Assert.Contains("keeps coming back", savedEvent.Message);
+        Assert.NotNull(savedEvent.Data);
+        Assert.Contains("Recurring Item", savedEvent.Data);
+        Assert.Contains("hash123", savedEvent.Data);
+    }
+
+    #endregion
+
+    #region PublishCategoryChanged Tests
+
+    [Fact]
+    public async Task PublishCategoryChanged_SavesEventWithContextData()
+    {
+        // Arrange
+        ContextProvider.Set(ContextProvider.Keys.ItemName, "Category Test");
+        ContextProvider.Set(ContextProvider.Keys.Hash, "cat123");
+
+        // Act
+        await _publisher.PublishCategoryChanged("oldCat", "newCat", isTag: false);
+
+        // Assert
+        var savedEvent = await _context.Events.FirstOrDefaultAsync();
+        Assert.NotNull(savedEvent);
+        Assert.Equal(EventType.CategoryChanged, savedEvent.EventType);
+        Assert.Equal(EventSeverity.Information, savedEvent.Severity);
+        Assert.Contains("Category changed from 'oldCat' to 'newCat'", savedEvent.Message);
+    }
+
+    [Fact]
+    public async Task PublishCategoryChanged_WithTag_SavesCorrectMessage()
+    {
+        // Arrange
+        ContextProvider.Set(ContextProvider.Keys.ItemName, "Tag Test");
+        ContextProvider.Set(ContextProvider.Keys.Hash, "tag123");
+
+        // Act
+        await _publisher.PublishCategoryChanged("", "cleanuperr-done", isTag: true);
+
+        // Assert
+        var savedEvent = await _context.Events.FirstOrDefaultAsync();
+        Assert.NotNull(savedEvent);
+        Assert.Contains("Tag 'cleanuperr-done' added", savedEvent.Message);
+    }
+
+    [Fact]
+    public async Task PublishCategoryChanged_SendsNotification()
+    {
+        // Arrange
+        ContextProvider.Set(ContextProvider.Keys.ItemName, "Test");
+        ContextProvider.Set(ContextProvider.Keys.Hash, "xyz");
+
+        // Act
+        await _publisher.PublishCategoryChanged("old", "new", isTag: true);
+
+        // Assert
+        _notificationPublisherMock.Verify(n => n.NotifyCategoryChanged("old", "new", true), Times.Once);
+    }
+
+    #endregion
+}

code/backend/Cleanuparr.Infrastructure.Tests/Features/Arr/ArrClientFactoryTests.cs

@@ -0,0 +1,147 @@
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Features.Arr;
+using Cleanuparr.Infrastructure.Features.Arr.Interfaces;
+using Moq;
+using Xunit;
+
+namespace Cleanuparr.Infrastructure.Tests.Features.Arr;
+
+public class ArrClientFactoryTests
+{
+    private readonly Mock<ISonarrClient> _sonarrClientMock;
+    private readonly Mock<IRadarrClient> _radarrClientMock;
+    private readonly Mock<ILidarrClient> _lidarrClientMock;
+    private readonly Mock<IReadarrClient> _readarrClientMock;
+    private readonly Mock<IWhisparrV2Client> _whisparrClientMock;
+    private readonly Mock<IWhisparrV3Client> _whisparrV3ClientMock;
+    private readonly ArrClientFactory _factory;
+
+    public ArrClientFactoryTests()
+    {
+        _sonarrClientMock = new Mock<ISonarrClient>();
+        _radarrClientMock = new Mock<IRadarrClient>();
+        _lidarrClientMock = new Mock<ILidarrClient>();
+        _readarrClientMock = new Mock<IReadarrClient>();
+        _whisparrClientMock = new Mock<IWhisparrV2Client>();
+        _whisparrV3ClientMock = new Mock<IWhisparrV3Client>();
+
+        _factory = new ArrClientFactory(
+            _sonarrClientMock.Object,
+            _radarrClientMock.Object,
+            _lidarrClientMock.Object,
+            _readarrClientMock.Object,
+            _whisparrClientMock.Object,
+            _whisparrV3ClientMock.Object
+        );
+    }
+
+    #region GetClient Tests
+
+    [Fact]
+    public void GetClient_Sonarr_ReturnsSonarrClient()
+    {
+        // Act
+        var result = _factory.GetClient(InstanceType.Sonarr, 0);
+
+        // Assert
+        Assert.Same(_sonarrClientMock.Object, result);
+    }
+
+    [Fact]
+    public void GetClient_Radarr_ReturnsRadarrClient()
+    {
+        // Act
+        var result = _factory.GetClient(InstanceType.Radarr, 0);
+
+        // Assert
+        Assert.Same(_radarrClientMock.Object, result);
+    }
+
+    [Fact]
+    public void GetClient_Lidarr_ReturnsLidarrClient()
+    {
+        // Act
+        var result = _factory.GetClient(InstanceType.Lidarr, 0);
+
+        // Assert
+        Assert.Same(_lidarrClientMock.Object, result);
+    }
+
+    [Fact]
+    public void GetClient_Readarr_ReturnsReadarrClient()
+    {
+        // Act
+        var result = _factory.GetClient(InstanceType.Readarr, 0);
+
+        // Assert
+        Assert.Same(_readarrClientMock.Object, result);
+    }
+
+    [Fact]
+    public void GetClient_Whisparr_ReturnsWhisparrClient()
+    {
+        // Act
+        var result = _factory.GetClient(InstanceType.Whisparr, 2);
+
+        // Assert
+        Assert.Same(_whisparrClientMock.Object, result);
+    }
+
+    [Fact]
+    public void GetClient_WhisparrV3_ReturnsWhisparrClient()
+    {
+        // Act
+        var result = _factory.GetClient(InstanceType.Whisparr, 3);
+        
+        // Assert
+        Assert.Same(_whisparrV3ClientMock.Object, result);
+    }
+
+    [Fact]
+    public void GetClient_UnsupportedType_ThrowsNotImplementedException()
+    {
+        // Arrange
+        var unsupportedType = (InstanceType)999;
+
+        // Act & Assert
+        var exception = Assert.Throws<NotImplementedException>(() => _factory.GetClient(unsupportedType, It.IsAny<float>()));
+        Assert.Contains("not yet supported", exception.Message);
+        Assert.Contains("999", exception.Message);
+    }
+
+    [Theory]
+    [MemberData(nameof(InstancesData))]
+    public void GetClient_AllSupportedTypes_ReturnsNonNullClient(InstanceType instanceType, float? version)
+    {
+        // Act
+        var result = _factory.GetClient(instanceType, version ?? 0f);
+
+        // Assert
+        Assert.NotNull(result);
+        Assert.IsAssignableFrom<IArrClient>(result);
+    }
+
+    [Theory]
+    [MemberData(nameof(InstancesData))]
+    public void GetClient_CalledMultipleTimes_ReturnsSameInstance(InstanceType instanceType, float? version)
+    {
+        // Act
+        var result1 = _factory.GetClient(instanceType, version ?? 0f);
+        var result2 = _factory.GetClient(instanceType, version ?? 0f);
+
+        // Assert
+        Assert.Same(result1, result2);
+    }
+    
+    public static IEnumerable<object?[]> InstancesData =>
+    [
+        [InstanceType.Sonarr, null],
+        [InstanceType.Radarr, null],
+        [InstanceType.Lidarr, null],
+        [InstanceType.Readarr, null],
+        [InstanceType.Whisparr, 2f],
+        [InstanceType.Whisparr, 3f]
+    ];
+
+    #endregion
+}

code/backend/Cleanuparr.Infrastructure.Tests/Features/Arr/WhisparrV2ClientTests.cs

@@ -0,0 +1,178 @@
+using Cleanuparr.Domain.Entities.Arr.Queue;
+using Cleanuparr.Infrastructure.Features.Arr;
+using Cleanuparr.Infrastructure.Features.ItemStriker;
+using Cleanuparr.Infrastructure.Interceptors;
+using Microsoft.Extensions.Logging;
+using Moq;
+using Xunit;
+
+namespace Cleanuparr.Infrastructure.Tests.Features.Arr;
+
+public class WhisparrV2ClientTests
+{
+    private readonly Mock<ILogger<WhisparrV2Client>> _loggerMock;
+    private readonly Mock<IHttpClientFactory> _httpClientFactoryMock;
+    private readonly Mock<IStriker> _strikerMock;
+    private readonly Mock<IDryRunInterceptor> _dryRunInterceptorMock;
+    private readonly Mock<HttpMessageHandler> _httpMessageHandlerMock;
+    private readonly WhisparrV2Client _client;
+
+    public WhisparrV2ClientTests()
+    {
+        _loggerMock = new Mock<ILogger<WhisparrV2Client>>();
+        _httpClientFactoryMock = new Mock<IHttpClientFactory>();
+        _strikerMock = new Mock<IStriker>();
+        _dryRunInterceptorMock = new Mock<IDryRunInterceptor>();
+        _httpMessageHandlerMock = new Mock<HttpMessageHandler>();
+
+        var httpClient = new HttpClient(_httpMessageHandlerMock.Object);
+        _httpClientFactoryMock.Setup(x => x.CreateClient(It.IsAny<string>())).Returns(httpClient);
+
+        _client = new WhisparrV2Client(
+            _loggerMock.Object,
+            _httpClientFactoryMock.Object,
+            _strikerMock.Object,
+            _dryRunInterceptorMock.Object
+        );
+    }
+
+    #region IsRecordValid Tests
+
+    [Fact]
+    public void IsRecordValid_WhenEpisodeIdIsZero_ReturnsFalse()
+    {
+        // Arrange
+        var record = new QueueRecord
+        {
+            Id = 1,
+            Title = "Test Episode",
+            DownloadId = "abc123",
+            Protocol = "torrent",
+            EpisodeId = 0,
+            SeriesId = 1
+        };
+
+        // Act
+        var result = _client.IsRecordValid(record);
+
+        // Assert
+        Assert.False(result);
+        _loggerMock.Verify(
+            x => x.Log(
+                LogLevel.Debug,
+                It.IsAny<EventId>(),
+                It.Is<It.IsAnyType>((v, t) => v.ToString()!.Contains("episode id and/or series id missing")),
+                It.IsAny<Exception?>(),
+                It.IsAny<Func<It.IsAnyType, Exception?, string>>()
+            ),
+            Times.Once
+        );
+    }
+
+    [Fact]
+    public void IsRecordValid_WhenSeriesIdIsZero_ReturnsFalse()
+    {
+        // Arrange
+        var record = new QueueRecord
+        {
+            Id = 1,
+            Title = "Test Episode",
+            DownloadId = "abc123",
+            Protocol = "torrent",
+            EpisodeId = 1,
+            SeriesId = 0
+        };
+
+        // Act
+        var result = _client.IsRecordValid(record);
+
+        // Assert
+        Assert.False(result);
+    }
+
+    [Fact]
+    public void IsRecordValid_WhenBothIdsAreZero_ReturnsFalse()
+    {
+        // Arrange
+        var record = new QueueRecord
+        {
+            Id = 1,
+            Title = "Test Episode",
+            DownloadId = "abc123",
+            Protocol = "torrent",
+            EpisodeId = 0,
+            SeriesId = 0
+        };
+
+        // Act
+        var result = _client.IsRecordValid(record);
+
+        // Assert
+        Assert.False(result);
+    }
+
+    [Fact]
+    public void IsRecordValid_WhenBothIdsAreSet_ReturnsTrue()
+    {
+        // Arrange
+        var record = new QueueRecord
+        {
+            Id = 1,
+            Title = "Test Episode",
+            DownloadId = "abc123",
+            Protocol = "torrent",
+            EpisodeId = 42,
+            SeriesId = 10
+        };
+
+        // Act
+        var result = _client.IsRecordValid(record);
+
+        // Assert
+        Assert.True(result);
+    }
+
+    [Fact]
+    public void IsRecordValid_WhenDownloadIdIsNull_ReturnsFalse()
+    {
+        // Arrange
+        var record = new QueueRecord
+        {
+            Id = 1,
+            Title = "Test Episode",
+            DownloadId = null!,
+            Protocol = "torrent",
+            EpisodeId = 42,
+            SeriesId = 10
+        };
+
+        // Act
+        var result = _client.IsRecordValid(record);
+
+        // Assert
+        Assert.False(result);
+    }
+
+    [Fact]
+    public void IsRecordValid_WhenDownloadIdIsEmpty_ReturnsFalse()
+    {
+        // Arrange
+        var record = new QueueRecord
+        {
+            Id = 1,
+            Title = "Test Episode",
+            DownloadId = "",
+            Protocol = "torrent",
+            EpisodeId = 42,
+            SeriesId = 10
+        };
+
+        // Act
+        var result = _client.IsRecordValid(record);
+
+        // Assert
+        Assert.False(result);
+    }
+
+    #endregion
+}

code/backend/Cleanuparr.Infrastructure.Tests/Features/Arr/WhisparrV3ClientTests.cs

@@ -0,0 +1,132 @@
+using Cleanuparr.Domain.Entities.Arr.Queue;
+using Cleanuparr.Infrastructure.Features.Arr;
+using Cleanuparr.Infrastructure.Features.ItemStriker;
+using Cleanuparr.Infrastructure.Interceptors;
+using Microsoft.Extensions.Logging;
+using Moq;
+using Xunit;
+
+namespace Cleanuparr.Infrastructure.Tests.Features.Arr;
+
+public class WhisparrV3ClientTests
+{
+    private readonly Mock<ILogger<WhisparrV3Client>> _loggerMock;
+    private readonly Mock<IHttpClientFactory> _httpClientFactoryMock;
+    private readonly Mock<IStriker> _strikerMock;
+    private readonly Mock<IDryRunInterceptor> _dryRunInterceptorMock;
+    private readonly Mock<HttpMessageHandler> _httpMessageHandlerMock;
+    private readonly WhisparrV3Client _client;
+
+    public WhisparrV3ClientTests()
+    {
+        _loggerMock = new Mock<ILogger<WhisparrV3Client>>();
+        _httpClientFactoryMock = new Mock<IHttpClientFactory>();
+        _strikerMock = new Mock<IStriker>();
+        _dryRunInterceptorMock = new Mock<IDryRunInterceptor>();
+        _httpMessageHandlerMock = new Mock<HttpMessageHandler>();
+
+        var httpClient = new HttpClient(_httpMessageHandlerMock.Object);
+        _httpClientFactoryMock.Setup(x => x.CreateClient(It.IsAny<string>())).Returns(httpClient);
+
+        _client = new WhisparrV3Client(
+            _loggerMock.Object,
+            _httpClientFactoryMock.Object,
+            _strikerMock.Object,
+            _dryRunInterceptorMock.Object
+        );
+    }
+
+    #region IsRecordValid Tests
+
+    [Fact]
+    public void IsRecordValid_WhenMovieIdIsZero_ReturnsFalse()
+    {
+        // Arrange
+        var record = new QueueRecord
+        {
+            Id = 1,
+            Title = "Test Movie",
+            DownloadId = "abc123",
+            Protocol = "torrent",
+            MovieId = 0
+        };
+
+        // Act
+        var result = _client.IsRecordValid(record);
+
+        // Assert
+        Assert.False(result);
+        _loggerMock.Verify(
+            x => x.Log(
+                LogLevel.Debug,
+                It.IsAny<EventId>(),
+                It.Is<It.IsAnyType>((v, t) => v.ToString()!.Contains("movie id missing")),
+                It.IsAny<Exception?>(),
+                It.IsAny<Func<It.IsAnyType, Exception?, string>>()
+            ),
+            Times.Once
+        );
+    }
+
+    [Fact]
+    public void IsRecordValid_WhenMovieIdIsSet_ReturnsTrue()
+    {
+        // Arrange
+        var record = new QueueRecord
+        {
+            Id = 1,
+            Title = "Test Movie",
+            DownloadId = "abc123",
+            Protocol = "torrent",
+            MovieId = 42
+        };
+
+        // Act
+        var result = _client.IsRecordValid(record);
+
+        // Assert
+        Assert.True(result);
+    }
+
+    [Fact]
+    public void IsRecordValid_WhenDownloadIdIsNull_ReturnsFalse()
+    {
+        // Arrange
+        var record = new QueueRecord
+        {
+            Id = 1,
+            Title = "Test Movie",
+            DownloadId = null!,
+            Protocol = "torrent",
+            MovieId = 42
+        };
+
+        // Act
+        var result = _client.IsRecordValid(record);
+
+        // Assert
+        Assert.False(result);
+    }
+
+    [Fact]
+    public void IsRecordValid_WhenDownloadIdIsEmpty_ReturnsFalse()
+    {
+        // Arrange
+        var record = new QueueRecord
+        {
+            Id = 1,
+            Title = "Test Movie",
+            DownloadId = "",
+            Protocol = "torrent",
+            MovieId = 42
+        };
+
+        // Act
+        var result = _client.IsRecordValid(record);
+
+        // Assert
+        Assert.False(result);
+    }
+
+    #endregion
+}