Fix some auth endpoints not checking if user setup is complete (#468)

.github/workflows/build-macos-installer.yml

@@ -21,12 +21,12 @@ jobs:
       matrix:
         include:
           - arch: Intel
-            runner: macos-13
+            runner: macos-15-intel
             runtime: osx-x64
             min_os_version: "10.15"
             artifact_suffix: intel
           - arch: ARM
-            runner: macos-14
+            runner: macos-15
             runtime: osx-arm64
             min_os_version: "11.0"
             artifact_suffix: arm64

CLAUDE.md

@@ -0,0 +1,350 @@
+# Cleanuparr - Claude AI Rules
+
+## 🚨 Critical Guidelines
+
+**READ THIS FIRST:**
+1. ⚠️ **DO NOT break existing functionality** - All features are critical and must continue to work
+2. ❓ **When in doubt, ASK** - Always clarify before implementing uncertain changes
+3. 📋 **Follow existing patterns** - Study the codebase style before making changes
+4. 🆕 **Ask before introducing new patterns** - Use current coding standards or get approval first
+
+## Project Overview
+
+Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, Lidarr, Readarr, Whisparr and supported download clients like qBittorrent, Transmission, Deluge, and µTorrent. It provides malware protection, automated cleanup, and queue management for *arr applications.
+
+**Key Features:**
+- Strike system for bad downloads
+- Malware detection and blocking
+- Automatic search triggering after removal
+- Orphaned download cleanup with cross-seed support
+- Support for multiple notification providers (Discord, etc.)
+
+## Architecture & Tech Stack
+
+### Backend
+- **.NET 10.0** (C#) with ASP.NET Core
+- **Architecture**: Clean Architecture pattern
+  - `Cleanuparr.Domain` - Domain models and business logic
+  - `Cleanuparr.Application` - Application services and use cases
+  - `Cleanuparr.Infrastructure` - External integrations (*arr apps, download clients)
+  - `Cleanuparr.Persistence` - Data access with EF Core (SQLite)
+  - `Cleanuparr.Api` - REST API and web host
+  - `Cleanuparr.Shared` - Shared utilities
+- **Database**: SQLite with Entity Framework Core 10.0
+  - Two separate contexts: `DataContext` and `EventsContext`
+- **Key Libraries**:
+  - MassTransit (messaging)
+  - Quartz.NET (scheduling)
+  - Serilog (logging)
+  - SignalR (real-time communication)
+
+### Frontend
+- **Angular 21** with TypeScript 5.9 (standalone components, zoneless, OnPush)
+- **UI**: Custom glassmorphism design system (no external UI frameworks)
+- **Icons**: @ng-icons/core + @ng-icons/tabler-icons
+- **Design System**: 3-layer SCSS (`_variables` → `_tokens` → `_themes`), dark/light themes
+- **State Management**: @ngrx/signals (Angular signals-based)
+- **Real-time Updates**: SignalR (@microsoft/signalr)
+- **PWA**: Service Worker support enabled
+
+### Documentation
+- **Docusaurus** (TypeScript-based static site)
+- Hosted at https://cleanuparr.github.io/Cleanuparr/
+
+### Deployment
+- **Docker** (primary distribution method)
+- Standalone executables for Windows, macOS, and Linux
+- Platform installers for Windows (.exe) and macOS (.pkg)
+
+## Development Setup
+
+### Prerequisites
+- .NET 10.0 SDK
+- Node.js 18+
+- Git
+- (Optional) Make for database migrations
+- (Optional) JetBrains Rider or Visual Studio
+
+### GitHub Packages Authentication
+Cleanuparr uses GitHub Packages for NuGet dependencies. Configure access:
+
+```bash
+dotnet nuget add source \
+  --username YOUR_GITHUB_USERNAME \
+  --password YOUR_GITHUB_PAT \
+  --store-password-in-clear-text \
+  --name Cleanuparr \
+  https://nuget.pkg.github.com/Cleanuparr/index.json
+```
+
+You need a GitHub PAT with `read:packages` permission.
+
+### Running the Backend
+```bash
+cd code/backend
+dotnet build Cleanuparr.Api/Cleanuparr.Api.csproj
+dotnet run --project Cleanuparr.Api/Cleanuparr.Api.csproj
+```
+API runs at http://localhost:5000
+
+### Running the Frontend
+```bash
+cd code/frontend
+npm install
+npm start
+```
+UI runs at http://localhost:4200
+
+### Running Tests
+```bash
+cd code/backend
+dotnet test
+```
+
+### Running Documentation
+```bash
+cd docs
+npm install
+npm start
+```
+Docs run at http://localhost:3000
+
+## Project Structure
+
+```
+Cleanuparr/
+├── code/
+│   ├── backend/
+│   │   ├── Cleanuparr.Api/           # API entry point
+│   │   ├── Cleanuparr.Application/   # Business logic layer
+│   │   ├── Cleanuparr.Domain/        # Domain models
+│   │   ├── Cleanuparr.Infrastructure/ # External integrations
+│   │   ├── Cleanuparr.Persistence/   # Database & EF Core
+│   │   ├── Cleanuparr.Shared/        # Shared utilities
+│   │   └── *.Tests/                  # Unit tests
+│   ├── frontend/                     # Angular 21 application
+│   ├── ui/                           # Built frontend assets
+│   ├── Dockerfile                    # Multi-stage Docker build
+│   ├── entrypoint.sh                 # Docker entrypoint
+│   └── Makefile                      # Build & migration helpers
+├── docs/                             # Docusaurus documentation
+├── Logo/                             # Branding assets
+├── .github/workflows/                # CI/CD pipelines
+├── blacklist                         # Default malware patterns
+├── blacklist_permissive              # Alternative blacklist
+├── whitelist                         # Safe file patterns
+└── CONTRIBUTING.md                   # Contribution guidelines
+```
+
+## Code Standards & Conventions
+
+**IMPORTANT:** Always study existing code in the relevant area before making changes. Match the existing style exactly.
+
+### Backend (C#)
+- Follow [Microsoft C# Coding Conventions](https://docs.microsoft.com/dotnet/csharp/fundamentals/coding-style/coding-conventions)
+- Use nullable reference types (`<Nullable>enable</Nullable>`)
+- Add XML documentation comments for public APIs
+- Write unit tests for business logic
+- Use meaningful names - avoid abbreviations unless widely understood
+- Keep services focused - single responsibility principle
+- **Study existing service implementations before creating new ones**
+
+### Frontend (TypeScript/Angular)
+- Follow [Angular Style Guide](https://angular.io/guide/styleguide)
+- Use TypeScript strict mode
+- All components must be **standalone** (no NgModules) with **ChangeDetectionStrategy.OnPush**
+- Use `input()` / `output()` function APIs (not `@Input()` / `@Output()` decorators)
+- Use Angular **signals** for reactive state (`signal()`, `computed()`, `effect()`)
+- Follow the 3-layer SCSS design system (`_variables` → `_tokens` → `_themes`) for styling
+- Component naming: `{feature}.component.ts`
+- Service naming: `{feature}.service.ts`
+- **Look at similar existing components before creating new ones**
+
+### Testing
+- Write unit tests for new features and bug fixes
+- Use descriptive test names that explain what is being tested
+- Backend: xUnit or NUnit conventions
+- Frontend: Jasmine/Karma
+- **Test that existing functionality still works after changes**
+
+### Git Commit Messages
+- Use clear, descriptive messages in imperative mood
+- Examples: "Add Discord notification support", "Fix memory leak in download client polling"
+- Reference issue numbers when applicable: "Fix #123: Handle null response from Radarr API"
+
+### Discovering Issues
+If you encounter potential gotchas, common mistakes, or areas that need special attention during development:
+- **Flag them to the maintainer immediately**
+- Document them if confirmed
+- Consider if they should be added to this guide
+
+## Database Migrations
+
+Cleanuparr uses two separate database contexts:
+- **DataContext**: Main application data
+- **EventsContext**: Event logging and audit trail
+
+### Creating Migrations
+From the `code` directory:
+
+```bash
+# Data migrations
+make migrate-data name=YourMigrationName
+
+# Events migrations
+make migrate-events name=YourMigrationName
+```
+
+Example:
+```bash
+make migrate-data name=AddDownloadClientConfig
+make migrate-events name=AddStrikeEvents
+```
+
+## Common Development Workflows
+
+### Adding a New *arr Application Integration
+1. Add integration in `Cleanuparr.Infrastructure/Arr/`
+2. Update domain models in `Cleanuparr.Domain/`
+3. Create/update services in `Cleanuparr.Application/`
+4. Add API endpoints in `Cleanuparr.Api/`
+5. Update frontend in `code/frontend/src/app/`
+6. Document in `docs/docs/`
+
+### Adding a New Download Client
+1. Add client implementation in `Cleanuparr.Infrastructure/DownloadClients/`
+2. Follow existing patterns (qBittorrent, Transmission, etc.)
+3. Add configuration models to `Cleanuparr.Domain/`
+4. Update API and frontend as above
+
+### Adding a New Notification Provider
+1. Add provider in `Cleanuparr.Infrastructure/Notifications/`
+2. Update configuration models
+3. Add UI configuration in frontend
+4. Test with actual service
+
+## Important Files
+
+### Configuration Files
+- `code/backend/Cleanuparr.Api/appsettings.json` - Backend configuration
+- `code/frontend/angular.json` - Angular build configuration
+- `code/Dockerfile` - Docker multi-stage build
+- `docs/docusaurus.config.ts` - Documentation site config
+
+### CI/CD Workflows
+- `.github/workflows/test.yml` - Run tests
+- `.github/workflows/build-docker.yml` - Build Docker images
+- `.github/workflows/build-executable.yml` - Build standalone executables
+- `.github/workflows/release.yml` - Create releases
+- `.github/workflows/docs.yml` - Deploy documentation
+
+### Malware Protection
+- `blacklist` - Default malware file patterns (strict)
+- `blacklist_permissive` - Less strict patterns
+- `whitelist` - Known safe file extensions
+- `whitelist_with_subtitles` - Includes subtitle formats
+
+## Contributing Guidelines
+
+### Before Starting Work
+1. **Announce your intent** - Comment on an issue or create a new one
+2. **Wait for approval** from maintainers
+3. Fork the repository and create a feature branch
+4. Make your changes following code standards
+5. Test thoroughly (both manual and automated tests)
+6. Submit a PR with clear description and testing notes
+
+### Pull Request Requirements
+- Link to related issue
+- Clear description of changes
+- Evidence of testing
+- Updated documentation if needed
+- No breaking changes without discussion
+
+## Docker Development
+
+### Build Local Docker Image
+```bash
+cd code
+docker build \
+  --build-arg PACKAGES_USERNAME=YOUR_GITHUB_USERNAME \
+  --build-arg PACKAGES_PAT=YOUR_GITHUB_PAT \
+  -t cleanuparr:local \
+  -f Dockerfile .
+```
+
+### Multi-Architecture Build
+```bash
+docker buildx build \
+  --platform linux/amd64,linux/arm64 \
+  --build-arg PACKAGES_USERNAME=YOUR_GITHUB_USERNAME \
+  --build-arg PACKAGES_PAT=YOUR_GITHUB_PAT \
+  -t cleanuparr:local \
+  -f Dockerfile .
+```
+
+## Environment Variables
+
+When running via Docker:
+- `PORT` - API port (default: 11011)
+- `PUID` - User ID for file permissions
+- `PGID` - Group ID for file permissions
+- `TZ` - Timezone (e.g., `America/New_York`)
+
+## Security & Safety
+
+- Never commit sensitive data (API keys, tokens, passwords)
+- All *arr and download client credentials are stored encrypted
+- The malware detection system uses pattern matching on file extensions and names
+- Always validate user input on both frontend and backend
+- Follow OWASP guidelines for web application security
+
+## Additional Resources
+
+- **Documentation**: https://cleanuparr.github.io/Cleanuparr/
+- **Discord**: https://discord.gg/SCtMCgtsc4
+- **GitHub Issues**: https://github.com/Cleanuparr/Cleanuparr/issues
+- **Releases**: https://github.com/Cleanuparr/Cleanuparr/releases
+
+## Working with Claude - IMPORTANT
+
+### Core Principles
+1. **When in doubt, ASK** - Don't assume, clarify with the maintainer first
+2. **Don't break existing functionality** - Everything is important and needs to work
+3. **Follow existing coding style** - Study the codebase patterns before making changes
+4. **Use current coding standards** - If you want to introduce something new, ask first
+
+### When Modifying Code
+- **ALWAYS read existing files before suggesting changes**
+- Understand the current architecture and patterns
+- Prefer editing existing files over creating new ones
+- Follow the established conventions in the codebase exactly
+- Test changes locally when possible
+- **If you're unsure about an approach, ask before implementing**
+
+### When Adding Features
+- Review similar existing features first to understand patterns
+- Maintain consistency with existing UI/UX patterns
+- Update both backend and frontend together
+- Add/update documentation
+- Consider backwards compatibility
+- **Ask about architectural decisions before implementing new patterns**
+
+### When Fixing Bugs
+- Understand the root cause before proposing a fix
+- **Be careful not to break other functionality** - test related areas
+- Add tests to prevent regression
+- Update relevant documentation if behavior changes
+- Consider if other parts of the codebase might have similar issues
+- **Flag any potential gotchas or issues you discover**
+
+## Notes
+
+- The project uses **Clean Architecture** - respect layer boundaries
+- Database migrations require both contexts - don't forget EventsContext
+- Frontend uses a **custom glassmorphism design system** - don't introduce external UI frameworks (no PrimeNG, Material, etc.)
+- All frontend components are **standalone** with **OnPush** change detection
+- All downloads from *arr apps are processed through a **strike system**
+- The malware blocker is a critical security feature - changes require careful testing
+- Cross-seed integration allows keeping torrents that are actively seeding
+- Real-time updates use **SignalR** - maintain websocket patterns when adding features

README.md

@@ -101,14 +101,6 @@ We welcome contributions from the community! Whether it's bug fixes, new feature
 - **[Feature Requests](https://github.com/Cleanuparr/Cleanuparr/issues/new/choose)** - Share your ideas for new features
 - **[Help Test Features](https://discord.gg/SCtMCgtsc4)** - Join Discord to test pre-release features and provide feedback
 
-# <img style="vertical-align: middle;" width="24px" src="./Logo/256.png" alt="Cleanuparr"> <span style="vertical-align: middle;">Cleanuparr</span> <img src="https://raw.githubusercontent.com/FortAwesome/Font-Awesome/6.x/svgs/solid/x.svg" height="24px" width="30px" style="vertical-align: middle;"> <span style="vertical-align: middle;">Huntarr</span> <img style="vertical-align: middle;" width="24px" src="https://github.com/plexguide/Huntarr.io/blob/main/frontend/static/logo/512.png?raw=true" alt Huntarr></img>
-
-Think of **Cleanuparr** as the janitor of your server; it keeps your download queue spotless, removes clutter, and blocks malicious files. Now imagine combining that with **Huntarr**, the compulsive librarian who finds missing and upgradable media to complete your collection
-
-While **Huntarr** fills in the blanks and improves what you already have, **Cleanuparr** makes sure that only clean downloads get through. If you're aiming for a reliable and self-sufficient setup, **Cleanuparr** and **Huntarr** will take your automated media stack to another level.
-
-<span style="font-size:24px"> ➡️ [**Huntarr**](https://github.com/plexguide/Huntarr.io) <span style="vertical-align: middle">![Huntarr](https://img.shields.io/github/stars/plexguide/Huntarr.io?style=social)</span></span> 
-
 # Credits
 Special thanks for inspiration go to:
 - [ThijmenGThN/swaparr](https://github.com/ThijmenGThN/swaparr)

code/Dockerfile

@@ -1,5 +1,5 @@
 # Build Angular frontend
-FROM --platform=$BUILDPLATFORM node:24-alpine AS frontend-build
+FROM --platform=$BUILDPLATFORM node:25-alpine AS frontend-build
 WORKDIR /app
 
 # Copy package files first for better layer caching

code/Makefile

@@ -15,6 +15,12 @@ ifndef name
 endif
 	dotnet ef migrations add $(name) --context EventsContext --project backend/Cleanuparr.Persistence/Cleanuparr.Persistence.csproj --startup-project backend/Cleanuparr.Api/Cleanuparr.Api.csproj --output-dir Migrations/Events
 
+migrate-users:
+ifndef name
+	$(error name is required. Usage: make migrate-users name=YourMigrationName)
+endif
+	dotnet ef migrations add $(name) --context UsersContext --project backend/Cleanuparr.Persistence/Cleanuparr.Persistence.csproj --startup-project backend/Cleanuparr.Api/Cleanuparr.Api.csproj --output-dir Migrations/Users
+
 docker-build:
 ifndef tag
 	$(error tag is required. Usage: make docker-build tag=latest version=1.0.0 user=... pat=...)

code/backend/Cleanuparr.Api.Tests/Cleanuparr.Api.Tests.csproj

@@ -0,0 +1,27 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="coverlet.collector" Version="6.0.4" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.1" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="Shouldly" Version="4.3.0" />
+    <PackageReference Include="xunit" Version="2.9.3" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <Using Include="Xunit" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\Cleanuparr.Api\Cleanuparr.Api.csproj" />
+  </ItemGroup>
+
+</Project>

code/backend/Cleanuparr.Api.Tests/CustomWebApplicationFactory.cs

@@ -0,0 +1,61 @@
+using Cleanuparr.Persistence;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Mvc.Testing;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Cleanuparr.Api.Tests;
+
+/// <summary>
+/// Custom WebApplicationFactory that uses an isolated SQLite database for each test fixture.
+/// The database file is created in a temp directory so both DI and static contexts share the same data.
+/// </summary>
+public class CustomWebApplicationFactory : WebApplicationFactory<Program>
+{
+    private readonly string _tempDir;
+
+    public CustomWebApplicationFactory()
+    {
+        _tempDir = Path.Combine(Path.GetTempPath(), $"cleanuparr-test-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(_tempDir);
+    }
+
+    protected override void ConfigureWebHost(IWebHostBuilder builder)
+    {
+        builder.UseEnvironment("Testing");
+
+        builder.ConfigureServices(services =>
+        {
+            // Remove the existing UsersContext registration
+            var descriptor = services.SingleOrDefault(d => d.ServiceType == typeof(DbContextOptions<UsersContext>));
+            if (descriptor != null) services.Remove(descriptor);
+
+            // Also remove the DbContext registration itself
+            var contextDescriptor = services.SingleOrDefault(d => d.ServiceType == typeof(UsersContext));
+            if (contextDescriptor != null) services.Remove(contextDescriptor);
+
+            var dbPath = Path.Combine(_tempDir, "users.db");
+
+            services.AddDbContext<UsersContext>(options =>
+            {
+                options.UseSqlite($"Data Source={dbPath}");
+            });
+
+            // Ensure DB is created
+            var sp = services.BuildServiceProvider();
+            using var scope = sp.CreateScope();
+            var db = scope.ServiceProvider.GetRequiredService<UsersContext>();
+            db.Database.EnsureCreated();
+        });
+    }
+
+    protected override void Dispose(bool disposing)
+    {
+        base.Dispose(disposing);
+
+        if (disposing && Directory.Exists(_tempDir))
+        {
+            try { Directory.Delete(_tempDir, true); } catch { /* best effort cleanup */ }
+        }
+    }
+}

code/backend/Cleanuparr.Api.Tests/Features/Auth/AuthControllerTests.cs

@@ -0,0 +1,287 @@
+using System.Net;
+using System.Net.Http.Json;
+using System.Text.Json;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features.Auth;
+
+/// <summary>
+/// Integration tests for the authentication flow.
+/// Uses a single shared factory to avoid static state conflicts.
+/// Tests are ordered to build on each other: setup → login → protected endpoints.
+/// </summary>
+[TestCaseOrderer("Cleanuparr.Api.Tests.PriorityOrderer", "Cleanuparr.Api.Tests")]
+public class AuthControllerTests : IClassFixture<CustomWebApplicationFactory>
+{
+    private readonly HttpClient _client;
+
+    public AuthControllerTests(CustomWebApplicationFactory factory)
+    {
+        _client = factory.CreateClient();
+    }
+
+    [Fact, TestPriority(0)]
+    public async Task GetStatus_BeforeSetup_ReturnsNotCompleted()
+    {
+        var response = await _client.GetAsync("/api/auth/status");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("setupCompleted").GetBoolean().ShouldBeFalse();
+    }
+
+    [Fact, TestPriority(1)]
+    public async Task Setup_CreateAccount_ReturnsCreated()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/account", new
+        {
+            username = "admin",
+            password = "TestPassword123!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Created);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("userId").GetString().ShouldNotBeNullOrEmpty();
+    }
+
+    [Fact, TestPriority(2)]
+    public async Task Setup_CreateDuplicateAccount_ReturnsConflict()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/account", new
+        {
+            username = "another",
+            password = "TestPassword123!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Conflict);
+    }
+
+    [Fact, TestPriority(3)]
+    public async Task Setup_Generate2FA_ReturnsSecretAndRecoveryCodes()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/2fa/generate", new { });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("secret").GetString().ShouldNotBeNullOrEmpty();
+        body.GetProperty("qrCodeUri").GetString().ShouldNotBeNullOrEmpty();
+        body.GetProperty("recoveryCodes").GetArrayLength().ShouldBeGreaterThan(0);
+
+        // Store the secret for the next test
+        _totpSecret = body.GetProperty("secret").GetString()!;
+    }
+
+    [Fact, TestPriority(4)]
+    public async Task Setup_Verify2FA_WithValidCode_Succeeds()
+    {
+        // If we don't have the secret from the previous test, generate it again
+        if (string.IsNullOrEmpty(_totpSecret))
+        {
+            var genResponse = await _client.PostAsJsonAsync("/api/auth/setup/2fa/generate", new { });
+            var genBody = await genResponse.Content.ReadFromJsonAsync<JsonElement>();
+            _totpSecret = genBody.GetProperty("secret").GetString()!;
+        }
+
+        var code = GenerateTotpCode(_totpSecret);
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/2fa/verify", new { code });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+    }
+
+    [Fact, TestPriority(5)]
+    public async Task Setup_Complete_Succeeds()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/complete", new { });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+    }
+
+    [Fact, TestPriority(6)]
+    public async Task Login_ValidCredentials_RequiresTwoFactor()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "admin",
+            password = "TestPassword123!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("requiresTwoFactor").GetBoolean().ShouldBeTrue();
+        body.GetProperty("loginToken").GetString().ShouldNotBeNullOrEmpty();
+    }
+
+    [Fact, TestPriority(7)]
+    public async Task Login_InvalidCredentials_ReturnsUnauthorized()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "admin",
+            password = "WrongPassword!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Unauthorized);
+    }
+
+    [Fact, TestPriority(8)]
+    public async Task Login_BruteForce_ReturnsRetryAfter()
+    {
+        // Make multiple failed attempts
+        for (int i = 0; i < 3; i++)
+        {
+            await _client.PostAsJsonAsync("/api/auth/login", new
+            {
+                username = "admin",
+                password = "WrongPassword!"
+            });
+        }
+
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "admin",
+            password = "WrongPassword!"
+        });
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+
+        if (response.StatusCode == HttpStatusCode.TooManyRequests)
+        {
+            body.GetProperty("retryAfterSeconds").GetInt32().ShouldBeGreaterThan(0);
+        }
+        else
+        {
+            response.StatusCode.ShouldBe(HttpStatusCode.Unauthorized);
+            body.TryGetProperty("retryAfterSeconds", out var retry).ShouldBeTrue();
+            retry.GetInt32().ShouldBeGreaterThan(0);
+        }
+    }
+
+    [Fact, TestPriority(9)]
+    public async Task ProtectedEndpoint_WithoutAuth_DeniesAccess()
+    {
+        var response = await _client.GetAsync("/api/account");
+
+        // 401 (FallbackPolicy) or 403 (SetupGuardMiddleware) - both deny unauthenticated access
+        new[] { HttpStatusCode.Unauthorized, HttpStatusCode.Forbidden }
+            .ShouldContain(response.StatusCode);
+    }
+
+    [Fact, TestPriority(10)]
+    public async Task HealthEndpoint_WithoutAuth_Returns200()
+    {
+        var response = await _client.GetAsync("/health");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+    }
+
+    [Fact, TestPriority(11)]
+    public async Task Setup_2FAGenerate_AfterCompletion_IsBlocked()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/2fa/generate", new { });
+
+        // Blocked by middleware (403) or controller defense-in-depth (409)
+        new[] { HttpStatusCode.Forbidden, HttpStatusCode.Conflict }
+            .ShouldContain(response.StatusCode);
+    }
+
+    [Fact, TestPriority(12)]
+    public async Task Setup_PlexPin_AfterCompletion_IsBlocked()
+    {
+        var response = await _client.PostAsync("/api/auth/setup/plex/pin", null);
+
+        // Blocked by middleware (403) or controller defense-in-depth (409)
+        new[] { HttpStatusCode.Forbidden, HttpStatusCode.Conflict }
+            .ShouldContain(response.StatusCode);
+    }
+
+    [Fact, TestPriority(13)]
+    public async Task Setup_Complete_AfterCompletion_IsBlocked()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/complete", new { });
+
+        // Blocked by middleware (403) or controller defense-in-depth (409)
+        new[] { HttpStatusCode.Forbidden, HttpStatusCode.Conflict }
+            .ShouldContain(response.StatusCode);
+    }
+
+    [Fact, TestPriority(14)]
+    public async Task Login_NotBlockedByMiddleware_AfterSetupEndpointsBlocked()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "admin",
+            password = "TestPassword123!"
+        });
+
+        // Login endpoint must NOT be blocked by the middleware (403).
+        // It may return OK (200) or TooManyRequests (429) due to brute force lockout from earlier tests.
+        response.StatusCode.ShouldNotBe(HttpStatusCode.Forbidden);
+    }
+
+    [Fact, TestPriority(15)]
+    public async Task AuthStatus_StillWorks_AfterSetupEndpointsBlocked()
+    {
+        var response = await _client.GetAsync("/api/auth/status");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("setupCompleted").GetBoolean().ShouldBeTrue();
+    }
+
+    #region TOTP helpers
+
+    private static string _totpSecret = "";
+
+    private static string GenerateTotpCode(string base32Secret)
+    {
+        var key = Base32Decode(base32Secret);
+        var timestep = (long)(DateTime.UtcNow - DateTime.UnixEpoch).TotalSeconds / 30;
+        var timestepBytes = BitConverter.GetBytes(timestep);
+
+        if (BitConverter.IsLittleEndian)
+            Array.Reverse(timestepBytes);
+
+        using var hmac = new System.Security.Cryptography.HMACSHA1(key);
+        var hash = hmac.ComputeHash(timestepBytes);
+
+        var offset = hash[^1] & 0x0F;
+        var binaryCode =
+            ((hash[offset] & 0x7F) << 24) |
+            ((hash[offset + 1] & 0xFF) << 16) |
+            ((hash[offset + 2] & 0xFF) << 8) |
+            (hash[offset + 3] & 0xFF);
+
+        return (binaryCode % 1_000_000).ToString("D6");
+    }
+
+    private static byte[] Base32Decode(string base32)
+    {
+        const string alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+        base32 = base32.ToUpperInvariant().TrimEnd('=');
+
+        var bits = new List<byte>();
+        foreach (var c in base32)
+        {
+            var val = alphabet.IndexOf(c);
+            if (val < 0) continue;
+            for (var i = 4; i >= 0; i--)
+                bits.Add((byte)((val >> i) & 1));
+        }
+
+        var bytes = new byte[bits.Count / 8];
+        for (var i = 0; i < bytes.Length; i++)
+        {
+            for (var j = 0; j < 8; j++)
+                bytes[i] = (byte)((bytes[i] << 1) | bits[i * 8 + j]);
+        }
+
+        return bytes;
+    }
+
+    #endregion
+}

code/backend/Cleanuparr.Api.Tests/PriorityOrderer.cs

@@ -0,0 +1,37 @@
+using Xunit.Abstractions;
+using Xunit.Sdk;
+
+namespace Cleanuparr.Api.Tests;
+
+public sealed class PriorityOrderer : ITestCaseOrderer
+{
+    public IEnumerable<TTestCase> OrderTestCases<TTestCase>(IEnumerable<TTestCase> testCases)
+        where TTestCase : ITestCase
+    {
+        var sortedMethods = new SortedDictionary<int, List<TTestCase>>();
+
+        foreach (var testCase in testCases)
+        {
+            var priority = testCase.TestMethod.Method
+                .GetCustomAttributes(typeof(TestPriorityAttribute).AssemblyQualifiedName)
+                .FirstOrDefault()
+                ?.GetNamedArgument<int>("Priority") ?? 0;
+
+            if (!sortedMethods.TryGetValue(priority, out var list))
+            {
+                list = [];
+                sortedMethods[priority] = list;
+            }
+
+            list.Add(testCase);
+        }
+
+        foreach (var list in sortedMethods.Values)
+        {
+            foreach (var testCase in list)
+            {
+                yield return testCase;
+            }
+        }
+    }
+}

code/backend/Cleanuparr.Api.Tests/TestPriorityAttribute.cs

@@ -0,0 +1,12 @@
+namespace Cleanuparr.Api.Tests;
+
+[AttributeUsage(AttributeTargets.Method)]
+public sealed class TestPriorityAttribute : Attribute
+{
+    public int Priority { get; }
+
+    public TestPriorityAttribute(int priority)
+    {
+        Priority = priority;
+    }
+}

code/backend/Cleanuparr.Api/Auth/ApiKeyAuthenticationHandler.cs

@@ -0,0 +1,69 @@
+using System.Security.Claims;
+using System.Text.Encodings.Web;
+using Cleanuparr.Persistence;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Options;
+
+namespace Cleanuparr.Api.Auth;
+
+public static class ApiKeyAuthenticationDefaults
+{
+    public const string AuthenticationScheme = "ApiKey";
+    public const string HeaderName = "X-Api-Key";
+    public const string QueryParameterName = "apikey";
+}
+
+public class ApiKeyAuthenticationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
+{
+    public ApiKeyAuthenticationHandler(
+        IOptionsMonitor<AuthenticationSchemeOptions> options,
+        ILoggerFactory logger,
+        UrlEncoder encoder)
+        : base(options, logger, encoder)
+    {
+    }
+
+    protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
+    {
+        // Try header first, then query string
+        string? apiKey = null;
+
+        if (Request.Headers.TryGetValue(ApiKeyAuthenticationDefaults.HeaderName, out var headerValue))
+        {
+            apiKey = headerValue.ToString();
+        }
+        else if (Request.Query.TryGetValue(ApiKeyAuthenticationDefaults.QueryParameterName, out var queryValue))
+        {
+            apiKey = queryValue.ToString();
+        }
+
+        if (string.IsNullOrWhiteSpace(apiKey))
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        await using var usersContext = UsersContext.CreateStaticInstance();
+        var user = await usersContext.Users
+            .AsNoTracking()
+            .FirstOrDefaultAsync(u => u.ApiKey == apiKey && u.SetupCompleted);
+
+        if (user is null)
+        {
+            return AuthenticateResult.Fail("Invalid API key");
+        }
+
+        var claims = new[]
+        {
+            new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
+            new Claim(ClaimTypes.Name, user.Username),
+            new Claim("auth_method", "apikey")
+        };
+
+        var identity = new ClaimsIdentity(claims, ApiKeyAuthenticationDefaults.AuthenticationScheme);
+        var principal = new ClaimsPrincipal(identity);
+        var ticket = new AuthenticationTicket(principal, ApiKeyAuthenticationDefaults.AuthenticationScheme);
+
+        return AuthenticateResult.Success(ticket);
+    }
+}

code/backend/Cleanuparr.Api/Auth/TrustedNetworkAuthenticationHandler.cs

@@ -0,0 +1,192 @@
+using System.Net;
+using System.Security.Claims;
+using System.Text.Encodings.Web;
+using Cleanuparr.Infrastructure.Extensions;
+using Cleanuparr.Persistence;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Options;
+
+namespace Cleanuparr.Api.Auth;
+
+public static class TrustedNetworkAuthenticationDefaults
+{
+    public const string AuthenticationScheme = "TrustedNetwork";
+}
+
+public class TrustedNetworkAuthenticationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
+{
+    public TrustedNetworkAuthenticationHandler(
+        IOptionsMonitor<AuthenticationSchemeOptions> options,
+        ILoggerFactory logger,
+        UrlEncoder encoder)
+        : base(options, logger, encoder)
+    {
+    }
+
+    protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
+    {
+        // Load auth config from database
+        await using var dataContext = DataContext.CreateStaticInstance();
+        var config = await dataContext.GeneralConfigs.AsNoTracking().FirstOrDefaultAsync();
+
+        if (config is null || !config.Auth.DisableAuthForLocalAddresses)
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        // Determine client IP
+        var clientIp = GetClientIp(config.Auth.TrustForwardedHeaders);
+        if (clientIp is null)
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        // Check if the client IP is trusted
+        if (!IsTrustedAddress(clientIp, config.Auth.TrustedNetworks))
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        // Load the admin user
+        await using var usersContext = UsersContext.CreateStaticInstance();
+        var user = await usersContext.Users
+            .AsNoTracking()
+            .FirstOrDefaultAsync(u => u.SetupCompleted);
+
+        if (user is null)
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        var claims = new[]
+        {
+            new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
+            new Claim(ClaimTypes.Name, user.Username),
+            new Claim("auth_method", "trusted_network")
+        };
+
+        var identity = new ClaimsIdentity(claims, TrustedNetworkAuthenticationDefaults.AuthenticationScheme);
+        var principal = new ClaimsPrincipal(identity);
+        var ticket = new AuthenticationTicket(principal, TrustedNetworkAuthenticationDefaults.AuthenticationScheme);
+
+        return AuthenticateResult.Success(ticket);
+    }
+
+    private IPAddress? GetClientIp(bool trustForwardedHeaders) =>
+        ResolveClientIp(Context, trustForwardedHeaders);
+
+    public static IPAddress? ResolveClientIp(HttpContext httpContext, bool trustForwardedHeaders)
+    {
+        var remoteIp = httpContext.Connection.RemoteIpAddress;
+        if (remoteIp is null)
+        {
+            return null;
+        }
+
+        // Only trust forwarded headers if the direct connection is from a local address
+        if (trustForwardedHeaders && remoteIp.IsLocalAddress())
+        {
+            // Check X-Forwarded-For first, then X-Real-IP
+            var forwardedFor = httpContext.Request.Headers["X-Forwarded-For"].FirstOrDefault();
+            if (!string.IsNullOrEmpty(forwardedFor))
+            {
+                // X-Forwarded-For can contain multiple IPs: client, proxy1, proxy2
+                // The first one is the original client
+                var firstIp = forwardedFor.Split(',')[0].Trim();
+                if (IPAddress.TryParse(firstIp, out var parsedIp))
+                {
+                    return parsedIp;
+                }
+            }
+
+            var realIp = httpContext.Request.Headers["X-Real-IP"].FirstOrDefault();
+            if (!string.IsNullOrEmpty(realIp) && IPAddress.TryParse(realIp, out var realParsedIp))
+            {
+                return realParsedIp;
+            }
+        }
+
+        return remoteIp;
+    }
+
+    public static bool IsTrustedAddress(IPAddress clientIp, List<string> trustedNetworks)
+    {
+        // Normalize IPv4-mapped IPv6 addresses
+        if (clientIp.IsIPv4MappedToIPv6)
+        {
+            clientIp = clientIp.MapToIPv4();
+        }
+
+        // Check if it's a local address (built-in ranges)
+        if (clientIp.IsLocalAddress())
+        {
+            return true;
+        }
+
+        // Check against custom trusted networks
+        foreach (var network in trustedNetworks)
+        {
+            if (MatchesCidr(clientIp, network))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    public static bool MatchesCidr(IPAddress address, string cidr)
+    {
+        if (cidr.Contains('/'))
+        {
+            var parts = cidr.Split('/');
+            if (!IPAddress.TryParse(parts[0], out var networkAddress) ||
+                !int.TryParse(parts[1], out var prefixLength))
+            {
+                return false;
+            }
+
+            // Normalize both addresses
+            if (networkAddress.IsIPv4MappedToIPv6)
+                networkAddress = networkAddress.MapToIPv4();
+            if (address.IsIPv4MappedToIPv6)
+                address = address.MapToIPv4();
+
+            // Must be same address family
+            if (address.AddressFamily != networkAddress.AddressFamily)
+                return false;
+
+            var addressBytes = address.GetAddressBytes();
+            var networkBytes = networkAddress.GetAddressBytes();
+
+            // Compare bytes up to prefix length
+            var fullBytes = prefixLength / 8;
+            var remainingBits = prefixLength % 8;
+
+            for (var i = 0; i < fullBytes && i < addressBytes.Length; i++)
+            {
+                if (addressBytes[i] != networkBytes[i])
+                    return false;
+            }
+
+            if (remainingBits > 0 && fullBytes < addressBytes.Length)
+            {
+                var mask = (byte)(0xFF << (8 - remainingBits));
+                if ((addressBytes[fullBytes] & mask) != (networkBytes[fullBytes] & mask))
+                    return false;
+            }
+
+            return true;
+        }
+
+        // Plain IP match
+        if (!IPAddress.TryParse(cidr, out var singleIp))
+            return false;
+
+        if (singleIp.IsIPv4MappedToIPv6)
+            singleIp = singleIp.MapToIPv4();
+
+        return address.Equals(singleIp);
+    }
+}

code/backend/Cleanuparr.Api/Cleanuparr.Api.csproj

@@ -24,6 +24,7 @@
 
     <ItemGroup>
         <PackageReference Include="MassTransit" Version="8.5.7" />
+        <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.1" />
         <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.1">
           <PrivateAssets>all</PrivateAssets>
           <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>

code/backend/Cleanuparr.Api/Controllers/EventsController.cs

@@ -29,12 +29,24 @@ public class EventsController : ControllerBase
         [FromQuery] string? eventType = null,
         [FromQuery] DateTime? fromDate = null,
         [FromQuery] DateTime? toDate = null,
-        [FromQuery] string? search = null)
+        [FromQuery] string? search = null,
+        [FromQuery] string? jobRunId = null)
     {
         // Validate pagination parameters
-        if (page < 1) page = 1;
-        if (pageSize < 1) pageSize = 100;
-        if (pageSize > 1000) pageSize = 1000; // Cap at 1000 for performance
+        if (page < 1)
+        {
+            page = 1;
+        }
+
+        if (pageSize < 1)
+        {
+            pageSize = 100;
+        }
+        
+        if (pageSize > 1000)
+        {
+            pageSize = 1000; // Cap at 1000 for performance
+        }
         
         var query = _context.Events.AsQueryable();
 
@@ -62,6 +74,12 @@ public class EventsController : ControllerBase
             query = query.Where(e => e.Timestamp <= toDate.Value);
         }
 
+        // Apply job run ID exact-match filter
+        if (!string.IsNullOrWhiteSpace(jobRunId) && Guid.TryParse(jobRunId, out var jobRunGuid))
+        {
+            query = query.Where(e => e.JobRunId == jobRunGuid);
+        }
+
         // Apply search filter if provided
         if (!string.IsNullOrWhiteSpace(search))
         {
@@ -69,7 +87,10 @@ public class EventsController : ControllerBase
             query = query.Where(e =>
                 EF.Functions.Like(e.Message, pattern) ||
                 EF.Functions.Like(e.Data, pattern) ||
-                EF.Functions.Like(e.TrackingId.ToString(), pattern)
+                EF.Functions.Like(e.TrackingId.ToString(), pattern) ||
+                EF.Functions.Like(e.InstanceUrl, pattern) ||
+                EF.Functions.Like(e.DownloadClientName, pattern) ||
+                EF.Functions.Like(e.JobRunId.ToString(), pattern)
             );
         }
 
@@ -128,33 +149,6 @@ public class EventsController : ControllerBase
         return Ok(events);
     }
 
-    /// <summary>
-    /// Gets event statistics
-    /// </summary>
-    [HttpGet("stats")]
-    public async Task<ActionResult<object>> GetEventStats()
-    {
-        var stats = new
-        {
-            TotalEvents = await _context.Events.CountAsync(),
-            EventsBySeverity = await _context.Events
-                .GroupBy(e => e.Severity)
-                .Select(g => new { Severity = g.Key.ToString(), Count = g.Count() })
-                .ToListAsync(),
-            EventsByType = await _context.Events
-                .GroupBy(e => e.EventType)
-                .Select(g => new { EventType = g.Key.ToString(), Count = g.Count() })
-                .OrderByDescending(x => x.Count)
-                .Take(10)
-                .ToListAsync(),
-            RecentEventsCount = await _context.Events
-                .Where(e => e.Timestamp > DateTime.UtcNow.AddHours(-24))
-                .CountAsync()
-        };
-
-        return Ok(stats);
-    }
-
     /// <summary>
     /// Manually triggers cleanup of old events
     /// </summary>

code/backend/Cleanuparr.Api/Controllers/JobsController.cs

@@ -1,4 +1,5 @@
 using Cleanuparr.Api.Models;
+using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Models;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Microsoft.AspNetCore.Mvc;

code/backend/Cleanuparr.Api/Controllers/ManualEventsController.cs

@@ -66,7 +66,9 @@ public class ManualEventsController : ControllerBase
             string pattern = EventsContext.GetLikePattern(search);
             query = query.Where(e =>
                 EF.Functions.Like(e.Message, pattern) ||
-                EF.Functions.Like(e.Data, pattern)
+                EF.Functions.Like(e.Data, pattern) ||
+                EF.Functions.Like(e.InstanceUrl, pattern) ||
+                EF.Functions.Like(e.DownloadClientName, pattern)
             );
         }
 

code/backend/Cleanuparr.Api/Controllers/StatsController.cs

@@ -0,0 +1,51 @@
+using Cleanuparr.Infrastructure.Stats;
+using Microsoft.AspNetCore.Mvc;
+
+namespace Cleanuparr.Api.Controllers;
+
+/// <summary>
+/// Aggregated statistics endpoint for dashboard integrations
+/// </summary>
+[ApiController]
+[Route("api/[controller]")]
+public class StatsController : ControllerBase
+{
+    private readonly ILogger<StatsController> _logger;
+    private readonly IStatsService _statsService;
+
+    public StatsController(
+        ILogger<StatsController> logger,
+        IStatsService statsService)
+    {
+        _logger = logger;
+        _statsService = statsService;
+    }
+
+    /// <summary>
+    /// Gets aggregated application statistics for the specified timeframe
+    /// </summary>
+    /// <param name="hours">Timeframe in hours (default 24, range 1-720)</param>
+    /// <param name="includeEvents">Number of recent events to include (0 = none, max 100)</param>
+    /// <param name="includeStrikes">Number of recent strikes to include (0 = none, max 100)</param>
+    [HttpGet]
+    public async Task<IActionResult> GetStats(
+        [FromQuery] int hours = 24,
+        [FromQuery] int includeEvents = 0,
+        [FromQuery] int includeStrikes = 0)
+    {
+        try
+        {
+            hours = Math.Clamp(hours, 1, 720);
+            includeEvents = Math.Clamp(includeEvents, 0, 100);
+            includeStrikes = Math.Clamp(includeStrikes, 0, 100);
+
+            var stats = await _statsService.GetStatsAsync(hours, includeEvents, includeStrikes);
+            return Ok(stats);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Error retrieving stats");
+            return StatusCode(500, new { Error = "An error occurred while retrieving stats" });
+        }
+    }
+}

code/backend/Cleanuparr.Api/Controllers/StrikesController.cs

@@ -0,0 +1,189 @@
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.State;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Api.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class StrikesController : ControllerBase
+{
+    private readonly EventsContext _context;
+
+    public StrikesController(EventsContext context)
+    {
+        _context = context;
+    }
+
+    /// <summary>
+    /// Gets download items with their strikes (grouped), with pagination and filtering
+    /// </summary>
+    [HttpGet]
+    public async Task<ActionResult<PaginatedResult<DownloadItemStrikesDto>>> GetStrikes(
+        [FromQuery] int page = 1,
+        [FromQuery] int pageSize = 50,
+        [FromQuery] string? search = null,
+        [FromQuery] string? type = null)
+    {
+        if (page < 1) page = 1;
+        if (pageSize < 1) pageSize = 50;
+        if (pageSize > 100) pageSize = 100;
+
+        var query = _context.DownloadItems
+            .Include(d => d.Strikes)
+            .Where(d => d.Strikes.Any());
+
+        // Filter by strike type: only show items that have strikes of this type
+        if (!string.IsNullOrWhiteSpace(type))
+        {
+            if (Enum.TryParse<StrikeType>(type, true, out var strikeType))
+                query = query.Where(d => d.Strikes.Any(s => s.Type == strikeType));
+        }
+
+        // Apply search filter on title or download hash
+        if (!string.IsNullOrWhiteSpace(search))
+        {
+            string pattern = EventsContext.GetLikePattern(search);
+            query = query.Where(d =>
+                EF.Functions.Like(d.Title, pattern) ||
+                EF.Functions.Like(d.DownloadId, pattern));
+        }
+
+        var totalCount = await query.CountAsync();
+        var totalPages = (int)Math.Ceiling(totalCount / (double)pageSize);
+        var skip = (page - 1) * pageSize;
+
+        var items = await query
+            .OrderByDescending(d => d.Strikes.Max(s => s.CreatedAt))
+            .Skip(skip)
+            .Take(pageSize)
+            .ToListAsync();
+
+        var dtos = items.Select(d => new DownloadItemStrikesDto
+        {
+            DownloadItemId = d.Id,
+            DownloadId = d.DownloadId,
+            Title = d.Title,
+            TotalStrikes = d.Strikes.Count,
+            StrikesByType = d.Strikes
+                .GroupBy(s => s.Type)
+                .ToDictionary(g => g.Key.ToString(), g => g.Count()),
+            LatestStrikeAt = d.Strikes.Max(s => s.CreatedAt),
+            FirstStrikeAt = d.Strikes.Min(s => s.CreatedAt),
+            IsMarkedForRemoval = d.IsMarkedForRemoval,
+            IsRemoved = d.IsRemoved,
+            IsReturning = d.IsReturning,
+            Strikes = d.Strikes
+                .OrderByDescending(s => s.CreatedAt)
+                .Select(s => new StrikeDetailDto
+                {
+                    Id = s.Id,
+                    Type = s.Type.ToString(),
+                    CreatedAt = s.CreatedAt,
+                    LastDownloadedBytes = s.LastDownloadedBytes,
+                    JobRunId = s.JobRunId,
+                }).ToList(),
+        }).ToList();
+
+        return Ok(new PaginatedResult<DownloadItemStrikesDto>
+        {
+            Items = dtos,
+            Page = page,
+            PageSize = pageSize,
+            TotalCount = totalCount,
+            TotalPages = totalPages,
+        });
+    }
+
+    /// <summary>
+    /// Gets the most recent individual strikes with download item info (for dashboard)
+    /// </summary>
+    [HttpGet("recent")]
+    public async Task<ActionResult<List<RecentStrikeDto>>> GetRecentStrikes(
+        [FromQuery] int count = 5)
+    {
+        if (count < 1) count = 1;
+        if (count > 50) count = 50;
+
+        var strikes = await _context.Strikes
+            .Include(s => s.DownloadItem)
+            .OrderByDescending(s => s.CreatedAt)
+            .Take(count)
+            .Select(s => new RecentStrikeDto
+            {
+                Id = s.Id,
+                Type = s.Type.ToString(),
+                CreatedAt = s.CreatedAt,
+                DownloadId = s.DownloadItem.DownloadId,
+                Title = s.DownloadItem.Title,
+            })
+            .ToListAsync();
+
+        return Ok(strikes);
+    }
+
+    /// <summary>
+    /// Gets all available strike types
+    /// </summary>
+    [HttpGet("types")]
+    public ActionResult<List<string>> GetStrikeTypes()
+    {
+        var types = Enum.GetNames(typeof(StrikeType)).ToList();
+        return Ok(types);
+    }
+
+    /// <summary>
+    /// Deletes all strikes for a specific download item
+    /// </summary>
+    [HttpDelete("{downloadItemId:guid}")]
+    public async Task<IActionResult> DeleteStrikesForItem(Guid downloadItemId)
+    {
+        var item = await _context.DownloadItems
+            .Include(d => d.Strikes)
+            .FirstOrDefaultAsync(d => d.Id == downloadItemId);
+
+        if (item == null)
+            return NotFound();
+
+        _context.Strikes.RemoveRange(item.Strikes);
+        _context.DownloadItems.Remove(item);
+        await _context.SaveChangesAsync();
+
+        return NoContent();
+    }
+}
+
+public class DownloadItemStrikesDto
+{
+    public Guid DownloadItemId { get; set; }
+    public string DownloadId { get; set; } = string.Empty;
+    public string Title { get; set; } = string.Empty;
+    public int TotalStrikes { get; set; }
+    public Dictionary<string, int> StrikesByType { get; set; } = new();
+    public DateTime LatestStrikeAt { get; set; }
+    public DateTime FirstStrikeAt { get; set; }
+    public bool IsMarkedForRemoval { get; set; }
+    public bool IsRemoved { get; set; }
+    public bool IsReturning { get; set; }
+    public List<StrikeDetailDto> Strikes { get; set; } = [];
+}
+
+public class StrikeDetailDto
+{
+    public Guid Id { get; set; }
+    public string Type { get; set; } = string.Empty;
+    public DateTime CreatedAt { get; set; }
+    public long? LastDownloadedBytes { get; set; }
+    public Guid JobRunId { get; set; }
+}
+
+public class RecentStrikeDto
+{
+    public Guid Id { get; set; }
+    public string Type { get; set; } = string.Empty;
+    public DateTime CreatedAt { get; set; }
+    public string DownloadId { get; set; } = string.Empty;
+    public string Title { get; set; } = string.Empty;
+}

code/backend/Cleanuparr.Api/DependencyInjection/ApiDI.cs

@@ -65,9 +65,13 @@ public static class ApiDI
         // Add the global exception handling middleware first
         app.UseMiddleware<ExceptionMiddleware>();
 
+        // Block non-auth requests until setup is complete
+        app.UseMiddleware<SetupGuardMiddleware>();
+
         app.UseCors("Any");
         app.UseRouting();
 
+        app.UseAuthentication();
         app.UseAuthorization();
         app.MapControllers();
         
@@ -108,11 +112,11 @@ public static class ApiDI
             
             context.Response.ContentType = "text/html";
             await context.Response.WriteAsync(indexContent, Encoding.UTF8);
-        });
+        }).AllowAnonymous();
         
         // Map SignalR hubs
-        app.MapHub<HealthStatusHub>("/api/hubs/health");
-        app.MapHub<AppHub>("/api/hubs/app");
+        app.MapHub<HealthStatusHub>("/api/hubs/health").RequireAuthorization();
+        app.MapHub<AppHub>("/api/hubs/app").RequireAuthorization();
         
         app.MapGet("/manifest.webmanifest", (HttpContext context) =>
         {
@@ -124,12 +128,18 @@ public static class ApiDI
             {
                 name = "Cleanuparr",
                 short_name = "Cleanuparr",
+                description = "Automated cleanup for *arr applications and download clients",
                 start_url = basePath,
                 display = "standalone",
-                background_color = "#ffffff",
-                theme_color = "#ffffff",
+                background_color = "#0e0a1a",
+                theme_color = "#1a1135",
                 icons = new[]
                 {
+                    new {
+                        src = "icons/128.png",
+                        sizes = "128x128",
+                        type = "image/png"
+                    },
                     new {
                         src = "icons/icon-192x192.png",
                         sizes = "192x192",
@@ -144,7 +154,7 @@ public static class ApiDI
             };
 
             return Results.Json(manifest, contentType: "application/manifest+json");
-        });
+        }).AllowAnonymous();
 
         return app;
     }

code/backend/Cleanuparr.Api/DependencyInjection/AuthDI.cs

@@ -0,0 +1,92 @@
+using Cleanuparr.Api.Auth;
+using Cleanuparr.Infrastructure.Features.Auth;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.IdentityModel.Tokens;
+
+namespace Cleanuparr.Api.DependencyInjection;
+
+public static class AuthDI
+{
+    private const string SmartScheme = "Smart";
+
+    public static IServiceCollection AddAuthServices(this IServiceCollection services)
+    {
+        // Get the signing key from the JwtService
+        var jwtService = new JwtService();
+        var signingKey = jwtService.GetOrCreateSigningKey();
+
+        services
+            .AddAuthentication(SmartScheme)
+            .AddPolicyScheme(SmartScheme, "JWT or API Key", options =>
+            {
+                // Route to the correct auth handler based on the request
+                options.ForwardDefaultSelector = context =>
+                {
+                    if (context.Request.Headers.ContainsKey(ApiKeyAuthenticationDefaults.HeaderName) ||
+                        context.Request.Query.ContainsKey(ApiKeyAuthenticationDefaults.QueryParameterName))
+                    {
+                        return ApiKeyAuthenticationDefaults.AuthenticationScheme;
+                    }
+
+                    // Check for Bearer token or SignalR access_token
+                    if (context.Request.Headers.ContainsKey("Authorization") ||
+                        (context.Request.Path.StartsWithSegments("/api/hubs") &&
+                         context.Request.Query.ContainsKey("access_token")))
+                    {
+                        return JwtBearerDefaults.AuthenticationScheme;
+                    }
+
+                    // Fall through to trusted network handler (returns NoResult if disabled)
+                    return TrustedNetworkAuthenticationDefaults.AuthenticationScheme;
+                };
+            })
+            .AddJwtBearer(options =>
+            {
+                options.TokenValidationParameters = new TokenValidationParameters
+                {
+                    ValidateIssuer = true,
+                    ValidIssuer = "Cleanuparr",
+                    ValidateAudience = true,
+                    ValidAudience = "Cleanuparr",
+                    ValidateLifetime = true,
+                    ValidateIssuerSigningKey = true,
+                    IssuerSigningKey = new SymmetricSecurityKey(signingKey),
+                    ClockSkew = TimeSpan.FromSeconds(30)
+                };
+
+                // Support SignalR token via query string
+                options.Events = new JwtBearerEvents
+                {
+                    OnMessageReceived = context =>
+                    {
+                        var accessToken = context.Request.Query["access_token"];
+                        var path = context.HttpContext.Request.Path;
+
+                        if (!string.IsNullOrEmpty(accessToken) && path.StartsWithSegments("/api/hubs"))
+                        {
+                            context.Token = accessToken;
+                        }
+
+                        return Task.CompletedTask;
+                    }
+                };
+            })
+            .AddScheme<AuthenticationSchemeOptions, ApiKeyAuthenticationHandler>(
+                ApiKeyAuthenticationDefaults.AuthenticationScheme, _ => { })
+            .AddScheme<AuthenticationSchemeOptions, TrustedNetworkAuthenticationHandler>(
+                TrustedNetworkAuthenticationDefaults.AuthenticationScheme, _ => { });
+
+        services.AddAuthorization(options =>
+        {
+            var defaultPolicy = new Microsoft.AspNetCore.Authorization.AuthorizationPolicyBuilder()
+                .RequireAuthenticatedUser()
+                .Build();
+
+            options.DefaultPolicy = defaultPolicy;
+            options.FallbackPolicy = defaultPolicy;
+        });
+
+        return services;
+    }
+}

code/backend/Cleanuparr.Api/DependencyInjection/MainDI.cs

@@ -56,8 +56,8 @@ public static class MainDI
                     {
                         e.ConfigureConsumer<DownloadRemoverConsumer<SearchItem>>(context);
                         e.ConfigureConsumer<DownloadRemoverConsumer<SeriesSearchItem>>(context);
-                        e.ConcurrentMessageLimit = 2;
-                        e.PrefetchCount = 2;
+                        e.ConcurrentMessageLimit = 1;
+                        e.PrefetchCount = 1;
                     });
                     
                     cfg.ReceiveEndpoint("download-hunter-queue", e =>
@@ -87,10 +87,13 @@ public static class MainDI
     {
         // Add the dynamic HTTP client system - this replaces all the previous static configurations
         services.AddDynamicHttpClients();
-        
+
         // Add the dynamic HTTP client provider that uses the new system
         services.AddSingleton<IDynamicHttpClientProvider, DynamicHttpClientProvider>();
-        
+
+        // Add HTTP client for Plex authentication
+        services.AddHttpClient("PlexAuth");
+
         return services;
     }
 

code/backend/Cleanuparr.Api/DependencyInjection/NotificationsDI.cs

@@ -1,9 +1,11 @@
 using Cleanuparr.Infrastructure.Features.Notifications;
 using Cleanuparr.Infrastructure.Features.Notifications.Apprise;
+using Cleanuparr.Infrastructure.Features.Notifications.Discord;
 using Cleanuparr.Infrastructure.Features.Notifications.Notifiarr;
 using Cleanuparr.Infrastructure.Features.Notifications.Ntfy;
 using Cleanuparr.Infrastructure.Features.Notifications.Pushover;
 using Cleanuparr.Infrastructure.Features.Notifications.Telegram;
+using Cleanuparr.Infrastructure.Features.Notifications.Gotify;
 
 namespace Cleanuparr.Api.DependencyInjection;
 
@@ -18,6 +20,8 @@ public static class NotificationsDI
             .AddScoped<INtfyProxy, NtfyProxy>()
             .AddScoped<IPushoverProxy, PushoverProxy>()
             .AddScoped<ITelegramProxy, TelegramProxy>()
+            .AddScoped<IDiscordProxy, DiscordProxy>()
+            .AddScoped<IGotifyProxy, GotifyProxy>()
             .AddScoped<INotificationConfigurationService, NotificationConfigurationService>()
             .AddScoped<INotificationProviderFactory, NotificationProviderFactory>()
             .AddScoped<NotificationProviderFactory>()

code/backend/Cleanuparr.Api/DependencyInjection/ServicesDI.cs

@@ -2,6 +2,7 @@ using Cleanuparr.Infrastructure.Events;
 using Cleanuparr.Infrastructure.Events.Interfaces;
 using Cleanuparr.Infrastructure.Features.Arr;
 using Cleanuparr.Infrastructure.Features.Arr.Interfaces;
+using Cleanuparr.Infrastructure.Features.Auth;
 using Cleanuparr.Infrastructure.Features.BlacklistSync;
 using Cleanuparr.Infrastructure.Features.DownloadClient;
 using Cleanuparr.Infrastructure.Features.DownloadHunter;
@@ -16,6 +17,7 @@ using Cleanuparr.Infrastructure.Helpers;
 using Cleanuparr.Infrastructure.Interceptors;
 using Cleanuparr.Infrastructure.Services;
 using Cleanuparr.Infrastructure.Services.Interfaces;
+using Cleanuparr.Infrastructure.Stats;
 using Cleanuparr.Persistence;
 
 namespace Cleanuparr.Api.DependencyInjection;
@@ -26,6 +28,11 @@ public static class ServicesDI
         services
             .AddScoped<EventsContext>()
             .AddScoped<DataContext>()
+            .AddScoped<UsersContext>()
+            .AddSingleton<IJwtService, JwtService>()
+            .AddSingleton<IPasswordService, PasswordService>()
+            .AddSingleton<ITotpService, TotpService>()
+            .AddScoped<IPlexAuthService, PlexAuthService>()
             .AddScoped<IEventPublisher, EventPublisher>()
             .AddHostedService<EventCleanupService>()
             .AddScoped<IDryRunInterceptor, DryRunInterceptor>()
@@ -54,6 +61,7 @@ public static class ServicesDI
             .AddScoped<IRuleManager, RuleManager>()
             .AddScoped<IRuleEvaluator, RuleEvaluator>()
             .AddScoped<IRuleIntervalValidator, RuleIntervalValidator>()
+            .AddScoped<IStatsService, StatsService>()
             .AddSingleton<IJobManagementService, JobManagementService>()
             .AddSingleton<IBlocklistProvider, BlocklistProvider>()
             .AddSingleton(TimeProvider.System)

code/backend/Cleanuparr.Api/Features/Arr/Contracts/Requests/ArrInstanceRequest.cs

@@ -21,11 +21,14 @@ public sealed record ArrInstanceRequest
     [Required]
     public required float Version { get; init; }
 
+    public string? ExternalUrl { get; init; }
+
     public ArrInstance ToEntity(Guid configId) => new()
     {
         Enabled = Enabled,
         Name = Name,
         Url = new Uri(Url),
+        ExternalUrl = ExternalUrl is not null ? new Uri(ExternalUrl) : null,
         ApiKey = ApiKey,
         ArrConfigId = configId,
         Version = Version,
@@ -36,6 +39,7 @@ public sealed record ArrInstanceRequest
         instance.Enabled = Enabled;
         instance.Name = Name;
         instance.Url = new Uri(Url);
+        instance.ExternalUrl = ExternalUrl is not null ? new Uri(ExternalUrl) : null;
         instance.ApiKey = ApiKey;
         instance.Version = Version;
     }

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/ChangePasswordRequest.cs

@@ -0,0 +1,14 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record ChangePasswordRequest
+{
+    [Required]
+    public required string CurrentPassword { get; init; }
+
+    [Required]
+    [MinLength(8)]
+    [MaxLength(128)]
+    public required string NewPassword { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/CreateAccountRequest.cs

@@ -0,0 +1,16 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record CreateAccountRequest
+{
+    [Required]
+    [MinLength(3)]
+    [MaxLength(50)]
+    public required string Username { get; init; }
+
+    [Required]
+    [MinLength(8)]
+    [MaxLength(128)]
+    public required string Password { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/Disable2faRequest.cs

@@ -0,0 +1,13 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record Disable2faRequest
+{
+    [Required]
+    public required string Password { get; init; }
+
+    [Required]
+    [StringLength(6, MinimumLength = 6)]
+    public required string TotpCode { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/Enable2faRequest.cs

@@ -0,0 +1,9 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record Enable2faRequest
+{
+    [Required]
+    public required string Password { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/LoginRequest.cs

@@ -0,0 +1,12 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record LoginRequest
+{
+    [Required]
+    public required string Username { get; init; }
+
+    [Required]
+    public required string Password { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/PlexPinRequest.cs

@@ -0,0 +1,9 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record PlexPinRequest
+{
+    [Required]
+    public required int PinId { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/RefreshTokenRequest.cs

@@ -0,0 +1,9 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record RefreshTokenRequest
+{
+    [Required]
+    public required string RefreshToken { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/Regenerate2faRequest.cs

@@ -0,0 +1,13 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record Regenerate2faRequest
+{
+    [Required]
+    public required string Password { get; init; }
+
+    [Required]
+    [StringLength(6, MinimumLength = 6)]
+    public required string TotpCode { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/TwoFactorRequest.cs

@@ -0,0 +1,14 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record TwoFactorRequest
+{
+    [Required]
+    public required string LoginToken { get; init; }
+
+    [Required]
+    public required string Code { get; init; }
+
+    public bool IsRecoveryCode { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/VerifyTotpRequest.cs

@@ -0,0 +1,10 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record VerifyTotpRequest
+{
+    [Required]
+    [StringLength(6, MinimumLength = 6)]
+    public required string Code { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Responses/AccountInfoResponse.cs

@@ -0,0 +1,10 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record AccountInfoResponse
+{
+    public required string Username { get; init; }
+    public required bool PlexLinked { get; init; }
+    public string? PlexUsername { get; init; }
+    public required bool TwoFactorEnabled { get; init; }
+    public required string ApiKeyPreview { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Responses/AuthStatusResponse.cs

@@ -0,0 +1,8 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record AuthStatusResponse
+{
+    public required bool SetupCompleted { get; init; }
+    public bool PlexLinked { get; init; }
+    public bool AuthBypassActive { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Responses/LoginResponse.cs

@@ -0,0 +1,8 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record LoginResponse
+{
+    public required bool RequiresTwoFactor { get; init; }
+    public string? LoginToken { get; init; }
+    public TokenResponse? Tokens { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Responses/PlexPinResponse.cs

@@ -0,0 +1,13 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record PlexPinStatusResponse
+{
+    public required int PinId { get; init; }
+    public required string AuthUrl { get; init; }
+}
+
+public sealed record PlexVerifyResponse
+{
+    public required bool Completed { get; init; }
+    public TokenResponse? Tokens { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Responses/TokenResponse.cs

@@ -0,0 +1,8 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record TokenResponse
+{
+    public required string AccessToken { get; init; }
+    public required string RefreshToken { get; init; }
+    public required int ExpiresIn { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Responses/TotpSetupResponse.cs

@@ -0,0 +1,8 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record TotpSetupResponse
+{
+    public required string Secret { get; init; }
+    public required string QrCodeUri { get; init; }
+    public required List<string> RecoveryCodes { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Controllers/AccountController.cs

@@ -0,0 +1,404 @@
+using System.Security.Claims;
+using System.Security.Cryptography;
+using Cleanuparr.Api.Features.Auth.Contracts.Requests;
+using Cleanuparr.Api.Features.Auth.Contracts.Responses;
+using Cleanuparr.Infrastructure.Features.Auth;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Auth;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Api.Features.Auth.Controllers;
+
+[ApiController]
+[Route("api/account")]
+[Authorize]
+public sealed class AccountController : ControllerBase
+{
+    private readonly UsersContext _usersContext;
+    private readonly IPasswordService _passwordService;
+    private readonly ITotpService _totpService;
+    private readonly IPlexAuthService _plexAuthService;
+    private readonly ILogger<AccountController> _logger;
+
+    public AccountController(
+        UsersContext usersContext,
+        IPasswordService passwordService,
+        ITotpService totpService,
+        IPlexAuthService plexAuthService,
+        ILogger<AccountController> logger)
+    {
+        _usersContext = usersContext;
+        _passwordService = passwordService;
+        _totpService = totpService;
+        _plexAuthService = plexAuthService;
+        _logger = logger;
+    }
+
+    [HttpGet]
+    public async Task<IActionResult> GetAccountInfo()
+    {
+        var user = await GetCurrentUser();
+        if (user is null) return Unauthorized();
+
+        return Ok(new AccountInfoResponse
+        {
+            Username = user.Username,
+            PlexLinked = user.PlexAccountId is not null,
+            PlexUsername = user.PlexUsername,
+            TwoFactorEnabled = user.TotpEnabled,
+            ApiKeyPreview = user.ApiKey[..8] + "..."
+        });
+    }
+
+    [HttpPut("password")]
+    public async Task<IActionResult> ChangePassword([FromBody] ChangePasswordRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser();
+            if (user is null) return Unauthorized();
+
+            if (!_passwordService.VerifyPassword(request.CurrentPassword, user.PasswordHash))
+            {
+                return BadRequest(new { error = "Current password is incorrect" });
+            }
+
+            user.PasswordHash = _passwordService.HashPassword(request.NewPassword);
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Password changed for user {Username}", user.Username);
+
+            return Ok(new { message = "Password changed" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("2fa/regenerate")]
+    public async Task<IActionResult> Regenerate2fa([FromBody] Regenerate2faRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser(includeRecoveryCodes: true);
+            if (user is null) return Unauthorized();
+
+            // Verify current credentials
+            if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash))
+            {
+                return BadRequest(new { error = "Incorrect password" });
+            }
+
+            if (!_totpService.ValidateCode(user.TotpSecret, request.TotpCode))
+            {
+                return BadRequest(new { error = "Invalid 2FA code" });
+            }
+
+            // Generate new TOTP
+            var secret = _totpService.GenerateSecret();
+            var qrUri = _totpService.GetQrCodeUri(secret, user.Username);
+            var recoveryCodes = _totpService.GenerateRecoveryCodes();
+
+            user.TotpSecret = secret;
+            user.UpdatedAt = DateTime.UtcNow;
+
+            // Replace recovery codes
+            _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
+
+            foreach (var code in recoveryCodes)
+            {
+                _usersContext.RecoveryCodes.Add(new RecoveryCode
+                {
+                    Id = Guid.NewGuid(),
+                    UserId = user.Id,
+                    CodeHash = _totpService.HashRecoveryCode(code),
+                    IsUsed = false
+                });
+            }
+
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("2FA regenerated for user {Username}", user.Username);
+
+            return Ok(new TotpSetupResponse
+            {
+                Secret = secret,
+                QrCodeUri = qrUri,
+                RecoveryCodes = recoveryCodes
+            });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("2fa/enable")]
+    public async Task<IActionResult> Enable2fa([FromBody] Enable2faRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser(includeRecoveryCodes: true);
+            if (user is null) return Unauthorized();
+
+            if (user.TotpEnabled)
+            {
+                return Conflict(new { error = "2FA is already enabled" });
+            }
+
+            if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash))
+            {
+                return BadRequest(new { error = "Incorrect password" });
+            }
+
+            // Generate new TOTP
+            var secret = _totpService.GenerateSecret();
+            var qrUri = _totpService.GetQrCodeUri(secret, user.Username);
+            var recoveryCodes = _totpService.GenerateRecoveryCodes();
+
+            user.TotpSecret = secret;
+            user.UpdatedAt = DateTime.UtcNow;
+
+            // Replace any existing recovery codes
+            _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
+
+            foreach (var code in recoveryCodes)
+            {
+                _usersContext.RecoveryCodes.Add(new RecoveryCode
+                {
+                    Id = Guid.NewGuid(),
+                    UserId = user.Id,
+                    CodeHash = _totpService.HashRecoveryCode(code),
+                    IsUsed = false
+                });
+            }
+
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("2FA setup generated for user {Username}", user.Username);
+
+            return Ok(new TotpSetupResponse
+            {
+                Secret = secret,
+                QrCodeUri = qrUri,
+                RecoveryCodes = recoveryCodes
+            });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("2fa/enable/verify")]
+    public async Task<IActionResult> VerifyEnable2fa([FromBody] VerifyTotpRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser();
+            if (user is null) return Unauthorized();
+
+            if (user.TotpEnabled)
+            {
+                return Conflict(new { error = "2FA is already enabled" });
+            }
+
+            if (string.IsNullOrEmpty(user.TotpSecret))
+            {
+                return BadRequest(new { error = "Generate 2FA setup first" });
+            }
+
+            if (!_totpService.ValidateCode(user.TotpSecret, request.Code))
+            {
+                return BadRequest(new { error = "Invalid verification code" });
+            }
+
+            user.TotpEnabled = true;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("2FA enabled for user {Username}", user.Username);
+
+            return Ok(new { message = "2FA enabled" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("2fa/disable")]
+    public async Task<IActionResult> Disable2fa([FromBody] Disable2faRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser(includeRecoveryCodes: true);
+            if (user is null) return Unauthorized();
+
+            if (!user.TotpEnabled)
+            {
+                return BadRequest(new { error = "2FA is not enabled" });
+            }
+
+            if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash))
+            {
+                return BadRequest(new { error = "Incorrect password" });
+            }
+
+            if (!_totpService.ValidateCode(user.TotpSecret, request.TotpCode))
+            {
+                return BadRequest(new { error = "Invalid 2FA code" });
+            }
+
+            user.TotpEnabled = false;
+            user.TotpSecret = string.Empty;
+            user.UpdatedAt = DateTime.UtcNow;
+
+            // Remove all recovery codes
+            _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
+
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("2FA disabled for user {Username}", user.Username);
+
+            return Ok(new { message = "2FA disabled" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpGet("api-key")]
+    public async Task<IActionResult> GetApiKey()
+    {
+        var user = await GetCurrentUser();
+        if (user is null) return Unauthorized();
+
+        return Ok(new { apiKey = user.ApiKey });
+    }
+
+    [HttpPost("api-key/regenerate")]
+    public async Task<IActionResult> RegenerateApiKey()
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser();
+            if (user is null) return Unauthorized();
+
+            var bytes = new byte[32];
+            using var rng = RandomNumberGenerator.Create();
+            rng.GetBytes(bytes);
+
+            user.ApiKey = Convert.ToHexString(bytes).ToLowerInvariant();
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("API key regenerated for user {Username}", user.Username);
+
+            return Ok(new { apiKey = user.ApiKey });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("plex/link")]
+    public async Task<IActionResult> StartPlexLink()
+    {
+        var pin = await _plexAuthService.RequestPin();
+
+        return Ok(new { pinId = pin.PinId, authUrl = pin.AuthUrl });
+    }
+
+    [HttpPost("plex/link/verify")]
+    public async Task<IActionResult> VerifyPlexLink([FromBody] PlexPinRequest request)
+    {
+        var pinResult = await _plexAuthService.CheckPin(request.PinId);
+
+        if (!pinResult.Completed || pinResult.AuthToken is null)
+        {
+            return Ok(new { completed = false });
+        }
+
+        var plexAccount = await _plexAuthService.GetAccount(pinResult.AuthToken);
+
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser();
+            if (user is null) return Unauthorized();
+
+            user.PlexAccountId = plexAccount.AccountId;
+            user.PlexUsername = plexAccount.Username;
+            user.PlexEmail = plexAccount.Email;
+            user.PlexAuthToken = pinResult.AuthToken;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Plex account linked for user {Username}: {PlexUsername}",
+                user.Username, plexAccount.Username);
+
+            return Ok(new { completed = true, plexUsername = plexAccount.Username });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpDelete("plex/link")]
+    public async Task<IActionResult> UnlinkPlex()
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser();
+            if (user is null) return Unauthorized();
+
+            user.PlexAccountId = null;
+            user.PlexUsername = null;
+            user.PlexEmail = null;
+            user.PlexAuthToken = null;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Plex account unlinked for user {Username}", user.Username);
+
+            return Ok(new { message = "Plex account unlinked" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    private async Task<User?> GetCurrentUser(bool includeRecoveryCodes = false)
+    {
+        var userIdClaim = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
+        if (userIdClaim is null || !Guid.TryParse(userIdClaim, out var userId))
+        {
+            return null;
+        }
+
+        var query = _usersContext.Users.AsQueryable();
+
+        if (includeRecoveryCodes)
+        {
+            query = query.Include(u => u.RecoveryCodes);
+        }
+
+        return await query.FirstOrDefaultAsync(u => u.Id == userId);
+    }
+}

code/backend/Cleanuparr.Api/Features/Auth/Controllers/AuthController.cs

@@ -0,0 +1,611 @@
+using System.Security.Cryptography;
+using Cleanuparr.Api.Auth;
+using Cleanuparr.Api.Features.Auth.Contracts.Requests;
+using Cleanuparr.Api.Features.Auth.Contracts.Responses;
+using Cleanuparr.Infrastructure.Features.Auth;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Auth;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Api.Features.Auth.Controllers;
+
+[ApiController]
+[Route("api/auth")]
+[AllowAnonymous]
+public sealed class AuthController : ControllerBase
+{
+    private readonly UsersContext _usersContext;
+    private readonly IJwtService _jwtService;
+    private readonly IPasswordService _passwordService;
+    private readonly ITotpService _totpService;
+    private readonly IPlexAuthService _plexAuthService;
+    private readonly ILogger<AuthController> _logger;
+
+    public AuthController(
+        UsersContext usersContext,
+        IJwtService jwtService,
+        IPasswordService passwordService,
+        ITotpService totpService,
+        IPlexAuthService plexAuthService,
+        ILogger<AuthController> logger)
+    {
+        _usersContext = usersContext;
+        _jwtService = jwtService;
+        _passwordService = passwordService;
+        _totpService = totpService;
+        _plexAuthService = plexAuthService;
+        _logger = logger;
+    }
+
+    [HttpGet("status")]
+    public async Task<IActionResult> GetStatus()
+    {
+        var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+
+        var authBypass = false;
+        await using var dataContext = DataContext.CreateStaticInstance();
+        var generalConfig = await dataContext.GeneralConfigs.AsNoTracking().FirstOrDefaultAsync();
+        if (generalConfig is { Auth.DisableAuthForLocalAddresses: true })
+        {
+            var clientIp = TrustedNetworkAuthenticationHandler.ResolveClientIp(
+                HttpContext, generalConfig.Auth.TrustForwardedHeaders);
+            if (clientIp is not null)
+            {
+                authBypass = TrustedNetworkAuthenticationHandler.IsTrustedAddress(
+                    clientIp, generalConfig.Auth.TrustedNetworks);
+            }
+        }
+
+        return Ok(new AuthStatusResponse
+        {
+            SetupCompleted = user is { SetupCompleted: true },
+            PlexLinked = user?.PlexAccountId is not null,
+            AuthBypassActive = authBypass
+        });
+    }
+
+    [HttpPost("setup/account")]
+    public async Task<IActionResult> CreateAccount([FromBody] CreateAccountRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var existingUser = await _usersContext.Users.FirstOrDefaultAsync();
+            if (existingUser is not null)
+            {
+                return Conflict(new { error = "Account already exists" });
+            }
+
+            var user = new User
+            {
+                Id = Guid.NewGuid(),
+                Username = request.Username,
+                PasswordHash = _passwordService.HashPassword(request.Password),
+                TotpSecret = string.Empty,
+                TotpEnabled = false,
+                ApiKey = GenerateApiKey(),
+                SetupCompleted = false,
+                CreatedAt = DateTime.UtcNow,
+                UpdatedAt = DateTime.UtcNow
+            };
+
+            _usersContext.Users.Add(user);
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Admin account created for user {Username}", request.Username);
+
+            return Created("", new { userId = user.Id });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("setup/2fa/generate")]
+    public async Task<IActionResult> GenerateTotpSetup()
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users
+                .Include(u => u.RecoveryCodes)
+                .FirstOrDefaultAsync();
+
+            if (user is null)
+            {
+                return BadRequest(new { error = "Create an account first" });
+            }
+
+            if (user.SetupCompleted)
+            {
+                return Conflict(new { error = "Setup already completed. Use account settings to manage 2FA." });
+            }
+
+            // Generate new TOTP secret
+            var secret = _totpService.GenerateSecret();
+            var qrUri = _totpService.GetQrCodeUri(secret, user.Username);
+
+            // Generate recovery codes
+            var recoveryCodes = _totpService.GenerateRecoveryCodes();
+
+            // Store secret (will be finalized on verify)
+            user.TotpSecret = secret;
+            user.UpdatedAt = DateTime.UtcNow;
+
+            // Remove old recovery codes and add new ones
+            _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
+
+            foreach (var code in recoveryCodes)
+            {
+                _usersContext.RecoveryCodes.Add(new RecoveryCode
+                {
+                    Id = Guid.NewGuid(),
+                    UserId = user.Id,
+                    CodeHash = _totpService.HashRecoveryCode(code),
+                    IsUsed = false
+                });
+            }
+
+            await _usersContext.SaveChangesAsync();
+
+            return Ok(new TotpSetupResponse
+            {
+                Secret = secret,
+                QrCodeUri = qrUri,
+                RecoveryCodes = recoveryCodes
+            });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("setup/2fa/verify")]
+    public async Task<IActionResult> VerifyTotpSetup([FromBody] VerifyTotpRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users.FirstOrDefaultAsync();
+            if (user is null)
+            {
+                return BadRequest(new { error = "Create an account first" });
+            }
+
+            if (user.SetupCompleted)
+            {
+                return Conflict(new { error = "Setup already completed. Use account settings to manage 2FA." });
+            }
+
+            if (string.IsNullOrEmpty(user.TotpSecret))
+            {
+                return BadRequest(new { error = "Generate 2FA setup first" });
+            }
+
+            if (!_totpService.ValidateCode(user.TotpSecret, request.Code))
+            {
+                return Unauthorized(new { error = "Invalid verification code" });
+            }
+
+            user.TotpEnabled = true;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("2FA enabled for user {Username}", user.Username);
+
+            return Ok(new { message = "2FA verified and enabled" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("setup/complete")]
+    public async Task<IActionResult> CompleteSetup()
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users.FirstOrDefaultAsync();
+            if (user is null)
+            {
+                return BadRequest(new { error = "Create an account first" });
+            }
+
+            if (user.SetupCompleted)
+            {
+                return Conflict(new { error = "Setup already completed" });
+            }
+
+            user.SetupCompleted = true;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Setup completed for user {Username}", user.Username);
+
+            return Ok(new { message = "Setup complete" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("login")]
+    public async Task<IActionResult> Login([FromBody] LoginRequest request)
+    {
+        var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+
+        if (user is null || !user.SetupCompleted)
+        {
+            return Unauthorized(new { error = "Invalid credentials" });
+        }
+
+        // Check lockout
+        if (user.LockoutEnd.HasValue && user.LockoutEnd.Value > DateTime.UtcNow)
+        {
+            var remaining = (int)(user.LockoutEnd.Value - DateTime.UtcNow).TotalSeconds;
+            return StatusCode(429, new { error = "Account is locked", retryAfterSeconds = remaining });
+        }
+
+        if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash) ||
+            !string.Equals(user.Username, request.Username, StringComparison.OrdinalIgnoreCase))
+        {
+            var retryAfterSeconds = await IncrementFailedAttempts(user.Id);
+            return Unauthorized(new { error = "Invalid credentials", retryAfterSeconds });
+        }
+
+        // Reset failed attempts on successful password verification
+        await ResetFailedAttempts(user.Id);
+
+        // If 2FA is not enabled, issue tokens directly
+        if (!user.TotpEnabled)
+        {
+            // Re-fetch with tracking since the query above used AsNoTracking
+            var trackedUser = await _usersContext.Users.FirstAsync(u => u.Id == user.Id);
+            var tokenResponse = await GenerateTokenResponse(trackedUser);
+
+            _logger.LogInformation("User {Username} logged in (2FA disabled)", user.Username);
+
+            return Ok(new LoginResponse
+            {
+                RequiresTwoFactor = false,
+                Tokens = tokenResponse
+            });
+        }
+
+        // Password valid - require 2FA
+        var loginToken = _jwtService.GenerateLoginToken(user.Id);
+
+        return Ok(new LoginResponse
+        {
+            RequiresTwoFactor = true,
+            LoginToken = loginToken
+        });
+    }
+
+    [HttpPost("login/2fa")]
+    public async Task<IActionResult> VerifyTwoFactor([FromBody] TwoFactorRequest request)
+    {
+        var userId = _jwtService.ValidateLoginToken(request.LoginToken);
+        if (userId is null)
+        {
+            return Unauthorized(new { error = "Invalid or expired login token" });
+        }
+
+        var user = await _usersContext.Users
+            .Include(u => u.RecoveryCodes)
+            .FirstOrDefaultAsync(u => u.Id == userId.Value);
+
+        if (user is null)
+        {
+            return Unauthorized(new { error = "Invalid login token" });
+        }
+
+        bool codeValid;
+
+        if (request.IsRecoveryCode)
+        {
+            codeValid = await TryUseRecoveryCode(user, request.Code);
+        }
+        else
+        {
+            codeValid = _totpService.ValidateCode(user.TotpSecret, request.Code);
+        }
+
+        if (!codeValid)
+        {
+            return Unauthorized(new { error = "Invalid verification code" });
+        }
+
+        return Ok(await GenerateTokenResponse(user));
+    }
+
+    [HttpPost("refresh")]
+    public async Task<IActionResult> RefreshToken([FromBody] RefreshTokenRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var tokenHash = HashRefreshToken(request.RefreshToken);
+
+            var storedToken = await _usersContext.RefreshTokens
+                .Include(r => r.User)
+                .FirstOrDefaultAsync(r => r.TokenHash == tokenHash && r.RevokedAt == null);
+
+            if (storedToken is null || storedToken.ExpiresAt < DateTime.UtcNow)
+            {
+                return Unauthorized(new { error = "Invalid or expired refresh token" });
+            }
+
+            // Revoke the old token (rotation)
+            storedToken.RevokedAt = DateTime.UtcNow;
+
+            // Generate new tokens
+            var response = await GenerateTokenResponse(storedToken.User);
+            await _usersContext.SaveChangesAsync();
+
+            return Ok(response);
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("logout")]
+    public async Task<IActionResult> Logout([FromBody] RefreshTokenRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var tokenHash = HashRefreshToken(request.RefreshToken);
+
+            var storedToken = await _usersContext.RefreshTokens
+                .FirstOrDefaultAsync(r => r.TokenHash == tokenHash && r.RevokedAt == null);
+
+            if (storedToken is not null)
+            {
+                storedToken.RevokedAt = DateTime.UtcNow;
+                await _usersContext.SaveChangesAsync();
+            }
+
+            return Ok(new { message = "Logged out" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("setup/plex/pin")]
+    public async Task<IActionResult> RequestSetupPlexPin()
+    {
+        var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+        if (user is null)
+        {
+            return BadRequest(new { error = "Create an account first" });
+        }
+
+        if (user.SetupCompleted)
+        {
+            return Conflict(new { error = "Setup already completed. Use account settings to manage Plex." });
+        }
+
+        var pin = await _plexAuthService.RequestPin();
+
+        return Ok(new PlexPinStatusResponse
+        {
+            PinId = pin.PinId,
+            AuthUrl = pin.AuthUrl
+        });
+    }
+
+    [HttpPost("setup/plex/verify")]
+    public async Task<IActionResult> VerifySetupPlexLink([FromBody] PlexPinRequest request)
+    {
+        var pinResult = await _plexAuthService.CheckPin(request.PinId);
+
+        if (!pinResult.Completed || pinResult.AuthToken is null)
+        {
+            return Ok(new PlexVerifyResponse { Completed = false });
+        }
+
+        var plexAccount = await _plexAuthService.GetAccount(pinResult.AuthToken);
+
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users.FirstOrDefaultAsync();
+            if (user is null)
+            {
+                return BadRequest(new { error = "Create an account first" });
+            }
+
+            if (user.SetupCompleted)
+            {
+                return Conflict(new { error = "Setup already completed. Use account settings to manage Plex." });
+            }
+
+            user.PlexAccountId = plexAccount.AccountId;
+            user.PlexUsername = plexAccount.Username;
+            user.PlexEmail = plexAccount.Email;
+            user.PlexAuthToken = pinResult.AuthToken;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("Plex account linked during setup for user {Username}: {PlexUsername}",
+                user.Username, plexAccount.Username);
+
+            return Ok(new PlexVerifyResponse { Completed = true });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("login/plex/pin")]
+    public async Task<IActionResult> RequestPlexPin()
+    {
+        var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+        if (user is null || !user.SetupCompleted || user.PlexAccountId is null)
+        {
+            return BadRequest(new { error = "Plex login is not available" });
+        }
+
+        var pin = await _plexAuthService.RequestPin();
+
+        return Ok(new PlexPinStatusResponse
+        {
+            PinId = pin.PinId,
+            AuthUrl = pin.AuthUrl
+        });
+    }
+
+    [HttpPost("login/plex/verify")]
+    public async Task<IActionResult> VerifyPlexLogin([FromBody] PlexPinRequest request)
+    {
+        var user = await _usersContext.Users.FirstOrDefaultAsync();
+        if (user is null || !user.SetupCompleted || user.PlexAccountId is null)
+        {
+            return BadRequest(new { error = "Plex login is not available" });
+        }
+
+        var pinResult = await _plexAuthService.CheckPin(request.PinId);
+
+        if (!pinResult.Completed || pinResult.AuthToken is null)
+        {
+            return Ok(new PlexVerifyResponse { Completed = false });
+        }
+
+        // Verify the Plex account matches the linked one
+        var plexAccount = await _plexAuthService.GetAccount(pinResult.AuthToken);
+
+        if (plexAccount.AccountId != user.PlexAccountId)
+        {
+            return Unauthorized(new { error = "Plex account does not match the linked account" });
+        }
+
+        // Plex OAuth acts as a trusted identity provider — the user explicitly linked their
+        // Plex account during setup or via account settings (both require authentication).
+        // Since Plex login verifies the exact same Plex account ID that was linked,
+        // 2FA is not required for Plex login.
+        _logger.LogInformation("User {Username} logged in via Plex", user.Username);
+
+        var tokenResponse = await GenerateTokenResponse(user);
+
+        return Ok(new PlexVerifyResponse
+        {
+            Completed = true,
+            Tokens = tokenResponse
+        });
+    }
+
+    private async Task<TokenResponse> GenerateTokenResponse(User user)
+    {
+        var accessToken = _jwtService.GenerateAccessToken(user);
+        var refreshToken = _jwtService.GenerateRefreshToken();
+
+        _usersContext.RefreshTokens.Add(new RefreshToken
+        {
+            Id = Guid.NewGuid(),
+            UserId = user.Id,
+            TokenHash = HashRefreshToken(refreshToken),
+            ExpiresAt = DateTime.UtcNow.AddDays(7),
+            CreatedAt = DateTime.UtcNow
+        });
+
+        await _usersContext.SaveChangesAsync();
+
+        return new TokenResponse
+        {
+            AccessToken = accessToken,
+            RefreshToken = refreshToken,
+            ExpiresIn = 60 // seconds
+        };
+    }
+
+    private async Task<bool> TryUseRecoveryCode(User user, string code)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            foreach (var recoveryCode in user.RecoveryCodes.Where(r => !r.IsUsed))
+            {
+                if (_totpService.VerifyRecoveryCode(code, recoveryCode.CodeHash))
+                {
+                    recoveryCode.IsUsed = true;
+                    recoveryCode.UsedAt = DateTime.UtcNow;
+                    await _usersContext.SaveChangesAsync();
+
+                    _logger.LogWarning("Recovery code used for user {Username}", user.Username);
+                    return true;
+                }
+            }
+
+            return false;
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    private async Task<int> IncrementFailedAttempts(Guid userId)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users.FirstAsync(u => u.Id == userId);
+            user.FailedLoginAttempts++;
+            user.LockoutEnd = DateTime.UtcNow.AddSeconds(user.FailedLoginAttempts * 2);
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogWarning("Failed login attempt {Attempts} for user {Username}, locked for {Seconds}s",
+                user.FailedLoginAttempts, user.Username, user.FailedLoginAttempts * 2);
+
+            return user.FailedLoginAttempts * 2;
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    private async Task ResetFailedAttempts(Guid userId)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await _usersContext.Users.FirstAsync(u => u.Id == userId);
+            user.FailedLoginAttempts = 0;
+            user.LockoutEnd = null;
+            await _usersContext.SaveChangesAsync();
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    private static string GenerateApiKey()
+    {
+        var bytes = new byte[32];
+        using var rng = RandomNumberGenerator.Create();
+        rng.GetBytes(bytes);
+        return Convert.ToHexString(bytes).ToLowerInvariant();
+    }
+
+    private static string HashRefreshToken(string token)
+    {
+        var bytes = System.Text.Encoding.UTF8.GetBytes(token);
+        var hash = SHA256.HashData(bytes);
+        return Convert.ToBase64String(hash);
+    }
+}

code/backend/Cleanuparr.Api/Features/BlacklistSync/Controllers/BlacklistSyncConfigController.cs

@@ -2,7 +2,7 @@ using System;
 using System.Threading.Tasks;
 
 using Cleanuparr.Api.Features.BlacklistSync.Contracts.Requests;
-using Cleanuparr.Infrastructure.Models;
+using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration.BlacklistSync;

code/backend/Cleanuparr.Api/Features/DownloadCleaner/Contracts/Requests/SeedingRuleRequest.cs

@@ -1,4 +1,5 @@
 using System.ComponentModel.DataAnnotations;
+using Cleanuparr.Domain.Enums;
 
 namespace Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests;
 
@@ -6,7 +7,12 @@ public record SeedingRuleRequest
 {
     [Required]
     public string Name { get; init; } = string.Empty;
-    
+
+    /// <summary>
+    /// Which torrent privacy types this rule applies to.
+    /// </summary>
+    public TorrentPrivacyType PrivacyType { get; init; } = TorrentPrivacyType.Public;
+
     /// <summary>
     /// Max ratio before removing a download.
     /// </summary>

code/backend/Cleanuparr.Api/Features/DownloadCleaner/Contracts/Requests/UpdateDownloadCleanerConfigRequest.cs

@@ -13,8 +13,6 @@ public sealed record UpdateDownloadCleanerConfigRequest
 
     public List<SeedingRuleRequest> Categories { get; init; } = [];
 
-    public bool DeletePrivate { get; init; }
-    
     /// <summary>
     /// Indicates whether unlinked download handling is enabled.
     /// </summary>

code/backend/Cleanuparr.Api/Features/DownloadCleaner/Controllers/DownloadCleanerConfigController.cs

@@ -3,7 +3,7 @@ using System.IO;
 using System.Linq;
 
 using Cleanuparr.Api.Features.DownloadCleaner.Contracts.Requests;
-using Cleanuparr.Infrastructure.Models;
+using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Cleanuparr.Infrastructure.Utilities;
 using Cleanuparr.Persistence;
@@ -76,7 +76,6 @@ public sealed class DownloadCleanerConfigController : ControllerBase
             oldConfig.Enabled = newConfigDto.Enabled;
             oldConfig.CronExpression = newConfigDto.CronExpression;
             oldConfig.UseAdvancedScheduling = newConfigDto.UseAdvancedScheduling;
-            oldConfig.DeletePrivate = newConfigDto.DeletePrivate;
             oldConfig.UnlinkedEnabled = newConfigDto.UnlinkedEnabled;
             oldConfig.UnlinkedTargetCategory = newConfigDto.UnlinkedTargetCategory;
             oldConfig.UnlinkedUseTag = newConfigDto.UnlinkedUseTag;
@@ -93,6 +92,7 @@ public sealed class DownloadCleanerConfigController : ControllerBase
                 _dataContext.SeedingRules.Add(new SeedingRule
                 {
                     Name = categoryDto.Name,
+                    PrivacyType = categoryDto.PrivacyType,
                     MaxRatio = categoryDto.MaxRatio,
                     MinSeedTime = categoryDto.MinSeedTime,
                     MaxSeedTime = categoryDto.MaxSeedTime,

code/backend/Cleanuparr.Api/Features/DownloadClient/Contracts/Requests/CreateDownloadClientRequest.cs

@@ -16,7 +16,7 @@ public sealed record CreateDownloadClientRequest
 
     public DownloadClientType Type { get; init; }
 
-    public Uri? Host { get; init; }
+    public string? Host { get; init; }
 
     public string? Username { get; init; }
 
@@ -24,6 +24,8 @@ public sealed record CreateDownloadClientRequest
 
     public string? UrlBase { get; init; }
 
+    public string? ExternalUrl { get; init; }
+
     public void Validate()
     {
         if (string.IsNullOrWhiteSpace(Name))
@@ -31,10 +33,20 @@ public sealed record CreateDownloadClientRequest
             throw new ValidationException("Client name cannot be empty");
         }
 
-        if (Host is null)
+        if (string.IsNullOrWhiteSpace(Host))
         {
             throw new ValidationException("Host cannot be empty");
         }
+
+        if (!Uri.TryCreate(Host, UriKind.RelativeOrAbsolute, out _))
+        {
+            throw new ValidationException("Host is not a valid URL");
+        }
+
+        if (!string.IsNullOrWhiteSpace(ExternalUrl) && !Uri.TryCreate(ExternalUrl, UriKind.RelativeOrAbsolute, out _))
+        {
+            throw new ValidationException("External URL is not a valid URL");
+        }
     }
 
     public DownloadClientConfig ToEntity() => new()
@@ -43,9 +55,10 @@ public sealed record CreateDownloadClientRequest
         Name = Name,
         TypeName = TypeName,
         Type = Type,
-        Host = Host,
+        Host = new Uri(Host!, UriKind.RelativeOrAbsolute),
         Username = Username,
         Password = Password,
         UrlBase = UrlBase,
+        ExternalUrl = !string.IsNullOrWhiteSpace(ExternalUrl) ? new Uri(ExternalUrl, UriKind.RelativeOrAbsolute) : null,
     };
 }

code/backend/Cleanuparr.Api/Features/DownloadClient/Contracts/Requests/TestDownloadClientRequest.cs

@@ -12,7 +12,7 @@ public sealed record TestDownloadClientRequest
 
     public DownloadClientType Type { get; init; }
 
-    public Uri? Host { get; init; }
+    public string? Host { get; init; }
 
     public string? Username { get; init; }
 
@@ -22,10 +22,15 @@ public sealed record TestDownloadClientRequest
 
     public void Validate()
     {
-        if (Host is null)
+        if (string.IsNullOrWhiteSpace(Host))
         {
             throw new ValidationException("Host cannot be empty");
         }
+
+        if (!Uri.TryCreate(Host, UriKind.RelativeOrAbsolute, out _))
+        {
+            throw new ValidationException("Host is not a valid URL");
+        }
     }
 
     public DownloadClientConfig ToTestConfig() => new()
@@ -35,7 +40,7 @@ public sealed record TestDownloadClientRequest
         Name = "Test Client",
         TypeName = TypeName,
         Type = Type,
-        Host = Host,
+        Host = new Uri(Host!, UriKind.RelativeOrAbsolute),
         Username = Username,
         Password = Password,
         UrlBase = UrlBase,

code/backend/Cleanuparr.Api/Features/DownloadClient/Contracts/Requests/UpdateDownloadClientRequest.cs

@@ -16,7 +16,7 @@ public sealed record UpdateDownloadClientRequest
 
     public DownloadClientType Type { get; init; }
 
-    public Uri? Host { get; init; }
+    public string? Host { get; init; }
 
     public string? Username { get; init; }
 
@@ -24,6 +24,8 @@ public sealed record UpdateDownloadClientRequest
 
     public string? UrlBase { get; init; }
 
+    public string? ExternalUrl { get; init; }
+
     public void Validate()
     {
         if (string.IsNullOrWhiteSpace(Name))
@@ -31,10 +33,20 @@ public sealed record UpdateDownloadClientRequest
             throw new ValidationException("Client name cannot be empty");
         }
 
-        if (Host is null)
+        if (string.IsNullOrWhiteSpace(Host))
         {
             throw new ValidationException("Host cannot be empty");
         }
+
+        if (!Uri.TryCreate(Host, UriKind.RelativeOrAbsolute, out _))
+        {
+            throw new ValidationException("Host is not a valid URL");
+        }
+
+        if (!string.IsNullOrWhiteSpace(ExternalUrl) && !Uri.TryCreate(ExternalUrl, UriKind.RelativeOrAbsolute, out _))
+        {
+            throw new ValidationException("External URL is not a valid URL");
+        }
     }
 
     public DownloadClientConfig ApplyTo(DownloadClientConfig existing) => existing with
@@ -43,9 +55,10 @@ public sealed record UpdateDownloadClientRequest
         Name = Name,
         TypeName = TypeName,
         Type = Type,
-        Host = Host,
+        Host = new Uri(Host!, UriKind.RelativeOrAbsolute),
         Username = Username,
         Password = Password,
         UrlBase = UrlBase,
+        ExternalUrl = !string.IsNullOrWhiteSpace(ExternalUrl) ? new Uri(ExternalUrl, UriKind.RelativeOrAbsolute) : null,
     };
 }

code/backend/Cleanuparr.Api/Features/DownloadClient/Controllers/DownloadClientController.cs

@@ -5,10 +5,8 @@ using Cleanuparr.Api.Features.DownloadClient.Contracts.Requests;
 using Cleanuparr.Infrastructure.Features.DownloadClient;
 using Cleanuparr.Infrastructure.Http.DynamicHttpClientSystem;
 using Cleanuparr.Persistence;
-using Cleanuparr.Persistence.Models.Configuration;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
-using Microsoft.Extensions.Logging;
 
 namespace Cleanuparr.Api.Features.DownloadClient.Controllers;
 

code/backend/Cleanuparr.Api/Features/General/Contracts/Requests/UpdateGeneralConfigRequest.cs

@@ -24,12 +24,18 @@ public sealed record UpdateGeneralConfigRequest
 
     public ushort SearchDelay { get; init; } = Constants.DefaultSearchDelaySeconds;
 
+    public bool StatusCheckEnabled { get; init; } = true;
+
     public string EncryptionKey { get; init; } = Guid.NewGuid().ToString();
 
     public List<string> IgnoredDownloads { get; init; } = [];
 
+    public ushort StrikeInactivityWindowHours { get; init; } = 24;
+
     public UpdateLoggingConfigRequest Log { get; init; } = new();
 
+    public UpdateAuthConfigRequest Auth { get; init; } = new();
+
     public GeneralConfig ApplyTo(GeneralConfig existingConfig, IServiceProvider services, ILogger logger)
     {
         existingConfig.DisplaySupportBanner = DisplaySupportBanner;
@@ -39,10 +45,13 @@ public sealed record UpdateGeneralConfigRequest
         existingConfig.HttpCertificateValidation = HttpCertificateValidation;
         existingConfig.SearchEnabled = SearchEnabled;
         existingConfig.SearchDelay = SearchDelay;
+        existingConfig.StatusCheckEnabled = StatusCheckEnabled;
         existingConfig.EncryptionKey = EncryptionKey;
         existingConfig.IgnoredDownloads = IgnoredDownloads;
+        existingConfig.StrikeInactivityWindowHours = StrikeInactivityWindowHours;
 
         bool loggingChanged = Log.ApplyTo(existingConfig.Log);
+        Auth.ApplyTo(existingConfig.Auth);
 
         Validate(existingConfig);
 
@@ -58,7 +67,18 @@ public sealed record UpdateGeneralConfigRequest
             throw new ValidationException("HTTP_TIMEOUT must be greater than 0");
         }
 
+        if (config.StrikeInactivityWindowHours is 0)
+        {
+            throw new ValidationException("STRIKE_INACTIVITY_WINDOW_HOURS must be greater than 0");
+        }
+
+        if (config.StrikeInactivityWindowHours > 168)
+        {
+            throw new ValidationException("STRIKE_INACTIVITY_WINDOW_HOURS must be less than or equal to 168");
+        }
+
         config.Log.Validate();
+        config.Auth.Validate();
     }
 
     private void ApplySideEffects(GeneralConfig config, IServiceProvider services, ILogger logger, bool loggingChanged)
@@ -129,3 +149,19 @@ public sealed record UpdateLoggingConfigRequest
 
     public bool LevelOnlyChange { get; private set; }
 }
+
+public sealed record UpdateAuthConfigRequest
+{
+    public bool DisableAuthForLocalAddresses { get; init; }
+
+    public bool TrustForwardedHeaders { get; init; }
+
+    public List<string> TrustedNetworks { get; init; } = [];
+
+    public void ApplyTo(AuthConfig existingConfig)
+    {
+        existingConfig.DisableAuthForLocalAddresses = DisableAuthForLocalAddresses;
+        existingConfig.TrustForwardedHeaders = TrustForwardedHeaders;
+        existingConfig.TrustedNetworks = TrustedNetworks;
+    }
+}

code/backend/Cleanuparr.Api/Features/General/Controllers/GeneralConfigController.cs

@@ -3,12 +3,9 @@ using System.Linq;
 using System.Threading.Tasks;
 
 using Cleanuparr.Api.Features.General.Contracts.Requests;
-using Cleanuparr.Domain.Enums;
 using Cleanuparr.Persistence;
-using Cleanuparr.Persistence.Models.Configuration.General;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
-using Microsoft.Extensions.Caching.Memory;
 using Microsoft.Extensions.Logging;
 
 namespace Cleanuparr.Api.Features.General.Controllers;
@@ -19,16 +16,13 @@ public sealed class GeneralConfigController : ControllerBase
 {
     private readonly ILogger<GeneralConfigController> _logger;
     private readonly DataContext _dataContext;
-    private readonly MemoryCache _cache;
 
     public GeneralConfigController(
         ILogger<GeneralConfigController> logger,
-        DataContext dataContext,
-        MemoryCache cache)
+        DataContext dataContext)
     {
         _logger = logger;
         _dataContext = dataContext;
-        _cache = cache;
     }
 
     [HttpGet("general")]
@@ -49,7 +43,9 @@ public sealed class GeneralConfigController : ControllerBase
     }
 
     [HttpPut("general")]
-    public async Task<IActionResult> UpdateGeneralConfig([FromBody] UpdateGeneralConfigRequest request)
+    public async Task<IActionResult> UpdateGeneralConfig(
+        [FromBody] UpdateGeneralConfigRequest request,
+        [FromServices] EventsContext eventsContext)
     {
         await DataContext.Lock.WaitAsync();
         try
@@ -63,7 +59,17 @@ public sealed class GeneralConfigController : ControllerBase
 
             await _dataContext.SaveChangesAsync();
 
-            ClearStrikesCacheIfNeeded(wasDryRun, config.DryRun);
+            if (wasDryRun && !config.DryRun)
+            {
+                var deletedStrikes = await eventsContext.Strikes.ExecuteDeleteAsync();
+                var deletedItems = await eventsContext.DownloadItems
+                    .Where(d => !d.Strikes.Any())
+                    .ExecuteDeleteAsync();
+
+                _logger.LogWarning(
+                    "Dry run disabled — purged all strikes: {Strikes} strikes, {Items} download items removed",
+                    deletedStrikes, deletedItems);
+            }
 
             return Ok(new { Message = "General configuration updated successfully" });
         }
@@ -78,38 +84,18 @@ public sealed class GeneralConfigController : ControllerBase
         }
     }
 
-    private void ClearStrikesCacheIfNeeded(bool wasDryRun, bool isDryRun)
+    [HttpPost("strikes/purge")]
+    public async Task<IActionResult> PurgeAllStrikes(
+        [FromServices] EventsContext eventsContext)
     {
-        if (!wasDryRun || isDryRun)
-        {
-            return;
-        }
+        var deletedStrikes = await eventsContext.Strikes.ExecuteDeleteAsync();
+        var deletedItems = await eventsContext.DownloadItems
+            .Where(d => !d.Strikes.Any())
+            .ExecuteDeleteAsync();
 
-        List<object> keys;
+        _logger.LogWarning("Purged all strikes: {strikes} strikes, {items} download items removed",
+            deletedStrikes, deletedItems);
 
-        // Remove strikes
-        foreach (string strikeType in Enum.GetNames(typeof(StrikeType)))
-        {
-            keys = _cache.Keys
-                .Where(key => key.ToString()?.StartsWith(strikeType, StringComparison.InvariantCultureIgnoreCase) is true)
-                .ToList();
-
-            foreach (object key in keys)
-            {
-                _cache.Remove(key);
-            }
-
-            _logger.LogTrace("Removed all cache entries for strike type: {StrikeType}", strikeType);
-        }
-
-        // Remove strike cache items
-        keys = _cache.Keys
-            .Where(key => key.ToString()?.StartsWith("item_", StringComparison.InvariantCultureIgnoreCase) is true)
-            .ToList();
-        
-        foreach (object key in keys)
-        {
-            _cache.Remove(key);
-        }
+        return Ok(new { DeletedStrikes = deletedStrikes, DeletedItems = deletedItems });
     }
 }

code/backend/Cleanuparr.Api/Features/MalwareBlocker/Controllers/MalwareBlockerConfigController.cs

@@ -2,7 +2,7 @@ using System.ComponentModel.DataAnnotations;
 using System.Threading.Tasks;
 
 using Cleanuparr.Api.Features.MalwareBlocker.Contracts.Requests;
-using Cleanuparr.Infrastructure.Models;
+using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Cleanuparr.Infrastructure.Utilities;
 using Cleanuparr.Persistence;

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/CreateDiscordProviderRequest.cs

@@ -0,0 +1,10 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record CreateDiscordProviderRequest : CreateNotificationProviderRequestBase
+{
+    public string WebhookUrl { get; init; } = string.Empty;
+
+    public string Username { get; init; } = string.Empty;
+
+    public string AvatarUrl { get; init; } = string.Empty;
+}

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/CreateGotifyProviderRequest.cs

@@ -0,0 +1,10 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record CreateGotifyProviderRequest : CreateNotificationProviderRequestBase
+{
+    public string ServerUrl { get; init; } = string.Empty;
+
+    public string ApplicationToken { get; init; } = string.Empty;
+
+    public int Priority { get; init; } = 5;
+}

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/TestDiscordProviderRequest.cs

@@ -0,0 +1,10 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record TestDiscordProviderRequest
+{
+    public string WebhookUrl { get; init; } = string.Empty;
+
+    public string Username { get; init; } = string.Empty;
+
+    public string AvatarUrl { get; init; } = string.Empty;
+}

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/TestGotifyProviderRequest.cs

@@ -0,0 +1,10 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record TestGotifyProviderRequest
+{
+    public string ServerUrl { get; init; } = string.Empty;
+
+    public string ApplicationToken { get; init; } = string.Empty;
+
+    public int Priority { get; init; } = 5;
+}

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/UpdateDiscordProviderRequest.cs

@@ -0,0 +1,10 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record UpdateDiscordProviderRequest : UpdateNotificationProviderRequestBase
+{
+    public string WebhookUrl { get; init; } = string.Empty;
+
+    public string Username { get; init; } = string.Empty;
+
+    public string AvatarUrl { get; init; } = string.Empty;
+}

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/UpdateGotifyProviderRequest.cs

@@ -0,0 +1,10 @@
+namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
+
+public record UpdateGotifyProviderRequest : UpdateNotificationProviderRequestBase
+{
+    public string ServerUrl { get; init; } = string.Empty;
+
+    public string ApplicationToken { get; init; } = string.Empty;
+
+    public int Priority { get; init; } = 5;
+}

code/backend/Cleanuparr.Api/Features/Notifications/Controllers/NotificationProvidersController.cs

@@ -5,8 +5,10 @@ using Cleanuparr.Domain.Enums;
 using Cleanuparr.Domain.Exceptions;
 using Cleanuparr.Infrastructure.Features.Notifications;
 using Cleanuparr.Infrastructure.Features.Notifications.Apprise;
+using Cleanuparr.Infrastructure.Features.Notifications.Discord;
 using Cleanuparr.Infrastructure.Features.Notifications.Models;
 using Cleanuparr.Infrastructure.Features.Notifications.Telegram;
+using Cleanuparr.Infrastructure.Features.Notifications.Gotify;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration.Notification;
 using Microsoft.AspNetCore.Mvc;
@@ -50,6 +52,8 @@ public sealed class NotificationProvidersController : ControllerBase
                 .Include(p => p.NtfyConfiguration)
                 .Include(p => p.PushoverConfiguration)
                 .Include(p => p.TelegramConfiguration)
+                .Include(p => p.DiscordConfiguration)
+                .Include(p => p.GotifyConfiguration)
                 .AsNoTracking()
                 .ToListAsync();
 
@@ -76,6 +80,8 @@ public sealed class NotificationProvidersController : ControllerBase
                         NotificationProviderType.Ntfy => p.NtfyConfiguration ?? new object(),
                         NotificationProviderType.Pushover => p.PushoverConfiguration ?? new object(),
                         NotificationProviderType.Telegram => p.TelegramConfiguration ?? new object(),
+                        NotificationProviderType.Discord => p.DiscordConfiguration ?? new object(),
+                        NotificationProviderType.Gotify => p.GotifyConfiguration ?? new object(),
                         _ => new object()
                     }
                 })
@@ -694,6 +700,8 @@ public sealed class NotificationProvidersController : ControllerBase
                 .Include(p => p.NtfyConfiguration)
                 .Include(p => p.PushoverConfiguration)
                 .Include(p => p.TelegramConfiguration)
+                .Include(p => p.DiscordConfiguration)
+                .Include(p => p.GotifyConfiguration)
                 .FirstOrDefaultAsync(p => p.Id == id);
 
             if (existingProvider == null)
@@ -926,11 +934,201 @@ public sealed class NotificationProvidersController : ControllerBase
                 NotificationProviderType.Ntfy => provider.NtfyConfiguration ?? new object(),
                 NotificationProviderType.Pushover => provider.PushoverConfiguration ?? new object(),
                 NotificationProviderType.Telegram => provider.TelegramConfiguration ?? new object(),
+                NotificationProviderType.Discord => provider.DiscordConfiguration ?? new object(),
+                NotificationProviderType.Gotify => provider.GotifyConfiguration ?? new object(),
                 _ => new object()
             }
         };
     }
 
+    [HttpPost("discord")]
+    public async Task<IActionResult> CreateDiscordProvider([FromBody] CreateDiscordProviderRequest newProvider)
+    {
+        await DataContext.Lock.WaitAsync();
+        try
+        {
+            if (string.IsNullOrWhiteSpace(newProvider.Name))
+            {
+                return BadRequest("Provider name is required");
+            }
+
+            var duplicateConfig = await _dataContext.NotificationConfigs.CountAsync(x => x.Name == newProvider.Name);
+            if (duplicateConfig > 0)
+            {
+                return BadRequest("A provider with this name already exists");
+            }
+
+            var discordConfig = new DiscordConfig
+            {
+                WebhookUrl = newProvider.WebhookUrl,
+                Username = newProvider.Username,
+                AvatarUrl = newProvider.AvatarUrl
+            };
+            discordConfig.Validate();
+
+            var provider = new NotificationConfig
+            {
+                Name = newProvider.Name,
+                Type = NotificationProviderType.Discord,
+                IsEnabled = newProvider.IsEnabled,
+                OnFailedImportStrike = newProvider.OnFailedImportStrike,
+                OnStalledStrike = newProvider.OnStalledStrike,
+                OnSlowStrike = newProvider.OnSlowStrike,
+                OnQueueItemDeleted = newProvider.OnQueueItemDeleted,
+                OnDownloadCleaned = newProvider.OnDownloadCleaned,
+                OnCategoryChanged = newProvider.OnCategoryChanged,
+                DiscordConfiguration = discordConfig
+            };
+
+            _dataContext.NotificationConfigs.Add(provider);
+            await _dataContext.SaveChangesAsync();
+
+            await _notificationConfigurationService.InvalidateCacheAsync();
+
+            var providerDto = MapProvider(provider);
+            return CreatedAtAction(nameof(GetNotificationProviders), new { id = provider.Id }, providerDto);
+        }
+        catch (ValidationException ex)
+        {
+            return BadRequest(ex.Message);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to create Discord provider");
+            throw;
+        }
+        finally
+        {
+            DataContext.Lock.Release();
+        }
+    }
+
+    [HttpPut("discord/{id:guid}")]
+    public async Task<IActionResult> UpdateDiscordProvider(Guid id, [FromBody] UpdateDiscordProviderRequest updatedProvider)
+    {
+        await DataContext.Lock.WaitAsync();
+        try
+        {
+            var existingProvider = await _dataContext.NotificationConfigs
+                .Include(p => p.DiscordConfiguration)
+                .FirstOrDefaultAsync(p => p.Id == id && p.Type == NotificationProviderType.Discord);
+
+            if (existingProvider == null)
+            {
+                return NotFound($"Discord provider with ID {id} not found");
+            }
+
+            if (string.IsNullOrWhiteSpace(updatedProvider.Name))
+            {
+                return BadRequest("Provider name is required");
+            }
+
+            var duplicateConfig = await _dataContext.NotificationConfigs
+                .Where(x => x.Id != id)
+                .Where(x => x.Name == updatedProvider.Name)
+                .CountAsync();
+            if (duplicateConfig > 0)
+            {
+                return BadRequest("A provider with this name already exists");
+            }
+
+            var discordConfig = new DiscordConfig
+            {
+                WebhookUrl = updatedProvider.WebhookUrl,
+                Username = updatedProvider.Username,
+                AvatarUrl = updatedProvider.AvatarUrl
+            };
+
+            if (existingProvider.DiscordConfiguration != null)
+            {
+                discordConfig = discordConfig with { Id = existingProvider.DiscordConfiguration.Id };
+            }
+            discordConfig.Validate();
+
+            var newProvider = existingProvider with
+            {
+                Name = updatedProvider.Name,
+                IsEnabled = updatedProvider.IsEnabled,
+                OnFailedImportStrike = updatedProvider.OnFailedImportStrike,
+                OnStalledStrike = updatedProvider.OnStalledStrike,
+                OnSlowStrike = updatedProvider.OnSlowStrike,
+                OnQueueItemDeleted = updatedProvider.OnQueueItemDeleted,
+                OnDownloadCleaned = updatedProvider.OnDownloadCleaned,
+                OnCategoryChanged = updatedProvider.OnCategoryChanged,
+                DiscordConfiguration = discordConfig,
+                UpdatedAt = DateTime.UtcNow
+            };
+
+            _dataContext.NotificationConfigs.Remove(existingProvider);
+            _dataContext.NotificationConfigs.Add(newProvider);
+
+            await _dataContext.SaveChangesAsync();
+            await _notificationConfigurationService.InvalidateCacheAsync();
+
+            var providerDto = MapProvider(newProvider);
+            return Ok(providerDto);
+        }
+        catch (ValidationException ex)
+        {
+            return BadRequest(ex.Message);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to update Discord provider with ID {Id}", id);
+            throw;
+        }
+        finally
+        {
+            DataContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("discord/test")]
+    public async Task<IActionResult> TestDiscordProvider([FromBody] TestDiscordProviderRequest testRequest)
+    {
+        try
+        {
+            var discordConfig = new DiscordConfig
+            {
+                WebhookUrl = testRequest.WebhookUrl,
+                Username = testRequest.Username,
+                AvatarUrl = testRequest.AvatarUrl
+            };
+            discordConfig.Validate();
+
+            var providerDto = new NotificationProviderDto
+            {
+                Id = Guid.NewGuid(),
+                Name = "Test Provider",
+                Type = NotificationProviderType.Discord,
+                IsEnabled = true,
+                Events = new NotificationEventFlags
+                {
+                    OnFailedImportStrike = true,
+                    OnStalledStrike = false,
+                    OnSlowStrike = false,
+                    OnQueueItemDeleted = false,
+                    OnDownloadCleaned = false,
+                    OnCategoryChanged = false
+                },
+                Configuration = discordConfig
+            };
+
+            await _notificationService.SendTestNotificationAsync(providerDto);
+            return Ok(new { Message = "Test notification sent successfully" });
+        }
+        catch (DiscordException ex)
+        {
+            _logger.LogWarning(ex, "Failed to test Discord provider");
+            return BadRequest(new { Message = $"Test failed: {ex.Message}" });
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to test Discord provider");
+            return BadRequest(new { Message = $"Test failed: {ex.Message}" });
+        }
+    }
+
     [HttpPost("pushover")]
     public async Task<IActionResult> CreatePushoverProvider([FromBody] CreatePushoverProviderRequest newProvider)
     {
@@ -1128,4 +1326,192 @@ public sealed class NotificationProvidersController : ControllerBase
             return BadRequest(new { Message = $"Test failed: {ex.Message}" });
         }
     }
+
+    [HttpPost("gotify")]
+    public async Task<IActionResult> CreateGotifyProvider([FromBody] CreateGotifyProviderRequest newProvider)
+    {
+        await DataContext.Lock.WaitAsync();
+        try
+        {
+            if (string.IsNullOrWhiteSpace(newProvider.Name))
+            {
+                return BadRequest("Provider name is required");
+            }
+
+            var duplicateConfig = await _dataContext.NotificationConfigs.CountAsync(x => x.Name == newProvider.Name);
+            if (duplicateConfig > 0)
+            {
+                return BadRequest("A provider with this name already exists");
+            }
+
+            var gotifyConfig = new GotifyConfig
+            {
+                ServerUrl = newProvider.ServerUrl,
+                ApplicationToken = newProvider.ApplicationToken,
+                Priority = newProvider.Priority
+            };
+            gotifyConfig.Validate();
+
+            var provider = new NotificationConfig
+            {
+                Name = newProvider.Name,
+                Type = NotificationProviderType.Gotify,
+                IsEnabled = newProvider.IsEnabled,
+                OnFailedImportStrike = newProvider.OnFailedImportStrike,
+                OnStalledStrike = newProvider.OnStalledStrike,
+                OnSlowStrike = newProvider.OnSlowStrike,
+                OnQueueItemDeleted = newProvider.OnQueueItemDeleted,
+                OnDownloadCleaned = newProvider.OnDownloadCleaned,
+                OnCategoryChanged = newProvider.OnCategoryChanged,
+                GotifyConfiguration = gotifyConfig
+            };
+
+            _dataContext.NotificationConfigs.Add(provider);
+            await _dataContext.SaveChangesAsync();
+
+            await _notificationConfigurationService.InvalidateCacheAsync();
+
+            var providerDto = MapProvider(provider);
+            return CreatedAtAction(nameof(GetNotificationProviders), new { id = provider.Id }, providerDto);
+        }
+        catch (ValidationException ex)
+        {
+            return BadRequest(ex.Message);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to create Gotify provider");
+            throw;
+        }
+        finally
+        {
+            DataContext.Lock.Release();
+        }
+    }
+
+    [HttpPut("gotify/{id:guid}")]
+    public async Task<IActionResult> UpdateGotifyProvider(Guid id, [FromBody] UpdateGotifyProviderRequest updatedProvider)
+    {
+        await DataContext.Lock.WaitAsync();
+        try
+        {
+            var existingProvider = await _dataContext.NotificationConfigs
+                .Include(p => p.GotifyConfiguration)
+                .FirstOrDefaultAsync(p => p.Id == id && p.Type == NotificationProviderType.Gotify);
+
+            if (existingProvider == null)
+            {
+                return NotFound($"Gotify provider with ID {id} not found");
+            }
+
+            if (string.IsNullOrWhiteSpace(updatedProvider.Name))
+            {
+                return BadRequest("Provider name is required");
+            }
+
+            var duplicateConfig = await _dataContext.NotificationConfigs
+                .Where(x => x.Id != id)
+                .Where(x => x.Name == updatedProvider.Name)
+                .CountAsync();
+            if (duplicateConfig > 0)
+            {
+                return BadRequest("A provider with this name already exists");
+            }
+
+            var gotifyConfig = new GotifyConfig
+            {
+                ServerUrl = updatedProvider.ServerUrl,
+                ApplicationToken = updatedProvider.ApplicationToken,
+                Priority = updatedProvider.Priority
+            };
+
+            if (existingProvider.GotifyConfiguration != null)
+            {
+                gotifyConfig = gotifyConfig with { Id = existingProvider.GotifyConfiguration.Id };
+            }
+            gotifyConfig.Validate();
+
+            var newProvider = existingProvider with
+            {
+                Name = updatedProvider.Name,
+                IsEnabled = updatedProvider.IsEnabled,
+                OnFailedImportStrike = updatedProvider.OnFailedImportStrike,
+                OnStalledStrike = updatedProvider.OnStalledStrike,
+                OnSlowStrike = updatedProvider.OnSlowStrike,
+                OnQueueItemDeleted = updatedProvider.OnQueueItemDeleted,
+                OnDownloadCleaned = updatedProvider.OnDownloadCleaned,
+                OnCategoryChanged = updatedProvider.OnCategoryChanged,
+                GotifyConfiguration = gotifyConfig,
+                UpdatedAt = DateTime.UtcNow
+            };
+
+            _dataContext.NotificationConfigs.Remove(existingProvider);
+            _dataContext.NotificationConfigs.Add(newProvider);
+
+            await _dataContext.SaveChangesAsync();
+            await _notificationConfigurationService.InvalidateCacheAsync();
+
+            var providerDto = MapProvider(newProvider);
+            return Ok(providerDto);
+        }
+        catch (ValidationException ex)
+        {
+            return BadRequest(ex.Message);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to update Gotify provider with ID {Id}", id);
+            throw;
+        }
+        finally
+        {
+            DataContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("gotify/test")]
+    public async Task<IActionResult> TestGotifyProvider([FromBody] TestGotifyProviderRequest testRequest)
+    {
+        try
+        {
+            var gotifyConfig = new GotifyConfig
+            {
+                ServerUrl = testRequest.ServerUrl,
+                ApplicationToken = testRequest.ApplicationToken,
+                Priority = testRequest.Priority
+            };
+            gotifyConfig.Validate();
+
+            var providerDto = new NotificationProviderDto
+            {
+                Id = Guid.NewGuid(),
+                Name = "Test Provider",
+                Type = NotificationProviderType.Gotify,
+                IsEnabled = true,
+                Events = new NotificationEventFlags
+                {
+                    OnFailedImportStrike = true,
+                    OnStalledStrike = false,
+                    OnSlowStrike = false,
+                    OnQueueItemDeleted = false,
+                    OnDownloadCleaned = false,
+                    OnCategoryChanged = false
+                },
+                Configuration = gotifyConfig
+            };
+
+            await _notificationService.SendTestNotificationAsync(providerDto);
+            return Ok(new { Message = "Test notification sent successfully" });
+        }
+        catch (GotifyException ex)
+        {
+            _logger.LogWarning(ex, "Failed to test Gotify provider");
+            return BadRequest(new { Message = $"Test failed: {ex.Message}" });
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to test Gotify provider");
+            return BadRequest(new { Message = $"Test failed: {ex.Message}" });
+        }
+    }
 }

code/backend/Cleanuparr.Api/Features/QueueCleaner/Controllers/QueueCleanerConfigController.cs

@@ -1,7 +1,7 @@
 using System.ComponentModel.DataAnnotations;
 
 using Cleanuparr.Api.Features.QueueCleaner.Contracts.Requests;
-using Cleanuparr.Infrastructure.Models;
+using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Cleanuparr.Infrastructure.Utilities;
 using Cleanuparr.Persistence;

code/backend/Cleanuparr.Api/HostExtensions.cs

@@ -63,7 +63,14 @@ public static class HostExtensions
         {
             await configContext.Database.MigrateAsync();
         }
-        
+
+        // Apply users db migrations
+        await using var usersContext = UsersContext.CreateStaticInstance();
+        if ((await usersContext.Database.GetPendingMigrationsAsync()).Any())
+        {
+            await usersContext.Database.MigrateAsync();
+        }
+
         return builder;
     }
 }

code/backend/Cleanuparr.Api/Jobs/GenericJob.cs

@@ -1,7 +1,12 @@
-using Cleanuparr.Infrastructure.Features.Jobs;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Features.Context;
+using Cleanuparr.Infrastructure.Features.Jobs;
+using Cleanuparr.Infrastructure.Helpers;
 using Cleanuparr.Infrastructure.Hubs;
 using Cleanuparr.Infrastructure.Models;
 using Cleanuparr.Infrastructure.Services.Interfaces;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.State;
 using Microsoft.AspNetCore.SignalR;
 using Quartz;
 using Serilog.Context;
@@ -14,48 +19,73 @@ public sealed class GenericJob<T> : IJob
 {
     private readonly ILogger<GenericJob<T>> _logger;
     private readonly IServiceScopeFactory _scopeFactory;
-    
+
     public GenericJob(ILogger<GenericJob<T>> logger, IServiceScopeFactory scopeFactory)
     {
         _logger = logger;
         _scopeFactory = scopeFactory;
     }
-    
+
     public async Task Execute(IJobExecutionContext context)
     {
         using var _ = LogContext.PushProperty("JobName", typeof(T).Name);
-        
+
+        Guid jobRunId = Guid.CreateVersion7();
+        JobType jobType = Enum.Parse<JobType>(typeof(T).Name);
+        JobRunStatus? status = null;
+
         try
         {
             await using var scope = _scopeFactory.CreateAsyncScope();
+            var eventsContext = scope.ServiceProvider.GetRequiredService<EventsContext>();
             var hubContext = scope.ServiceProvider.GetRequiredService<IHubContext<AppHub>>();
             var jobManagementService = scope.ServiceProvider.GetRequiredService<IJobManagementService>();
-            
-            await BroadcastJobStatus(hubContext, jobManagementService, false);
-            
+
+            var jobRun = new JobRun { Id = jobRunId, Type = jobType };
+            eventsContext.JobRuns.Add(jobRun);
+            await eventsContext.SaveChangesAsync();
+
+            ContextProvider.SetJobRunId(jobRunId);
+            using var __ = LogContext.PushProperty(LogProperties.JobRunId, jobRunId.ToString());
+
+            await BroadcastJobStatus(hubContext, jobManagementService, jobType, false);
+
             var handler = scope.ServiceProvider.GetRequiredService<T>();
             await handler.ExecuteAsync();
-            
-            await BroadcastJobStatus(hubContext, jobManagementService, true);
+
+            status = JobRunStatus.Completed;
+            await BroadcastJobStatus(hubContext, jobManagementService, jobType, true);
         }
         catch (Exception ex)
         {
             _logger.LogError(ex, "{name} failed", typeof(T).Name);
+            status = JobRunStatus.Failed;
+        }
+        finally
+        {
+            await using var finalScope = _scopeFactory.CreateAsyncScope();
+            var eventsContext = finalScope.ServiceProvider.GetRequiredService<EventsContext>();
+            var jobRun = await eventsContext.JobRuns.FindAsync(jobRunId);
+            if (jobRun is not null)
+            {
+                jobRun.CompletedAt = DateTime.UtcNow;
+                jobRun.Status = status;
+                await eventsContext.SaveChangesAsync();
+            }
         }
     }
-    
-    private async Task BroadcastJobStatus(IHubContext<AppHub> hubContext, IJobManagementService jobManagementService, bool isFinished)
+
+    private async Task BroadcastJobStatus(IHubContext<AppHub> hubContext, IJobManagementService jobManagementService, JobType jobType, bool isFinished)
     {
         try
         {
-            JobType jobType = Enum.Parse<JobType>(typeof(T).Name);
             JobInfo jobInfo = await jobManagementService.GetJob(jobType);
 
             if (isFinished)
             {
                 jobInfo.Status = "Scheduled";
             }
-            
+
             await hubContext.Clients.All.SendAsync("JobStatusUpdate", jobInfo);
         }
         catch (Exception ex)

code/backend/Cleanuparr.Api/Middleware/SetupGuardMiddleware.cs

@@ -0,0 +1,89 @@
+using Cleanuparr.Persistence;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Api.Middleware;
+
+public class SetupGuardMiddleware
+{
+    private readonly RequestDelegate _next;
+    private volatile bool _setupCompleted;
+
+    public SetupGuardMiddleware(RequestDelegate next)
+    {
+        _next = next;
+    }
+
+    public async Task InvokeAsync(HttpContext context)
+    {
+        string path = context.Request.Path.Value?.ToLowerInvariant() ?? "";
+
+        // Always allow health checks and non-API paths (static files, SPA, etc.)
+        if (path.StartsWith("/health") || !path.StartsWith("/api/"))
+        {
+            await _next(context);
+            return;
+        }
+
+        // Setup-only paths (/api/auth/setup/*) require setup to NOT be complete
+        if (IsSetupOnlyPath(path))
+        {
+            if (await IsSetupCompleted())
+            {
+                context.Response.StatusCode = StatusCodes.Status403Forbidden;
+                context.Response.ContentType = "application/json";
+                await context.Response.WriteAsJsonAsync(new { error = "Setup already completed" });
+                return;
+            }
+
+            await _next(context);
+            return;
+        }
+
+        // Non-setup auth paths (login, refresh, logout, status) are always allowed
+        if (path.StartsWith("/api/auth/") || path == "/api/auth")
+        {
+            await _next(context);
+            return;
+        }
+
+        // All other API paths require setup to be complete
+        if (!await IsSetupCompleted())
+        {
+            context.Response.StatusCode = StatusCodes.Status403Forbidden;
+            context.Response.ContentType = "application/json";
+            await context.Response.WriteAsJsonAsync(new { error = "Setup required" });
+            return;
+        }
+
+        await _next(context);
+    }
+
+    public void ResetSetupState()
+    {
+        _setupCompleted = false;
+    }
+
+    private async Task<bool> IsSetupCompleted()
+    {
+        if (_setupCompleted)
+        {
+            return true;
+        }
+
+        await using var usersContext = UsersContext.CreateStaticInstance();
+        var user = await usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+
+        if (user is { SetupCompleted: true })
+        {
+            _setupCompleted = true;
+            return true;
+        }
+
+        return false;
+    }
+
+    private static bool IsSetupOnlyPath(string path)
+    {
+        return path.StartsWith("/api/auth/setup/") || path == "/api/auth/setup";
+    }
+}

code/backend/Cleanuparr.Api/Program.cs

@@ -3,6 +3,7 @@ using System.Runtime.InteropServices;
 using System.Text.Json.Serialization;
 using Cleanuparr.Api;
 using Cleanuparr.Api.DependencyInjection;
+using Microsoft.AspNetCore.DataProtection;
 using Cleanuparr.Infrastructure.Hubs;
 using Cleanuparr.Infrastructure.Logging;
 using Cleanuparr.Shared.Helpers;
@@ -70,12 +71,19 @@ builder.Services.ConfigureHttpJsonOptions(options =>
 // Add services to the container
 builder.Services
     .AddInfrastructure(builder.Configuration)
-    .AddApiServices();
+    .AddApiServices()
+    .AddAuthServices();
+
+// Persist Data Protection keys to the config directory
+builder.Services
+    .AddDataProtection()
+    .PersistKeysToFileSystem(new DirectoryInfo(Path.Combine(ConfigurationPathProvider.GetConfigPath(), "DataProtection-Keys")))
+    .SetApplicationName("Cleanuparr");
 
 // Add CORS before SignalR
-builder.Services.AddCors(options => 
+builder.Services.AddCors(options =>
 {
-    options.AddPolicy("Any", policy => 
+    options.AddPolicy("Any", policy =>
     {
         policy
             // https://github.com/dotnet/aspnetcore/issues/4457#issuecomment-465669576
@@ -123,6 +131,13 @@ if (basePath is not null)
         {
             if (!string.IsNullOrEmpty(basePath) && !context.Request.Path.StartsWithSegments(basePath, StringComparison.OrdinalIgnoreCase))
             {
+                // Redirect root to the base path for convenience
+                if (!context.Request.Path.HasValue || context.Request.Path.Value == "/")
+                {
+                    context.Response.Redirect(basePath + "/");
+                    return;
+                }
+
                 context.Response.StatusCode = StatusCodes.Status404NotFound;
                 return;
             }
@@ -146,14 +161,14 @@ app.Init();
 var appHub = app.Services.GetRequiredService<IHubContext<AppHub>>();
 SignalRLogSink.Instance.SetAppHubContext(appHub);
 
-// Configure health check endpoints before the API configuration
-app.MapHealthChecks("/health", new HealthCheckOptions
+// Configure health check endpoints as middleware (before auth pipeline) so they don't require authentication
+app.UseHealthChecks("/health", new HealthCheckOptions
 {
     Predicate = registration => registration.Tags.Contains("liveness"),
     ResponseWriter = HealthCheckResponseWriter.WriteMinimalPlaintext
 });
 
-app.MapHealthChecks("/health/ready", new HealthCheckOptions
+app.UseHealthChecks("/health/ready", new HealthCheckOptions
 {
     Predicate = registration => registration.Tags.Contains("readiness"),
     ResponseWriter = HealthCheckResponseWriter.WriteMinimalPlaintext

code/backend/Cleanuparr.Domain/Entities/HealthCheck/HealthCheckResult.cs

@@ -0,0 +1,10 @@
+namespace Cleanuparr.Domain.Entities.HealthCheck;
+
+public sealed record HealthCheckResult
+{
+    public bool IsHealthy { get; set; }
+    
+    public string? ErrorMessage { get; set; }
+    
+    public TimeSpan ResponseTime { get; set; }
+}

code/backend/Cleanuparr.Domain/Entities/ITorrentItemWrapper.cs

@@ -27,6 +27,8 @@ public interface ITorrentItemWrapper
     long SeedingTimeSeconds { get; }
 
     string? Category { get; set; }
+    
+    string SavePath { get; }
 
     bool IsDownloading();
     

code/backend/Cleanuparr.Domain/Entities/RTorrent/Response/RTorrentFile.cs

@@ -0,0 +1,37 @@
+namespace Cleanuparr.Domain.Entities.RTorrent.Response;
+
+/// <summary>
+/// Represents a file within a torrent from rTorrent's XML-RPC f.multicall response
+/// </summary>
+public sealed record RTorrentFile
+{
+    /// <summary>
+    /// File index within the torrent (0-based)
+    /// </summary>
+    public int Index { get; init; }
+
+    /// <summary>
+    /// File path relative to the torrent base directory
+    /// </summary>
+    public required string Path { get; init; }
+
+    /// <summary>
+    /// File size in bytes
+    /// </summary>
+    public long SizeBytes { get; init; }
+
+    /// <summary>
+    /// Download priority: 0 = skip/don't download, 1 = normal, 2 = high
+    /// </summary>
+    public int Priority { get; init; }
+
+    /// <summary>
+    /// Number of completed chunks for this file
+    /// </summary>
+    public long CompletedChunks { get; init; }
+
+    /// <summary>
+    /// Total number of chunks for this file
+    /// </summary>
+    public long SizeChunks { get; init; }
+}

code/backend/Cleanuparr.Domain/Entities/RTorrent/Response/RTorrentTorrent.cs

@@ -0,0 +1,72 @@
+namespace Cleanuparr.Domain.Entities.RTorrent.Response;
+
+/// <summary>
+/// Represents a torrent from rTorrent's XML-RPC multicall response
+/// </summary>
+public sealed record RTorrentTorrent
+{
+    /// <summary>
+    /// Torrent info hash (40-character hex string, uppercase)
+    /// </summary>
+    public required string Hash { get; init; }
+
+    /// <summary>
+    /// Torrent name
+    /// </summary>
+    public required string Name { get; init; }
+
+    /// <summary>
+    /// Whether the torrent is from a private tracker (0 or 1)
+    /// </summary>
+    public int IsPrivate { get; init; }
+
+    /// <summary>
+    /// Total size of the torrent in bytes
+    /// </summary>
+    public long SizeBytes { get; init; }
+
+    /// <summary>
+    /// Number of bytes completed/downloaded
+    /// </summary>
+    public long CompletedBytes { get; init; }
+
+    /// <summary>
+    /// Current download rate in bytes per second
+    /// </summary>
+    public long DownRate { get; init; }
+
+    /// <summary>
+    /// Upload/download ratio multiplied by 1000 (e.g., 1500 = 1.5 ratio)
+    /// </summary>
+    public long Ratio { get; init; }
+
+    /// <summary>
+    /// Torrent state: 0 = stopped, 1 = started
+    /// </summary>
+    public int State { get; init; }
+
+    /// <summary>
+    /// Completion status: 0 = incomplete, 1 = complete
+    /// </summary>
+    public int Complete { get; init; }
+
+    /// <summary>
+    /// Unix timestamp when the torrent finished downloading (0 if not finished)
+    /// </summary>
+    public long TimestampFinished { get; init; }
+
+    /// <summary>
+    /// Label/category from d.custom1 (commonly used by ruTorrent for labels)
+    /// </summary>
+    public string? Label { get; init; }
+
+    /// <summary>
+    /// Base path where the torrent data is stored
+    /// </summary>
+    public string? BasePath { get; init; }
+
+    /// <summary>
+    /// List of tracker URLs for this torrent
+    /// </summary>
+    public IReadOnlyList<string>? Trackers { get; init; }
+}

code/backend/Cleanuparr.Domain/Enums/DownloadClientTypeName.cs

@@ -6,4 +6,5 @@ public enum DownloadClientTypeName
     Deluge,
     Transmission,
     uTorrent,
+    rTorrent,
 }

code/backend/Cleanuparr.Domain/Enums/JobRunStatus.cs

@@ -0,0 +1,7 @@
+namespace Cleanuparr.Domain.Enums;
+
+public enum JobRunStatus
+{
+    Completed,
+    Failed
+}

code/backend/Cleanuparr.Domain/Enums/JobType.cs

@@ -0,0 +1,9 @@
+namespace Cleanuparr.Domain.Enums;
+
+public enum JobType
+{
+    QueueCleaner,
+    MalwareBlocker,
+    DownloadCleaner,
+    BlacklistSynchronizer,
+}

code/backend/Cleanuparr.Domain/Enums/NotificationProviderType.cs

@@ -7,4 +7,6 @@ public enum NotificationProviderType
     Ntfy,
     Pushover,
     Telegram,
+    Discord,
+    Gotify,
 }

code/backend/Cleanuparr.Domain/Exceptions/RTorrentClientException.cs

@@ -0,0 +1,12 @@
+namespace Cleanuparr.Domain.Exceptions;
+
+public class RTorrentClientException : Exception
+{
+    public RTorrentClientException(string message) : base(message)
+    {
+    }
+
+    public RTorrentClientException(string message, Exception innerException) : base(message, innerException)
+    {
+    }
+}

code/backend/Cleanuparr.Infrastructure.Tests/Events/EventPublisherTests.cs

@@ -65,6 +65,9 @@ public class EventPublisherTests : IDisposable
             _loggerMock.Object,
             _notificationPublisherMock.Object,
             _dryRunInterceptorMock.Object);
+
+        // Setup JobRunId in context for tests
+        ContextProvider.SetJobRunId(Guid.NewGuid());
     }
 
     public void Dispose()
@@ -339,8 +342,8 @@ public class EventPublisherTests : IDisposable
     public async Task PublishQueueItemDeleted_SavesEventWithContextData()
     {
         // Arrange
-        ContextProvider.Set("downloadName", "Test Download");
-        ContextProvider.Set("hash", "abc123");
+        ContextProvider.Set(ContextProvider.Keys.ItemName, "Test Download");
+        ContextProvider.Set(ContextProvider.Keys.Hash, "abc123");
 
         // Act
         await _publisher.PublishQueueItemDeleted(removeFromClient: true, DeleteReason.Stalled);
@@ -360,8 +363,8 @@ public class EventPublisherTests : IDisposable
     public async Task PublishQueueItemDeleted_SendsNotification()
     {
         // Arrange
-        ContextProvider.Set("downloadName", "Test Download");
-        ContextProvider.Set("hash", "abc123");
+        ContextProvider.Set(ContextProvider.Keys.ItemName, "Test Download");
+        ContextProvider.Set(ContextProvider.Keys.Hash, "abc123");
 
         // Act
         await _publisher.PublishQueueItemDeleted(removeFromClient: false, DeleteReason.FailedImport);
@@ -378,8 +381,8 @@ public class EventPublisherTests : IDisposable
     public async Task PublishDownloadCleaned_SavesEventWithContextData()
     {
         // Arrange
-        ContextProvider.Set("downloadName", "Cleaned Download");
-        ContextProvider.Set("hash", "def456");
+        ContextProvider.Set(ContextProvider.Keys.ItemName, "Cleaned Download");
+        ContextProvider.Set(ContextProvider.Keys.Hash, "def456");
 
         // Act
         await _publisher.PublishDownloadCleaned(
@@ -404,8 +407,8 @@ public class EventPublisherTests : IDisposable
     public async Task PublishDownloadCleaned_SendsNotification()
     {
         // Arrange
-        ContextProvider.Set("downloadName", "Test");
-        ContextProvider.Set("hash", "xyz");
+        ContextProvider.Set(ContextProvider.Keys.ItemName, "Test");
+        ContextProvider.Set(ContextProvider.Keys.Hash, "xyz");
 
         var ratio = 1.5;
         var seedingTime = TimeSpan.FromHours(24);
@@ -428,7 +431,7 @@ public class EventPublisherTests : IDisposable
     {
         // Arrange
         ContextProvider.Set(nameof(InstanceType), (object)InstanceType.Sonarr);
-        ContextProvider.Set(nameof(ArrInstance) + nameof(ArrInstance.Url), new Uri("http://localhost:8989"));
+        ContextProvider.Set(ContextProvider.Keys.ArrInstanceUrl, new Uri("http://localhost:8989"));
 
         // Act
         await _publisher.PublishSearchNotTriggered("abc123", "Test Item");
@@ -452,7 +455,7 @@ public class EventPublisherTests : IDisposable
     {
         // Arrange
         ContextProvider.Set(nameof(InstanceType), (object)InstanceType.Radarr);
-        ContextProvider.Set(nameof(ArrInstance) + nameof(ArrInstance.Url), new Uri("http://localhost:7878"));
+        ContextProvider.Set(ContextProvider.Keys.ArrInstanceUrl, new Uri("http://localhost:7878"));
 
         // Act
         await _publisher.PublishRecurringItem("hash123", "Recurring Item", 5);
@@ -475,8 +478,8 @@ public class EventPublisherTests : IDisposable
     public async Task PublishCategoryChanged_SavesEventWithContextData()
     {
         // Arrange
-        ContextProvider.Set("downloadName", "Category Test");
-        ContextProvider.Set("hash", "cat123");
+        ContextProvider.Set(ContextProvider.Keys.ItemName, "Category Test");
+        ContextProvider.Set(ContextProvider.Keys.Hash, "cat123");
 
         // Act
         await _publisher.PublishCategoryChanged("oldCat", "newCat", isTag: false);
@@ -493,8 +496,8 @@ public class EventPublisherTests : IDisposable
     public async Task PublishCategoryChanged_WithTag_SavesCorrectMessage()
     {
         // Arrange
-        ContextProvider.Set("downloadName", "Tag Test");
-        ContextProvider.Set("hash", "tag123");
+        ContextProvider.Set(ContextProvider.Keys.ItemName, "Tag Test");
+        ContextProvider.Set(ContextProvider.Keys.Hash, "tag123");
 
         // Act
         await _publisher.PublishCategoryChanged("", "cleanuperr-done", isTag: true);
@@ -509,8 +512,8 @@ public class EventPublisherTests : IDisposable
     public async Task PublishCategoryChanged_SendsNotification()
     {
         // Arrange
-        ContextProvider.Set("downloadName", "Test");
-        ContextProvider.Set("hash", "xyz");
+        ContextProvider.Set(ContextProvider.Keys.ItemName, "Test");
+        ContextProvider.Set(ContextProvider.Keys.Hash, "xyz");
 
         // Act
         await _publisher.PublishCategoryChanged("old", "new", isTag: true);

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/DelugeServiceDCTests.cs

@@ -1,3 +1,4 @@
+using Cleanuparr.Domain.Entities;
 using Cleanuparr.Domain.Entities.Deluge.Response;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Features.Context;
@@ -340,13 +341,15 @@ public class DelugeServiceDCTests : IClassFixture<DelugeServiceFixture>
             // Arrange
             var sut = _fixture.CreateSut();
             const string hash = "TEST-HASH";
+            var mockTorrent = new Mock<ITorrentItemWrapper>();
+            mockTorrent.Setup(x => x.Hash).Returns(hash);
 
             _fixture.ClientWrapper
                 .Setup(x => x.DeleteTorrents(It.Is<List<string>>(h => h.Contains("test-hash")), true))
                 .Returns(Task.CompletedTask);
 
             // Act
-            await sut.DeleteDownload(hash, true);
+            await sut.DeleteDownload(mockTorrent.Object, true);
 
             // Assert
             _fixture.ClientWrapper.Verify(
@@ -360,13 +363,15 @@ public class DelugeServiceDCTests : IClassFixture<DelugeServiceFixture>
             // Arrange
             var sut = _fixture.CreateSut();
             const string hash = "UPPERCASE-HASH";
+            var mockTorrent = new Mock<ITorrentItemWrapper>();
+            mockTorrent.Setup(x => x.Hash).Returns(hash);
 
             _fixture.ClientWrapper
                 .Setup(x => x.DeleteTorrents(It.IsAny<List<string>>(), true))
                 .Returns(Task.CompletedTask);
 
             // Act
-            await sut.DeleteDownload(hash, true);
+            await sut.DeleteDownload(mockTorrent.Object, true);
 
             // Assert
             _fixture.ClientWrapper.Verify(
@@ -380,13 +385,15 @@ public class DelugeServiceDCTests : IClassFixture<DelugeServiceFixture>
             // Arrange
             var sut = _fixture.CreateSut();
             const string hash = "TEST-HASH";
+            var mockTorrent = new Mock<ITorrentItemWrapper>();
+            mockTorrent.Setup(x => x.Hash).Returns(hash);
 
             _fixture.ClientWrapper
                 .Setup(x => x.DeleteTorrents(It.Is<List<string>>(h => h.Contains("test-hash")), false))
                 .Returns(Task.CompletedTask);
 
             // Act
-            await sut.DeleteDownload(hash, false);
+            await sut.DeleteDownload(mockTorrent.Object, false);
 
             // Assert
             _fixture.ClientWrapper.Verify(

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/DelugeServiceFixture.cs

@@ -6,9 +6,7 @@ using Cleanuparr.Infrastructure.Features.MalwareBlocker;
 using Cleanuparr.Infrastructure.Http;
 using Cleanuparr.Infrastructure.Interceptors;
 using Cleanuparr.Infrastructure.Services.Interfaces;
-using Cleanuparr.Infrastructure.Tests.Features.DownloadClient.TestHelpers;
 using Cleanuparr.Persistence.Models.Configuration;
-using Microsoft.Extensions.Caching.Memory;
 using Microsoft.Extensions.Logging;
 using Moq;
 
@@ -17,14 +15,13 @@ namespace Cleanuparr.Infrastructure.Tests.Features.DownloadClient;
 public class DelugeServiceFixture : IDisposable
 {
     public Mock<ILogger<DelugeService>> Logger { get; }
-    public MemoryCache Cache { get; }
     public Mock<IFilenameEvaluator> FilenameEvaluator { get; }
     public Mock<IStriker> Striker { get; }
     public Mock<IDryRunInterceptor> DryRunInterceptor { get; }
     public Mock<IHardLinkFileService> HardLinkFileService { get; }
     public Mock<IDynamicHttpClientProvider> HttpClientProvider { get; }
     public Mock<IEventPublisher> EventPublisher { get; }
-    public BlocklistProvider BlocklistProvider { get; }
+    public Mock<IBlocklistProvider> BlocklistProvider { get; }
     public Mock<IRuleEvaluator> RuleEvaluator { get; }
     public Mock<IRuleManager> RuleManager { get; }
     public Mock<IDelugeClientWrapper> ClientWrapper { get; }
@@ -32,14 +29,13 @@ public class DelugeServiceFixture : IDisposable
     public DelugeServiceFixture()
     {
         Logger = new Mock<ILogger<DelugeService>>();
-        Cache = new MemoryCache(new MemoryCacheOptions());
         FilenameEvaluator = new Mock<IFilenameEvaluator>();
         Striker = new Mock<IStriker>();
         DryRunInterceptor = new Mock<IDryRunInterceptor>();
         HardLinkFileService = new Mock<IHardLinkFileService>();
         HttpClientProvider = new Mock<IDynamicHttpClientProvider>();
         EventPublisher = new Mock<IEventPublisher>();
-        BlocklistProvider = TestBlocklistProviderFactory.Create();
+        BlocklistProvider = new Mock<IBlocklistProvider>();
         RuleEvaluator = new Mock<IRuleEvaluator>();
         RuleManager = new Mock<IRuleManager>();
         ClientWrapper = new Mock<IDelugeClientWrapper>();
@@ -74,14 +70,13 @@ public class DelugeServiceFixture : IDisposable
 
         return new DelugeService(
             Logger.Object,
-            Cache,
             FilenameEvaluator.Object,
             Striker.Object,
             DryRunInterceptor.Object,
             HardLinkFileService.Object,
             HttpClientProvider.Object,
             EventPublisher.Object,
-            BlocklistProvider,
+            BlocklistProvider.Object,
             config,
             RuleEvaluator.Object,
             RuleManager.Object,
@@ -112,7 +107,6 @@ public class DelugeServiceFixture : IDisposable
 
     public void Dispose()
     {
-        Cache.Dispose();
         GC.SuppressFinalize(this);
     }
 }

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/QBitServiceDCTests.cs

@@ -1,3 +1,4 @@
+using Cleanuparr.Domain.Entities;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Features.Context;
 using Cleanuparr.Infrastructure.Features.DownloadClient.QBittorrent;
@@ -302,6 +303,203 @@ public class QBitServiceDCTests : IClassFixture<QBitServiceFixture>
         }
     }
 
+    public class CleanDownloadsAsync_Tests : QBitServiceDCTests
+    {
+        public CleanDownloadsAsync_Tests(QBitServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        private static QBitItemWrapper CreateTorrent(string hash, string category, bool isPrivate) =>
+            new(new TorrentInfo
+            {
+                Hash = hash,
+                Name = $"Test {hash}",
+                Category = category,
+                Ratio = 2.0,
+                SeedingTime = TimeSpan.FromHours(10)
+            }, Array.Empty<TorrentTracker>(), isPrivate);
+
+        private static SeedingRule CreateRule(string name, TorrentPrivacyType privacyType) =>
+            new()
+            {
+                Name = name,
+                PrivacyType = privacyType,
+                MaxRatio = 0,
+                MinSeedTime = 0,
+                MaxSeedTime = -1,
+                DeleteSourceFiles = false
+            };
+
+        private void SetupDeleteMock()
+        {
+            _fixture.ClientWrapper
+                .Setup(x => x.DeleteAsync(It.IsAny<IEnumerable<string>>(), It.IsAny<bool>()))
+                .Returns(Task.CompletedTask);
+        }
+
+        [Fact]
+        public async Task SkipsPrivateTorrent_WhenRuleIsPublicOnly()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+            SetupDeleteMock();
+
+            var downloads = new List<Domain.Entities.ITorrentItemWrapper>
+            {
+                CreateTorrent("hash1", "movies", isPrivate: true)
+            };
+            var rules = new List<SeedingRule> { CreateRule("movies", TorrentPrivacyType.Public) };
+
+            // Act
+            await sut.CleanDownloadsAsync(downloads, rules);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.DeleteAsync(It.IsAny<IEnumerable<string>>(), It.IsAny<bool>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task CleansPublicTorrent_WhenRuleIsPublicOnly()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+            SetupDeleteMock();
+
+            var downloads = new List<Domain.Entities.ITorrentItemWrapper>
+            {
+                CreateTorrent("hash1", "movies", isPrivate: false)
+            };
+            var rules = new List<SeedingRule> { CreateRule("movies", TorrentPrivacyType.Public) };
+
+            // Act
+            await sut.CleanDownloadsAsync(downloads, rules);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.DeleteAsync(It.Is<IEnumerable<string>>(h => h.Contains("hash1")), false),
+                Times.Once);
+        }
+
+        [Fact]
+        public async Task SkipsPublicTorrent_WhenRuleIsPrivateOnly()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+            SetupDeleteMock();
+
+            var downloads = new List<Domain.Entities.ITorrentItemWrapper>
+            {
+                CreateTorrent("hash1", "movies", isPrivate: false)
+            };
+            var rules = new List<SeedingRule> { CreateRule("movies", TorrentPrivacyType.Private) };
+
+            // Act
+            await sut.CleanDownloadsAsync(downloads, rules);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.DeleteAsync(It.IsAny<IEnumerable<string>>(), It.IsAny<bool>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task CleansPrivateTorrent_WhenRuleIsPrivateOnly()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+            SetupDeleteMock();
+
+            var downloads = new List<Domain.Entities.ITorrentItemWrapper>
+            {
+                CreateTorrent("hash1", "movies", isPrivate: true)
+            };
+            var rules = new List<SeedingRule> { CreateRule("movies", TorrentPrivacyType.Private) };
+
+            // Act
+            await sut.CleanDownloadsAsync(downloads, rules);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.DeleteAsync(It.Is<IEnumerable<string>>(h => h.Contains("hash1")), false),
+                Times.Once);
+        }
+
+        [Fact]
+        public async Task CleansPublicTorrent_WhenRuleIsBoth()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+            SetupDeleteMock();
+
+            var downloads = new List<Domain.Entities.ITorrentItemWrapper>
+            {
+                CreateTorrent("hash1", "movies", isPrivate: false)
+            };
+            var rules = new List<SeedingRule> { CreateRule("movies", TorrentPrivacyType.Both) };
+
+            // Act
+            await sut.CleanDownloadsAsync(downloads, rules);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.DeleteAsync(It.Is<IEnumerable<string>>(h => h.Contains("hash1")), false),
+                Times.Once);
+        }
+
+        [Fact]
+        public async Task CleansPrivateTorrent_WhenRuleIsBoth()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+            SetupDeleteMock();
+
+            var downloads = new List<Domain.Entities.ITorrentItemWrapper>
+            {
+                CreateTorrent("hash1", "movies", isPrivate: true)
+            };
+            var rules = new List<SeedingRule> { CreateRule("movies", TorrentPrivacyType.Both) };
+
+            // Act
+            await sut.CleanDownloadsAsync(downloads, rules);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.DeleteAsync(It.Is<IEnumerable<string>>(h => h.Contains("hash1")), false),
+                Times.Once);
+        }
+
+        [Fact]
+        public async Task MatchesCorrectRule_WhenMultipleRulesForSameCategory()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+            SetupDeleteMock();
+
+            var downloads = new List<Domain.Entities.ITorrentItemWrapper>
+            {
+                CreateTorrent("public-hash", "movies", isPrivate: false),
+                CreateTorrent("private-hash", "movies", isPrivate: true)
+            };
+            var rules = new List<SeedingRule>
+            {
+                CreateRule("movies", TorrentPrivacyType.Public),
+                CreateRule("movies", TorrentPrivacyType.Private)
+            };
+
+            // Act
+            await sut.CleanDownloadsAsync(downloads, rules);
+
+            // Assert - both torrents should be cleaned, each matching their respective rule
+            _fixture.ClientWrapper.Verify(
+                x => x.DeleteAsync(It.Is<IEnumerable<string>>(h => h.Contains("public-hash")), false),
+                Times.Once);
+            _fixture.ClientWrapper.Verify(
+                x => x.DeleteAsync(It.Is<IEnumerable<string>>(h => h.Contains("private-hash")), false),
+                Times.Once);
+        }
+    }
+
     public class FilterDownloadsToChangeCategoryAsync_Tests : QBitServiceDCTests
     {
         public FilterDownloadsToChangeCategoryAsync_Tests(QBitServiceFixture fixture) : base(fixture)
@@ -503,13 +701,15 @@ public class QBitServiceDCTests : IClassFixture<QBitServiceFixture>
             // Arrange
             var sut = _fixture.CreateSut();
             const string hash = "test-hash";
+            var mockTorrent = new Mock<ITorrentItemWrapper>();
+            mockTorrent.Setup(x => x.Hash).Returns(hash);
 
             _fixture.ClientWrapper
                 .Setup(x => x.DeleteAsync(It.Is<IEnumerable<string>>(h => h.Contains(hash)), true))
                 .Returns(Task.CompletedTask);
 
             // Act
-            await sut.DeleteDownload(hash, true);
+            await sut.DeleteDownload(mockTorrent.Object, true);
 
             // Assert
             _fixture.ClientWrapper.Verify(
@@ -523,13 +723,15 @@ public class QBitServiceDCTests : IClassFixture<QBitServiceFixture>
             // Arrange
             var sut = _fixture.CreateSut();
             const string hash = "test-hash";
+            var mockTorrent = new Mock<ITorrentItemWrapper>();
+            mockTorrent.Setup(x => x.Hash).Returns(hash);
 
             _fixture.ClientWrapper
                 .Setup(x => x.DeleteAsync(It.IsAny<IEnumerable<string>>(), It.IsAny<bool>()))
                 .Returns(Task.CompletedTask);
 
             // Act
-            await sut.DeleteDownload(hash, true);
+            await sut.DeleteDownload(mockTorrent.Object, true);
 
             // Assert
             _fixture.ClientWrapper.Verify(

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/QBitServiceFixture.cs

@@ -6,9 +6,7 @@ using Cleanuparr.Infrastructure.Features.MalwareBlocker;
 using Cleanuparr.Infrastructure.Http;
 using Cleanuparr.Infrastructure.Interceptors;
 using Cleanuparr.Infrastructure.Services.Interfaces;
-using Cleanuparr.Infrastructure.Tests.Features.DownloadClient.TestHelpers;
 using Cleanuparr.Persistence.Models.Configuration;
-using Microsoft.Extensions.Caching.Memory;
 using Microsoft.Extensions.Logging;
 using Moq;
 
@@ -17,14 +15,13 @@ namespace Cleanuparr.Infrastructure.Tests.Features.DownloadClient;
 public class QBitServiceFixture : IDisposable
 {
     public Mock<ILogger<QBitService>> Logger { get; }
-    public MemoryCache Cache { get; }
     public Mock<IFilenameEvaluator> FilenameEvaluator { get; }
     public Mock<IStriker> Striker { get; }
     public Mock<IDryRunInterceptor> DryRunInterceptor { get; }
     public Mock<IHardLinkFileService> HardLinkFileService { get; }
     public Mock<IDynamicHttpClientProvider> HttpClientProvider { get; }
     public Mock<IEventPublisher> EventPublisher { get; }
-    public BlocklistProvider BlocklistProvider { get; }
+    public Mock<IBlocklistProvider> BlocklistProvider { get; }
     public Mock<IRuleEvaluator> RuleEvaluator { get; }
     public Mock<IRuleManager> RuleManager { get; }
     public Mock<IQBittorrentClientWrapper> ClientWrapper { get; }
@@ -32,14 +29,13 @@ public class QBitServiceFixture : IDisposable
     public QBitServiceFixture()
     {
         Logger = new Mock<ILogger<QBitService>>();
-        Cache = new MemoryCache(new MemoryCacheOptions());
         FilenameEvaluator = new Mock<IFilenameEvaluator>();
         Striker = new Mock<IStriker>();
         DryRunInterceptor = new Mock<IDryRunInterceptor>();
         HardLinkFileService = new Mock<IHardLinkFileService>();
         HttpClientProvider = new Mock<IDynamicHttpClientProvider>();
         EventPublisher = new Mock<IEventPublisher>();
-        BlocklistProvider = TestBlocklistProviderFactory.Create();
+        BlocklistProvider =new Mock<IBlocklistProvider>();
         RuleEvaluator = new Mock<IRuleEvaluator>();
         RuleManager = new Mock<IRuleManager>();
         ClientWrapper = new Mock<IQBittorrentClientWrapper>();
@@ -76,14 +72,13 @@ public class QBitServiceFixture : IDisposable
 
         return new QBitService(
             Logger.Object,
-            Cache,
             FilenameEvaluator.Object,
             Striker.Object,
             DryRunInterceptor.Object,
             HardLinkFileService.Object,
             HttpClientProvider.Object,
             EventPublisher.Object,
-            BlocklistProvider,
+            BlocklistProvider.Object,
             config,
             RuleEvaluator.Object,
             RuleManager.Object,
@@ -115,7 +110,6 @@ public class QBitServiceFixture : IDisposable
 
     public void Dispose()
     {
-        Cache.Dispose();
         GC.SuppressFinalize(this);
     }
 }

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/QBitServiceTests.cs

@@ -470,7 +470,7 @@ public class QBitServiceTests : IClassFixture<QBitServiceFixture>
                 });
 
             _fixture.Striker
-                .Setup(x => x.StrikeAndCheckLimit(hash, It.IsAny<string>(), (ushort)3, StrikeType.DownloadingMetadata))
+                .Setup(x => x.StrikeAndCheckLimit(hash, It.IsAny<string>(), (ushort)3, StrikeType.DownloadingMetadata, It.IsAny<long?>()))
                 .ReturnsAsync(false);
 
             // Act
@@ -479,7 +479,7 @@ public class QBitServiceTests : IClassFixture<QBitServiceFixture>
             // Assert
             Assert.False(result.ShouldRemove);
             _fixture.Striker.Verify(
-                x => x.StrikeAndCheckLimit(hash, It.IsAny<string>(), (ushort)3, StrikeType.DownloadingMetadata),
+                x => x.StrikeAndCheckLimit(hash, It.IsAny<string>(), (ushort)3, StrikeType.DownloadingMetadata, It.IsAny<long?>()),
                 Times.Once);
         }
 
@@ -533,7 +533,7 @@ public class QBitServiceTests : IClassFixture<QBitServiceFixture>
                 });
 
             _fixture.Striker
-                .Setup(x => x.StrikeAndCheckLimit(hash, It.IsAny<string>(), (ushort)3, StrikeType.DownloadingMetadata))
+                .Setup(x => x.StrikeAndCheckLimit(hash, It.IsAny<string>(), (ushort)3, StrikeType.DownloadingMetadata, It.IsAny<long?>()))
                 .ReturnsAsync(true); // Strike limit exceeded
 
             // Act
@@ -600,7 +600,7 @@ public class QBitServiceTests : IClassFixture<QBitServiceFixture>
             // Assert
             Assert.False(result.ShouldRemove);
             _fixture.Striker.Verify(
-                x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), It.IsAny<StrikeType>()),
+                x => x.StrikeAndCheckLimit(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<ushort>(), It.IsAny<StrikeType>(), It.IsAny<long?>()),
                 Times.Never);
         }
     }

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/RTorrentItemWrapperTests.cs

@@ -0,0 +1,582 @@
+using Cleanuparr.Domain.Entities.RTorrent.Response;
+using Cleanuparr.Infrastructure.Features.DownloadClient.RTorrent;
+using Xunit;
+
+namespace Cleanuparr.Infrastructure.Tests.Features.DownloadClient;
+
+public class RTorrentItemWrapperTests
+{
+    public class PropertyMapping_Tests
+    {
+        [Fact]
+        public void MapsHash()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "ABC123DEF456", Name = "Test" };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal("ABC123DEF456", wrapper.Hash);
+        }
+
+        [Fact]
+        public void MapsName()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test Torrent Name" };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal("Test Torrent Name", wrapper.Name);
+        }
+
+        [Fact]
+        public void MapsIsPrivate_True()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", IsPrivate = 1 };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.True(wrapper.IsPrivate);
+        }
+
+        [Fact]
+        public void MapsIsPrivate_False()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", IsPrivate = 0 };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.False(wrapper.IsPrivate);
+        }
+
+        [Fact]
+        public void MapsSize()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", SizeBytes = 1024000 };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(1024000, wrapper.Size);
+        }
+
+        [Fact]
+        public void MapsDownloadSpeed()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", DownRate = 500000 };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(500000, wrapper.DownloadSpeed);
+        }
+
+        [Fact]
+        public void MapsDownloadedBytes()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", CompletedBytes = 750000 };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(750000, wrapper.DownloadedBytes);
+        }
+
+        [Fact]
+        public void MapsCategory()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "movies" };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal("movies", wrapper.Category);
+        }
+
+        [Fact]
+        public void CategoryIsSettable()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "movies" };
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Act
+            wrapper.Category = "tv";
+
+            // Assert
+            Assert.Equal("tv", wrapper.Category);
+        }
+    }
+
+    public class Ratio_Tests
+    {
+        [Fact]
+        public void ConvertsRatioFromRTorrentFormat()
+        {
+            // rTorrent returns ratio * 1000, so 1500 = 1.5 ratio
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", Ratio = 1500 };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(1.5, wrapper.Ratio);
+        }
+
+        [Fact]
+        public void HandlesZeroRatio()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", Ratio = 0 };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(0, wrapper.Ratio);
+        }
+
+        [Fact]
+        public void HandlesHighRatio()
+        {
+            // Arrange - 10.0 ratio = 10000 in rTorrent
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", Ratio = 10000 };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(10.0, wrapper.Ratio);
+        }
+    }
+
+    public class CompletionPercentage_Tests
+    {
+        [Fact]
+        public void CalculatesCorrectPercentage()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                SizeBytes = 1000,
+                CompletedBytes = 500
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(50.0, wrapper.CompletionPercentage);
+        }
+
+        [Fact]
+        public void ReturnsZero_WhenSizeIsZero()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                SizeBytes = 0,
+                CompletedBytes = 0
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(0.0, wrapper.CompletionPercentage);
+        }
+
+        [Fact]
+        public void ReturnsHundred_WhenComplete()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                SizeBytes = 1000,
+                CompletedBytes = 1000
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(100.0, wrapper.CompletionPercentage);
+        }
+    }
+
+    public class IsDownloading_Tests
+    {
+        [Fact]
+        public void ReturnsTrue_WhenStateIsStartedAndNotComplete()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                State = 1,  // Started
+                Complete = 0  // Not complete
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.True(wrapper.IsDownloading());
+        }
+
+        [Fact]
+        public void ReturnsFalse_WhenStopped()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                State = 0,  // Stopped
+                Complete = 0
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.False(wrapper.IsDownloading());
+        }
+
+        [Fact]
+        public void ReturnsFalse_WhenComplete()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                State = 1,  // Started
+                Complete = 1  // Complete (seeding)
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.False(wrapper.IsDownloading());
+        }
+    }
+
+    public class IsStalled_Tests
+    {
+        [Fact]
+        public void ReturnsTrue_WhenDownloadingWithNoSpeed()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                State = 1,
+                Complete = 0,
+                DownRate = 0,
+                SizeBytes = 1000,
+                CompletedBytes = 500
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.True(wrapper.IsStalled());
+        }
+
+        [Fact]
+        public void ReturnsFalse_WhenDownloadingWithSpeed()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                State = 1,
+                Complete = 0,
+                DownRate = 100000,
+                SizeBytes = 1000,
+                CompletedBytes = 500
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.False(wrapper.IsStalled());
+        }
+
+        [Fact]
+        public void ReturnsFalse_WhenNotDownloading()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                State = 0,  // Stopped
+                Complete = 0,
+                DownRate = 0
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.False(wrapper.IsStalled());
+        }
+    }
+
+    public class SeedingTime_Tests
+    {
+        [Fact]
+        public void ReturnsZero_WhenNotComplete()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                Complete = 0,
+                TimestampFinished = 0
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(0, wrapper.SeedingTimeSeconds);
+        }
+
+        [Fact]
+        public void ReturnsZero_WhenNoFinishTimestamp()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                Complete = 1,
+                TimestampFinished = 0
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(0, wrapper.SeedingTimeSeconds);
+        }
+
+        [Fact]
+        public void CalculatesSeedingTime_WhenComplete()
+        {
+            // Arrange
+            var finishedTime = DateTimeOffset.UtcNow.AddHours(-2).ToUnixTimeSeconds();
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                Complete = 1,
+                TimestampFinished = finishedTime
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert - should be approximately 2 hours (7200 seconds)
+            Assert.True(wrapper.SeedingTimeSeconds >= 7190 && wrapper.SeedingTimeSeconds <= 7210);
+        }
+    }
+
+    public class Eta_Tests
+    {
+        [Fact]
+        public void ReturnsZero_WhenNoDownloadSpeed()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                SizeBytes = 1000,
+                CompletedBytes = 500,
+                DownRate = 0
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(0, wrapper.Eta);
+        }
+
+        [Fact]
+        public void CalculatesEta_WhenDownloading()
+        {
+            // Arrange - 500 bytes remaining at 100 bytes/sec = 5 seconds ETA
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                SizeBytes = 1000,
+                CompletedBytes = 500,
+                DownRate = 100
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(5, wrapper.Eta);
+        }
+
+        [Fact]
+        public void ReturnsZero_WhenComplete()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                SizeBytes = 1000,
+                CompletedBytes = 1000,
+                DownRate = 100
+            };
+
+            // Act
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Assert
+            Assert.Equal(0, wrapper.Eta);
+        }
+    }
+
+    public class IsIgnored_Tests
+    {
+        [Fact]
+        public void ReturnsFalse_WhenEmptyIgnoreList()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "movies" };
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Act
+            var result = wrapper.IsIgnored(new List<string>());
+
+            // Assert
+            Assert.False(result);
+        }
+
+        [Fact]
+        public void ReturnsTrue_WhenHashMatches()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "ABC123", Name = "Test", Label = "movies" };
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Act
+            var result = wrapper.IsIgnored(new List<string> { "ABC123" });
+
+            // Assert
+            Assert.True(result);
+        }
+
+        [Fact]
+        public void ReturnsTrue_WhenHashMatchesCaseInsensitive()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "ABC123", Name = "Test", Label = "movies" };
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Act
+            var result = wrapper.IsIgnored(new List<string> { "abc123" });
+
+            // Assert
+            Assert.True(result);
+        }
+
+        [Fact]
+        public void ReturnsTrue_WhenCategoryMatches()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "movies" };
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Act
+            var result = wrapper.IsIgnored(new List<string> { "movies" });
+
+            // Assert
+            Assert.True(result);
+        }
+
+        [Fact]
+        public void ReturnsTrue_WhenTrackerDomainMatches()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                Label = "movies",
+                Trackers = new List<string> { "https://tracker.example.com/announce" }
+            };
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Act
+            var result = wrapper.IsIgnored(new List<string> { "example.com" });
+
+            // Assert
+            Assert.True(result);
+        }
+
+        [Fact]
+        public void ReturnsFalse_WhenNoMatch()
+        {
+            // Arrange
+            var torrent = new RTorrentTorrent
+            {
+                Hash = "HASH1",
+                Name = "Test",
+                Label = "movies",
+                Trackers = new List<string> { "https://tracker.example.com/announce" }
+            };
+            var wrapper = new RTorrentItemWrapper(torrent);
+
+            // Act
+            var result = wrapper.IsIgnored(new List<string> { "other.com", "tv", "HASH2" });
+
+            // Assert
+            Assert.False(result);
+        }
+    }
+}

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/RTorrentServiceDCTests.cs

@@ -0,0 +1,689 @@
+using Cleanuparr.Domain.Entities;
+using Cleanuparr.Domain.Entities.RTorrent.Response;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Features.Context;
+using Cleanuparr.Infrastructure.Features.DownloadClient.RTorrent;
+using Cleanuparr.Persistence.Models.Configuration.DownloadCleaner;
+using Moq;
+using Xunit;
+
+namespace Cleanuparr.Infrastructure.Tests.Features.DownloadClient;
+
+public class RTorrentServiceDCTests : IClassFixture<RTorrentServiceFixture>
+{
+    private readonly RTorrentServiceFixture _fixture;
+
+    public RTorrentServiceDCTests(RTorrentServiceFixture fixture)
+    {
+        _fixture = fixture;
+        _fixture.ResetMocks();
+    }
+
+    public class GetSeedingDownloads_Tests : RTorrentServiceDCTests
+    {
+        public GetSeedingDownloads_Tests(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        [Fact]
+        public async Task FiltersSeedingState()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var downloads = new List<RTorrentTorrent>
+            {
+                new RTorrentTorrent { Hash = "HASH1", Name = "Torrent 1", State = 1, Complete = 1, IsPrivate = 0, Label = "" },
+                new RTorrentTorrent { Hash = "HASH2", Name = "Torrent 2", State = 1, Complete = 0, IsPrivate = 0, Label = "" }, // Downloading, not seeding
+                new RTorrentTorrent { Hash = "HASH3", Name = "Torrent 3", State = 1, Complete = 1, IsPrivate = 0, Label = "" },
+                new RTorrentTorrent { Hash = "HASH4", Name = "Torrent 4", State = 0, Complete = 1, IsPrivate = 0, Label = "" } // Stopped, not seeding
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetAllTorrentsAsync())
+                .ReturnsAsync(downloads);
+
+            // Act
+            var result = await sut.GetSeedingDownloads();
+
+            // Assert - only torrents with State=1 AND Complete=1 should be returned
+            Assert.Equal(2, result.Count);
+            Assert.All(result, item => Assert.NotNull(item.Hash));
+        }
+
+        [Fact]
+        public async Task ReturnsEmptyList_WhenNoTorrents()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetAllTorrentsAsync())
+                .ReturnsAsync(new List<RTorrentTorrent>());
+
+            // Act
+            var result = await sut.GetSeedingDownloads();
+
+            // Assert
+            Assert.Empty(result);
+        }
+
+        [Fact]
+        public async Task SkipsTorrentsWithEmptyHash()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var downloads = new List<RTorrentTorrent>
+            {
+                new RTorrentTorrent { Hash = "", Name = "No Hash", State = 1, Complete = 1, IsPrivate = 0, Label = "" },
+                new RTorrentTorrent { Hash = "HASH1", Name = "Valid Hash", State = 1, Complete = 1, IsPrivate = 0, Label = "" }
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetAllTorrentsAsync())
+                .ReturnsAsync(downloads);
+
+            // Act
+            var result = await sut.GetSeedingDownloads();
+
+            // Assert
+            Assert.Single(result);
+            Assert.Equal("HASH1", result[0].Hash);
+        }
+    }
+
+    public class FilterDownloadsToBeCleanedAsync_Tests : RTorrentServiceDCTests
+    {
+        public FilterDownloadsToBeCleanedAsync_Tests(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        [Fact]
+        public void MatchesCategories()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Torrent 1", Label = "movies" }),
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH2", Name = "Torrent 2", Label = "tv" }),
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH3", Name = "Torrent 3", Label = "music" })
+            };
+
+            var categories = new List<SeedingRule>
+            {
+                new SeedingRule { Name = "movies", MaxRatio = -1, MinSeedTime = 0, MaxSeedTime = -1, DeleteSourceFiles = true },
+                new SeedingRule { Name = "tv", MaxRatio = -1, MinSeedTime = 0, MaxSeedTime = -1, DeleteSourceFiles = true }
+            };
+
+            // Act
+            var result = sut.FilterDownloadsToBeCleanedAsync(downloads, categories);
+
+            // Assert
+            Assert.NotNull(result);
+            Assert.Equal(2, result.Count);
+            Assert.Contains(result, x => x.Category == "movies");
+            Assert.Contains(result, x => x.Category == "tv");
+        }
+
+        [Fact]
+        public void IsCaseInsensitive()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Torrent 1", Label = "Movies" })
+            };
+
+            var categories = new List<SeedingRule>
+            {
+                new SeedingRule { Name = "movies", MaxRatio = -1, MinSeedTime = 0, MaxSeedTime = -1, DeleteSourceFiles = true }
+            };
+
+            // Act
+            var result = sut.FilterDownloadsToBeCleanedAsync(downloads, categories);
+
+            // Assert
+            Assert.NotNull(result);
+            Assert.Single(result);
+        }
+
+        [Fact]
+        public void ReturnsEmptyList_WhenNoMatches()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Torrent 1", Label = "music" })
+            };
+
+            var categories = new List<SeedingRule>
+            {
+                new SeedingRule { Name = "movies", MaxRatio = -1, MinSeedTime = 0, MaxSeedTime = -1, DeleteSourceFiles = true }
+            };
+
+            // Act
+            var result = sut.FilterDownloadsToBeCleanedAsync(downloads, categories);
+
+            // Assert
+            Assert.NotNull(result);
+            Assert.Empty(result);
+        }
+
+        [Fact]
+        public void ReturnsNull_WhenDownloadsNull()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var categories = new List<SeedingRule>
+            {
+                new SeedingRule { Name = "movies", MaxRatio = -1, MinSeedTime = 0, MaxSeedTime = -1, DeleteSourceFiles = true }
+            };
+
+            // Act
+            var result = sut.FilterDownloadsToBeCleanedAsync(null, categories);
+
+            // Assert
+            Assert.Null(result);
+        }
+    }
+
+    public class FilterDownloadsToChangeCategoryAsync_Tests : RTorrentServiceDCTests
+    {
+        public FilterDownloadsToChangeCategoryAsync_Tests(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        [Fact]
+        public void MatchesCategories()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Torrent 1", Label = "movies" }),
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH2", Name = "Torrent 2", Label = "tv" }),
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH3", Name = "Torrent 3", Label = "music" })
+            };
+
+            var categories = new List<string> { "movies", "tv" };
+
+            // Act
+            var result = sut.FilterDownloadsToChangeCategoryAsync(downloads, categories);
+
+            // Assert
+            Assert.NotNull(result);
+            Assert.Equal(2, result.Count);
+        }
+
+        [Fact]
+        public void SkipsEmptyHashes()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "", Name = "No Hash", Label = "movies" }),
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Valid Hash", Label = "movies" })
+            };
+
+            var categories = new List<string> { "movies" };
+
+            // Act
+            var result = sut.FilterDownloadsToChangeCategoryAsync(downloads, categories);
+
+            // Assert
+            Assert.NotNull(result);
+            Assert.Single(result);
+            Assert.Equal("HASH1", result[0].Hash);
+        }
+    }
+
+    public class DeleteDownload_Tests : RTorrentServiceDCTests
+    {
+        public DeleteDownload_Tests(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+
+        [Fact]
+        public async Task NormalizesHashToUppercase()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+            var hash = "lowercase";
+            var mockTorrent = new Mock<ITorrentItemWrapper>();
+            mockTorrent.Setup(x => x.Hash).Returns(hash);
+            mockTorrent.Setup(x => x.SavePath).Returns("/test/path");
+
+            _fixture.ClientWrapper
+                .Setup(x => x.DeleteTorrentAsync("LOWERCASE"))
+                .Returns(Task.CompletedTask);
+
+            // Act
+            await sut.DeleteDownload(mockTorrent.Object, deleteSourceFiles: false);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.DeleteTorrentAsync("LOWERCASE"),
+                Times.Once);
+        }
+    }
+
+    public class CreateCategoryAsync_Tests : RTorrentServiceDCTests
+    {
+        public CreateCategoryAsync_Tests(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        [Fact]
+        public async Task IsNoOp_BecauseRTorrentDoesNotSupportCategories()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            // Act
+            await sut.CreateCategoryAsync("test-category");
+
+            // Assert - no client calls should be made
+            _fixture.ClientWrapper.VerifyNoOtherCalls();
+        }
+    }
+
+    public class ChangeCategoryForNoHardLinksAsync_Tests : RTorrentServiceDCTests
+    {
+        public ChangeCategoryForNoHardLinksAsync_Tests(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        [Fact]
+        public async Task NullDownloads_DoesNothing()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(null);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.SetLabelAsync(It.IsAny<string>(), It.IsAny<string>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task EmptyDownloads_DoesNothing()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(new List<ITorrentItemWrapper>());
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.SetLabelAsync(It.IsAny<string>(), It.IsAny<string>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task MissingHash_SkipsTorrent()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "", Name = "Test", Label = "movies", BasePath = "/downloads" })
+            };
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(downloads);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.SetLabelAsync(It.IsAny<string>(), It.IsAny<string>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task MissingName_SkipsTorrent()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "", Label = "movies", BasePath = "/downloads" })
+            };
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(downloads);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.SetLabelAsync(It.IsAny<string>(), It.IsAny<string>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task MissingCategory_SkipsTorrent()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "", BasePath = "/downloads" })
+            };
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(downloads);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.SetLabelAsync(It.IsAny<string>(), It.IsAny<string>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task GetFilesThrows_SkipsTorrent()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "movies", BasePath = "/downloads" })
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync("HASH1"))
+                .ThrowsAsync(new Exception("XML-RPC error"));
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(downloads);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.SetLabelAsync(It.IsAny<string>(), It.IsAny<string>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task SkippedFiles_IgnoredInCheck()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "movies", BasePath = "/downloads" })
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync("HASH1"))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file1.mkv", Priority = 0 }, // Skipped
+                    new RTorrentFile { Index = 1, Path = "file2.mkv", Priority = 1 }  // Active
+                });
+
+            _fixture.HardLinkFileService
+                .Setup(x => x.GetHardLinkCount(It.IsAny<string>(), It.IsAny<bool>()))
+                .Returns(0);
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(downloads);
+
+            // Assert - only called for file2.mkv (the active file)
+            _fixture.HardLinkFileService.Verify(
+                x => x.GetHardLinkCount(It.IsAny<string>(), It.IsAny<bool>()),
+                Times.Once);
+        }
+
+        [Fact]
+        public async Task NoHardlinks_ChangesLabel()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "movies", BasePath = "/downloads" })
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync("HASH1"))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file1.mkv", Priority = 1 }
+                });
+
+            _fixture.HardLinkFileService
+                .Setup(x => x.GetHardLinkCount(It.IsAny<string>(), It.IsAny<bool>()))
+                .Returns(0);
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(downloads);
+
+            // Assert - rTorrent uses SetLabelAsync (not SetTorrentCategoryAsync)
+            _fixture.ClientWrapper.Verify(
+                x => x.SetLabelAsync("HASH1", "unlinked"),
+                Times.Once);
+        }
+
+        [Fact]
+        public async Task HasHardlinks_SkipsTorrent()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "movies", BasePath = "/downloads" })
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync("HASH1"))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file1.mkv", Priority = 1 }
+                });
+
+            _fixture.HardLinkFileService
+                .Setup(x => x.GetHardLinkCount(It.IsAny<string>(), It.IsAny<bool>()))
+                .Returns(2); // Has hardlinks
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(downloads);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.SetLabelAsync(It.IsAny<string>(), It.IsAny<string>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task FileNotFound_SkipsTorrent()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "movies", BasePath = "/downloads" })
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync("HASH1"))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file1.mkv", Priority = 1 }
+                });
+
+            _fixture.HardLinkFileService
+                .Setup(x => x.GetHardLinkCount(It.IsAny<string>(), It.IsAny<bool>()))
+                .Returns(-1); // Error / file not found
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(downloads);
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.SetLabelAsync(It.IsAny<string>(), It.IsAny<string>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task PublishesCategoryChangedEvent()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            var downloads = new List<ITorrentItemWrapper>
+            {
+                new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "movies", BasePath = "/downloads" })
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync("HASH1"))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file1.mkv", Priority = 1 }
+                });
+
+            _fixture.HardLinkFileService
+                .Setup(x => x.GetHardLinkCount(It.IsAny<string>(), It.IsAny<bool>()))
+                .Returns(0);
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(downloads);
+
+            // Assert
+            _fixture.EventPublisher.Verify(
+                x => x.PublishCategoryChanged("movies", "unlinked", false),
+                Times.Once);
+        }
+
+        [Fact]
+        public async Task UpdatesCategoryOnWrapper()
+        {
+            // Arrange
+            var sut = _fixture.CreateSut();
+
+            var config = new DownloadCleanerConfig
+            {
+                Id = Guid.NewGuid(),
+                UnlinkedTargetCategory = "unlinked"
+            };
+            ContextProvider.Set(nameof(DownloadCleanerConfig), config);
+
+            var wrapper = new RTorrentItemWrapper(new RTorrentTorrent { Hash = "HASH1", Name = "Test", Label = "movies", BasePath = "/downloads" });
+            var downloads = new List<ITorrentItemWrapper> { wrapper };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync("HASH1"))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file1.mkv", Priority = 1 }
+                });
+
+            _fixture.HardLinkFileService
+                .Setup(x => x.GetHardLinkCount(It.IsAny<string>(), It.IsAny<bool>()))
+                .Returns(0);
+
+            // Act
+            await sut.ChangeCategoryForNoHardLinksAsync(downloads);
+
+            // Assert
+            Assert.Equal("unlinked", wrapper.Category);
+        }
+    }
+}

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/RTorrentServiceFixture.cs

@@ -0,0 +1,112 @@
+using Cleanuparr.Infrastructure.Events.Interfaces;
+using Cleanuparr.Infrastructure.Features.DownloadClient.RTorrent;
+using Cleanuparr.Infrastructure.Features.Files;
+using Cleanuparr.Infrastructure.Features.ItemStriker;
+using Cleanuparr.Infrastructure.Features.MalwareBlocker;
+using Cleanuparr.Infrastructure.Http;
+using Cleanuparr.Infrastructure.Interceptors;
+using Cleanuparr.Infrastructure.Services.Interfaces;
+using Cleanuparr.Persistence.Models.Configuration;
+using Microsoft.Extensions.Logging;
+using Moq;
+
+namespace Cleanuparr.Infrastructure.Tests.Features.DownloadClient;
+
+public class RTorrentServiceFixture : IDisposable
+{
+    public Mock<ILogger<RTorrentService>> Logger { get; }
+    public Mock<IFilenameEvaluator> FilenameEvaluator { get; }
+    public Mock<IStriker> Striker { get; }
+    public Mock<IDryRunInterceptor> DryRunInterceptor { get; }
+    public Mock<IHardLinkFileService> HardLinkFileService { get; }
+    public Mock<IDynamicHttpClientProvider> HttpClientProvider { get; }
+    public Mock<IEventPublisher> EventPublisher { get; }
+    public Mock<IBlocklistProvider> BlocklistProvider { get; }
+    public Mock<IRuleEvaluator> RuleEvaluator { get; }
+    public Mock<IRuleManager> RuleManager { get; }
+    public Mock<IRTorrentClientWrapper> ClientWrapper { get; }
+
+    public RTorrentServiceFixture()
+    {
+        Logger = new Mock<ILogger<RTorrentService>>();
+        FilenameEvaluator = new Mock<IFilenameEvaluator>();
+        Striker = new Mock<IStriker>();
+        DryRunInterceptor = new Mock<IDryRunInterceptor>();
+        HardLinkFileService = new Mock<IHardLinkFileService>();
+        HttpClientProvider = new Mock<IDynamicHttpClientProvider>();
+        EventPublisher = new Mock<IEventPublisher>();
+        BlocklistProvider = new Mock<IBlocklistProvider>();
+        RuleEvaluator = new Mock<IRuleEvaluator>();
+        RuleManager = new Mock<IRuleManager>();
+        ClientWrapper = new Mock<IRTorrentClientWrapper>();
+
+        DryRunInterceptor
+            .Setup(x => x.InterceptAsync(It.IsAny<Delegate>(), It.IsAny<object[]>()))
+            .Returns((Delegate action, object[] parameters) =>
+            {
+                return (Task)(action.DynamicInvoke(parameters) ?? Task.CompletedTask);
+            });
+    }
+
+    public RTorrentService CreateSut(DownloadClientConfig? config = null)
+    {
+        config ??= new DownloadClientConfig
+        {
+            Id = Guid.NewGuid(),
+            Name = "Test rTorrent Client",
+            TypeName = Domain.Enums.DownloadClientTypeName.rTorrent,
+            Type = Domain.Enums.DownloadClientType.Torrent,
+            Enabled = true,
+            Host = new Uri("http://localhost/RPC2"),
+            Username = "admin",
+            Password = "admin",
+            UrlBase = ""
+        };
+
+        var httpClient = new HttpClient();
+        HttpClientProvider
+            .Setup(x => x.CreateClient(It.IsAny<DownloadClientConfig>()))
+            .Returns(httpClient);
+
+        return new RTorrentService(
+            Logger.Object,
+            FilenameEvaluator.Object,
+            Striker.Object,
+            DryRunInterceptor.Object,
+            HardLinkFileService.Object,
+            HttpClientProvider.Object,
+            EventPublisher.Object,
+            BlocklistProvider.Object,
+            config,
+            RuleEvaluator.Object,
+            RuleManager.Object,
+            ClientWrapper.Object
+        );
+    }
+
+    public void ResetMocks()
+    {
+        Logger.Reset();
+        FilenameEvaluator.Reset();
+        Striker.Reset();
+        DryRunInterceptor.Reset();
+        HardLinkFileService.Reset();
+        HttpClientProvider.Reset();
+        EventPublisher.Reset();
+        RuleEvaluator.Reset();
+        RuleManager.Reset();
+        ClientWrapper.Reset();
+
+        DryRunInterceptor
+            .Setup(x => x.InterceptAsync(It.IsAny<Delegate>(), It.IsAny<object[]>()))
+            .Returns((Delegate action, object[] parameters) =>
+            {
+                return (Task)(action.DynamicInvoke(parameters) ?? Task.CompletedTask);
+            });
+    }
+
+    public void Dispose()
+    {
+        GC.SuppressFinalize(this);
+    }
+}

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/RTorrentServiceTests.cs

@@ -0,0 +1,725 @@
+using Cleanuparr.Domain.Entities.RTorrent.Response;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Features.DownloadClient.RTorrent;
+using Moq;
+using Xunit;
+
+namespace Cleanuparr.Infrastructure.Tests.Features.DownloadClient;
+
+public class RTorrentServiceTests : IClassFixture<RTorrentServiceFixture>
+{
+    private readonly RTorrentServiceFixture _fixture;
+
+    public RTorrentServiceTests(RTorrentServiceFixture fixture)
+    {
+        _fixture = fixture;
+        _fixture.ResetMocks();
+    }
+
+    public class ShouldRemoveFromArrQueueAsync_BasicScenarios : RTorrentServiceTests
+    {
+        public ShouldRemoveFromArrQueueAsync_BasicScenarios(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        [Fact]
+        public async Task TorrentNotFound_ReturnsEmptyResult()
+        {
+            // Arrange
+            const string hash = "nonexistent";
+            var sut = _fixture.CreateSut();
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash.ToUpperInvariant()))
+                .ReturnsAsync((RTorrentTorrent?)null);
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.False(result.Found);
+            Assert.False(result.ShouldRemove);
+            Assert.Equal(DeleteReason.None, result.DeleteReason);
+        }
+
+        [Fact]
+        public async Task TorrentWithEmptyHash_ReturnsEmptyResult()
+        {
+            // Arrange
+            const string hash = "test-hash";
+            var sut = _fixture.CreateSut();
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash.ToUpperInvariant()))
+                .ReturnsAsync(new RTorrentTorrent { Hash = "", Name = "Test" });
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.False(result.Found);
+            Assert.False(result.ShouldRemove);
+        }
+
+        [Fact]
+        public async Task TorrentIsIgnored_ReturnsEmptyResult_WithFound()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                Label = "ignored-category",
+                State = 1,
+                Complete = 0
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, new[] { "ignored-category" });
+
+            // Assert
+            Assert.True(result.Found);
+            Assert.False(result.ShouldRemove);
+        }
+
+        [Fact]
+        public async Task TorrentFound_SetsIsPrivateCorrectly_WhenPrivate()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 1,
+                State = 1,
+                Complete = 0,
+                DownRate = 1000,
+                SizeBytes = 1000,
+                CompletedBytes = 500
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file.mkv", Priority = 1 }
+                });
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateSlowRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((false, DeleteReason.None, false));
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateStallRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((false, DeleteReason.None, false));
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.True(result.Found);
+            Assert.True(result.IsPrivate);
+        }
+
+        [Fact]
+        public async Task TorrentFound_SetsIsPrivateCorrectly_WhenPublic()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                State = 1,
+                Complete = 0,
+                DownRate = 1000,
+                SizeBytes = 1000,
+                CompletedBytes = 500
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file.mkv", Priority = 1 }
+                });
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateSlowRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((false, DeleteReason.None, false));
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateStallRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((false, DeleteReason.None, false));
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.True(result.Found);
+            Assert.False(result.IsPrivate);
+        }
+
+        [Fact]
+        public async Task NormalizesHashToUppercase()
+        {
+            // Arrange
+            const string hash = "lowercase-hash";
+            var sut = _fixture.CreateSut();
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync("LOWERCASE-HASH"))
+                .ReturnsAsync((RTorrentTorrent?)null);
+
+            // Act
+            await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            _fixture.ClientWrapper.Verify(
+                x => x.GetTorrentAsync("LOWERCASE-HASH"),
+                Times.Once);
+        }
+    }
+
+    public class ShouldRemoveFromArrQueueAsync_AllFilesSkippedScenarios : RTorrentServiceTests
+    {
+        public ShouldRemoveFromArrQueueAsync_AllFilesSkippedScenarios(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        [Fact]
+        public async Task AllFilesSkipped_DeletesFromClient()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                State = 1,
+                Complete = 0
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file1.mkv", Priority = 0 },
+                    new RTorrentFile { Index = 1, Path = "file2.mkv", Priority = 0 }
+                });
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.True(result.ShouldRemove);
+            Assert.Equal(DeleteReason.AllFilesSkipped, result.DeleteReason);
+            Assert.True(result.DeleteFromClient);
+        }
+
+        [Fact]
+        public async Task SomeFilesWanted_DoesNotRemove()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                State = 1,
+                Complete = 0,
+                DownRate = 1000,
+                SizeBytes = 1000,
+                CompletedBytes = 500
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file1.mkv", Priority = 0 },
+                    new RTorrentFile { Index = 1, Path = "file2.mkv", Priority = 1 } // At least one wanted
+                });
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateSlowRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((false, DeleteReason.None, false));
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateStallRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((false, DeleteReason.None, false));
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.False(result.ShouldRemove);
+        }
+    }
+
+    public class ShouldRemoveFromArrQueueAsync_FileErrorScenarios : RTorrentServiceTests
+    {
+        public ShouldRemoveFromArrQueueAsync_FileErrorScenarios(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        [Fact]
+        public async Task GetTorrentFilesThrows_ReturnsEmptyResult()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                State = 1,
+                Complete = 0
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ThrowsAsync(new Exception("XML-RPC error"));
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.True(result.Found);
+            Assert.False(result.ShouldRemove);
+            Assert.Equal(DeleteReason.None, result.DeleteReason);
+        }
+    }
+
+    public class ShouldRemoveFromArrQueueAsync_SlowDownloadScenarios : RTorrentServiceTests
+    {
+        public ShouldRemoveFromArrQueueAsync_SlowDownloadScenarios(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        [Fact]
+        public async Task SlowDownload_NotInDownloadingState_SkipsCheck()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            // State=1, Complete=1 means seeding (not downloading)
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                State = 1,
+                Complete = 1,
+                DownRate = 100
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file.mkv", Priority = 1 }
+                });
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateStallRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((false, DeleteReason.None, false));
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.False(result.ShouldRemove);
+            _fixture.RuleEvaluator.Verify(
+                x => x.EvaluateSlowRulesAsync(It.IsAny<RTorrentItemWrapper>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task SlowDownload_ZeroSpeed_SkipsCheck()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            // State=1, Complete=0 means downloading; DownRate=0 means zero speed
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                State = 1,
+                Complete = 0,
+                DownRate = 0,
+                SizeBytes = 1000,
+                CompletedBytes = 500
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file.mkv", Priority = 1 }
+                });
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateStallRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((false, DeleteReason.None, false));
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.False(result.ShouldRemove);
+            _fixture.RuleEvaluator.Verify(
+                x => x.EvaluateSlowRulesAsync(It.IsAny<RTorrentItemWrapper>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task SlowDownload_MatchesRule_RemovesFromQueue()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            // State=1, Complete=0 means downloading; DownRate > 0 means some speed
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                State = 1,
+                Complete = 0,
+                DownRate = 1000,
+                SizeBytes = 1000,
+                CompletedBytes = 500
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file.mkv", Priority = 1 }
+                });
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateSlowRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((true, DeleteReason.SlowSpeed, true));
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.True(result.ShouldRemove);
+            Assert.Equal(DeleteReason.SlowSpeed, result.DeleteReason);
+            Assert.True(result.DeleteFromClient);
+        }
+    }
+
+    public class ShouldRemoveFromArrQueueAsync_StalledDownloadScenarios : RTorrentServiceTests
+    {
+        public ShouldRemoveFromArrQueueAsync_StalledDownloadScenarios(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        [Fact]
+        public async Task StalledDownload_NotInStalledState_SkipsCheck()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            // State=1, Complete=0, DownRate > 0 = downloading with speed (not stalled)
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                State = 1,
+                Complete = 0,
+                DownRate = 5000,
+                SizeBytes = 1000,
+                CompletedBytes = 500
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file.mkv", Priority = 1 }
+                });
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateSlowRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((false, DeleteReason.None, false));
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.False(result.ShouldRemove);
+            _fixture.RuleEvaluator.Verify(
+                x => x.EvaluateStallRulesAsync(It.IsAny<RTorrentItemWrapper>()),
+                Times.Never);
+        }
+
+        [Fact]
+        public async Task StalledDownload_MatchesRule_RemovesFromQueue()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            // State=1, Complete=0, DownRate=0 = stalled (downloading with no speed)
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                State = 1,
+                Complete = 0,
+                DownRate = 0,
+                SizeBytes = 1000,
+                CompletedBytes = 500
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file.mkv", Priority = 1 }
+                });
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateStallRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((true, DeleteReason.Stalled, true));
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.True(result.ShouldRemove);
+            Assert.Equal(DeleteReason.Stalled, result.DeleteReason);
+            Assert.True(result.DeleteFromClient);
+        }
+    }
+
+    public class ShouldRemoveFromArrQueueAsync_IntegrationScenarios : RTorrentServiceTests
+    {
+        public ShouldRemoveFromArrQueueAsync_IntegrationScenarios(RTorrentServiceFixture fixture) : base(fixture)
+        {
+        }
+
+        [Fact]
+        public async Task SlowCheckPasses_ButStalledCheckFails_RemovesFromQueue()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            // State=1, Complete=0, DownRate=0 = stalled (not downloading, so slow check skipped)
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                State = 1,
+                Complete = 0,
+                DownRate = 0,
+                SizeBytes = 1000,
+                CompletedBytes = 500
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file.mkv", Priority = 1 }
+                });
+
+            // Slow check is skipped because speed is 0
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateStallRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((true, DeleteReason.Stalled, true));
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.True(result.ShouldRemove);
+            Assert.Equal(DeleteReason.Stalled, result.DeleteReason);
+            _fixture.RuleEvaluator.Verify(
+                x => x.EvaluateSlowRulesAsync(It.IsAny<RTorrentItemWrapper>()),
+                Times.Never); // Skipped
+            _fixture.RuleEvaluator.Verify(
+                x => x.EvaluateStallRulesAsync(It.IsAny<RTorrentItemWrapper>()),
+                Times.Once);
+        }
+
+        [Fact]
+        public async Task BothChecksPass_DoesNotRemove()
+        {
+            // Arrange
+            const string hash = "TEST-HASH";
+            var sut = _fixture.CreateSut();
+
+            var download = new RTorrentTorrent
+            {
+                Hash = hash,
+                Name = "Test Torrent",
+                IsPrivate = 0,
+                State = 1,
+                Complete = 0,
+                DownRate = 5000000, // Good speed
+                SizeBytes = 10000000,
+                CompletedBytes = 5000000
+            };
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentAsync(hash))
+                .ReturnsAsync(download);
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTrackersAsync(hash))
+                .ReturnsAsync(new List<string>());
+
+            _fixture.ClientWrapper
+                .Setup(x => x.GetTorrentFilesAsync(hash))
+                .ReturnsAsync(new List<RTorrentFile>
+                {
+                    new RTorrentFile { Index = 0, Path = "file.mkv", Priority = 1 }
+                });
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateSlowRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((false, DeleteReason.None, false));
+
+            _fixture.RuleEvaluator
+                .Setup(x => x.EvaluateStallRulesAsync(It.IsAny<RTorrentItemWrapper>()))
+                .ReturnsAsync((false, DeleteReason.None, false));
+
+            // Act
+            var result = await sut.ShouldRemoveFromArrQueueAsync(hash, Array.Empty<string>());
+
+            // Assert
+            Assert.False(result.ShouldRemove);
+            Assert.Equal(DeleteReason.None, result.DeleteReason);
+        }
+    }
+}

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/TestHelpers/TestBlocklistProvider.cs

@@ -1,25 +0,0 @@
-using System.Collections.Concurrent;
-using System.Text.RegularExpressions;
-using Cleanuparr.Domain.Enums;
-using Cleanuparr.Infrastructure.Features.MalwareBlocker;
-using Microsoft.Extensions.Caching.Memory;
-using Microsoft.Extensions.DependencyInjection;
-using Microsoft.Extensions.Logging;
-using Moq;
-
-namespace Cleanuparr.Infrastructure.Tests.Features.DownloadClient.TestHelpers;
-
-/// <summary>
-/// Test implementation of BlocklistProvider for testing purposes
-/// </summary>
-public static class TestBlocklistProviderFactory
-{
-    public static BlocklistProvider Create()
-    {
-        var logger = new Mock<ILogger<BlocklistProvider>>().Object;
-        var scopeFactory = new Mock<IServiceScopeFactory>().Object;
-        var cache = new MemoryCache(new MemoryCacheOptions());
-
-        return new BlocklistProvider(logger, scopeFactory, cache);
-    }
-}

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/TransmissionServiceDCTests.cs

@@ -303,44 +303,15 @@ public class TransmissionServiceDCTests : IClassFixture<TransmissionServiceFixtu
             // Arrange
             var sut = _fixture.CreateSut();
             const string hash = "test-hash";
-
-            var fields = new[]
-            {
-                TorrentFields.FILES,
-                TorrentFields.FILE_STATS,
-                TorrentFields.HASH_STRING,
-                TorrentFields.ID,
-                TorrentFields.ETA,
-                TorrentFields.NAME,
-                TorrentFields.STATUS,
-                TorrentFields.IS_PRIVATE,
-                TorrentFields.DOWNLOADED_EVER,
-                TorrentFields.DOWNLOAD_DIR,
-                TorrentFields.SECONDS_SEEDING,
-                TorrentFields.UPLOAD_RATIO,
-                TorrentFields.TRACKERS,
-                TorrentFields.RATE_DOWNLOAD,
-                TorrentFields.TOTAL_SIZE
-            };
-
-            var torrents = new TransmissionTorrents
-            {
-                Torrents = new[]
-                {
-                    new TorrentInfo { Id = 123, HashString = hash }
-                }
-            };
-
-            _fixture.ClientWrapper
-                .Setup(x => x.TorrentGetAsync(fields, hash))
-                .ReturnsAsync(torrents);
+            var torrentInfo = new TorrentInfo { Id = 123, HashString = hash };
+            var torrentWrapper = new TransmissionItemWrapper(torrentInfo);
 
             _fixture.ClientWrapper
                 .Setup(x => x.TorrentRemoveAsync(It.Is<long[]>(ids => ids.Contains(123)), true))
                 .Returns(Task.CompletedTask);
 
             // Act
-            await sut.DeleteDownload(hash, true);
+            await sut.DeleteDownload(torrentWrapper, true);
 
             // Assert
             _fixture.ClientWrapper.Verify(
@@ -354,37 +325,20 @@ public class TransmissionServiceDCTests : IClassFixture<TransmissionServiceFixtu
             // Arrange
             var sut = _fixture.CreateSut();
             const string hash = "nonexistent-hash";
-
-            var fields = new[]
-            {
-                TorrentFields.FILES,
-                TorrentFields.FILE_STATS,
-                TorrentFields.HASH_STRING,
-                TorrentFields.ID,
-                TorrentFields.ETA,
-                TorrentFields.NAME,
-                TorrentFields.STATUS,
-                TorrentFields.IS_PRIVATE,
-                TorrentFields.DOWNLOADED_EVER,
-                TorrentFields.DOWNLOAD_DIR,
-                TorrentFields.SECONDS_SEEDING,
-                TorrentFields.UPLOAD_RATIO,
-                TorrentFields.TRACKERS,
-                TorrentFields.RATE_DOWNLOAD,
-                TorrentFields.TOTAL_SIZE
-            };
+            var torrentInfo = new TorrentInfo { Id = 456, HashString = hash };
+            var torrentWrapper = new TransmissionItemWrapper(torrentInfo);
 
             _fixture.ClientWrapper
-                .Setup(x => x.TorrentGetAsync(fields, hash))
-                .ReturnsAsync((TransmissionTorrents?)null);
+                .Setup(x => x.TorrentRemoveAsync(It.Is<long[]>(ids => ids.Contains(456)), true))
+                .Returns(Task.CompletedTask);
 
             // Act
-            await sut.DeleteDownload(hash, true);
+            await sut.DeleteDownload(torrentWrapper, true);
 
-            // Assert - no exception thrown
+            // Assert
             _fixture.ClientWrapper.Verify(
-                x => x.TorrentRemoveAsync(It.IsAny<long[]>(), It.IsAny<bool>()),
-                Times.Never);
+                x => x.TorrentRemoveAsync(It.Is<long[]>(ids => ids.Contains(456)), true),
+                Times.Once);
         }
 
         [Fact]
@@ -393,40 +347,15 @@ public class TransmissionServiceDCTests : IClassFixture<TransmissionServiceFixtu
             // Arrange
             var sut = _fixture.CreateSut();
             const string hash = "test-hash";
-
-            var fields = new[]
-            {
-                TorrentFields.FILES,
-                TorrentFields.FILE_STATS,
-                TorrentFields.HASH_STRING,
-                TorrentFields.ID,
-                TorrentFields.ETA,
-                TorrentFields.NAME,
-                TorrentFields.STATUS,
-                TorrentFields.IS_PRIVATE,
-                TorrentFields.DOWNLOADED_EVER,
-                TorrentFields.DOWNLOAD_DIR,
-                TorrentFields.SECONDS_SEEDING,
-                TorrentFields.UPLOAD_RATIO,
-                TorrentFields.TRACKERS,
-                TorrentFields.RATE_DOWNLOAD,
-                TorrentFields.TOTAL_SIZE
-            };
-
-            var torrents = new TransmissionTorrents
-            {
-                Torrents = new[]
-                {
-                    new TorrentInfo { Id = 123, HashString = hash }
-                }
-            };
+            var torrentInfo = new TorrentInfo { Id = 123, HashString = hash };
+            var torrentWrapper = new TransmissionItemWrapper(torrentInfo);
 
             _fixture.ClientWrapper
-                .Setup(x => x.TorrentGetAsync(fields, hash))
-                .ReturnsAsync(torrents);
+                .Setup(x => x.TorrentRemoveAsync(It.IsAny<long[]>(), true))
+                .Returns(Task.CompletedTask);
 
             // Act
-            await sut.DeleteDownload(hash, true);
+            await sut.DeleteDownload(torrentWrapper, true);
 
             // Assert
             _fixture.ClientWrapper.Verify(

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/TransmissionServiceFixture.cs

@@ -6,9 +6,7 @@ using Cleanuparr.Infrastructure.Features.MalwareBlocker;
 using Cleanuparr.Infrastructure.Http;
 using Cleanuparr.Infrastructure.Interceptors;
 using Cleanuparr.Infrastructure.Services.Interfaces;
-using Cleanuparr.Infrastructure.Tests.Features.DownloadClient.TestHelpers;
 using Cleanuparr.Persistence.Models.Configuration;
-using Microsoft.Extensions.Caching.Memory;
 using Microsoft.Extensions.Logging;
 using Moq;
 
@@ -17,14 +15,13 @@ namespace Cleanuparr.Infrastructure.Tests.Features.DownloadClient;
 public class TransmissionServiceFixture : IDisposable
 {
     public Mock<ILogger<TransmissionService>> Logger { get; }
-    public MemoryCache Cache { get; }
     public Mock<IFilenameEvaluator> FilenameEvaluator { get; }
     public Mock<IStriker> Striker { get; }
     public Mock<IDryRunInterceptor> DryRunInterceptor { get; }
     public Mock<IHardLinkFileService> HardLinkFileService { get; }
     public Mock<IDynamicHttpClientProvider> HttpClientProvider { get; }
     public Mock<IEventPublisher> EventPublisher { get; }
-    public BlocklistProvider BlocklistProvider { get; }
+    public Mock<IBlocklistProvider> BlocklistProvider { get; }
     public Mock<IRuleEvaluator> RuleEvaluator { get; }
     public Mock<IRuleManager> RuleManager { get; }
     public Mock<ITransmissionClientWrapper> ClientWrapper { get; }
@@ -32,14 +29,13 @@ public class TransmissionServiceFixture : IDisposable
     public TransmissionServiceFixture()
     {
         Logger = new Mock<ILogger<TransmissionService>>();
-        Cache = new MemoryCache(new MemoryCacheOptions());
         FilenameEvaluator = new Mock<IFilenameEvaluator>();
         Striker = new Mock<IStriker>();
         DryRunInterceptor = new Mock<IDryRunInterceptor>();
         HardLinkFileService = new Mock<IHardLinkFileService>();
         HttpClientProvider = new Mock<IDynamicHttpClientProvider>();
         EventPublisher = new Mock<IEventPublisher>();
-        BlocklistProvider = TestBlocklistProviderFactory.Create();
+        BlocklistProvider = new Mock<IBlocklistProvider>();
         RuleEvaluator = new Mock<IRuleEvaluator>();
         RuleManager = new Mock<IRuleManager>();
         ClientWrapper = new Mock<ITransmissionClientWrapper>();
@@ -74,14 +70,13 @@ public class TransmissionServiceFixture : IDisposable
 
         return new TransmissionService(
             Logger.Object,
-            Cache,
             FilenameEvaluator.Object,
             Striker.Object,
             DryRunInterceptor.Object,
             HardLinkFileService.Object,
             HttpClientProvider.Object,
             EventPublisher.Object,
-            BlocklistProvider,
+            BlocklistProvider.Object,
             config,
             RuleEvaluator.Object,
             RuleManager.Object,
@@ -112,7 +107,6 @@ public class TransmissionServiceFixture : IDisposable
 
     public void Dispose()
     {
-        Cache.Dispose();
         GC.SuppressFinalize(this);
     }
 }

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/UTorrentServiceDCTests.cs

@@ -1,3 +1,4 @@
+using Cleanuparr.Domain.Entities;
 using Cleanuparr.Domain.Entities.UTorrent.Response;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Features.Context;
@@ -290,13 +291,15 @@ public class UTorrentServiceDCTests : IClassFixture<UTorrentServiceFixture>
             // Arrange
             var sut = _fixture.CreateSut();
             const string hash = "TEST-HASH";
+            var mockTorrent = new Mock<ITorrentItemWrapper>();
+            mockTorrent.Setup(x => x.Hash).Returns(hash);
 
             _fixture.ClientWrapper
                 .Setup(x => x.RemoveTorrentsAsync(It.Is<List<string>>(h => h.Contains("test-hash")), true))
                 .Returns(Task.CompletedTask);
 
             // Act
-            await sut.DeleteDownload(hash, true);
+            await sut.DeleteDownload(mockTorrent.Object, true);
 
             // Assert
             _fixture.ClientWrapper.Verify(
@@ -310,13 +313,15 @@ public class UTorrentServiceDCTests : IClassFixture<UTorrentServiceFixture>
             // Arrange
             var sut = _fixture.CreateSut();
             const string hash = "UPPERCASE-HASH";
+            var mockTorrent = new Mock<ITorrentItemWrapper>();
+            mockTorrent.Setup(x => x.Hash).Returns(hash);
 
             _fixture.ClientWrapper
                 .Setup(x => x.RemoveTorrentsAsync(It.IsAny<List<string>>(), true))
                 .Returns(Task.CompletedTask);
 
             // Act
-            await sut.DeleteDownload(hash, true);
+            await sut.DeleteDownload(mockTorrent.Object, true);
 
             // Assert
             _fixture.ClientWrapper.Verify(
@@ -330,13 +335,15 @@ public class UTorrentServiceDCTests : IClassFixture<UTorrentServiceFixture>
             // Arrange
             var sut = _fixture.CreateSut();
             const string hash = "TEST-HASH";
+            var mockTorrent = new Mock<ITorrentItemWrapper>();
+            mockTorrent.Setup(x => x.Hash).Returns(hash);
 
             _fixture.ClientWrapper
                 .Setup(x => x.RemoveTorrentsAsync(It.Is<List<string>>(h => h.Contains("test-hash")), false))
                 .Returns(Task.CompletedTask);
 
             // Act
-            await sut.DeleteDownload(hash, false);
+            await sut.DeleteDownload(mockTorrent.Object, false);
 
             // Assert
             _fixture.ClientWrapper.Verify(

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadClient/UTorrentServiceFixture.cs

@@ -6,9 +6,7 @@ using Cleanuparr.Infrastructure.Features.MalwareBlocker;
 using Cleanuparr.Infrastructure.Http;
 using Cleanuparr.Infrastructure.Interceptors;
 using Cleanuparr.Infrastructure.Services.Interfaces;
-using Cleanuparr.Infrastructure.Tests.Features.DownloadClient.TestHelpers;
 using Cleanuparr.Persistence.Models.Configuration;
-using Microsoft.Extensions.Caching.Memory;
 using Microsoft.Extensions.Logging;
 using Moq;
 
@@ -17,14 +15,13 @@ namespace Cleanuparr.Infrastructure.Tests.Features.DownloadClient;
 public class UTorrentServiceFixture : IDisposable
 {
     public Mock<ILogger<UTorrentService>> Logger { get; }
-    public MemoryCache Cache { get; }
     public Mock<IFilenameEvaluator> FilenameEvaluator { get; }
     public Mock<IStriker> Striker { get; }
     public Mock<IDryRunInterceptor> DryRunInterceptor { get; }
     public Mock<IHardLinkFileService> HardLinkFileService { get; }
     public Mock<IDynamicHttpClientProvider> HttpClientProvider { get; }
     public Mock<IEventPublisher> EventPublisher { get; }
-    public BlocklistProvider BlocklistProvider { get; }
+    public Mock<IBlocklistProvider> BlocklistProvider { get; }
     public Mock<IRuleEvaluator> RuleEvaluator { get; }
     public Mock<IRuleManager> RuleManager { get; }
     public Mock<IUTorrentClientWrapper> ClientWrapper { get; }
@@ -32,14 +29,13 @@ public class UTorrentServiceFixture : IDisposable
     public UTorrentServiceFixture()
     {
         Logger = new Mock<ILogger<UTorrentService>>();
-        Cache = new MemoryCache(new MemoryCacheOptions());
         FilenameEvaluator = new Mock<IFilenameEvaluator>();
         Striker = new Mock<IStriker>();
         DryRunInterceptor = new Mock<IDryRunInterceptor>();
         HardLinkFileService = new Mock<IHardLinkFileService>();
         HttpClientProvider = new Mock<IDynamicHttpClientProvider>();
         EventPublisher = new Mock<IEventPublisher>();
-        BlocklistProvider = TestBlocklistProviderFactory.Create();
+        BlocklistProvider = new Mock<IBlocklistProvider>();
         RuleEvaluator = new Mock<IRuleEvaluator>();
         RuleManager = new Mock<IRuleManager>();
         ClientWrapper = new Mock<IUTorrentClientWrapper>();
@@ -74,14 +70,13 @@ public class UTorrentServiceFixture : IDisposable
 
         return new UTorrentService(
             Logger.Object,
-            Cache,
             FilenameEvaluator.Object,
             Striker.Object,
             DryRunInterceptor.Object,
             HardLinkFileService.Object,
             HttpClientProvider.Object,
             EventPublisher.Object,
-            BlocklistProvider,
+            BlocklistProvider.Object,
             config,
             RuleEvaluator.Object,
             RuleManager.Object,
@@ -112,7 +107,6 @@ public class UTorrentServiceFixture : IDisposable
 
     public void Dispose()
     {
-        Cache.Dispose();
         GC.SuppressFinalize(this);
     }
 }

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadHunter/Consumers/DownloadHunterConsumerTests.cs

@@ -101,7 +101,8 @@ public class DownloadHunterConsumerTests
             InstanceType = InstanceType.Lidarr,
             Instance = CreateArrInstance(),
             SearchItem = new SearchItem { Id = 999 },
-            Record = CreateQueueRecord()
+            Record = CreateQueueRecord(),
+            JobRunId = Guid.NewGuid()
         };
         var contextMock = CreateConsumeContextMock(request);
 
@@ -128,7 +129,8 @@ public class DownloadHunterConsumerTests
             InstanceType = InstanceType.Radarr,
             Instance = CreateArrInstance(),
             SearchItem = new SearchItem { Id = 123 },
-            Record = CreateQueueRecord()
+            Record = CreateQueueRecord(),
+            JobRunId = Guid.NewGuid()
         };
     }
 

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadHunter/DownloadHunterTests.cs

@@ -282,7 +282,8 @@ public class DownloadHunterTests : IDisposable
             InstanceType = instanceType,
             Instance = CreateArrInstance(),
             SearchItem = new SearchItem { Id = 123 },
-            Record = CreateQueueRecord()
+            Record = CreateQueueRecord(),
+            JobRunId = Guid.NewGuid()
         };
     }
 

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadRemover/Consumers/DownloadRemoverConsumerTests.cs

@@ -105,7 +105,8 @@ public class DownloadRemoverConsumerTests
             SearchItem = new SearchItem { Id = 456 },
             Record = CreateQueueRecord(),
             RemoveFromClient = true,
-            DeleteReason = DeleteReason.Stalled
+            DeleteReason = DeleteReason.Stalled,
+            JobRunId = Guid.NewGuid()
         };
         var contextMock = CreateConsumeContextMock(request);
 
@@ -134,7 +135,8 @@ public class DownloadRemoverConsumerTests
             SearchItem = new SearchItem { Id = 789 },
             Record = CreateQueueRecord(),
             RemoveFromClient = false,
-            DeleteReason = DeleteReason.FailedImport
+            DeleteReason = DeleteReason.FailedImport,
+            JobRunId = Guid.NewGuid()
         };
         var contextMock = CreateConsumeContextMock(request);
 
@@ -162,7 +164,8 @@ public class DownloadRemoverConsumerTests
             SearchItem = new SearchItem { Id = 111 },
             Record = CreateQueueRecord(),
             RemoveFromClient = true,
-            DeleteReason = DeleteReason.SlowSpeed
+            DeleteReason = DeleteReason.SlowSpeed,
+            JobRunId = Guid.NewGuid()
         };
         var contextMock = CreateConsumeContextMock(request);
 
@@ -191,7 +194,8 @@ public class DownloadRemoverConsumerTests
             SearchItem = new SearchItem { Id = 123 },
             Record = CreateQueueRecord(),
             RemoveFromClient = true,
-            DeleteReason = DeleteReason.Stalled
+            DeleteReason = DeleteReason.Stalled,
+            JobRunId = Guid.NewGuid()
         };
     }
 

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadRemover/QueueItemRemoverTests.cs

@@ -10,12 +10,12 @@ using Cleanuparr.Infrastructure.Features.ItemStriker;
 using Cleanuparr.Infrastructure.Features.Notifications;
 using Cleanuparr.Infrastructure.Hubs;
 using Cleanuparr.Infrastructure.Interceptors;
+using Cleanuparr.Infrastructure.Tests.Features.Jobs.TestHelpers;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration.Arr;
 using Data.Models.Arr;
 using MassTransit;
 using Microsoft.AspNetCore.SignalR;
-using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Caching.Memory;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
@@ -48,10 +48,7 @@ public class QueueItemRemoverTests : IDisposable
             .Returns(_arrClientMock.Object);
 
         // Create real EventPublisher with mocked dependencies
-        var eventsContextOptions = new DbContextOptionsBuilder<EventsContext>()
-            .UseInMemoryDatabase(databaseName: Guid.NewGuid().ToString())
-            .Options;
-        _eventsContext = new EventsContext(eventsContextOptions);
+        _eventsContext = TestEventsContextFactory.Create();
 
         var hubContextMock = new Mock<IHubContext<AppHub>>();
         var clientsMock = new Mock<IHubClients>();
@@ -59,18 +56,10 @@ public class QueueItemRemoverTests : IDisposable
         hubContextMock.Setup(h => h.Clients).Returns(clientsMock.Object);
 
         var dryRunInterceptorMock = new Mock<IDryRunInterceptor>();
-        // Setup interceptor to execute the action with params using DynamicInvoke
+        // Setup interceptor to skip actual database saves (these tests verify QueueItemRemover, not EventPublisher)
         dryRunInterceptorMock
             .Setup(d => d.InterceptAsync(It.IsAny<Delegate>(), It.IsAny<object[]>()))
-            .Returns((Delegate action, object[] parameters) =>
-            {
-                var result = action.DynamicInvoke(parameters);
-                if (result is Task task)
-                {
-                    return task;
-                }
-                return Task.CompletedTask;
-            });
+            .Returns(Task.CompletedTask);
 
         _eventPublisher = new EventPublisher(
             _eventsContext,
@@ -84,7 +73,8 @@ public class QueueItemRemoverTests : IDisposable
             _busMock.Object,
             _memoryCache,
             _arrClientFactoryMock.Object,
-            _eventPublisher
+            _eventPublisher,
+            _eventsContext
         );
 
         // Clear static RecurringHashes before each test
@@ -455,7 +445,8 @@ public class QueueItemRemoverTests : IDisposable
             SearchItem = new SearchItem { Id = 123 },
             Record = CreateQueueRecord(),
             RemoveFromClient = removeFromClient,
-            DeleteReason = deleteReason
+            DeleteReason = deleteReason,
+            JobRunId = Guid.NewGuid()
         };
     }
 

code/backend/Cleanuparr.Infrastructure.Tests/Features/Jobs/TestHelpers/JobHandlerFixture.cs

@@ -45,6 +45,9 @@ public class JobHandlerFixture : IDisposable
 
         // Setup default behaviors
         SetupDefaultBehaviors();
+
+        // Setup JobRunId in context for tests
+        ContextProvider.SetJobRunId(Guid.NewGuid());
     }
 
     private void SetupDefaultBehaviors()
@@ -56,6 +59,7 @@ public class JobHandlerFixture : IDisposable
                 It.IsAny<string>(),
                 It.IsAny<Domain.Enums.EventSeverity>(),
                 It.IsAny<object?>(),
+                It.IsAny<Guid?>(),
                 It.IsAny<Guid?>()))
             .Returns(Task.CompletedTask);
     }
@@ -123,6 +127,9 @@ public class JobHandlerFixture : IDisposable
         TimeProvider = new FakeTimeProvider();
 
         SetupDefaultBehaviors();
+
+        // Setup fresh JobRunId for each test
+        ContextProvider.SetJobRunId(Guid.NewGuid());
     }
 
     public void Dispose()

code/backend/Cleanuparr.Infrastructure.Tests/Features/Jobs/TestHelpers/TestDataContextFactory.cs

@@ -314,7 +314,8 @@ public static class TestDataContextFactory
         string name = "completed",
         double maxRatio = 1.0,
         double minSeedTime = 1.0,
-        double maxSeedTime = -1)
+        double maxSeedTime = -1,
+        TorrentPrivacyType privacyType = TorrentPrivacyType.Both)
     {
         var config = context.DownloadCleanerConfigs.Include(x => x.Categories).First();
         var category = new SeedingRule
@@ -324,6 +325,7 @@ public static class TestDataContextFactory
             MaxRatio = maxRatio,
             MinSeedTime = minSeedTime,
             MaxSeedTime = maxSeedTime,
+            PrivacyType = privacyType,
             DeleteSourceFiles = true,
             DownloadCleanerConfigId = config.Id
         };

code/backend/Cleanuparr.Infrastructure.Tests/Features/Jobs/TestHelpers/TestEventsContextFactory.cs

@@ -0,0 +1,31 @@
+using Cleanuparr.Persistence;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Infrastructure.Tests.Features.Jobs.TestHelpers;
+
+/// <summary>
+/// Factory for creating SQLite in-memory EventsContext instances for testing.
+/// SQLite in-memory supports ExecuteUpdateAsync, ExecuteDeleteAsync, and EF.Functions.Like,
+/// unlike the EF Core InMemory provider.
+/// </summary>
+public static class TestEventsContextFactory
+{
+    /// <summary>
+    /// Creates a new SQLite in-memory EventsContext with schema initialized
+    /// </summary>
+    public static EventsContext Create()
+    {
+        var connection = new SqliteConnection("DataSource=:memory:");
+        connection.Open();
+
+        var options = new DbContextOptionsBuilder<EventsContext>()
+            .UseSqlite(connection)
+            .Options;
+
+        var context = new EventsContext(options);
+        context.Database.EnsureCreated();
+
+        return context;
+    }
+}

code/backend/Cleanuparr.Infrastructure.Tests/Features/Notifications/Discord/DiscordProxyTests.cs

@@ -0,0 +1,315 @@
+using System.Net;
+using Cleanuparr.Infrastructure.Features.Notifications.Discord;
+using Cleanuparr.Persistence.Models.Configuration.Notification;
+using Cleanuparr.Shared.Helpers;
+using Microsoft.Extensions.Logging;
+using Moq;
+using Moq.Protected;
+using Xunit;
+
+namespace Cleanuparr.Infrastructure.Tests.Features.Notifications.Discord;
+
+public class DiscordProxyTests
+{
+    private readonly Mock<ILogger<DiscordProxy>> _loggerMock;
+    private readonly Mock<IHttpClientFactory> _httpClientFactoryMock;
+    private readonly Mock<HttpMessageHandler> _httpMessageHandlerMock;
+
+    public DiscordProxyTests()
+    {
+        _loggerMock = new Mock<ILogger<DiscordProxy>>();
+        _httpMessageHandlerMock = new Mock<HttpMessageHandler>();
+        _httpClientFactoryMock = new Mock<IHttpClientFactory>();
+
+        var httpClient = new HttpClient(_httpMessageHandlerMock.Object);
+        _httpClientFactoryMock
+            .Setup(f => f.CreateClient(Constants.HttpClientWithRetryName))
+            .Returns(httpClient);
+    }
+
+    private DiscordProxy CreateProxy()
+    {
+        return new DiscordProxy(_loggerMock.Object, _httpClientFactoryMock.Object);
+    }
+
+    private static DiscordPayload CreatePayload()
+    {
+        return new DiscordPayload
+        {
+            Embeds = new List<DiscordEmbed>
+            {
+                new()
+                {
+                    Title = "Test Title",
+                    Description = "Test Description",
+                    Color = 0x28a745
+                }
+            }
+        };
+    }
+
+    private static DiscordConfig CreateConfig()
+    {
+        return new DiscordConfig
+        {
+            WebhookUrl = "https://discord.com/api/webhooks/123456789/abcdefghij",
+            Username = "Test Bot",
+            AvatarUrl = "https://example.com/avatar.png"
+        };
+    }
+
+    #region Constructor Tests
+
+    [Fact]
+    public void Constructor_WithValidDependencies_CreatesInstance()
+    {
+        // Act
+        var proxy = CreateProxy();
+
+        // Assert
+        Assert.NotNull(proxy);
+    }
+
+    [Fact]
+    public void Constructor_CreatesHttpClientWithCorrectName()
+    {
+        // Act
+        _ = CreateProxy();
+
+        // Assert
+        _httpClientFactoryMock.Verify(f => f.CreateClient(Constants.HttpClientWithRetryName), Times.Once);
+    }
+
+    #endregion
+
+    #region SendNotification Success Tests
+
+    [Fact]
+    public async Task SendNotification_WhenSuccessful_CompletesWithoutException()
+    {
+        // Arrange
+        var proxy = CreateProxy();
+        SetupSuccessResponse();
+
+        // Act & Assert - Should not throw
+        await proxy.SendNotification(CreatePayload(), CreateConfig());
+    }
+
+    [Fact]
+    public async Task SendNotification_SendsPostRequest()
+    {
+        // Arrange
+        var proxy = CreateProxy();
+        HttpMethod? capturedMethod = null;
+
+        _httpMessageHandlerMock
+            .Protected()
+            .Setup<Task<HttpResponseMessage>>(
+                "SendAsync",
+                ItExpr.IsAny<HttpRequestMessage>(),
+                ItExpr.IsAny<CancellationToken>())
+            .Callback<HttpRequestMessage, CancellationToken>((req, _) => capturedMethod = req.Method)
+            .ReturnsAsync(new HttpResponseMessage(HttpStatusCode.OK));
+
+        // Act
+        await proxy.SendNotification(CreatePayload(), CreateConfig());
+
+        // Assert
+        Assert.Equal(HttpMethod.Post, capturedMethod);
+    }
+
+    [Fact]
+    public async Task SendNotification_BuildsCorrectUrl()
+    {
+        // Arrange
+        var proxy = CreateProxy();
+        Uri? capturedUri = null;
+
+        _httpMessageHandlerMock
+            .Protected()
+            .Setup<Task<HttpResponseMessage>>(
+                "SendAsync",
+                ItExpr.IsAny<HttpRequestMessage>(),
+                ItExpr.IsAny<CancellationToken>())
+            .Callback<HttpRequestMessage, CancellationToken>((req, _) => capturedUri = req.RequestUri)
+            .ReturnsAsync(new HttpResponseMessage(HttpStatusCode.OK));
+
+        var config = new DiscordConfig
+        {
+            WebhookUrl = "https://discord.com/api/webhooks/123/abc"
+        };
+
+        // Act
+        await proxy.SendNotification(CreatePayload(), config);
+
+        // Assert
+        Assert.NotNull(capturedUri);
+        Assert.Equal("https://discord.com/api/webhooks/123/abc", capturedUri.ToString());
+    }
+
+    [Fact]
+    public async Task SendNotification_SetsJsonContentType()
+    {
+        // Arrange
+        var proxy = CreateProxy();
+        string? capturedContentType = null;
+
+        _httpMessageHandlerMock
+            .Protected()
+            .Setup<Task<HttpResponseMessage>>(
+                "SendAsync",
+                ItExpr.IsAny<HttpRequestMessage>(),
+                ItExpr.IsAny<CancellationToken>())
+            .Callback<HttpRequestMessage, CancellationToken>((req, _) =>
+                capturedContentType = req.Content?.Headers.ContentType?.MediaType)
+            .ReturnsAsync(new HttpResponseMessage(HttpStatusCode.OK));
+
+        // Act
+        await proxy.SendNotification(CreatePayload(), CreateConfig());
+
+        // Assert
+        Assert.Equal("application/json", capturedContentType);
+    }
+
+    [Fact]
+    public async Task SendNotification_LogsTraceWithContent()
+    {
+        // Arrange
+        var proxy = CreateProxy();
+        SetupSuccessResponse();
+
+        // Act
+        await proxy.SendNotification(CreatePayload(), CreateConfig());
+
+        // Assert
+        _loggerMock.Verify(
+            x => x.Log(
+                LogLevel.Trace,
+                It.IsAny<EventId>(),
+                It.Is<It.IsAnyType>((v, t) => v.ToString()!.Contains("sending notification")),
+                It.IsAny<Exception>(),
+                It.IsAny<Func<It.IsAnyType, Exception?, string>>()),
+            Times.Once);
+    }
+
+    #endregion
+
+    #region SendNotification Error Tests
+
+    [Theory]
+    [InlineData(HttpStatusCode.Unauthorized)]
+    [InlineData(HttpStatusCode.Forbidden)]
+    public async Task SendNotification_WhenUnauthorized_ThrowsDiscordExceptionWithInvalidWebhook(HttpStatusCode statusCode)
+    {
+        // Arrange
+        var proxy = CreateProxy();
+        SetupErrorResponse(statusCode);
+
+        // Act & Assert
+        var ex = await Assert.ThrowsAsync<DiscordException>(() =>
+            proxy.SendNotification(CreatePayload(), CreateConfig()));
+        Assert.Contains("invalid or unauthorized", ex.Message);
+    }
+
+    [Fact]
+    public async Task SendNotification_When404_ThrowsDiscordExceptionWithNotFound()
+    {
+        // Arrange
+        var proxy = CreateProxy();
+        SetupErrorResponse(HttpStatusCode.NotFound);
+
+        // Act & Assert
+        var ex = await Assert.ThrowsAsync<DiscordException>(() =>
+            proxy.SendNotification(CreatePayload(), CreateConfig()));
+        Assert.Contains("not found", ex.Message);
+    }
+
+    [Fact]
+    public async Task SendNotification_When429_ThrowsDiscordExceptionWithRateLimited()
+    {
+        // Arrange
+        var proxy = CreateProxy();
+        SetupErrorResponse((HttpStatusCode)429);
+
+        // Act & Assert
+        var ex = await Assert.ThrowsAsync<DiscordException>(() =>
+            proxy.SendNotification(CreatePayload(), CreateConfig()));
+        Assert.Contains("rate limited", ex.Message, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Theory]
+    [InlineData(HttpStatusCode.BadGateway)]
+    [InlineData(HttpStatusCode.ServiceUnavailable)]
+    [InlineData(HttpStatusCode.GatewayTimeout)]
+    public async Task SendNotification_WhenServiceUnavailable_ThrowsDiscordException(HttpStatusCode statusCode)
+    {
+        // Arrange
+        var proxy = CreateProxy();
+        SetupErrorResponse(statusCode);
+
+        // Act & Assert
+        var ex = await Assert.ThrowsAsync<DiscordException>(() =>
+            proxy.SendNotification(CreatePayload(), CreateConfig()));
+        Assert.Contains("service unavailable", ex.Message, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public async Task SendNotification_WhenOtherError_ThrowsDiscordException()
+    {
+        // Arrange
+        var proxy = CreateProxy();
+        SetupErrorResponse(HttpStatusCode.InternalServerError);
+
+        // Act & Assert
+        var ex = await Assert.ThrowsAsync<DiscordException>(() =>
+            proxy.SendNotification(CreatePayload(), CreateConfig()));
+        Assert.Contains("unable to send notification", ex.Message, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public async Task SendNotification_WhenNetworkError_ThrowsDiscordException()
+    {
+        // Arrange
+        var proxy = CreateProxy();
+        _httpMessageHandlerMock
+            .Protected()
+            .Setup<Task<HttpResponseMessage>>(
+                "SendAsync",
+                ItExpr.IsAny<HttpRequestMessage>(),
+                ItExpr.IsAny<CancellationToken>())
+            .ThrowsAsync(new HttpRequestException("Network error"));
+
+        // Act & Assert
+        var ex = await Assert.ThrowsAsync<DiscordException>(() =>
+            proxy.SendNotification(CreatePayload(), CreateConfig()));
+        Assert.Contains("unable to send notification", ex.Message, StringComparison.OrdinalIgnoreCase);
+    }
+
+    #endregion
+
+    #region Helper Methods
+
+    private void SetupSuccessResponse()
+    {
+        _httpMessageHandlerMock
+            .Protected()
+            .Setup<Task<HttpResponseMessage>>(
+                "SendAsync",
+                ItExpr.IsAny<HttpRequestMessage>(),
+                ItExpr.IsAny<CancellationToken>())
+            .ReturnsAsync(new HttpResponseMessage(HttpStatusCode.OK));
+    }
+
+    private void SetupErrorResponse(HttpStatusCode statusCode)
+    {
+        _httpMessageHandlerMock
+            .Protected()
+            .Setup<Task<HttpResponseMessage>>(
+                "SendAsync",
+                ItExpr.IsAny<HttpRequestMessage>(),
+                ItExpr.IsAny<CancellationToken>())
+            .ThrowsAsync(new HttpRequestException("Error", null, statusCode));
+    }
+
+    #endregion
+}

code/backend/Cleanuparr.Infrastructure.Tests/Features/Notifications/Gotify/GotifyProxyTests.cs

@@ -0,0 +1,329 @@
+using System.Net;
+using Cleanuparr.Infrastructure.Features.Notifications.Gotify;
+using Cleanuparr.Persistence.Models.Configuration.Notification;
+using Cleanuparr.Shared.Helpers;
+using Microsoft.Extensions.Logging;
+using Moq;
+using Moq.Protected;
+using Xunit;
+
+namespace Cleanuparr.Infrastructure.Tests.Features.Notifications.Gotify;
+
+public class GotifyProxyTests
+{
+    private readonly Mock<ILogger<GotifyProxy>> _loggerMock;
+    private readonly Mock<IHttpClientFactory> _httpClientFactoryMock;
+    private readonly Mock<HttpMessageHandler> _httpMessageHandlerMock;
+
+    public GotifyProxyTests()
+    {
+        _loggerMock = new Mock<ILogger<GotifyProxy>>();
+        _httpMessageHandlerMock = new Mock<HttpMessageHandler>();
+        _httpClientFactoryMock = new Mock<IHttpClientFactory>();
+
+        var httpClient = new HttpClient(_httpMessageHandlerMock.Object);
+        _httpClientFactoryMock
+            .Setup(f => f.CreateClient(Constants.HttpClientWithRetryName))
+            .Returns(httpClient);
+    }
+
+    private GotifyProxy CreateProxy()
+    {
+        return new GotifyProxy(_loggerMock.Object, _httpClientFactoryMock.Object);
+    }
+
+    private static GotifyPayload CreatePayload()
+    {
+        return new GotifyPayload
+        {
+            Title = "Test Title",
+            Message = "Test Message",
+            Priority = 5
+        };
+    }
+
+    private static GotifyConfig CreateConfig()
+    {
+        return new GotifyConfig
+        {
+            ServerUrl = "https://gotify.example.com",
+            ApplicationToken = "test-app-token",
+            Priority = 5
+        };
+    }
+
+    #region Constructor Tests
+
+    [Fact]
+    public void Constructor_WithValidDependencies_CreatesInstance()
+    {
+        // Act
+        var proxy = CreateProxy();
+
+        // Assert
+        Assert.NotNull(proxy);
+    }
+
+    [Fact]
+    public void Constructor_CreatesHttpClientWithCorrectName()
+    {
+        // Act
+        _ = CreateProxy();
+
+        // Assert
+        _httpClientFactoryMock.Verify(f => f.CreateClient(Constants.HttpClientWithRetryName), Times.Once);
+    }
+
+    #endregion
+
+    #region SendNotification Success Tests
+
+    [Fact]
+    public async Task SendNotification_WhenSuccessful_CompletesWithoutException()
+    {
+        // Arrange
+        var proxy = CreateProxy();
+        SetupSuccessResponse();
+
+        // Act & Assert - Should not throw
+        await proxy.SendNotification(CreatePayload(), CreateConfig());
+    }
+
+    [Fact]
+    public async Task SendNotification_SendsPostRequest()
+    {
+        // Arrange
+        var proxy = CreateProxy();
+        HttpMethod? capturedMethod = null;
+
+        _httpMessageHandlerMock
+            .Protected()
+            .Setup<Task<HttpResponseMessage>>(
+                "SendAsync",
+                ItExpr.IsAny<HttpRequestMessage>(),
+                ItExpr.IsAny<CancellationToken>())
+            .Callback<HttpRequestMessage, CancellationToken>((req, _) => capturedMethod = req.Method)
+            .ReturnsAsync(new HttpResponseMessage(HttpStatusCode.OK));
+
+        // Act
+        await proxy.SendNotification(CreatePayload(), CreateConfig());
+
+        // Assert
+        Assert.Equal(HttpMethod.Post, capturedMethod);
+    }
+
+    [Fact]
+    public async Task SendNotification_BuildsCorrectUrl()
+    {
+        // Arrange
+        var proxy = CreateProxy();
+        Uri? capturedUri = null;
+
+        _httpMessageHandlerMock
+            .Protected()
+            .Setup<Task<HttpResponseMessage>>(
+                "SendAsync",
+                ItExpr.IsAny<HttpRequestMessage>(),
+                ItExpr.IsAny<CancellationToken>())
+            .Callback<HttpRequestMessage, CancellationToken>((req, _) => capturedUri = req.RequestUri)
+            .ReturnsAsync(new HttpResponseMessage(HttpStatusCode.OK));
+
+        var config = new GotifyConfig
+        {
+            ServerUrl = "https://gotify.example.com",
+            ApplicationToken = "my-token",
+            Priority = 5
+        };
+
+        // Act
+        await proxy.SendNotification(CreatePayload(), config);
+
+        // Assert
+        Assert.NotNull(capturedUri);
+        Assert.Equal("https://gotify.example.com/message?token=my-token", capturedUri.ToString());
+    }
+
+    [Fact]
+    public async Task SendNotification_TrimsTrailingSlashFromServerUrl()
+    {
+        // Arrange
+        var proxy = CreateProxy();
+        Uri? capturedUri = null;
+
+        _httpMessageHandlerMock
+            .Protected()
+            .Setup<Task<HttpResponseMessage>>(
+                "SendAsync",
+                ItExpr.IsAny<HttpRequestMessage>(),
+                ItExpr.IsAny<CancellationToken>())
+            .Callback<HttpRequestMessage, CancellationToken>((req, _) => capturedUri = req.RequestUri)
+            .ReturnsAsync(new HttpResponseMessage(HttpStatusCode.OK));
+
+        var config = new GotifyConfig
+        {
+            ServerUrl = "https://gotify.example.com/",
+            ApplicationToken = "my-token",
+            Priority = 5
+        };
+
+        // Act
+        await proxy.SendNotification(CreatePayload(), config);
+
+        // Assert
+        Assert.NotNull(capturedUri);
+        Assert.Equal("https://gotify.example.com/message?token=my-token", capturedUri.ToString());
+    }
+
+    [Fact]
+    public async Task SendNotification_SetsJsonContentType()
+    {
+        // Arrange
+        var proxy = CreateProxy();
+        string? capturedContentType = null;
+
+        _httpMessageHandlerMock
+            .Protected()
+            .Setup<Task<HttpResponseMessage>>(
+                "SendAsync",
+                ItExpr.IsAny<HttpRequestMessage>(),
+                ItExpr.IsAny<CancellationToken>())
+            .Callback<HttpRequestMessage, CancellationToken>((req, _) =>
+                capturedContentType = req.Content?.Headers.ContentType?.MediaType)
+            .ReturnsAsync(new HttpResponseMessage(HttpStatusCode.OK));
+
+        // Act
+        await proxy.SendNotification(CreatePayload(), CreateConfig());
+
+        // Assert
+        Assert.Equal("application/json", capturedContentType);
+    }
+
+    [Fact]
+    public async Task SendNotification_LogsTraceWithContent()
+    {
+        // Arrange
+        var proxy = CreateProxy();
+        SetupSuccessResponse();
+
+        // Act
+        await proxy.SendNotification(CreatePayload(), CreateConfig());
+
+        // Assert
+        _loggerMock.Verify(
+            x => x.Log(
+                LogLevel.Trace,
+                It.IsAny<EventId>(),
+                It.Is<It.IsAnyType>((v, t) => v.ToString()!.Contains("sending notification")),
+                It.IsAny<Exception>(),
+                It.IsAny<Func<It.IsAnyType, Exception?, string>>()),
+            Times.Once);
+    }
+
+    #endregion
+
+    #region SendNotification Error Tests
+
+    [Theory]
+    [InlineData(HttpStatusCode.Unauthorized)]
+    [InlineData(HttpStatusCode.Forbidden)]
+    public async Task SendNotification_WhenUnauthorized_ThrowsGotifyExceptionWithInvalidToken(HttpStatusCode statusCode)
+    {
+        // Arrange
+        var proxy = CreateProxy();
+        SetupErrorResponse(statusCode);
+
+        // Act & Assert
+        var ex = await Assert.ThrowsAsync<GotifyException>(() =>
+            proxy.SendNotification(CreatePayload(), CreateConfig()));
+        Assert.Contains("invalid or unauthorized", ex.Message);
+    }
+
+    [Fact]
+    public async Task SendNotification_When404_ThrowsGotifyExceptionWithNotFound()
+    {
+        // Arrange
+        var proxy = CreateProxy();
+        SetupErrorResponse(HttpStatusCode.NotFound);
+
+        // Act & Assert
+        var ex = await Assert.ThrowsAsync<GotifyException>(() =>
+            proxy.SendNotification(CreatePayload(), CreateConfig()));
+        Assert.Contains("not found", ex.Message);
+    }
+
+    [Theory]
+    [InlineData(HttpStatusCode.BadGateway)]
+    [InlineData(HttpStatusCode.ServiceUnavailable)]
+    [InlineData(HttpStatusCode.GatewayTimeout)]
+    public async Task SendNotification_WhenServiceUnavailable_ThrowsGotifyException(HttpStatusCode statusCode)
+    {
+        // Arrange
+        var proxy = CreateProxy();
+        SetupErrorResponse(statusCode);
+
+        // Act & Assert
+        var ex = await Assert.ThrowsAsync<GotifyException>(() =>
+            proxy.SendNotification(CreatePayload(), CreateConfig()));
+        Assert.Contains("service unavailable", ex.Message, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public async Task SendNotification_WhenOtherError_ThrowsGotifyException()
+    {
+        // Arrange
+        var proxy = CreateProxy();
+        SetupErrorResponse(HttpStatusCode.InternalServerError);
+
+        // Act & Assert
+        var ex = await Assert.ThrowsAsync<GotifyException>(() =>
+            proxy.SendNotification(CreatePayload(), CreateConfig()));
+        Assert.Contains("unable to send notification", ex.Message, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public async Task SendNotification_WhenNetworkError_ThrowsGotifyException()
+    {
+        // Arrange
+        var proxy = CreateProxy();
+        _httpMessageHandlerMock
+            .Protected()
+            .Setup<Task<HttpResponseMessage>>(
+                "SendAsync",
+                ItExpr.IsAny<HttpRequestMessage>(),
+                ItExpr.IsAny<CancellationToken>())
+            .ThrowsAsync(new HttpRequestException("Network error"));
+
+        // Act & Assert
+        var ex = await Assert.ThrowsAsync<GotifyException>(() =>
+            proxy.SendNotification(CreatePayload(), CreateConfig()));
+        Assert.Contains("unable to send notification", ex.Message, StringComparison.OrdinalIgnoreCase);
+    }
+
+    #endregion
+
+    #region Helper Methods
+
+    private void SetupSuccessResponse()
+    {
+        _httpMessageHandlerMock
+            .Protected()
+            .Setup<Task<HttpResponseMessage>>(
+                "SendAsync",
+                ItExpr.IsAny<HttpRequestMessage>(),
+                ItExpr.IsAny<CancellationToken>())
+            .ReturnsAsync(new HttpResponseMessage(HttpStatusCode.OK));
+    }
+
+    private void SetupErrorResponse(HttpStatusCode statusCode)
+    {
+        _httpMessageHandlerMock
+            .Protected()
+            .Setup<Task<HttpResponseMessage>>(
+                "SendAsync",
+                ItExpr.IsAny<HttpRequestMessage>(),
+                ItExpr.IsAny<CancellationToken>())
+            .ThrowsAsync(new HttpRequestException("Error", null, statusCode));
+    }
+
+    #endregion
+}

code/backend/Cleanuparr.Infrastructure.Tests/Features/Notifications/Notifiarr/NotifiarrProxyTests.cs

@@ -37,7 +37,7 @@ public class NotifiarrProxyTests
         return new NotifiarrPayload
         {
             Notification = new NotifiarrNotification { Update = false },
-            Discord = new Discord
+            Discord = new NotifiarrDiscord
             {
                 Color = "#FF0000",
                 Text = new Text { Title = "Test", Content = "Test content" },

code/backend/Cleanuparr.Infrastructure.Tests/Features/Notifications/NotificationConfigurationServiceTests.cs

@@ -358,12 +358,9 @@ public class NotificationConfigurationServiceTests : IDisposable
 
     #region Provider Type Mapping Tests
 
+
     [Theory]
-    [InlineData(NotificationProviderType.Notifiarr)]
-    [InlineData(NotificationProviderType.Apprise)]
-    [InlineData(NotificationProviderType.Ntfy)]
-    [InlineData(NotificationProviderType.Pushover)]
-    [InlineData(NotificationProviderType.Telegram)]
+    [MemberData(nameof(NotificationProviderTypes))]
     public async Task GetActiveProvidersAsync_MapsProviderTypeCorrectly(NotificationProviderType providerType)
     {
         // Arrange
@@ -383,11 +380,7 @@ public class NotificationConfigurationServiceTests : IDisposable
     }
 
     [Theory]
-    [InlineData(NotificationProviderType.Notifiarr)]
-    [InlineData(NotificationProviderType.Apprise)]
-    [InlineData(NotificationProviderType.Ntfy)]
-    [InlineData(NotificationProviderType.Pushover)]
-    [InlineData(NotificationProviderType.Telegram)]
+    [MemberData(nameof(NotificationProviderTypes))]
     public async Task GetProvidersForEventAsync_ReturnsProviderForAllTypes(NotificationProviderType providerType)
     {
         // Arrange
@@ -420,6 +413,8 @@ public class NotificationConfigurationServiceTests : IDisposable
             NotificationProviderType.Ntfy => CreateNtfyConfig(name, isEnabled),
             NotificationProviderType.Pushover => CreatePushoverConfig(name, isEnabled),
             NotificationProviderType.Telegram => CreateTelegramConfig(name, isEnabled),
+            NotificationProviderType.Discord => CreateDiscordConfig(name, isEnabled),
+            NotificationProviderType.Gotify => CreateGotifyConfig(name, isEnabled),
             _ => throw new ArgumentOutOfRangeException(nameof(providerType))
         };
     }
@@ -549,5 +544,60 @@ public class NotificationConfigurationServiceTests : IDisposable
         };
     }
 
+    private static NotificationConfig CreateDiscordConfig(string name, bool isEnabled)
+    {
+        return new NotificationConfig
+        {
+            Id = Guid.NewGuid(),
+            Name = name,
+            Type = NotificationProviderType.Discord,
+            IsEnabled = isEnabled,
+            OnStalledStrike = true,
+            OnFailedImportStrike = true,
+            OnSlowStrike = true,
+            OnQueueItemDeleted = true,
+            OnDownloadCleaned = true,
+            OnCategoryChanged = true,
+            DiscordConfiguration = new DiscordConfig
+            {
+                Id = Guid.NewGuid(),
+                WebhookUrl = "http://localhost:8000",
+                AvatarUrl =  "https://example.com/avatar.png",
+                Username = "test_username",
+            }
+        };
+    }
+
+    private static NotificationConfig CreateGotifyConfig(string name, bool isEnabled)
+    {
+        return new NotificationConfig
+        {
+            Id = Guid.NewGuid(),
+            Name = name,
+            Type = NotificationProviderType.Gotify,
+            IsEnabled = isEnabled,
+            OnStalledStrike = true,
+            OnFailedImportStrike = true,
+            OnSlowStrike = true,
+            OnQueueItemDeleted = true,
+            OnDownloadCleaned = true,
+            OnCategoryChanged = true,
+            GotifyConfiguration = new GotifyConfig
+            {
+                Id = Guid.NewGuid(),
+                ServerUrl = "http://localhost:8000",
+                ApplicationToken =  "test_application_token",
+            }
+        };
+    }
+
     #endregion
+
+    public static IEnumerable<object[]> NotificationProviderTypes =>
+    [
+        ..Enum.GetValues<NotificationProviderType>()
+            .Cast<Object>()
+            .Select(x => new[] { x })
+            .ToList()
+    ];
 }