Update frontend packages (#528)

.github/workflows/build-docker.yml

@@ -22,23 +22,32 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  packages: write
+
+env:
+  REGISTRY_IMAGE: ghcr.io/cleanuparr/cleanuparr
+
 jobs:
-  build_app:
+  # Compute tags, version, and push decision for downstream jobs
+  prepare:
     runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    outputs:
+      tags: ${{ steps.build-info.outputs.tags }}
+      version: ${{ steps.build-info.outputs.version }}
+      version_docker_tag: ${{ steps.build-info.outputs.version_docker_tag }}
+      branch: ${{ steps.build-info.outputs.branch }}
+      push: ${{ steps.build-info.outputs.push }}
+      github_sha: ${{ github.sha }}
     steps:
-
-      - name: Set github context
-        timeout-minutes: 1
-        run: |
-          echo 'githubRepository=${{ github.repository }}' >> $GITHUB_ENV
-          echo 'githubSha=${{ github.sha }}' >> $GITHUB_ENV
-          echo 'githubRef=${{ github.ref }}' >> $GITHUB_ENV
-          echo 'githubHeadRef=${{ github.head_ref }}' >> $GITHUB_ENV
-
       - name: Initialize build info
+        id: build-info
         timeout-minutes: 1
         run: |
-          githubHeadRef=${{ env.githubHeadRef }}
+          githubHeadRef="${{ github.head_ref }}"
+          githubRef="${{ github.ref }}"
           inputVersion="${{ inputs.app_version }}"
           latestDockerTag=""
           versionDockerTag=""
@@ -71,10 +80,8 @@ jobs:
               minorVersionDockerTag="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}"
             fi
           else
-            # Determine if this run is for the main branch or another branch
             if [[ -z "$githubHeadRef" ]]; then
               # Main branch
-              githubRef=${{ env.githubRef }}
               branch=${githubRef##*/}
               versionDockerTag="$branch"
             else
@@ -85,25 +92,45 @@ jobs:
           fi
 
           githubTags=""
-
           if [ -n "$latestDockerTag" ]; then
-            githubTags="$githubTags,ghcr.io/cleanuparr/cleanuparr:$latestDockerTag"
+            githubTags="$githubTags,$REGISTRY_IMAGE:$latestDockerTag"
           fi
           if [ -n "$versionDockerTag" ]; then
-            githubTags="$githubTags,ghcr.io/cleanuparr/cleanuparr:$versionDockerTag"
+            githubTags="$githubTags,$REGISTRY_IMAGE:$versionDockerTag"
           fi
           if [ -n "$minorVersionDockerTag" ]; then
-            githubTags="$githubTags,ghcr.io/cleanuparr/cleanuparr:$minorVersionDockerTag"
+            githubTags="$githubTags,$REGISTRY_IMAGE:$minorVersionDockerTag"
           fi
           if [ -n "$majorVersionDockerTag" ]; then
-            githubTags="$githubTags,ghcr.io/cleanuparr/cleanuparr:$majorVersionDockerTag"
+            githubTags="$githubTags,$REGISTRY_IMAGE:$majorVersionDockerTag"
           fi
 
-          # set env vars
-          echo "branch=$branch" >> $GITHUB_ENV
-          echo "githubTags=$githubTags" >> $GITHUB_ENV
-          echo "versionDockerTag=$versionDockerTag" >> $GITHUB_ENV
-          echo "version=$version" >> $GITHUB_ENV
+          githubTags="${githubTags#,}"
+
+          # Determine push decision
+          push="${{ github.event_name == 'pull_request' || inputs.push_docker == true }}"
+
+          echo "tags=$githubTags" >> $GITHUB_OUTPUT
+          echo "version=$version" >> $GITHUB_OUTPUT
+          echo "version_docker_tag=$versionDockerTag" >> $GITHUB_OUTPUT
+          echo "branch=$branch" >> $GITHUB_OUTPUT
+          echo "push=$push" >> $GITHUB_OUTPUT
+
+  # Build each platform in parallel
+  build:
+    runs-on: ubuntu-latest
+    needs: [prepare]
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - linux/amd64
+          - linux/arm64
+    steps:
+      - name: Prepare platform pair
+        run: |
+          platform=${{ matrix.platform }}
+          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
 
       - name: Get vault secrets
         uses: hashicorp/vault-action@v2
@@ -113,8 +140,6 @@ jobs:
           roleId: ${{ secrets.VAULT_ROLE_ID }}
           secretId: ${{ secrets.VAULT_SECRET_ID }}
           secrets:
-            secrets/data/docker username | DOCKER_USERNAME;
-            secrets/data/docker password | DOCKER_PASSWORD;
             secrets/data/github repo_readonly_pat | REPO_READONLY_PAT;
             secrets/data/github packages_pat | PACKAGES_PAT
 
@@ -122,16 +147,97 @@ jobs:
         uses: actions/checkout@v4
         timeout-minutes: 1
         with:
-          repository: ${{ env.githubRepository }}
-          ref: ${{ env.branch }}
+          repository: ${{ github.repository }}
+          ref: ${{ needs.prepare.outputs.branch }}
           token: ${{ env.REPO_READONLY_PAT }}
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         timeout-minutes: 5
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+      - name: Login to GitHub Container Registry
+        if: needs.prepare.outputs.push == 'true'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push by digest
+        if: needs.prepare.outputs.push == 'true'
+        id: build-push
+        timeout-minutes: 30
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ github.workspace }}/code
+          file: ${{ github.workspace }}/code/Dockerfile
+          provenance: false
+          labels: |
+            commit=sha-${{ needs.prepare.outputs.github_sha }}
+            version=${{ needs.prepare.outputs.version_docker_tag }}
+          build-args: |
+            VERSION=${{ needs.prepare.outputs.version }}
+            PACKAGES_USERNAME=${{ secrets.PACKAGES_USERNAME }}
+            PACKAGES_PAT=${{ env.PACKAGES_PAT }}
+          platforms: ${{ matrix.platform }}
+          outputs: type=image,"name=${{ env.REGISTRY_IMAGE }}",push-by-digest=true,name-canonical=true,push=true
+          cache-from: type=gha,scope=build-${{ env.PLATFORM_PAIR }}
+          cache-to: type=gha,scope=build-${{ env.PLATFORM_PAIR }},mode=max
+
+      - name: Build (no push)
+        if: needs.prepare.outputs.push != 'true'
+        timeout-minutes: 30
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ github.workspace }}/code
+          file: ${{ github.workspace }}/code/Dockerfile
+          provenance: false
+          labels: |
+            commit=sha-${{ needs.prepare.outputs.github_sha }}
+            version=${{ needs.prepare.outputs.version_docker_tag }}
+          build-args: |
+            VERSION=${{ needs.prepare.outputs.version }}
+            PACKAGES_USERNAME=${{ secrets.PACKAGES_USERNAME }}
+            PACKAGES_PAT=${{ env.PACKAGES_PAT }}
+          platforms: ${{ matrix.platform }}
+          push: false
+          cache-from: type=gha,scope=build-${{ env.PLATFORM_PAIR }}
+          cache-to: type=gha,scope=build-${{ env.PLATFORM_PAIR }},mode=max
+
+      - name: Export digest
+        if: needs.prepare.outputs.push == 'true'
+        run: |
+          mkdir -p ${{ runner.temp }}/digests
+          digest="${{ steps.build-push.outputs.digest }}"
+          touch "${{ runner.temp }}/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        if: needs.prepare.outputs.push == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: digests-${{ env.PLATFORM_PAIR }}
+          path: ${{ runner.temp }}/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  # Create multi-platform manifest and push with final tags
+  merge:
+    runs-on: ubuntu-latest
+    needs: [prepare, build]
+    if: needs.prepare.outputs.push == 'true'
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@v4
+        with:
+          path: ${{ runner.temp }}/digests
+          pattern: digests-*
+          merge-multiple: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v3
@@ -140,27 +246,25 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build and push docker image
-        id: docker-build
-        timeout-minutes: 15
-        uses: docker/build-push-action@v6
-        with:
-          context: ${{ github.workspace }}/code
-          file: ${{ github.workspace }}/code/Dockerfile
-          provenance: false
-          labels: |
-            commit=sha-${{ env.githubSha }}
-            version=${{ env.versionDockerTag }}
-          build-args: |
-            VERSION=${{ env.version }}
-            PACKAGES_USERNAME=${{ secrets.PACKAGES_USERNAME }}
-            PACKAGES_PAT=${{ env.PACKAGES_PAT }}
-          platforms: |
-            linux/amd64
-            linux/arm64
-          push: ${{ github.event_name == 'pull_request' || inputs.push_docker == true }}
-          tags: |
-            ${{ env.githubTags }}
-          # Enable BuildKit cache for faster builds
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+      - name: Create manifest list and push
+        timeout-minutes: 5
+        working-directory: ${{ runner.temp }}/digests
+        run: |
+          tags="${{ needs.prepare.outputs.tags }}"
+          tag_args=""
+          IFS=',' read -ra TAG_ARRAY <<< "$tags"
+          for tag in "${TAG_ARRAY[@]}"; do
+            tag=$(echo "$tag" | xargs)
+            if [ -n "$tag" ]; then
+              tag_args="$tag_args -t $tag"
+            fi
+          done
+
+          docker buildx imagetools create $tag_args \
+            $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)
+
+      - name: Inspect image
+        run: |
+          tags="${{ needs.prepare.outputs.tags }}"
+          first_tag=$(echo "$tags" | tr ',' '\n' | grep -v '^$' | head -1 | xargs)
+          docker buildx imagetools inspect "$first_tag"

.github/workflows/build-executable.yml

@@ -74,9 +74,9 @@ jobs:
           token: ${{ env.REPO_READONLY_PAT }}
 
       - name: Setup dotnet
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: 10.0.x
+          dotnet-version: 10.0.200
 
       - name: Cache NuGet packages
         uses: actions/cache@v4

.github/workflows/build-frontend.yml

@@ -2,6 +2,12 @@ name: Build Frontend
 
 on:
   workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref to checkout (branch, tag, or SHA). Defaults to github.ref_name.'
+        type: string
+        required: false
+        default: ''
 
 jobs:
   build-frontend:
@@ -22,7 +28,7 @@ jobs:
         timeout-minutes: 1
         with:
           repository: ${{ github.repository }}
-          ref: ${{ github.ref_name }}
+          ref: ${{ inputs.ref || github.ref_name }}
           token: ${{ env.REPO_READONLY_PAT }}
 
       - name: Setup Node.js

.github/workflows/build-macos-installer.yml

@@ -84,9 +84,9 @@ jobs:
           path: code/frontend/dist/ui/browser
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: 10.0.x
+          dotnet-version: 10.0.200
 
       - name: Restore .NET dependencies
         run: |

.github/workflows/build-windows-installer.yml

@@ -8,6 +8,11 @@ on:
         type: string
         required: false
         default: ''
+      ref:
+        description: 'Git ref to checkout (branch, tag, or SHA). Defaults to github.ref_name.'
+        type: string
+        required: false
+        default: ''
 
 jobs:
   build-windows-installer:
@@ -58,7 +63,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: ${{ env.githubRepository }}
-          ref: ${{ github.ref_name }}
+          ref: ${{ inputs.ref || github.ref_name }}
           token: ${{ env.REPO_READONLY_PAT }}
 
       - name: Download frontend artifact
@@ -68,9 +73,9 @@ jobs:
           path: code/frontend/dist/ui/browser
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: 10.0.x
+          dotnet-version: 10.0.200
 
       - name: Restore .NET dependencies
         run: |

.github/workflows/cloudflare-pages-blocklists.yml

@@ -20,6 +20,10 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+
+      - name: Create directory for static files
+        run: |
+          mkdir -p Cloudflare/static
       
       - name: Copy root static files to Cloudflare static directory
         run: |

.github/workflows/e2e.yml

@@ -0,0 +1,94 @@
+name: E2E Tests
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'code/**'
+      - 'e2e/**'
+      - '.github/workflows/e2e.yml'
+  pull_request:
+    paths:
+      - 'code/**'
+      - 'e2e/**'
+      - '.github/workflows/e2e.yml'
+  workflow_call:
+
+concurrency:
+  group: E2E Tests-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  e2e:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        timeout-minutes: 1
+
+      - name: Get vault secrets
+        uses: hashicorp/vault-action@v2
+        with:
+          url: ${{ secrets.VAULT_HOST }}
+          method: approle
+          roleId: ${{ secrets.VAULT_ROLE_ID }}
+          secretId: ${{ secrets.VAULT_SECRET_ID }}
+          secrets:
+            secrets/data/github packages_pat | PACKAGES_PAT
+
+      - name: Start services
+        working-directory: e2e
+        run: docker compose -f docker-compose.e2e.yml up -d --build
+        env:
+          PACKAGES_USERNAME: ${{ github.repository_owner }}
+          PACKAGES_PAT: ${{ env.PACKAGES_PAT }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install E2E dependencies
+        working-directory: e2e
+        run: npm ci
+
+      - name: Install Playwright browsers
+        working-directory: e2e
+        run: npx playwright install --with-deps chromium
+
+      - name: Wait for Keycloak
+        run: |
+          echo "Waiting for Keycloak realm to be ready..."
+          timeout 120 bash -c 'until curl -sf http://localhost:8080/realms/cleanuparr-test/.well-known/openid-configuration; do sleep 3; done'
+          echo "Keycloak ready!"
+
+      - name: Wait for app
+        run: |
+          echo "Waiting for Cleanuparr to be ready..."
+          timeout 120 bash -c 'until curl -sf http://localhost:5000/health; do sleep 3; done'
+          echo "App ready!"
+
+      - name: Run E2E tests
+        working-directory: e2e
+        run: npx playwright test
+
+      - name: Upload test results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: e2e-test-results
+          path: |
+            e2e/playwright-report/
+            e2e/test-results/
+          retention-days: 7
+
+      - name: Stop services
+        if: always()
+        working-directory: e2e
+        run: docker compose -f docker-compose.e2e.yml down

.github/workflows/pr-build.yml

@@ -0,0 +1,181 @@
+name: PR Build (Comment Triggered)
+
+on:
+  issue_comment:
+    types: [created]
+
+concurrency:
+  group: pr-build-${{ github.event.issue.number }}
+  cancel-in-progress: true
+
+permissions:
+  issues: write
+  pull-requests: write
+  actions: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    if: github.event.issue.pull_request != null
+    outputs:
+      build_windows: ${{ steps.parse.outputs.build_windows }}
+      pr_ref: ${{ steps.parse.outputs.pr_ref }}
+      pr_sha: ${{ steps.parse.outputs.pr_sha }}
+      pr_number: ${{ steps.parse.outputs.pr_number }}
+
+    steps:
+      - name: Parse command and check permissions
+        id: parse
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const comment = context.payload.comment.body.trim();
+
+            // Parse supported commands
+            const commands = {
+              '/build-windows': 'build_windows'
+            };
+
+            const command = commands[comment];
+            if (!command) {
+              console.log(`Comment "${comment}" is not a recognized build command, skipping.`);
+              core.setOutput('build_windows', 'false');
+              return;
+            }
+
+            try {
+              await github.rest.reactions.createForIssueComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: context.payload.comment.id,
+                content: 'eyes'
+              });
+            } catch (e) {
+              console.log(`Could not add reaction: ${e}`);
+            }
+
+            // Fetch PR details
+            const pr = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.issue.number
+            });
+
+            // Verify PR is open
+            if (pr.data.state !== 'open') {
+              console.log('PR is not open, skipping.');
+              core.setOutput('build_windows', 'false');
+              return;
+            }
+
+            // Block fork PRs — fork code should not run with access to secrets
+            const isFork = pr.data.head.repo.full_name !== context.repo.owner + '/' + context.repo.repo;
+            if (isFork) {
+              console.log(`PR is from fork ${pr.data.head.repo.full_name}, blocking build.`);
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body: 'On-demand builds are not available for PRs from forks.'
+              });
+              core.setOutput('build_windows', 'false');
+              return;
+            }
+
+            // Verify commenter has write access
+            let permission = 'none';
+            try {
+              const resp = await github.rest.repos.getCollaboratorPermissionLevel({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                username: context.payload.comment.user.login
+              });
+              permission = resp.data.permission;
+            } catch (_) {}
+
+            if (!['admin', 'write'].includes(permission)) {
+              console.log(`User ${context.payload.comment.user.login} has '${permission}' permission — insufficient.`);
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body: `@${context.payload.comment.user.login} Only collaborators with write access can trigger builds.`
+              });
+              core.setOutput('build_windows', 'false');
+              return;
+            }
+
+            console.log(`User ${context.payload.comment.user.login} has '${permission}' permission — proceeding with ${command}.`);
+            core.setOutput(command, 'true');
+
+            // Export PR details for downstream jobs
+            core.setOutput('pr_ref', pr.data.head.ref);
+            core.setOutput('pr_sha', pr.data.head.sha);
+            core.setOutput('pr_number', String(pr.data.number));
+
+  build-frontend:
+    needs: validate
+    if: needs.validate.outputs.build_windows == 'true'
+    uses: ./.github/workflows/build-frontend.yml
+    with:
+      ref: ${{ needs.validate.outputs.pr_ref }}
+    secrets: inherit
+
+  build-windows:
+    needs: [validate, build-frontend]
+    if: needs.validate.outputs.build_windows == 'true'
+    uses: ./.github/workflows/build-windows-installer.yml
+    with:
+      ref: ${{ needs.validate.outputs.pr_ref }}
+    secrets: inherit
+
+  post-result:
+    needs: [validate, build-windows]
+    if: always() && needs.validate.outputs.build_windows == 'true'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Post result comment
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const buildResult = '${{ needs.build-windows.result }}';
+            const runUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
+            const prRef = '${{ needs.validate.outputs.pr_ref }}';
+            const prSha = '${{ needs.validate.outputs.pr_sha }}';
+            const shortSha = prSha.substring(0, 7);
+
+            // Skip comment for skipped builds
+            if (buildResult === 'skipped') {
+              console.log('Build was skipped, no comment needed.');
+              return;
+            }
+
+            let body;
+            if (buildResult === 'success') {
+              body = [
+                `Windows installer build **succeeded** for \`${prRef}\` (\`${shortSha}\`).`,
+                ``,
+                `**Download:** open the [workflow run](${runUrl}), scroll to the **Artifacts** section at the bottom.`,
+                `The artifact \`Cleanuparr-windows-installer\` is retained for 30 days.`
+              ].join('\n');
+            } else if (buildResult === 'cancelled') {
+              body = [
+                `Windows installer build was **cancelled** for \`${prRef}\` (\`${shortSha}\`).`,
+                ``,
+                `See the [workflow run](${runUrl}) for details.`
+              ].join('\n');
+            } else {
+              body = [
+                `Windows installer build **failed** for \`${prRef}\` (\`${shortSha}\`).`,
+                ``,
+                `See the [workflow run](${runUrl}) for details.`
+              ].join('\n');
+            }
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: parseInt('${{ needs.validate.outputs.pr_number }}'),
+              body
+            });

.github/workflows/release.yml

@@ -96,24 +96,33 @@ jobs:
     uses: ./.github/workflows/test.yml
     secrets: inherit
 
+  # Run E2E tests
+  e2e:
+    needs: validate
+    if: ${{ needs.validate.outputs.is_tag == 'true' || github.event.inputs.runTests == 'true' }}
+    uses: ./.github/workflows/e2e.yml
+    secrets: inherit
+
   # Build frontend once for all build jobs and cache it
   build-frontend:
-    needs: [validate, test]
+    needs: [validate, test, e2e]
     if: |
       always() &&
       needs.validate.result == 'success' &&
       (needs.test.result == 'success' || needs.test.result == 'skipped') &&
+      (needs.e2e.result == 'success' || needs.e2e.result == 'skipped') &&
       (needs.validate.outputs.is_tag == 'true' || github.event.inputs.buildBinaries == 'true')
     uses: ./.github/workflows/build-frontend.yml
     secrets: inherit
 
   # Build portable executables
   build-executables:
-    needs: [validate, test, build-frontend]
+    needs: [validate, test, e2e, build-frontend]
     if: |
       always() &&
       needs.validate.result == 'success' &&
       (needs.test.result == 'success' || needs.test.result == 'skipped') &&
+      (needs.e2e.result == 'success' || needs.e2e.result == 'skipped') &&
       needs.build-frontend.result == 'success' &&
       (needs.validate.outputs.is_tag == 'true' || github.event.inputs.buildBinaries == 'true')
     uses: ./.github/workflows/build-executable.yml
@@ -123,11 +132,12 @@ jobs:
 
   # Build Windows installer
   build-windows-installer:
-    needs: [validate, test, build-frontend]
+    needs: [validate, test, e2e, build-frontend]
     if: |
       always() &&
       needs.validate.result == 'success' &&
       (needs.test.result == 'success' || needs.test.result == 'skipped') &&
+      (needs.e2e.result == 'success' || needs.e2e.result == 'skipped') &&
       needs.build-frontend.result == 'success' &&
       (needs.validate.outputs.is_tag == 'true' || github.event.inputs.buildBinaries == 'true')
     uses: ./.github/workflows/build-windows-installer.yml
@@ -137,11 +147,12 @@ jobs:
 
   # Build macOS installers (Intel and ARM)
   build-macos:
-    needs: [validate, test, build-frontend]
+    needs: [validate, test, e2e, build-frontend]
     if: |
       always() &&
       needs.validate.result == 'success' &&
       (needs.test.result == 'success' || needs.test.result == 'skipped') &&
+      (needs.e2e.result == 'success' || needs.e2e.result == 'skipped') &&
       needs.build-frontend.result == 'success' &&
       (needs.validate.outputs.is_tag == 'true' || github.event.inputs.buildBinaries == 'true')
     uses: ./.github/workflows/build-macos-installer.yml
@@ -151,11 +162,12 @@ jobs:
 
   # Build and push Docker image(s)
   build-docker:
-    needs: [validate, test]
+    needs: [validate, test, e2e]
     if: |
       always() &&
       needs.validate.result == 'success' &&
       (needs.test.result == 'success' || needs.test.result == 'skipped') &&
+      (needs.e2e.result == 'success' || needs.e2e.result == 'skipped') &&
       (needs.validate.outputs.is_tag == 'true' || github.event.inputs.buildDocker == 'true')
     uses: ./.github/workflows/build-docker.yml
     with:
@@ -232,7 +244,7 @@ jobs:
 
   # Summary job
   summary:
-    needs: [validate, test, build-frontend, build-executables, build-windows-installer, build-macos, build-docker]
+    needs: [validate, test, e2e, build-frontend, build-executables, build-windows-installer, build-macos, build-docker]
     runs-on: ubuntu-latest
     if: always()
 
@@ -277,6 +289,7 @@ jobs:
           }
 
           print_result "Tests" "${{ needs.test.result }}"
+          print_result "E2E Tests" "${{ needs.e2e.result }}"
           print_result "Frontend Build" "${{ needs.build-frontend.result }}"
           print_result "Portable Executables" "${{ needs.build-executables.result }}"
           print_result "Windows Installer" "${{ needs.build-windows-installer.result }}"

.github/workflows/test.yml

@@ -15,7 +15,7 @@ on:
 
 # Cancel in-progress runs for the same PR
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  group: Tests-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
@@ -29,9 +29,9 @@ jobs:
         timeout-minutes: 1
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: 10.0.x
+          dotnet-version: 10.0.200
 
       - name: Cache NuGet packages
         uses: actions/cache@v4

CLAUDE.md

@@ -10,7 +10,7 @@
 
 ## Project Overview
 
-Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, Lidarr, Readarr, Whisparr and supported download clients like qBittorrent, Transmission, Deluge, and µTorrent. It provides malware protection, automated cleanup, and queue management for *arr applications.
+Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, Lidarr, Readarr, Whisparr and supported download clients like qBittorrent, Transmission, Deluge, µTorrent and rTorrent. It provides malware protection, automated cleanup, and queue management for *arr applications.
 
 **Key Features:**
 - Strike system for bad downloads

Cloudflare/static/known_malware_file_name_patterns

@@ -1,2 +0,0 @@
-thepirateheaven.org
-RARBG.work

README.md

@@ -23,6 +23,9 @@ Cleanuparr was created primarily to address malicious files, such as `*.lnk` or
 > - Remove and block downloads blocked by qBittorrent or by Cleanuparr's **Malware Blocker**.
 > - Remove and block known malware based on patterns found by the community.
 > - Automatically trigger a search for downloads removed from the arrs.
+> - Proactively search for **missing** items across your Radarr and Sonarr libraries.
+> - Search for **quality upgrades** for items that haven't met their quality profile's cutoff (a.k.a. **Cutoff Unmet**).
+> - Search for **custom format score upgrades** with automatic score tracking.
 > - Clean up downloads that have been **seeding** for a certain amount of time.
 > - Remove downloads that are **orphaned**/have no **hardlinks**/are not referenced by the arrs anymore (with [cross-seed](https://www.cross-seed.org/) support).
 > - Notify on strike or download removal.
@@ -49,6 +52,7 @@ https://cleanuparr.github.io/Cleanuparr/docs/screenshots
 - **Transmission**
 - **Deluge**
 - **µTorrent**
+- **rTorrent**
 
 ### Platforms
 - **Docker**
@@ -101,14 +105,6 @@ We welcome contributions from the community! Whether it's bug fixes, new feature
 - **[Feature Requests](https://github.com/Cleanuparr/Cleanuparr/issues/new/choose)** - Share your ideas for new features
 - **[Help Test Features](https://discord.gg/SCtMCgtsc4)** - Join Discord to test pre-release features and provide feedback
 
-# <img style="vertical-align: middle;" width="24px" src="./Logo/256.png" alt="Cleanuparr"> <span style="vertical-align: middle;">Cleanuparr</span> <img src="https://raw.githubusercontent.com/FortAwesome/Font-Awesome/6.x/svgs/solid/x.svg" height="24px" width="30px" style="vertical-align: middle;"> <span style="vertical-align: middle;">Huntarr</span> <img style="vertical-align: middle;" width="24px" src="https://github.com/plexguide/Huntarr.io/blob/main/frontend/static/logo/512.png?raw=true" alt Huntarr></img>
-
-Think of **Cleanuparr** as the janitor of your server; it keeps your download queue spotless, removes clutter, and blocks malicious files. Now imagine combining that with **Huntarr**, the compulsive librarian who finds missing and upgradable media to complete your collection
-
-While **Huntarr** fills in the blanks and improves what you already have, **Cleanuparr** makes sure that only clean downloads get through. If you're aiming for a reliable and self-sufficient setup, **Cleanuparr** and **Huntarr** will take your automated media stack to another level.
-
-<span style="font-size:24px"> ➡️ [**Huntarr**](https://github.com/plexguide/Huntarr.io) <span style="vertical-align: middle">![Huntarr](https://img.shields.io/github/stars/plexguide/Huntarr.io?style=social)</span></span> 
-
 # Credits
 Special thanks for inspiration go to:
 - [ThijmenGThN/swaparr](https://github.com/ThijmenGThN/swaparr)

code/backend/Cleanuparr.Api.Tests/Cleanuparr.Api.Tests.csproj

@@ -11,6 +11,7 @@
     <PackageReference Include="coverlet.collector" Version="6.0.4" />
     <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.1" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageReference Include="NSubstitute" Version="5.3.0" />
     <PackageReference Include="Shouldly" Version="4.3.0" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.4" />
@@ -24,4 +25,8 @@
     <ProjectReference Include="..\Cleanuparr.Api\Cleanuparr.Api.csproj" />
   </ItemGroup>
 
+  <ItemGroup>
+    <Content Include="xunit.runner.json" CopyToOutputDirectory="PreserveNewest" />
+  </ItemGroup>
+
 </Project>

code/backend/Cleanuparr.Api.Tests/CustomWebApplicationFactory.cs

@@ -1,14 +1,17 @@
-using Cleanuparr.Persistence;
+using Cleanuparr.Shared.Helpers;
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Mvc.Testing;
-using Microsoft.EntityFrameworkCore;
-using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using Xunit;
+
+// Integration tests share file-system state (config-dir used by SetupGuardMiddleware),
+// so they must be run sequentially to avoid interference between factories.
+[assembly: CollectionBehavior(DisableTestParallelization = true)]
 
 namespace Cleanuparr.Api.Tests;
 
 /// <summary>
-/// Custom WebApplicationFactory that uses an isolated SQLite database for each test fixture.
-/// The database file is created in a temp directory so both DI and static contexts share the same data.
+/// Custom WebApplicationFactory that redirects all database contexts to an isolated temp directory
 /// </summary>
 public class CustomWebApplicationFactory : WebApplicationFactory<Program>
 {
@@ -18,6 +21,8 @@ public class CustomWebApplicationFactory : WebApplicationFactory<Program>
     {
         _tempDir = Path.Combine(Path.GetTempPath(), $"cleanuparr-test-{Guid.NewGuid():N}");
         Directory.CreateDirectory(_tempDir);
+
+        ConfigurationPathProvider.SetConfigPath(_tempDir);
     }
 
     protected override void ConfigureWebHost(IWebHostBuilder builder)
@@ -26,26 +31,12 @@ public class CustomWebApplicationFactory : WebApplicationFactory<Program>
 
         builder.ConfigureServices(services =>
         {
-            // Remove the existing UsersContext registration
-            var descriptor = services.SingleOrDefault(d => d.ServiceType == typeof(DbContextOptions<UsersContext>));
-            if (descriptor != null) services.Remove(descriptor);
-
-            // Also remove the DbContext registration itself
-            var contextDescriptor = services.SingleOrDefault(d => d.ServiceType == typeof(UsersContext));
-            if (contextDescriptor != null) services.Remove(contextDescriptor);
-
-            var dbPath = Path.Combine(_tempDir, "users.db");
-
-            services.AddDbContext<UsersContext>(options =>
+            // Remove all hosted services (Quartz scheduler, BackgroundJobManager) to prevent
+            // Quartz.Logging.LogProvider.ResolvedLogProvider (a cached Lazy<T>) from being accessed
+            foreach (var hostedService in services.Where(d => d.ServiceType == typeof(IHostedService)).ToList())
             {
-                options.UseSqlite($"Data Source={dbPath}");
-            });
-
-            // Ensure DB is created
-            var sp = services.BuildServiceProvider();
-            using var scope = sp.CreateScope();
-            var db = scope.ServiceProvider.GetRequiredService<UsersContext>();
-            db.Database.EnsureCreated();
+                services.Remove(hostedService);
+            }
         });
     }
 

code/backend/Cleanuparr.Api.Tests/Features/Auth/AccountControllerOidcTests.cs

@@ -0,0 +1,423 @@
+using System.Collections.Concurrent;
+using System.Net;
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using System.Text.Json;
+using Cleanuparr.Infrastructure.Features.Auth;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Auth;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Mvc.Testing;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features.Auth;
+
+/// <summary>
+/// Integration tests for the OIDC account linking flow (POST /api/account/oidc/link and
+/// GET /api/account/oidc/link/callback). Uses a mock IOidcAuthService that tracks the
+/// initiatorUserId passed from StartOidcLink so OidcLinkCallback can complete the flow.
+/// </summary>
+[Collection("Auth Integration Tests")]
+[TestCaseOrderer("Cleanuparr.Api.Tests.PriorityOrderer", "Cleanuparr.Api.Tests")]
+public class AccountControllerOidcTests : IClassFixture<AccountControllerOidcTests.OidcLinkWebApplicationFactory>
+{
+    private readonly HttpClient _client;
+    private readonly OidcLinkWebApplicationFactory _factory;
+
+    // Shared across ordered tests
+    private static string? _accessToken;
+
+    public AccountControllerOidcTests(OidcLinkWebApplicationFactory factory)
+    {
+        _factory = factory;
+        _client = factory.CreateClient(new WebApplicationFactoryClientOptions
+        {
+            AllowAutoRedirect = false
+        });
+        
+        if (_accessToken is not null)
+        {
+            _client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", _accessToken);
+        }
+    }
+
+    [Fact, TestPriority(0)]
+    public async Task Setup_CreateAccountAndComplete()
+    {
+        var createResponse = await _client.PostAsJsonAsync("/api/auth/setup/account", new
+        {
+            username = "linkadmin",
+            password = "LinkPassword123!"
+        });
+        createResponse.StatusCode.ShouldBe(HttpStatusCode.Created);
+
+        var completeResponse = await _client.PostAsJsonAsync("/api/auth/setup/complete", new { });
+        completeResponse.StatusCode.ShouldBe(HttpStatusCode.OK);
+    }
+
+    [Fact, TestPriority(1)]
+    public async Task Login_StoreAccessToken()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "linkadmin",
+            password = "LinkPassword123!"
+        });
+
+        var bodyText = await response.Content.ReadAsStringAsync();
+        response.StatusCode.ShouldBe(HttpStatusCode.OK, $"Login failed. Body: {bodyText}");
+
+        var body = JsonSerializer.Deserialize<JsonElement>(bodyText);
+        body.TryGetProperty("requiresTwoFactor", out var rtf)
+            .ShouldBeTrue($"Missing 'requiresTwoFactor' in body: {bodyText}");
+        rtf.GetBoolean().ShouldBeFalse();
+        // Tokens are nested: { "requiresTwoFactor": false, "tokens": { "accessToken": "..." } }
+        _accessToken = body.GetProperty("tokens").GetProperty("accessToken").GetString();
+        _accessToken.ShouldNotBeNullOrEmpty();
+
+        _client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", _accessToken);
+    }
+
+    [Fact, TestPriority(2)]
+    public async Task OidcLink_WhenOidcDisabled_ReturnsBadRequest()
+    {
+        var response = await _client.PostAsync("/api/account/oidc/link", null);
+
+        response.StatusCode.ShouldBe(HttpStatusCode.BadRequest);
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("error").GetString().ShouldContain("OIDC is not enabled");
+    }
+
+    [Fact, TestPriority(3)]
+    public async Task EnableOidcConfig_ViaDirectDbUpdate()
+    {
+        await _factory.EnableOidcAsync();
+
+        var statusResponse = await _client.GetAsync("/api/auth/status");
+        statusResponse.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await statusResponse.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("oidcEnabled").GetBoolean().ShouldBeTrue();
+    }
+
+    [Fact, TestPriority(4)]
+    public async Task OidcLink_WhenAuthenticated_ReturnsAuthorizationUrl()
+    {
+        var response = await _client.PostAsync("/api/account/oidc/link", null);
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        var authUrl = body.GetProperty("authorizationUrl").GetString();
+        authUrl.ShouldNotBeNullOrEmpty();
+        authUrl.ShouldContain("authorize");
+    }
+
+    [Fact, TestPriority(5)]
+    public async Task OidcLinkCallback_WithErrorParam_RedirectsToSettingsWithError()
+    {
+        var response = await _client.GetAsync("/api/account/oidc/link/callback?error=access_denied");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Redirect);
+        var location = response.Headers.Location?.ToString();
+        location.ShouldNotBeNull();
+        location.ShouldContain("/settings/account");
+        location.ShouldContain("oidc_link_error=failed");
+    }
+
+    [Fact, TestPriority(6)]
+    public async Task OidcLinkCallback_MissingCodeOrState_RedirectsWithError()
+    {
+        var noParams = await _client.GetAsync("/api/account/oidc/link/callback");
+        noParams.StatusCode.ShouldBe(HttpStatusCode.Redirect);
+        noParams.Headers.Location?.ToString().ShouldContain("oidc_link_error=failed");
+
+        var onlyCode = await _client.GetAsync("/api/account/oidc/link/callback?code=some-code");
+        onlyCode.StatusCode.ShouldBe(HttpStatusCode.Redirect);
+        onlyCode.Headers.Location?.ToString().ShouldContain("oidc_link_error=failed");
+    }
+
+    [Fact, TestPriority(7)]
+    public async Task OidcLinkCallback_ValidFlow_SavesSubjectAndRedirectsToSuccess()
+    {
+        // First trigger StartOidcLink so the mock captures the initiatorUserId
+        var linkResponse = await _client.PostAsync("/api/account/oidc/link", null);
+        linkResponse.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        // Now simulate the IdP callback with the mock's success state
+        var callbackResponse = await _client.GetAsync(
+            $"/api/account/oidc/link/callback?code=valid-code&state={MockOidcAuthService.LinkSuccessState}");
+
+        callbackResponse.StatusCode.ShouldBe(HttpStatusCode.Redirect);
+        var location = callbackResponse.Headers.Location?.ToString();
+        location.ShouldNotBeNull();
+        location.ShouldContain("/settings/account");
+        location.ShouldContain("oidc_link=success");
+        location.ShouldNotContain("oidc_link_error");
+
+        // Verify the subject was saved to config
+        var savedSubject = await _factory.GetAuthorizedSubjectAsync();
+        savedSubject.ShouldBe(MockOidcAuthService.LinkedSubject);
+    }
+
+    [Fact, TestPriority(8)]
+    public async Task OidcLinkCallback_NoInitiatorUserId_RedirectsWithError()
+    {
+        var response = await _client.GetAsync(
+            $"/api/account/oidc/link/callback?code=valid-code&state={MockOidcAuthService.NoInitiatorState}");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Redirect);
+        var location = response.Headers.Location?.ToString();
+        location.ShouldNotBeNull();
+        location.ShouldContain("oidc_link_error=failed");
+    }
+
+    [Fact, TestPriority(9)]
+    public async Task OidcLink_WhenUnauthenticated_ReturnsUnauthorized()
+    {
+        // Create a fresh unauthenticated client
+        var unauthClient = _factory.CreateClient(new WebApplicationFactoryClientOptions
+        {
+            AllowAutoRedirect = false
+        });
+
+        var response = await unauthClient.PostAsync("/api/account/oidc/link", null);
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Unauthorized);
+    }
+
+    #region Exclusive Mode
+
+    [Fact, TestPriority(10)]
+    public async Task EnableExclusiveMode_ViaDirectDbUpdate()
+    {
+        await _factory.SetOidcExclusiveModeAsync(true);
+
+        var response = await _client.GetAsync("/api/auth/status");
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("oidcExclusiveMode").GetBoolean().ShouldBeTrue();
+    }
+
+    [Fact, TestPriority(11)]
+    public async Task ChangePassword_Blocked_WhenExclusiveModeActive()
+    {
+        var response = await _client.PutAsJsonAsync("/api/account/password", new
+        {
+            currentPassword = "LinkPassword123!",
+            newPassword = "NewPassword456!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Forbidden);
+    }
+
+    [Fact, TestPriority(12)]
+    public async Task PlexLink_Blocked_WhenExclusiveModeActive()
+    {
+        var response = await _client.PostAsync("/api/account/plex/link", null);
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Forbidden);
+    }
+
+    [Fact, TestPriority(13)]
+    public async Task PlexUnlink_Blocked_WhenExclusiveModeActive()
+    {
+        var response = await _client.DeleteAsync("/api/account/plex/link");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Forbidden);
+    }
+
+    [Fact, TestPriority(14)]
+    public async Task OidcConfigUpdate_StillWorks_WhenExclusiveModeActive()
+    {
+        var response = await _client.PutAsJsonAsync("/api/account/oidc", new
+        {
+            enabled = true,
+            issuerUrl = "https://mock-oidc-provider.test",
+            clientId = "test-client",
+            clientSecret = "test-secret",
+            scopes = "openid profile email",
+            authorizedSubject = MockOidcAuthService.LinkedSubject,
+            providerName = "TestProvider",
+            redirectUrl = "",
+            exclusiveMode = true
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+    }
+
+    [Fact, TestPriority(15)]
+    public async Task OidcUnlink_ResetsExclusiveMode()
+    {
+        var response = await _client.DeleteAsync("/api/account/oidc/link");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        // Verify exclusive mode was reset
+        var exclusiveMode = await _factory.GetExclusiveModeAsync();
+        exclusiveMode.ShouldBeFalse();
+    }
+
+    [Fact, TestPriority(16)]
+    public async Task DisableExclusiveMode_PasswordChangeWorks_Again()
+    {
+        // Re-enable OIDC with a linked subject but without exclusive mode
+        await _factory.EnableOidcAsync();
+        await _factory.SetOidcExclusiveModeAsync(false);
+
+        var response = await _client.PutAsJsonAsync("/api/account/password", new
+        {
+            currentPassword = "LinkPassword123!",
+            newPassword = "NewPassword789!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+    }
+
+    #endregion
+
+    #region Test Infrastructure
+
+    public class OidcLinkWebApplicationFactory : CustomWebApplicationFactory
+    {
+        protected override void ConfigureWebHost(IWebHostBuilder builder)
+        {
+            base.ConfigureWebHost(builder);
+
+            builder.ConfigureServices(services =>
+            {
+                var oidcDescriptor = services.SingleOrDefault(d => d.ServiceType == typeof(IOidcAuthService));
+                if (oidcDescriptor != null) services.Remove(oidcDescriptor);
+
+                services.AddSingleton<IOidcAuthService, MockOidcAuthService>();
+            });
+        }
+
+        public async Task EnableOidcAsync()
+        {
+            using var scope = Services.CreateScope();
+            var usersContext = scope.ServiceProvider.GetRequiredService<UsersContext>();
+
+            var user = await usersContext.Users.FirstOrDefaultAsync();
+            if (user is null)
+            {
+                return;
+            }
+
+            user.Oidc = new OidcConfig
+            {
+                Enabled = true,
+                IssuerUrl = "https://mock-oidc-provider.test",
+                ClientId = "test-client",
+                ClientSecret = "test-secret",
+                Scopes = "openid profile email",
+                AuthorizedSubject = "initial-subject",
+                ProviderName = "TestProvider"
+            };
+
+            await usersContext.SaveChangesAsync();
+        }
+
+        public async Task<string?> GetAuthorizedSubjectAsync()
+        {
+            using var scope = Services.CreateScope();
+            var usersContext = scope.ServiceProvider.GetRequiredService<UsersContext>();
+
+            var user = await usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+            return user?.Oidc.AuthorizedSubject;
+        }
+
+        public async Task SetOidcExclusiveModeAsync(bool enabled)
+        {
+            using var scope = Services.CreateScope();
+            var usersContext = scope.ServiceProvider.GetRequiredService<UsersContext>();
+
+            var user = await usersContext.Users.FirstOrDefaultAsync();
+            if (user is not null)
+            {
+                user.Oidc.ExclusiveMode = enabled;
+                await usersContext.SaveChangesAsync();
+            }
+        }
+
+        public async Task<bool> GetExclusiveModeAsync()
+        {
+            using var scope = Services.CreateScope();
+            var usersContext = scope.ServiceProvider.GetRequiredService<UsersContext>();
+
+            var user = await usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+            return user?.Oidc.ExclusiveMode ?? false;
+        }
+
+    }
+
+    private sealed class MockOidcAuthService : IOidcAuthService
+    {
+        public const string LinkSuccessState = "mock-link-success-state";
+        public const string NoInitiatorState = "mock-no-initiator-state";
+        public const string LinkedSubject = "newly-linked-subject-123";
+
+        private string? _lastInitiatorUserId;
+        private readonly ConcurrentDictionary<string, OidcTokenExchangeResult> _oneTimeCodes = new();
+
+        public Task<OidcAuthorizationResult> StartAuthorization(string redirectUri, string? initiatorUserId = null)
+        {
+            _lastInitiatorUserId = initiatorUserId;
+            return Task.FromResult(new OidcAuthorizationResult
+            {
+                AuthorizationUrl = $"https://mock-oidc-provider.test/authorize?state={LinkSuccessState}",
+                State = LinkSuccessState
+            });
+        }
+
+        public Task<OidcCallbackResult> HandleCallback(string code, string state, string redirectUri)
+        {
+            if (state == LinkSuccessState)
+            {
+                return Task.FromResult(new OidcCallbackResult
+                {
+                    Success = true,
+                    Subject = LinkedSubject,
+                    PreferredUsername = "linkuser",
+                    Email = "link@example.com",
+                    InitiatorUserId = _lastInitiatorUserId
+                });
+            }
+
+            if (state == NoInitiatorState)
+            {
+                return Task.FromResult(new OidcCallbackResult
+                {
+                    Success = true,
+                    Subject = LinkedSubject,
+                    InitiatorUserId = null // No initiator — controller should redirect with error
+                });
+            }
+
+            return Task.FromResult(new OidcCallbackResult
+            {
+                Success = false,
+                Error = "Invalid or expired OIDC state"
+            });
+        }
+
+        public string StoreOneTimeCode(string accessToken, string refreshToken, int expiresIn)
+        {
+            var code = Guid.NewGuid().ToString("N");
+            _oneTimeCodes.TryAdd(code, new OidcTokenExchangeResult
+            {
+                AccessToken = accessToken,
+                RefreshToken = refreshToken,
+                ExpiresIn = expiresIn
+            });
+            return code;
+        }
+
+        public OidcTokenExchangeResult? ExchangeOneTimeCode(string code) =>
+            _oneTimeCodes.TryRemove(code, out var result) ? result : null;
+    }
+
+    #endregion
+}

code/backend/Cleanuparr.Api.Tests/Features/Auth/AuthControllerTests.cs

@@ -10,6 +10,7 @@ namespace Cleanuparr.Api.Tests.Features.Auth;
 /// Uses a single shared factory to avoid static state conflicts.
 /// Tests are ordered to build on each other: setup → login → protected endpoints.
 /// </summary>
+[Collection("Auth Integration Tests")]
 [TestCaseOrderer("Cleanuparr.Api.Tests.PriorityOrderer", "Cleanuparr.Api.Tests")]
 public class AuthControllerTests : IClassFixture<CustomWebApplicationFactory>
 {
@@ -31,6 +32,16 @@ public class AuthControllerTests : IClassFixture<CustomWebApplicationFactory>
         body.GetProperty("setupCompleted").GetBoolean().ShouldBeFalse();
     }
 
+    [Fact, TestPriority(0)]
+    public async Task AuthEndpoints_AlwaysReturnNoCacheHeaders()
+    {
+        var response = await _client.GetAsync("/api/auth/status");
+
+        response.Headers.CacheControl.ShouldNotBeNull();
+        response.Headers.CacheControl!.NoCache.ShouldBeTrue();
+        response.Headers.CacheControl!.NoStore.ShouldBeTrue();
+    }
+
     [Fact, TestPriority(1)]
     public async Task Setup_CreateAccount_ReturnsCreated()
     {
@@ -178,6 +189,85 @@ public class AuthControllerTests : IClassFixture<CustomWebApplicationFactory>
         response.StatusCode.ShouldBe(HttpStatusCode.OK);
     }
 
+    [Fact, TestPriority(11)]
+    public async Task Setup_2FAGenerate_AfterCompletion_IsBlocked()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/2fa/generate", new { });
+
+        // Blocked by middleware (403) or controller defense-in-depth (409)
+        new[] { HttpStatusCode.Forbidden, HttpStatusCode.Conflict }
+            .ShouldContain(response.StatusCode);
+    }
+
+    [Fact, TestPriority(12)]
+    public async Task Setup_PlexPin_AfterCompletion_IsBlocked()
+    {
+        var response = await _client.PostAsync("/api/auth/setup/plex/pin", null);
+
+        // Blocked by middleware (403) or controller defense-in-depth (409)
+        new[] { HttpStatusCode.Forbidden, HttpStatusCode.Conflict }
+            .ShouldContain(response.StatusCode);
+    }
+
+    [Fact, TestPriority(13)]
+    public async Task Setup_Complete_AfterCompletion_IsBlocked()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/complete", new { });
+
+        // Blocked by middleware (403) or controller defense-in-depth (409)
+        new[] { HttpStatusCode.Forbidden, HttpStatusCode.Conflict }
+            .ShouldContain(response.StatusCode);
+    }
+
+    [Fact, TestPriority(14)]
+    public async Task Login_NotBlockedByMiddleware_AfterSetupEndpointsBlocked()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "admin",
+            password = "TestPassword123!"
+        });
+
+        // Login endpoint must NOT be blocked by the middleware (403).
+        // It may return OK (200) or TooManyRequests (429) due to brute force lockout from earlier tests.
+        response.StatusCode.ShouldNotBe(HttpStatusCode.Forbidden);
+    }
+
+    [Fact, TestPriority(15)]
+    public async Task AuthStatus_StillWorks_AfterSetupEndpointsBlocked()
+    {
+        var response = await _client.GetAsync("/api/auth/status");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("setupCompleted").GetBoolean().ShouldBeTrue();
+    }
+
+    [Fact, TestPriority(16)]
+    public async Task OidcExchange_WithNonexistentCode_ReturnsNotFound()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/oidc/exchange", new
+        {
+            code = "nonexistent-one-time-code"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.NotFound);
+    }
+
+    [Fact, TestPriority(17)]
+    public async Task AuthStatus_IncludesOidcFields()
+    {
+        var response = await _client.GetAsync("/api/auth/status");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        // Verify OIDC fields exist in the response (values depend on shared static DB state)
+        body.TryGetProperty("oidcEnabled", out _).ShouldBeTrue();
+        body.TryGetProperty("oidcProviderName", out _).ShouldBeTrue();
+    }
+
     #region TOTP helpers
 
     private static string _totpSecret = "";

code/backend/Cleanuparr.Api.Tests/Features/Auth/LoginTimingTests.cs

@@ -0,0 +1,182 @@
+using System.Diagnostics;
+using System.Net;
+using System.Net.Http.Json;
+using Cleanuparr.Persistence;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features.Auth;
+
+/// <summary>
+/// Tests that the login endpoint always runs BCrypt verification regardless of
+/// username validity, preventing timing-based username enumeration.
+/// </summary>
+[Collection("Login Timing Tests")]
+[TestCaseOrderer("Cleanuparr.Api.Tests.PriorityOrderer", "Cleanuparr.Api.Tests")]
+public class LoginTimingTests : IClassFixture<TimingTestWebApplicationFactory>
+{
+    private readonly HttpClient _client;
+    private readonly TimingTestWebApplicationFactory _factory;
+
+    public LoginTimingTests(TimingTestWebApplicationFactory factory)
+    {
+        _factory = factory;
+        _client = factory.CreateClient();
+    }
+
+    [Fact, TestPriority(0)]
+    public async Task Login_NoUserExists_StillCallsPasswordVerification()
+    {
+        _factory.TrackingPasswordService.Reset();
+
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "nouser",
+            password = "SomePassword123!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Unauthorized);
+        _factory.TrackingPasswordService.VerifyPasswordCallCount.ShouldBeGreaterThanOrEqualTo(1);
+    }
+
+    [Fact, TestPriority(1)]
+    public async Task Setup_CreateAccountAndComplete()
+    {
+        var createResponse = await _client.PostAsJsonAsync("/api/auth/setup/account", new
+        {
+            username = "timingtest",
+            password = "TimingTestPassword123!"
+        });
+        createResponse.StatusCode.ShouldBe(HttpStatusCode.Created);
+
+        var completeResponse = await _client.PostAsJsonAsync("/api/auth/setup/complete", new { });
+        completeResponse.StatusCode.ShouldBe(HttpStatusCode.OK);
+    }
+
+    [Fact, TestPriority(2)]
+    public async Task Login_ValidUsername_CallsPasswordVerification()
+    {
+        _factory.TrackingPasswordService.Reset();
+
+        await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "timingtest",
+            password = "TimingTestPassword123!"
+        });
+
+        _factory.TrackingPasswordService.VerifyPasswordCallCount.ShouldBeGreaterThanOrEqualTo(1);
+    }
+
+    [Fact, TestPriority(3)]
+    public async Task Login_NonexistentUsername_StillCallsPasswordVerification()
+    {
+        _factory.TrackingPasswordService.Reset();
+
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "doesnotexist",
+            password = "SomePassword123!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Unauthorized);
+        _factory.TrackingPasswordService.VerifyPasswordCallCount.ShouldBeGreaterThanOrEqualTo(1);
+    }
+
+    [Fact, TestPriority(4)]
+    public async Task Login_LockedOutUser_StillCallsPasswordVerification()
+    {
+        // Set lockout state directly in the database to avoid timing sensitivity
+        using (var scope = _factory.Services.CreateScope())
+        {
+            var context = scope.ServiceProvider.GetRequiredService<UsersContext>();
+            var user = await context.Users.FirstAsync();
+            user.FailedLoginAttempts = 5;
+            user.LockoutEnd = DateTime.UtcNow.AddMinutes(5);
+            await context.SaveChangesAsync();
+        }
+
+        _factory.TrackingPasswordService.Reset();
+
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "timingtest",
+            password = "WrongPassword!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.TooManyRequests);
+        _factory.TrackingPasswordService.VerifyPasswordCallCount.ShouldBeGreaterThanOrEqualTo(1);
+
+        // Reset lockout for subsequent tests
+        using (var scope = _factory.Services.CreateScope())
+        {
+            var context = scope.ServiceProvider.GetRequiredService<UsersContext>();
+            var user = await context.Users.FirstAsync();
+            user.FailedLoginAttempts = 0;
+            user.LockoutEnd = null;
+            await context.SaveChangesAsync();
+        }
+    }
+
+    [Fact, TestPriority(5)]
+    public async Task Login_TimingConsistency_InvalidAndValidUsernamesTakeSimilarTime()
+    {
+        const int iterations = 10;
+
+        // Warm up the server and BCrypt static init
+        await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "warmup",
+            password = "WarmupPassword123!"
+        });
+
+        var invalidTimings = new List<long>(iterations);
+        var validTimings = new List<long>(iterations);
+
+        for (var i = 0; i < iterations; i++)
+        {
+            // Alternate to avoid ordering bias
+            var invalidSw = Stopwatch.StartNew();
+            await _client.PostAsJsonAsync("/api/auth/login", new
+            {
+                username = $"nonexistent_{i}",
+                password = "SomePassword123!"
+            });
+            invalidSw.Stop();
+            invalidTimings.Add(invalidSw.ElapsedMilliseconds);
+
+            var validSw = Stopwatch.StartNew();
+            await _client.PostAsJsonAsync("/api/auth/login", new
+            {
+                username = "timingtest",
+                password = "WrongPasswordForTiming!"
+            });
+            validSw.Stop();
+            validTimings.Add(validSw.ElapsedMilliseconds);
+        }
+
+        var invalidMedian = Median(invalidTimings);
+        var validMedian = Median(validTimings);
+
+        // The invalid-username path must not be suspiciously fast
+        invalidMedian.ShouldBeGreaterThan(50,
+            $"Non-existent username median too fast ({invalidMedian}ms) — BCrypt may have been skipped");
+
+        // Medians should be in the same ballpark
+        var ratio = invalidMedian > validMedian
+            ? (double)invalidMedian / validMedian
+            : (double)validMedian / invalidMedian;
+
+        ratio.ShouldBeLessThan(3.0,
+            $"Timing difference too large: invalid median={invalidMedian}ms, valid median={validMedian}ms (ratio={ratio:F1}x)");
+    }
+
+    private static long Median(List<long> values)
+    {
+        values.Sort();
+        var mid = values.Count / 2;
+        return values.Count % 2 == 0
+            ? (values[mid - 1] + values[mid]) / 2
+            : values[mid];
+    }
+}

code/backend/Cleanuparr.Api.Tests/Features/Auth/OidcAuthControllerTests.cs

@@ -0,0 +1,628 @@
+using System.Net;
+using System.Net.Http.Json;
+using System.Text.Json;
+using Cleanuparr.Infrastructure.Features.Auth;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Auth;
+using Cleanuparr.Shared.Helpers;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Mvc.Testing;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features.Auth;
+
+/// <summary>
+/// Integration tests for the OIDC authentication flow.
+/// Uses a mock IOidcAuthService to simulate IdP behavior.
+/// Tests are ordered to build on each other: setup → enable OIDC → test flow.
+/// </summary>
+[Collection("Auth Integration Tests")]
+[TestCaseOrderer("Cleanuparr.Api.Tests.PriorityOrderer", "Cleanuparr.Api.Tests")]
+public class OidcAuthControllerTests : IClassFixture<OidcAuthControllerTests.OidcWebApplicationFactory>
+{
+    private readonly HttpClient _client;
+    private readonly OidcWebApplicationFactory _factory;
+
+    public OidcAuthControllerTests(OidcWebApplicationFactory factory)
+    {
+        _factory = factory;
+        _client = factory.CreateClient(new WebApplicationFactoryClientOptions
+        {
+            AllowAutoRedirect = false // We want to inspect redirects
+        });
+    }
+
+    [Fact, TestPriority(0)]
+    public async Task OidcStart_BeforeSetup_ReturnsBadRequest()
+    {
+        var response = await _client.PostAsync("/api/auth/oidc/start", null);
+
+        // OIDC start is on /api/auth/ path (not blocked by SetupGuardMiddleware)
+        // but the controller returns BadRequest because OIDC is not configured
+        response.StatusCode.ShouldBe(HttpStatusCode.BadRequest);
+    }
+
+    [Fact, TestPriority(1)]
+    public async Task Setup_CreateAccountAndComplete()
+    {
+        // Create account
+        var createResponse = await _client.PostAsJsonAsync("/api/auth/setup/account", new
+        {
+            username = "admin",
+            password = "TestPassword123!"
+        });
+        createResponse.StatusCode.ShouldBe(HttpStatusCode.Created);
+
+        // Complete setup (skip 2FA for this test suite)
+        var completeResponse = await _client.PostAsJsonAsync("/api/auth/setup/complete", new { });
+        completeResponse.StatusCode.ShouldBe(HttpStatusCode.OK);
+    }
+
+    [Fact, TestPriority(2)]
+    public async Task OidcStart_WhenDisabled_ReturnsBadRequest()
+    {
+        var response = await _client.PostAsync("/api/auth/oidc/start", null);
+
+        response.StatusCode.ShouldBe(HttpStatusCode.BadRequest);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("error").GetString()!.ShouldContain("OIDC is not enabled");
+    }
+
+    [Fact, TestPriority(3)]
+    public async Task OidcExchange_WhenDisabled_ReturnsNotFound()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/oidc/exchange", new
+        {
+            code = "some-random-code"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.NotFound);
+    }
+
+    [Fact, TestPriority(4)]
+    public async Task OidcCallback_WithErrorParam_RedirectsToLoginWithError()
+    {
+        var response = await _client.GetAsync("/api/auth/oidc/callback?error=access_denied");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Redirect);
+        var location = response.Headers.Location?.ToString();
+        location.ShouldNotBeNull();
+        location.ShouldContain("/auth/login");
+        location.ShouldContain("oidc_error=provider_error");
+    }
+
+    [Fact, TestPriority(5)]
+    public async Task OidcCallback_WithoutCodeOrState_RedirectsToLoginWithError()
+    {
+        var response = await _client.GetAsync("/api/auth/oidc/callback");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Redirect);
+        var location = response.Headers.Location?.ToString();
+        location.ShouldNotBeNull();
+        location.ShouldContain("oidc_error=invalid_request");
+    }
+
+    [Fact, TestPriority(6)]
+    public async Task OidcCallback_WithOnlyCode_RedirectsToLoginWithError()
+    {
+        var response = await _client.GetAsync("/api/auth/oidc/callback?code=some-code");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Redirect);
+        var location = response.Headers.Location?.ToString();
+        location.ShouldNotBeNull();
+        location.ShouldContain("oidc_error=invalid_request");
+    }
+
+    [Fact, TestPriority(7)]
+    public async Task OidcCallback_WithInvalidState_RedirectsToLoginWithError()
+    {
+        // Even with code and state, if the state is invalid the mock will return failure
+        var response = await _client.GetAsync("/api/auth/oidc/callback?code=some-code&state=invalid-state");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Redirect);
+        var location = response.Headers.Location?.ToString();
+        location.ShouldNotBeNull();
+        location.ShouldContain("oidc_error=authentication_failed");
+    }
+
+    [Fact, TestPriority(8)]
+    public async Task EnableOidcConfig_ViaDirectDbUpdate()
+    {
+        // Simulate enabling OIDC via direct DB manipulation (since we'd normally do this through settings UI)
+        await _factory.EnableOidcAsync();
+
+        // Verify auth status reflects OIDC enabled
+        var response = await _client.GetAsync("/api/auth/status");
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("oidcEnabled").GetBoolean().ShouldBeTrue();
+        body.GetProperty("oidcProviderName").GetString().ShouldBe("TestProvider");
+    }
+
+    [Fact, TestPriority(9)]
+    public async Task OidcStart_WhenEnabled_ReturnsAuthorizationUrl()
+    {
+        var response = await _client.PostAsync("/api/auth/oidc/start", null);
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        var authUrl = body.GetProperty("authorizationUrl").GetString();
+        authUrl.ShouldNotBeNullOrEmpty();
+        authUrl.ShouldContain("authorize");
+    }
+
+    [Fact, TestPriority(10)]
+    public async Task OidcCallback_ValidFlow_RedirectsWithOneTimeCode()
+    {
+        // Use the mock's valid state to simulate a successful callback
+        var response = await _client.GetAsync(
+            $"/api/auth/oidc/callback?code=valid-auth-code&state={MockOidcAuthService.ValidState}");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Redirect);
+        var location = response.Headers.Location?.ToString();
+        location.ShouldNotBeNull();
+        location.ShouldContain("/auth/oidc/callback");
+        location.ShouldContain("code=");
+        // Should NOT contain oidc_error
+        location.ShouldNotContain("oidc_error");
+    }
+
+    [Fact, TestPriority(11)]
+    public async Task OidcExchange_ValidOneTimeCode_ReturnsTokens()
+    {
+        // First, trigger a valid callback to get a one-time code
+        var callbackResponse = await _client.GetAsync(
+            $"/api/auth/oidc/callback?code=valid-auth-code&state={MockOidcAuthService.ValidState}");
+        callbackResponse.StatusCode.ShouldBe(HttpStatusCode.Redirect);
+
+        var location = callbackResponse.Headers.Location?.ToString();
+        location.ShouldNotBeNull();
+
+        // Extract the one-time code from the redirect URL
+        var uri = new Uri("http://localhost" + location);
+        var queryParams = System.Web.HttpUtility.ParseQueryString(uri.Query);
+        var oneTimeCode = queryParams["code"];
+        oneTimeCode.ShouldNotBeNullOrEmpty();
+
+        // Exchange the one-time code for tokens
+        var exchangeResponse = await _client.PostAsJsonAsync("/api/auth/oidc/exchange", new
+        {
+            code = oneTimeCode
+        });
+
+        exchangeResponse.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await exchangeResponse.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("accessToken").GetString().ShouldNotBeNullOrEmpty();
+        body.GetProperty("refreshToken").GetString().ShouldNotBeNullOrEmpty();
+        body.GetProperty("expiresIn").GetInt32().ShouldBeGreaterThan(0);
+    }
+
+    [Fact, TestPriority(12)]
+    public async Task OidcExchange_SameCodeTwice_SecondFails()
+    {
+        // First, trigger a valid callback
+        var callbackResponse = await _client.GetAsync(
+            $"/api/auth/oidc/callback?code=valid-auth-code&state={MockOidcAuthService.ValidState}");
+        var location = callbackResponse.Headers.Location?.ToString()!;
+        var uri = new Uri("http://localhost" + location);
+        var queryParams = System.Web.HttpUtility.ParseQueryString(uri.Query);
+        var oneTimeCode = queryParams["code"]!;
+
+        // First exchange succeeds
+        var response1 = await _client.PostAsJsonAsync("/api/auth/oidc/exchange", new { code = oneTimeCode });
+        response1.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        // Second exchange with same code fails
+        var response2 = await _client.PostAsJsonAsync("/api/auth/oidc/exchange", new { code = oneTimeCode });
+        response2.StatusCode.ShouldBe(HttpStatusCode.NotFound);
+    }
+
+    [Fact, TestPriority(13)]
+    public async Task OidcExchange_InvalidCode_ReturnsNotFound()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/oidc/exchange", new
+        {
+            code = "completely-invalid-code"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.NotFound);
+    }
+
+    [Fact, TestPriority(14)]
+    public async Task OidcCallback_UnauthorizedSubject_RedirectsWithError()
+    {
+        // Use the mock's state that returns a different subject
+        var response = await _client.GetAsync(
+            $"/api/auth/oidc/callback?code=valid-auth-code&state={MockOidcAuthService.WrongSubjectState}");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Redirect);
+        var location = response.Headers.Location?.ToString();
+        location.ShouldNotBeNull();
+        location.ShouldContain("oidc_error=unauthorized");
+    }
+
+    [Fact, TestPriority(15)]
+    public async Task AuthStatus_IncludesOidcFields()
+    {
+        var response = await _client.GetAsync("/api/auth/status");
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("setupCompleted").GetBoolean().ShouldBeTrue();
+        body.GetProperty("oidcEnabled").GetBoolean().ShouldBeTrue();
+        body.GetProperty("oidcProviderName").GetString().ShouldBe("TestProvider");
+    }
+
+    [Fact, TestPriority(16)]
+    public async Task PasswordLogin_StillWorks_AfterOidcEnabled()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "admin",
+            password = "TestPassword123!"
+        });
+
+        // Should succeed (no 2FA since we skipped it in setup)
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        // No 2FA, so should have tokens directly
+        body.GetProperty("requiresTwoFactor").GetBoolean().ShouldBeFalse();
+    }
+
+    [Fact, TestPriority(17)]
+    public async Task OidcStatus_WhenSubjectCleared_StillEnabled()
+    {
+        // Clearing the authorized subject should NOT disable OIDC — it just means any user can log in
+        await _factory.SetOidcAuthorizedSubjectAsync("");
+
+        var response = await _client.GetAsync("/api/auth/status");
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("oidcEnabled").GetBoolean().ShouldBeTrue();
+
+        // Restore for subsequent tests
+        await _factory.SetOidcAuthorizedSubjectAsync(MockOidcAuthService.AuthorizedSubject);
+    }
+
+    [Fact, TestPriority(17)]
+    public async Task OidcStatus_WhenMissingIssuerUrl_ReturnsFalse()
+    {
+        // OIDC should be disabled when essential config (IssuerUrl) is missing
+        await _factory.SetOidcIssuerUrlAsync("");
+
+        var response = await _client.GetAsync("/api/auth/status");
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("oidcEnabled").GetBoolean().ShouldBeFalse();
+
+        // Restore for subsequent tests
+        await _factory.SetOidcIssuerUrlAsync("https://mock-oidc-provider.test");
+    }
+
+    [Fact, TestPriority(17)]
+    public async Task OidcCallback_WithoutLinkedSubject_AllowsAnyUser()
+    {
+        // Clear the authorized subject — any OIDC user should be allowed
+        await _factory.SetOidcAuthorizedSubjectAsync("");
+
+        // Use the "wrong subject" state — this returns a different subject than the authorized one
+        // With no linked subject, it should still succeed
+        var response = await _client.GetAsync(
+            $"/api/auth/oidc/callback?code=valid-auth-code&state={MockOidcAuthService.WrongSubjectState}");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Redirect);
+        var location = response.Headers.Location?.ToString();
+        location.ShouldNotBeNull();
+        location.ShouldContain("code=");
+        location.ShouldNotContain("oidc_error");
+
+        // Restore for subsequent tests
+        await _factory.SetOidcAuthorizedSubjectAsync(MockOidcAuthService.AuthorizedSubject);
+    }
+
+    [Fact, TestPriority(18)]
+    public async Task OidcExchange_RandomCode_ReturnsNotFound()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/oidc/exchange", new
+        {
+            code = "completely-random-nonexistent-code"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.NotFound);
+    }
+
+    #region Exclusive Mode
+
+    [Fact, TestPriority(19)]
+    public async Task EnableExclusiveMode_AuthStatusReflectsIt()
+    {
+        await _factory.SetOidcExclusiveModeAsync(true);
+
+        var response = await _client.GetAsync("/api/auth/status");
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("oidcExclusiveMode").GetBoolean().ShouldBeTrue();
+    }
+
+    [Fact, TestPriority(20)]
+    public async Task PasswordLogin_Blocked_WhenExclusiveModeActive()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "admin",
+            password = "TestPassword123!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Forbidden);
+    }
+
+    [Fact, TestPriority(21)]
+    public async Task TwoFactorLogin_Blocked_WhenExclusiveModeActive()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/login/2fa", new
+        {
+            loginToken = "some-token",
+            code = "123456"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Forbidden);
+    }
+
+    [Fact, TestPriority(22)]
+    public async Task PlexLoginPin_Blocked_WhenExclusiveModeActive()
+    {
+        var response = await _client.PostAsync("/api/auth/login/plex/pin", null);
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Forbidden);
+    }
+
+    [Fact, TestPriority(23)]
+    public async Task PlexLoginVerify_Blocked_WhenExclusiveModeActive()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/login/plex/verify", new
+        {
+            pinId = 12345
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Forbidden);
+    }
+
+    [Fact, TestPriority(24)]
+    public async Task OidcStart_StillWorks_WhenExclusiveModeActive()
+    {
+        var response = await _client.PostAsync("/api/auth/oidc/start", null);
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("authorizationUrl").GetString().ShouldNotBeNullOrEmpty();
+    }
+
+    [Fact, TestPriority(25)]
+    public async Task OidcCallback_StillWorks_WhenExclusiveModeActive()
+    {
+        var response = await _client.GetAsync(
+            $"/api/auth/oidc/callback?code=valid-auth-code&state={MockOidcAuthService.ValidState}");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.Redirect);
+        var location = response.Headers.Location?.ToString();
+        location.ShouldNotBeNull();
+        location.ShouldContain("code=");
+        location.ShouldNotContain("oidc_error");
+    }
+
+    [Fact, TestPriority(26)]
+    public async Task DisableExclusiveMode_PasswordLoginWorks_Again()
+    {
+        await _factory.SetOidcExclusiveModeAsync(false);
+
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "admin",
+            password = "TestPassword123!"
+        });
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+    }
+
+    #endregion
+
+    #region Test Infrastructure
+
+    /// <summary>
+    /// Custom factory that replaces IOidcAuthService with a mock for testing.
+    /// </summary>
+    public class OidcWebApplicationFactory : WebApplicationFactory<Program>
+    {
+        private readonly string _tempDir;
+
+        public OidcWebApplicationFactory()
+        {
+            _tempDir = Path.Combine(Path.GetTempPath(), $"cleanuparr-oidc-test-{Guid.NewGuid():N}");
+            Directory.CreateDirectory(_tempDir);
+
+            // Redirect all database contexts to this factory's temp directory.
+            ConfigurationPathProvider.SetConfigPath(_tempDir);
+        }
+
+        protected override void ConfigureWebHost(IWebHostBuilder builder)
+        {
+            builder.UseEnvironment("Testing");
+
+            builder.ConfigureServices(services =>
+            {
+                // Replace IOidcAuthService with mock
+                var oidcDescriptor = services.SingleOrDefault(d => d.ServiceType == typeof(IOidcAuthService));
+                if (oidcDescriptor != null) services.Remove(oidcDescriptor);
+
+                services.AddSingleton<IOidcAuthService, MockOidcAuthService>();
+
+                // Remove all hosted services (Quartz scheduler, BackgroundJobManager) to prevent
+                // Quartz.Logging.LogProvider.ResolvedLogProvider (a cached Lazy<T>) from being accessed
+                // with a disposed ILoggerFactory from the previous factory lifecycle.
+                // Auth tests don't depend on background job scheduling, so this is safe.
+                foreach (var hostedService in services.Where(d => d.ServiceType == typeof(IHostedService)).ToList())
+                    services.Remove(hostedService);
+            });
+        }
+
+        /// <summary>
+        /// Enables OIDC on the user in the UsersContext database.
+        /// </summary>
+        public async Task EnableOidcAsync()
+        {
+            using var scope = Services.CreateScope();
+            var usersContext = scope.ServiceProvider.GetRequiredService<UsersContext>();
+
+            var user = await usersContext.Users.FirstOrDefaultAsync();
+            if (user is null)
+            {
+                return;
+            }
+
+            user.Oidc = new OidcConfig
+            {
+                Enabled = true,
+                IssuerUrl = "https://mock-oidc-provider.test",
+                ClientId = "test-client",
+                ClientSecret = "test-secret",
+                Scopes = "openid profile email",
+                AuthorizedSubject = MockOidcAuthService.AuthorizedSubject,
+                ProviderName = "TestProvider"
+            };
+
+            await usersContext.SaveChangesAsync();
+        }
+
+        public async Task SetOidcIssuerUrlAsync(string issuerUrl)
+        {
+            using var scope = Services.CreateScope();
+            var usersContext = scope.ServiceProvider.GetRequiredService<UsersContext>();
+
+            var user = await usersContext.Users.FirstOrDefaultAsync();
+            if (user is not null)
+            {
+                user.Oidc.IssuerUrl = issuerUrl;
+                await usersContext.SaveChangesAsync();
+            }
+        }
+
+        public async Task SetOidcAuthorizedSubjectAsync(string subject)
+        {
+            using var scope = Services.CreateScope();
+            var usersContext = scope.ServiceProvider.GetRequiredService<UsersContext>();
+
+            var user = await usersContext.Users.FirstOrDefaultAsync();
+            if (user is not null)
+            {
+                user.Oidc.AuthorizedSubject = subject;
+                await usersContext.SaveChangesAsync();
+            }
+        }
+
+        public async Task SetOidcExclusiveModeAsync(bool enabled)
+        {
+            using var scope = Services.CreateScope();
+            var usersContext = scope.ServiceProvider.GetRequiredService<UsersContext>();
+
+            var user = await usersContext.Users.FirstOrDefaultAsync();
+            if (user is not null)
+            {
+                user.Oidc.ExclusiveMode = enabled;
+                await usersContext.SaveChangesAsync();
+            }
+        }
+
+        protected override void Dispose(bool disposing)
+        {
+            base.Dispose(disposing);
+
+            if (disposing && Directory.Exists(_tempDir))
+            {
+                try { Directory.Delete(_tempDir, true); } catch { /* best effort */ }
+            }
+        }
+    }
+
+    /// <summary>
+    /// Mock OIDC auth service that simulates IdP behavior without network calls.
+    /// </summary>
+    private sealed class MockOidcAuthService : IOidcAuthService
+    {
+        public const string ValidState = "mock-valid-state";
+        public const string WrongSubjectState = "mock-wrong-subject-state";
+        public const string AuthorizedSubject = "mock-authorized-subject-123";
+
+        private readonly System.Collections.Concurrent.ConcurrentDictionary<string, OidcTokenExchangeResult> _oneTimeCodes = new();
+
+        public Task<OidcAuthorizationResult> StartAuthorization(string redirectUri, string? initiatorUserId = null)
+        {
+            return Task.FromResult(new OidcAuthorizationResult
+            {
+                AuthorizationUrl = $"https://mock-oidc-provider.test/authorize?redirect_uri={Uri.EscapeDataString(redirectUri)}&state={ValidState}",
+                State = ValidState
+            });
+        }
+
+        public Task<OidcCallbackResult> HandleCallback(string code, string state, string redirectUri)
+        {
+            if (state == ValidState)
+            {
+                return Task.FromResult(new OidcCallbackResult
+                {
+                    Success = true,
+                    Subject = AuthorizedSubject,
+                    PreferredUsername = "testuser",
+                    Email = "testuser@example.com"
+                });
+            }
+
+            if (state == WrongSubjectState)
+            {
+                return Task.FromResult(new OidcCallbackResult
+                {
+                    Success = true,
+                    Subject = "wrong-subject-that-doesnt-match",
+                    PreferredUsername = "wronguser",
+                    Email = "wrong@example.com"
+                });
+            }
+
+            return Task.FromResult(new OidcCallbackResult
+            {
+                Success = false,
+                Error = "Invalid or expired OIDC state"
+            });
+        }
+
+        public string StoreOneTimeCode(string accessToken, string refreshToken, int expiresIn)
+        {
+            var code = Guid.NewGuid().ToString("N");
+            _oneTimeCodes.TryAdd(code, new OidcTokenExchangeResult
+            {
+                AccessToken = accessToken,
+                RefreshToken = refreshToken,
+                ExpiresIn = expiresIn
+            });
+            return code;
+        }
+
+        public OidcTokenExchangeResult? ExchangeOneTimeCode(string code)
+        {
+            return _oneTimeCodes.TryRemove(code, out var result) ? result : null;
+        }
+    }
+
+    #endregion
+}

code/backend/Cleanuparr.Api.Tests/Features/Auth/TimingTestWebApplicationFactory.cs

@@ -0,0 +1,29 @@
+using Cleanuparr.Infrastructure.Features.Auth;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Cleanuparr.Api.Tests.Features.Auth;
+
+/// <summary>
+/// Factory variant that replaces <see cref="IPasswordService"/> with a
+/// <see cref="TrackingPasswordService"/> spy so tests can assert that
+/// password verification is always called regardless of username validity.
+/// </summary>
+public class TimingTestWebApplicationFactory : CustomWebApplicationFactory
+{
+    public TrackingPasswordService TrackingPasswordService { get; } = new();
+
+    protected override void ConfigureWebHost(IWebHostBuilder builder)
+    {
+        base.ConfigureWebHost(builder);
+
+        builder.ConfigureServices(services =>
+        {
+            // Replace IPasswordService with our tracking spy
+            var descriptor = services.SingleOrDefault(d => d.ServiceType == typeof(IPasswordService));
+            if (descriptor != null) services.Remove(descriptor);
+
+            services.AddSingleton<IPasswordService>(TrackingPasswordService);
+        });
+    }
+}

code/backend/Cleanuparr.Api.Tests/Features/Auth/TrackingPasswordService.cs

@@ -0,0 +1,33 @@
+using Cleanuparr.Infrastructure.Features.Auth;
+
+namespace Cleanuparr.Api.Tests.Features.Auth;
+
+/// <summary>
+/// Spy wrapper around <see cref="PasswordService"/> that tracks calls to
+/// <see cref="VerifyPassword"/> for behavioral assertions in timing tests.
+/// </summary>
+public sealed class TrackingPasswordService : IPasswordService
+{
+    private readonly PasswordService _inner = new();
+    private int _verifyPasswordCallCount;
+
+    public int VerifyPasswordCallCount => _verifyPasswordCallCount;
+    
+    public string DummyHash => _inner.DummyHash;
+
+    public string HashPassword(string password)
+    {
+        return _inner.HashPassword(password);
+    }
+
+    public bool VerifyPassword(string password, string hash)
+    {
+        Interlocked.Increment(ref _verifyPasswordCallCount);
+        return _inner.VerifyPassword(password, hash);
+    }
+
+    public void Reset()
+    {
+        Interlocked.Exchange(ref _verifyPasswordCallCount, 0);
+    }
+}

code/backend/Cleanuparr.Api.Tests/Features/Seeker/CustomFormatScoreControllerTests.cs

@@ -0,0 +1,359 @@
+using System.Text.Json;
+using Cleanuparr.Api.Features.Seeker.Contracts.Responses;
+using Cleanuparr.Api.Features.Seeker.Controllers;
+using Cleanuparr.Api.Tests.Features.Seeker.TestHelpers;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.State;
+using Microsoft.AspNetCore.Mvc;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features.Seeker;
+
+public class CustomFormatScoreControllerTests : IDisposable
+{
+    private readonly DataContext _dataContext;
+    private readonly CustomFormatScoreController _controller;
+
+    public CustomFormatScoreControllerTests()
+    {
+        _dataContext = SeekerTestDataFactory.CreateDataContext();
+        _controller = new CustomFormatScoreController(_dataContext);
+    }
+
+    public void Dispose()
+    {
+        _dataContext.Dispose();
+        GC.SuppressFinalize(this);
+    }
+
+    private static JsonElement GetResponseBody(IActionResult result)
+    {
+        var okResult = result.ShouldBeOfType<OkObjectResult>();
+        var json = JsonSerializer.Serialize(okResult.Value);
+        return JsonDocument.Parse(json).RootElement;
+    }
+
+    #region GetCustomFormatScores Tests
+
+    [Fact]
+    public async Task GetCustomFormatScores_WithPageBelowMinimum_ClampsToOne()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "Movie A", currentScore: 100, cutoffScore: 500);
+        AddScoreEntry(radarr.Id, 2, "Movie B", currentScore: 200, cutoffScore: 500);
+
+        var result = await _controller.GetCustomFormatScores(page: -5, pageSize: 50);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("Page").GetInt32().ShouldBe(1);
+        body.GetProperty("Items").GetArrayLength().ShouldBe(2);
+    }
+
+    [Fact]
+    public async Task GetCustomFormatScores_WithPageSizeAboveMaximum_ClampsToHundred()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "Movie A", currentScore: 100, cutoffScore: 500);
+
+        var result = await _controller.GetCustomFormatScores(page: 1, pageSize: 999);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("PageSize").GetInt32().ShouldBe(100);
+    }
+
+    [Fact]
+    public async Task GetCustomFormatScores_WithHideMetTrue_ExcludesItemsAtOrAboveCutoff()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "Below Cutoff", currentScore: 100, cutoffScore: 500);
+        AddScoreEntry(radarr.Id, 2, "At Cutoff", currentScore: 500, cutoffScore: 500);
+        AddScoreEntry(radarr.Id, 3, "Above Cutoff", currentScore: 600, cutoffScore: 500);
+
+        var result = await _controller.GetCustomFormatScores(hideMet: true);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(1);
+        body.GetProperty("Items")[0].GetProperty("Title").GetString().ShouldBe("Below Cutoff");
+    }
+
+    [Fact]
+    public async Task GetCustomFormatScores_WithSearchFilter_ReturnsMatchingTitlesOnly()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "The Matrix", currentScore: 100, cutoffScore: 500);
+        AddScoreEntry(radarr.Id, 2, "Inception", currentScore: 200, cutoffScore: 500);
+        AddScoreEntry(radarr.Id, 3, "The Matrix Reloaded", currentScore: 300, cutoffScore: 500);
+
+        var result = await _controller.GetCustomFormatScores(search: "matrix");
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(2);
+    }
+
+    [Fact]
+    public async Task GetCustomFormatScores_WithSortByDate_OrdersByLastSyncedDescending()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "Older", currentScore: 100, cutoffScore: 500,
+            lastSynced: DateTime.UtcNow.AddHours(-2));
+        AddScoreEntry(radarr.Id, 2, "Newer", currentScore: 200, cutoffScore: 500,
+            lastSynced: DateTime.UtcNow.AddHours(-1));
+
+        var result = await _controller.GetCustomFormatScores(sortBy: "date");
+        var body = GetResponseBody(result);
+
+        body.GetProperty("Items")[0].GetProperty("Title").GetString().ShouldBe("Newer");
+        body.GetProperty("Items")[1].GetProperty("Title").GetString().ShouldBe("Older");
+    }
+
+    [Fact]
+    public async Task GetCustomFormatScores_WithInstanceIdFilter_ReturnsOnlyThatInstance()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        var sonarr = SeekerTestDataFactory.AddSonarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "Movie", currentScore: 100, cutoffScore: 500);
+        AddScoreEntry(sonarr.Id, 2, "Series", currentScore: 200, cutoffScore: 500,
+            itemType: InstanceType.Sonarr);
+
+        var result = await _controller.GetCustomFormatScores(instanceId: radarr.Id);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(1);
+        body.GetProperty("Items")[0].GetProperty("Title").GetString().ShouldBe("Movie");
+    }
+
+    [Fact]
+    public async Task GetCustomFormatScores_ReturnsCorrectTotalPagesCalculation()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        for (int i = 1; i <= 7; i++)
+        {
+            AddScoreEntry(radarr.Id, i, $"Movie {i}", currentScore: 100, cutoffScore: 500);
+        }
+
+        var result = await _controller.GetCustomFormatScores(page: 1, pageSize: 3);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(7);
+        body.GetProperty("TotalPages").GetInt32().ShouldBe(3); // ceil(7/3) = 3
+        body.GetProperty("Items").GetArrayLength().ShouldBe(3);
+    }
+
+    #endregion
+
+    #region GetRecentUpgrades Tests
+
+    [Fact]
+    public async Task GetRecentUpgrades_WithNoHistory_ReturnsEmptyList()
+    {
+        var result = await _controller.GetRecentUpgrades();
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(0);
+        body.GetProperty("Items").GetArrayLength().ShouldBe(0);
+    }
+
+    [Fact]
+    public async Task GetRecentUpgrades_WithSingleEntryPerItem_ReturnsNoUpgrades()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 100, recordedAt: DateTime.UtcNow.AddDays(-1));
+
+        var result = await _controller.GetRecentUpgrades();
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(0);
+    }
+
+    [Fact]
+    public async Task GetRecentUpgrades_WithScoreIncrease_DetectsUpgrade()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 100, recordedAt: DateTime.UtcNow.AddDays(-2));
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 250, recordedAt: DateTime.UtcNow.AddDays(-1));
+
+        var result = await _controller.GetRecentUpgrades();
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(1);
+        var upgrade = body.GetProperty("Items")[0];
+        upgrade.GetProperty("PreviousScore").GetInt32().ShouldBe(100);
+        upgrade.GetProperty("NewScore").GetInt32().ShouldBe(250);
+    }
+
+    [Fact]
+    public async Task GetRecentUpgrades_WithScoreDecrease_DoesNotCountAsUpgrade()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 300, recordedAt: DateTime.UtcNow.AddDays(-2));
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 150, recordedAt: DateTime.UtcNow.AddDays(-1));
+
+        var result = await _controller.GetRecentUpgrades();
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(0);
+    }
+
+    [Fact]
+    public async Task GetRecentUpgrades_WithMultipleUpgradesInSameGroup_CountsEach()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        // 100 -> 200 -> 300 = two upgrades for the same item
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 100, recordedAt: DateTime.UtcNow.AddDays(-3));
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 200, recordedAt: DateTime.UtcNow.AddDays(-2));
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 300, recordedAt: DateTime.UtcNow.AddDays(-1));
+
+        var result = await _controller.GetRecentUpgrades();
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(2);
+    }
+
+    [Fact]
+    public async Task GetRecentUpgrades_WithDaysFilter_ExcludesOlderHistory()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        // Old upgrade (outside 7-day window)
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 100, recordedAt: DateTime.UtcNow.AddDays(-20));
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 250, recordedAt: DateTime.UtcNow.AddDays(-15));
+        // Recent upgrade (inside 7-day window)
+        AddHistoryEntry(radarr.Id, externalItemId: 2, score: 100, recordedAt: DateTime.UtcNow.AddDays(-3));
+        AddHistoryEntry(radarr.Id, externalItemId: 2, score: 300, recordedAt: DateTime.UtcNow.AddDays(-1));
+
+        var result = await _controller.GetRecentUpgrades(days: 7);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task GetRecentUpgrades_ReturnsSortedByMostRecentFirst()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        // Item 1: upgrade happened 5 days ago
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 100, recordedAt: DateTime.UtcNow.AddDays(-6));
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 200, recordedAt: DateTime.UtcNow.AddDays(-5));
+        // Item 2: upgrade happened 1 day ago
+        AddHistoryEntry(radarr.Id, externalItemId: 2, score: 100, recordedAt: DateTime.UtcNow.AddDays(-2));
+        AddHistoryEntry(radarr.Id, externalItemId: 2, score: 300, recordedAt: DateTime.UtcNow.AddDays(-1));
+
+        var result = await _controller.GetRecentUpgrades();
+        var body = GetResponseBody(result);
+
+        var items = body.GetProperty("Items");
+        items.GetArrayLength().ShouldBe(2);
+        // Most recent upgrade (item 2) should be first
+        items[0].GetProperty("NewScore").GetInt32().ShouldBe(300);
+        items[1].GetProperty("NewScore").GetInt32().ShouldBe(200);
+    }
+
+    #endregion
+
+    #region GetStats Tests
+
+    [Fact]
+    public async Task GetStats_WithNoEntries_ReturnsZeroes()
+    {
+        var result = await _controller.GetStats();
+        var okResult = result.ShouldBeOfType<OkObjectResult>();
+        var stats = okResult.Value.ShouldBeOfType<CustomFormatScoreStatsResponse>();
+
+        stats.TotalTracked.ShouldBe(0);
+        stats.BelowCutoff.ShouldBe(0);
+        stats.AtOrAboveCutoff.ShouldBe(0);
+        stats.RecentUpgrades.ShouldBe(0);
+    }
+
+    [Fact]
+    public async Task GetStats_CorrectlyCategorizesBelowAndAboveCutoff()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "Below", currentScore: 100, cutoffScore: 500);
+        AddScoreEntry(radarr.Id, 2, "At", currentScore: 500, cutoffScore: 500);
+        AddScoreEntry(radarr.Id, 3, "Above", currentScore: 600, cutoffScore: 500);
+
+        var result = await _controller.GetStats();
+        var okResult = result.ShouldBeOfType<OkObjectResult>();
+        var stats = okResult.Value.ShouldBeOfType<CustomFormatScoreStatsResponse>();
+
+        stats.TotalTracked.ShouldBe(3);
+        stats.BelowCutoff.ShouldBe(1);
+        stats.AtOrAboveCutoff.ShouldBe(2);
+    }
+
+    [Fact]
+    public async Task GetStats_CountsRecentUpgradesFromLast7Days()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        AddScoreEntry(radarr.Id, 1, "Movie", currentScore: 300, cutoffScore: 500);
+
+        // Upgrade within 7 days
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 100, recordedAt: DateTime.UtcNow.AddDays(-3));
+        AddHistoryEntry(radarr.Id, externalItemId: 1, score: 300, recordedAt: DateTime.UtcNow.AddDays(-1));
+
+        // Upgrade outside 7 days (should not be counted)
+        AddHistoryEntry(radarr.Id, externalItemId: 2, score: 50, recordedAt: DateTime.UtcNow.AddDays(-20));
+        AddHistoryEntry(radarr.Id, externalItemId: 2, score: 200, recordedAt: DateTime.UtcNow.AddDays(-15));
+
+        var result = await _controller.GetStats();
+        var okResult = result.ShouldBeOfType<OkObjectResult>();
+        var stats = okResult.Value.ShouldBeOfType<CustomFormatScoreStatsResponse>();
+
+        stats.RecentUpgrades.ShouldBe(1);
+    }
+
+    #endregion
+
+    #region Helpers
+
+    private void AddScoreEntry(
+        Guid arrInstanceId,
+        long externalItemId,
+        string title,
+        int currentScore,
+        int cutoffScore,
+        InstanceType itemType = InstanceType.Radarr,
+        DateTime? lastSynced = null)
+    {
+        _dataContext.CustomFormatScoreEntries.Add(new CustomFormatScoreEntry
+        {
+            ArrInstanceId = arrInstanceId,
+            ExternalItemId = externalItemId,
+            EpisodeId = 0,
+            ItemType = itemType,
+            Title = title,
+            FileId = externalItemId * 10,
+            CurrentScore = currentScore,
+            CutoffScore = cutoffScore,
+            QualityProfileName = "HD",
+            LastSyncedAt = lastSynced ?? DateTime.UtcNow
+        });
+        _dataContext.SaveChanges();
+    }
+
+    private void AddHistoryEntry(
+        Guid arrInstanceId,
+        long externalItemId,
+        int score,
+        DateTime recordedAt,
+        long episodeId = 0,
+        int cutoffScore = 500,
+        InstanceType itemType = InstanceType.Radarr)
+    {
+        _dataContext.CustomFormatScoreHistory.Add(new CustomFormatScoreHistory
+        {
+            ArrInstanceId = arrInstanceId,
+            ExternalItemId = externalItemId,
+            EpisodeId = episodeId,
+            ItemType = itemType,
+            Title = $"Item {externalItemId}",
+            Score = score,
+            CutoffScore = cutoffScore,
+            RecordedAt = recordedAt
+        });
+        _dataContext.SaveChanges();
+    }
+
+    #endregion
+}

code/backend/Cleanuparr.Api.Tests/Features/Seeker/SearchStatsControllerTests.cs

@@ -0,0 +1,221 @@
+using System.Text.Json;
+using Cleanuparr.Api.Features.Seeker.Controllers;
+using Cleanuparr.Api.Tests.Features.Seeker.TestHelpers;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Events;
+using Microsoft.AspNetCore.Mvc;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features.Seeker;
+
+public class SearchStatsControllerTests : IDisposable
+{
+    private readonly DataContext _dataContext;
+    private readonly EventsContext _eventsContext;
+    private readonly SearchStatsController _controller;
+
+    public SearchStatsControllerTests()
+    {
+        _dataContext = SeekerTestDataFactory.CreateDataContext();
+        _eventsContext = SeekerTestDataFactory.CreateEventsContext();
+        _controller = new SearchStatsController(_dataContext, _eventsContext);
+    }
+
+    public void Dispose()
+    {
+        _dataContext.Dispose();
+        _eventsContext.Dispose();
+        GC.SuppressFinalize(this);
+    }
+
+    private static JsonElement GetResponseBody(IActionResult result)
+    {
+        var okResult = result.ShouldBeOfType<OkObjectResult>();
+        var json = JsonSerializer.Serialize(okResult.Value);
+        return JsonDocument.Parse(json).RootElement;
+    }
+
+    #region ParseEventData (tested via GetEvents)
+
+    [Fact]
+    public async Task GetEvents_WithNullEventData_ReturnsUnknownDefaults()
+    {
+        AddSearchEvent(data: null);
+
+        var result = await _controller.GetEvents();
+        var body = GetResponseBody(result);
+
+        var item = body.GetProperty("Items")[0];
+        item.GetProperty("InstanceName").GetString().ShouldBe("Unknown");
+        item.GetProperty("ItemCount").GetInt32().ShouldBe(0);
+        item.GetProperty("Items").GetArrayLength().ShouldBe(0);
+    }
+
+    [Fact]
+    public async Task GetEvents_WithValidFullJson_ParsesAllFields()
+    {
+        var data = JsonSerializer.Serialize(new
+        {
+            InstanceName = "My Radarr",
+            ItemCount = 3,
+            Items = new[] { "Movie A", "Movie B", "Movie C" },
+            SearchType = "Proactive",
+            GrabbedItems = new[] { new { Title = "Movie A", Quality = "Bluray-1080p" } }
+        });
+        AddSearchEvent(data: data);
+
+        var result = await _controller.GetEvents();
+        var body = GetResponseBody(result);
+
+        var item = body.GetProperty("Items")[0];
+        item.GetProperty("InstanceName").GetString().ShouldBe("My Radarr");
+        item.GetProperty("ItemCount").GetInt32().ShouldBe(3);
+        item.GetProperty("Items").GetArrayLength().ShouldBe(3);
+        item.GetProperty("Items")[0].GetString().ShouldBe("Movie A");
+        item.GetProperty("SearchType").GetString().ShouldBe(nameof(SeekerSearchType.Proactive));
+    }
+
+    [Fact]
+    public async Task GetEvents_WithPartialJson_ReturnsDefaultsForMissingFields()
+    {
+        // Only InstanceName is present, other fields missing
+        var data = JsonSerializer.Serialize(new { InstanceName = "Partial Instance" });
+        AddSearchEvent(data: data);
+
+        var result = await _controller.GetEvents();
+        var body = GetResponseBody(result);
+
+        var item = body.GetProperty("Items")[0];
+        item.GetProperty("InstanceName").GetString().ShouldBe("Partial Instance");
+        item.GetProperty("ItemCount").GetInt32().ShouldBe(0);
+        item.GetProperty("Items").GetArrayLength().ShouldBe(0);
+    }
+
+    [Fact]
+    public async Task GetEvents_WithMalformedJson_ReturnsUnknownDefaults()
+    {
+        AddSearchEvent(data: "not valid json {{{");
+
+        var result = await _controller.GetEvents();
+        var body = GetResponseBody(result);
+
+        var item = body.GetProperty("Items")[0];
+        item.GetProperty("InstanceName").GetString().ShouldBe("Unknown");
+        item.GetProperty("ItemCount").GetInt32().ShouldBe(0);
+    }
+
+    [Fact]
+    public async Task GetEvents_WithSearchTypeReplacement_ParsesCorrectEnum()
+    {
+        var data = JsonSerializer.Serialize(new
+        {
+            InstanceName = "Sonarr",
+            SearchType = "Replacement"
+        });
+        AddSearchEvent(data: data);
+
+        var result = await _controller.GetEvents();
+        var body = GetResponseBody(result);
+
+        var item = body.GetProperty("Items")[0];
+        item.GetProperty("SearchType").GetString().ShouldBe(nameof(SeekerSearchType.Replacement));
+    }
+
+    #endregion
+
+    #region GetEvents Filtering
+
+    [Fact]
+    public async Task GetEvents_WithInstanceIdFilter_FiltersViaInstanceUrl()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        var sonarr = SeekerTestDataFactory.AddSonarrInstance(_dataContext);
+
+        // Event matching radarr's URL
+        AddSearchEvent(instanceUrl: radarr.Url.ToString(), instanceType: InstanceType.Radarr,
+            data: JsonSerializer.Serialize(new { InstanceName = "Radarr Event" }));
+        // Event matching sonarr's URL
+        AddSearchEvent(instanceUrl: sonarr.Url.ToString(), instanceType: InstanceType.Sonarr,
+            data: JsonSerializer.Serialize(new { InstanceName = "Sonarr Event" }));
+
+        var result = await _controller.GetEvents(instanceId: radarr.Id);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(1);
+        body.GetProperty("Items")[0].GetProperty("InstanceName").GetString().ShouldBe("Radarr Event");
+    }
+
+    [Fact]
+    public async Task GetEvents_WithCycleIdFilter_ReturnsOnlyMatchingCycle()
+    {
+        var cycleA = Guid.NewGuid();
+        var cycleB = Guid.NewGuid();
+
+        AddSearchEvent(cycleId: cycleA, data: JsonSerializer.Serialize(new { InstanceName = "Cycle A" }));
+        AddSearchEvent(cycleId: cycleB, data: JsonSerializer.Serialize(new { InstanceName = "Cycle B" }));
+
+        var result = await _controller.GetEvents(cycleId: cycleA);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(1);
+        body.GetProperty("Items")[0].GetProperty("InstanceName").GetString().ShouldBe("Cycle A");
+    }
+
+    [Fact]
+    public async Task GetEvents_WithSearchFilter_FiltersOnDataField()
+    {
+        AddSearchEvent(data: JsonSerializer.Serialize(new { InstanceName = "Radarr", Items = new[] { "The Matrix" } }));
+        AddSearchEvent(data: JsonSerializer.Serialize(new { InstanceName = "Sonarr", Items = new[] { "Breaking Bad" } }));
+
+        var result = await _controller.GetEvents(search: "matrix");
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task GetEvents_WithPagination_ReturnsCorrectPageAndCount()
+    {
+        for (int i = 0; i < 5; i++)
+        {
+            AddSearchEvent(data: JsonSerializer.Serialize(new { InstanceName = $"Event {i}" }));
+        }
+
+        var result = await _controller.GetEvents(page: 2, pageSize: 2);
+        var body = GetResponseBody(result);
+
+        body.GetProperty("TotalCount").GetInt32().ShouldBe(5);
+        body.GetProperty("TotalPages").GetInt32().ShouldBe(3); // ceil(5/2) = 3
+        body.GetProperty("Page").GetInt32().ShouldBe(2);
+        body.GetProperty("Items").GetArrayLength().ShouldBe(2);
+    }
+
+    #endregion
+
+    #region Helpers
+
+    private void AddSearchEvent(
+        string? data = null,
+        string? instanceUrl = null,
+        InstanceType? instanceType = null,
+        Guid? cycleId = null,
+        SearchCommandStatus? searchStatus = null)
+    {
+        _eventsContext.Events.Add(new AppEvent
+        {
+            EventType = EventType.SearchTriggered,
+            Message = "Search triggered",
+            Severity = EventSeverity.Information,
+            Data = data,
+            InstanceUrl = instanceUrl,
+            InstanceType = instanceType,
+            CycleId = cycleId,
+            SearchStatus = searchStatus,
+            Timestamp = DateTime.UtcNow
+        });
+        _eventsContext.SaveChanges();
+    }
+
+    #endregion
+}

code/backend/Cleanuparr.Api.Tests/Features/Seeker/SeekerConfigControllerTests.cs

@@ -0,0 +1,324 @@
+using Cleanuparr.Api.Features.Seeker.Contracts.Requests;
+using Cleanuparr.Api.Features.Seeker.Contracts.Responses;
+using Cleanuparr.Api.Features.Seeker.Controllers;
+using Cleanuparr.Api.Tests.Features.Seeker.TestHelpers;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Services.Interfaces;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Configuration.Seeker;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Logging;
+using NSubstitute;
+using Shouldly;
+using ValidationException = Cleanuparr.Domain.Exceptions.ValidationException;
+
+namespace Cleanuparr.Api.Tests.Features.Seeker;
+
+public class SeekerConfigControllerTests : IDisposable
+{
+    private readonly DataContext _dataContext;
+    private readonly ILogger<SeekerConfigController> _logger;
+    private readonly IJobManagementService _jobManagementService;
+    private readonly SeekerConfigController _controller;
+
+    public SeekerConfigControllerTests()
+    {
+        _dataContext = SeekerTestDataFactory.CreateDataContext();
+        _logger = Substitute.For<ILogger<SeekerConfigController>>();
+        _jobManagementService = Substitute.For<IJobManagementService>();
+        _controller = new SeekerConfigController(_logger, _dataContext, _jobManagementService);
+    }
+
+    public void Dispose()
+    {
+        _dataContext.Dispose();
+        GC.SuppressFinalize(this);
+    }
+
+    #region GetSeekerConfig Tests
+
+    [Fact]
+    public async Task GetSeekerConfig_WithNoSeekerInstanceConfigs_ReturnsDefaults()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+
+        var result = await _controller.GetSeekerConfig();
+        var okResult = result.ShouldBeOfType<OkObjectResult>();
+        var response = okResult.Value.ShouldBeOfType<SeekerConfigResponse>();
+
+        var instance = response.Instances.ShouldHaveSingleItem();
+        instance.ArrInstanceId.ShouldBe(radarr.Id);
+        instance.Enabled.ShouldBeFalse();
+        instance.SkipTags.ShouldBeEmpty();
+        instance.ActiveDownloadLimit.ShouldBe(3);
+        instance.MinCycleTimeDays.ShouldBe(7);
+    }
+
+    [Fact]
+    public async Task GetSeekerConfig_OnlyReturnsSonarrAndRadarrInstances()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        var sonarr = SeekerTestDataFactory.AddSonarrInstance(_dataContext);
+        var lidarr = SeekerTestDataFactory.AddLidarrInstance(_dataContext);
+
+        var result = await _controller.GetSeekerConfig();
+        var okResult = result.ShouldBeOfType<OkObjectResult>();
+        var response = okResult.Value.ShouldBeOfType<SeekerConfigResponse>();
+
+        response.Instances.Count.ShouldBe(2);
+        response.Instances.ShouldContain(i => i.ArrInstanceId == radarr.Id);
+        response.Instances.ShouldContain(i => i.ArrInstanceId == sonarr.Id);
+        response.Instances.ShouldNotContain(i => i.ArrInstanceId == lidarr.Id);
+    }
+
+    #endregion
+
+    #region UpdateSeekerConfig Tests
+
+    [Fact]
+    public async Task UpdateSeekerConfig_WithProactiveEnabledAndNoInstancesEnabled_ThrowsValidationException()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        var request = new UpdateSeekerConfigRequest
+        {
+            SearchEnabled = true,
+            SearchInterval = 5,
+            ProactiveSearchEnabled = true,
+            Instances =
+            [
+                new UpdateSeekerInstanceConfigRequest
+                {
+                    ArrInstanceId = radarr.Id,
+                    Enabled = false // No instances enabled
+                }
+            ]
+        };
+
+        await Should.ThrowAsync<ValidationException>(() => _controller.UpdateSeekerConfig(request));
+    }
+
+    [Fact]
+    public async Task UpdateSeekerConfig_WhenIntervalChanges_ReschedulesSeeker()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        _dataContext.SeekerInstanceConfigs.Add(new SeekerInstanceConfig
+        {
+            ArrInstanceId = radarr.Id,
+            Enabled = true
+        });
+        await _dataContext.SaveChangesAsync();
+
+        // Default interval is 3, change to 5
+        var request = new UpdateSeekerConfigRequest
+        {
+            SearchEnabled = true,
+            SearchInterval = 5,
+            ProactiveSearchEnabled = true,
+            Instances =
+            [
+                new UpdateSeekerInstanceConfigRequest { ArrInstanceId = radarr.Id, Enabled = true }
+            ]
+        };
+
+        await _controller.UpdateSeekerConfig(request);
+
+        await _jobManagementService.Received(1)
+            .StartJob(JobType.Seeker, null, Arg.Any<string>());
+    }
+
+    [Fact]
+    public async Task UpdateSeekerConfig_WhenIntervalUnchanged_DoesNotReschedule()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        _dataContext.SeekerInstanceConfigs.Add(new SeekerInstanceConfig
+        {
+            ArrInstanceId = radarr.Id,
+            Enabled = true
+        });
+        await _dataContext.SaveChangesAsync();
+
+        // Keep interval at default (3)
+        var request = new UpdateSeekerConfigRequest
+        {
+            SearchEnabled = true,
+            SearchInterval = 3,
+            ProactiveSearchEnabled = true,
+            Instances =
+            [
+                new UpdateSeekerInstanceConfigRequest { ArrInstanceId = radarr.Id, Enabled = true }
+            ]
+        };
+
+        await _controller.UpdateSeekerConfig(request);
+
+        await _jobManagementService.DidNotReceive()
+            .StartJob(Arg.Any<JobType>(), null, Arg.Any<string>());
+    }
+
+    [Fact]
+    public async Task UpdateSeekerConfig_WhenCustomFormatScoreEnabled_StartsAndTriggersSyncerJob()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        _dataContext.SeekerInstanceConfigs.Add(new SeekerInstanceConfig
+        {
+            ArrInstanceId = radarr.Id,
+            Enabled = true
+        });
+        await _dataContext.SaveChangesAsync();
+
+        // UseCustomFormatScore was false (default), now enable it
+        var request = new UpdateSeekerConfigRequest
+        {
+            SearchEnabled = true,
+            SearchInterval = 3,
+            ProactiveSearchEnabled = true,
+            UseCustomFormatScore = true,
+            Instances =
+            [
+                new UpdateSeekerInstanceConfigRequest { ArrInstanceId = radarr.Id, Enabled = true }
+            ]
+        };
+
+        await _controller.UpdateSeekerConfig(request);
+
+        await _jobManagementService.Received(1)
+            .StartJob(JobType.CustomFormatScoreSyncer, null, Arg.Any<string>());
+        await _jobManagementService.Received(1)
+            .TriggerJobOnce(JobType.CustomFormatScoreSyncer);
+    }
+
+    [Fact]
+    public async Task UpdateSeekerConfig_WhenCustomFormatScoreDisabled_StopsSyncerJob()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        _dataContext.SeekerInstanceConfigs.Add(new SeekerInstanceConfig
+        {
+            ArrInstanceId = radarr.Id,
+            Enabled = true
+        });
+        await _dataContext.SaveChangesAsync();
+
+        // First enable CF score
+        var config = await _dataContext.SeekerConfigs.FirstAsync();
+        config.UseCustomFormatScore = true;
+        await _dataContext.SaveChangesAsync();
+
+        // Now disable it
+        var request = new UpdateSeekerConfigRequest
+        {
+            SearchEnabled = true,
+            SearchInterval = 3,
+            ProactiveSearchEnabled = true,
+            UseCustomFormatScore = false,
+            Instances =
+            [
+                new UpdateSeekerInstanceConfigRequest { ArrInstanceId = radarr.Id, Enabled = true }
+            ]
+        };
+
+        await _controller.UpdateSeekerConfig(request);
+
+        await _jobManagementService.Received(1)
+            .StopJob(JobType.CustomFormatScoreSyncer);
+    }
+
+    [Fact]
+    public async Task UpdateSeekerConfig_WhenSearchReenabledWithCustomFormatActive_TriggersSyncerOnce()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        _dataContext.SeekerInstanceConfigs.Add(new SeekerInstanceConfig
+        {
+            ArrInstanceId = radarr.Id,
+            Enabled = true
+        });
+        await _dataContext.SaveChangesAsync();
+
+        // Set up state: CF score already enabled, search currently disabled
+        var config = await _dataContext.SeekerConfigs.FirstAsync();
+        config.UseCustomFormatScore = true;
+        config.SearchEnabled = false;
+        await _dataContext.SaveChangesAsync();
+
+        // Re-enable search
+        var request = new UpdateSeekerConfigRequest
+        {
+            SearchEnabled = true,
+            SearchInterval = 3,
+            ProactiveSearchEnabled = false,
+            UseCustomFormatScore = true,
+            Instances =
+            [
+                new UpdateSeekerInstanceConfigRequest { ArrInstanceId = radarr.Id, Enabled = true }
+            ]
+        };
+
+        await _controller.UpdateSeekerConfig(request);
+
+        await _jobManagementService.Received(1)
+            .TriggerJobOnce(JobType.CustomFormatScoreSyncer);
+    }
+
+    [Fact]
+    public async Task UpdateSeekerConfig_SyncsExistingAndCreatesNewInstanceConfigs()
+    {
+        var radarr = SeekerTestDataFactory.AddRadarrInstance(_dataContext);
+        var sonarr = SeekerTestDataFactory.AddSonarrInstance(_dataContext);
+
+        // Radarr already has a config
+        _dataContext.SeekerInstanceConfigs.Add(new SeekerInstanceConfig
+        {
+            ArrInstanceId = radarr.Id,
+            Enabled = false,
+            SkipTags = ["old-tag"],
+            ActiveDownloadLimit = 2,
+            MinCycleTimeDays = 5
+        });
+        await _dataContext.SaveChangesAsync();
+
+        var request = new UpdateSeekerConfigRequest
+        {
+            SearchEnabled = true,
+            SearchInterval = 3,
+            ProactiveSearchEnabled = true,
+            Instances =
+            [
+                // Update existing radarr config
+                new UpdateSeekerInstanceConfigRequest
+                {
+                    ArrInstanceId = radarr.Id,
+                    Enabled = true,
+                    SkipTags = ["new-tag"],
+                    ActiveDownloadLimit = 5,
+                    MinCycleTimeDays = 14
+                },
+                // Create new sonarr config
+                new UpdateSeekerInstanceConfigRequest
+                {
+                    ArrInstanceId = sonarr.Id,
+                    Enabled = true,
+                    SkipTags = ["sonarr-tag"],
+                    ActiveDownloadLimit = 3,
+                    MinCycleTimeDays = 7
+                }
+            ]
+        };
+
+        await _controller.UpdateSeekerConfig(request);
+
+        var configs = await _dataContext.SeekerInstanceConfigs.ToListAsync();
+        configs.Count.ShouldBe(2);
+
+        var radarrConfig = configs.First(c => c.ArrInstanceId == radarr.Id);
+        radarrConfig.Enabled.ShouldBeTrue();
+        radarrConfig.SkipTags.ShouldContain("new-tag");
+        radarrConfig.ActiveDownloadLimit.ShouldBe(5);
+        radarrConfig.MinCycleTimeDays.ShouldBe(14);
+
+        var sonarrConfig = configs.First(c => c.ArrInstanceId == sonarr.Id);
+        sonarrConfig.Enabled.ShouldBeTrue();
+        sonarrConfig.SkipTags.ShouldContain("sonarr-tag");
+    }
+
+    #endregion
+}

code/backend/Cleanuparr.Api.Tests/Features/Seeker/TestHelpers/SeekerTestDataFactory.cs

@@ -0,0 +1,166 @@
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Configuration;
+using Cleanuparr.Persistence.Models.Configuration.Arr;
+using Cleanuparr.Persistence.Models.Configuration.DownloadCleaner;
+using Cleanuparr.Persistence.Models.Configuration.General;
+using Cleanuparr.Persistence.Models.Configuration.MalwareBlocker;
+using Cleanuparr.Persistence.Models.Configuration.QueueCleaner;
+using Cleanuparr.Persistence.Models.Configuration.Seeker;
+using Microsoft.Data.Sqlite;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Api.Tests.Features.Seeker.TestHelpers;
+
+/// <summary>
+/// Factory for creating SQLite in-memory contexts for Seeker controller tests
+/// </summary>
+public static class SeekerTestDataFactory
+{
+    public static DataContext CreateDataContext()
+    {
+        var connection = new SqliteConnection("DataSource=:memory:");
+        connection.Open();
+
+        var options = new DbContextOptionsBuilder<DataContext>()
+            .UseSqlite(connection)
+            .Options;
+
+        var context = new DataContext(options);
+        context.Database.EnsureCreated();
+
+        SeedDefaultData(context);
+        return context;
+    }
+
+    public static EventsContext CreateEventsContext()
+    {
+        var connection = new SqliteConnection("DataSource=:memory:");
+        connection.Open();
+
+        var options = new DbContextOptionsBuilder<EventsContext>()
+            .UseSqlite(connection)
+            .Options;
+
+        var context = new EventsContext(options);
+        context.Database.EnsureCreated();
+        return context;
+    }
+
+    private static void SeedDefaultData(DataContext context)
+    {
+        context.GeneralConfigs.Add(new GeneralConfig
+        {
+            Id = Guid.NewGuid(),
+            DryRun = false,
+            IgnoredDownloads = [],
+            Log = new LoggingConfig()
+        });
+
+        context.ArrConfigs.AddRange(
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.Sonarr, Instances = [], FailedImportMaxStrikes = 3 },
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.Radarr, Instances = [], FailedImportMaxStrikes = 3 },
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.Lidarr, Instances = [], FailedImportMaxStrikes = 3 },
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.Readarr, Instances = [], FailedImportMaxStrikes = 3 },
+            new ArrConfig { Id = Guid.NewGuid(), Type = InstanceType.Whisparr, Instances = [], FailedImportMaxStrikes = 3 }
+        );
+
+        context.QueueCleanerConfigs.Add(new QueueCleanerConfig
+        {
+            Id = Guid.NewGuid(),
+            IgnoredDownloads = [],
+            FailedImport = new FailedImportConfig()
+        });
+
+        context.ContentBlockerConfigs.Add(new ContentBlockerConfig
+        {
+            Id = Guid.NewGuid(),
+            IgnoredDownloads = [],
+            DeletePrivate = false,
+            Sonarr = new BlocklistSettings { Enabled = false },
+            Radarr = new BlocklistSettings { Enabled = false },
+            Lidarr = new BlocklistSettings { Enabled = false },
+            Readarr = new BlocklistSettings { Enabled = false },
+            Whisparr = new BlocklistSettings { Enabled = false }
+        });
+
+        context.DownloadCleanerConfigs.Add(new DownloadCleanerConfig
+        {
+            Id = Guid.NewGuid(),
+            IgnoredDownloads = [],
+            Categories = [],
+            UnlinkedEnabled = false,
+            UnlinkedTargetCategory = "",
+            UnlinkedCategories = []
+        });
+
+        context.SeekerConfigs.Add(new SeekerConfig
+        {
+            Id = Guid.NewGuid(),
+            SearchEnabled = true,
+            ProactiveSearchEnabled = false
+        });
+
+        context.SaveChanges();
+    }
+
+    public static ArrInstance AddSonarrInstance(DataContext context, bool enabled = true)
+    {
+        var arrConfig = context.ArrConfigs.First(x => x.Type == InstanceType.Sonarr);
+        var instance = new ArrInstance
+        {
+            Id = Guid.NewGuid(),
+            Name = "Test Sonarr",
+            Url = new Uri("http://sonarr:8989"),
+            ApiKey = "test-api-key",
+            Enabled = enabled,
+            ArrConfigId = arrConfig.Id,
+            ArrConfig = arrConfig
+        };
+
+        arrConfig.Instances.Add(instance);
+        context.ArrInstances.Add(instance);
+        context.SaveChanges();
+        return instance;
+    }
+
+    public static ArrInstance AddRadarrInstance(DataContext context, bool enabled = true)
+    {
+        var arrConfig = context.ArrConfigs.First(x => x.Type == InstanceType.Radarr);
+        var instance = new ArrInstance
+        {
+            Id = Guid.NewGuid(),
+            Name = "Test Radarr",
+            Url = new Uri("http://radarr:7878"),
+            ApiKey = "test-api-key",
+            Enabled = enabled,
+            ArrConfigId = arrConfig.Id,
+            ArrConfig = arrConfig
+        };
+
+        arrConfig.Instances.Add(instance);
+        context.ArrInstances.Add(instance);
+        context.SaveChanges();
+        return instance;
+    }
+
+    public static ArrInstance AddLidarrInstance(DataContext context, bool enabled = true)
+    {
+        var arrConfig = context.ArrConfigs.First(x => x.Type == InstanceType.Lidarr);
+        var instance = new ArrInstance
+        {
+            Id = Guid.NewGuid(),
+            Name = "Test Lidarr",
+            Url = new Uri("http://lidarr:8686"),
+            ApiKey = "test-api-key",
+            Enabled = enabled,
+            ArrConfigId = arrConfig.Id,
+            ArrConfig = arrConfig
+        };
+
+        arrConfig.Instances.Add(instance);
+        context.ArrInstances.Add(instance);
+        context.SaveChanges();
+        return instance;
+    }
+}

code/backend/Cleanuparr.Api.Tests/Features/SensitiveData/SensitiveDataHelperTests.cs

@@ -0,0 +1,78 @@
+using Cleanuparr.Shared.Helpers;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features.SensitiveData;
+
+public class SensitiveDataHelperTests
+{
+    [Fact]
+    public void IsPlaceholder_WithPlaceholder_ReturnsTrue()
+    {
+        SensitiveDataHelper.Placeholder.IsPlaceholder().ShouldBeTrue();
+    }
+
+    [Fact]
+    public void IsPlaceholder_WithAppriseStyledPlaceholder_ReturnsTrue()
+    {
+        $"discord://{SensitiveDataHelper.Placeholder}".IsPlaceholder().ShouldBeTrue();
+    }
+
+    [Fact]
+    public void IsPlaceholder_WithNull_ReturnsFalse()
+    {
+        ((string?)null).IsPlaceholder().ShouldBeFalse();
+    }
+
+    [Fact]
+    public void IsPlaceholder_WithEmptyString_ReturnsFalse()
+    {
+        "".IsPlaceholder().ShouldBeFalse();
+    }
+
+    [Fact]
+    public void IsPlaceholder_WithRealValue_ReturnsFalse()
+    {
+        "my-secret-api-key-123".IsPlaceholder().ShouldBeFalse();
+    }
+
+    [Theory]
+    [InlineData("discord://webhook_id/webhook_token", "discord://••••••••")]
+    [InlineData("slack://tokenA/tokenB/tokenC", "slack://••••••••")]
+    [InlineData("mailto://user:pass@gmail.com", "mailto://••••••••")]
+    [InlineData("json+http://user:pass@host/path", "json+http://••••••••")]
+    public void MaskAppriseUrls_SingleUrl_MasksCorrectly(string input, string expected)
+    {
+        SensitiveDataHelper.MaskAppriseUrls(input).ShouldBe(expected);
+    }
+
+    [Fact]
+    public void MaskAppriseUrls_MultipleUrls_MasksAll()
+    {
+        var input = "discord://token1 slack://tokenA/tokenB";
+        var result = SensitiveDataHelper.MaskAppriseUrls(input);
+
+        result.ShouldContain("discord://••••••••");
+        result.ShouldContain("slack://••••••••");
+        result.ShouldNotContain("token1");
+        result.ShouldNotContain("tokenA");
+    }
+
+    [Fact]
+    public void MaskAppriseUrls_MultilineUrls_MasksAll()
+    {
+        var input = "discord://token1\nslack://tokenA/tokenB";
+        var result = SensitiveDataHelper.MaskAppriseUrls(input);
+
+        result.ShouldContain("discord://••••••••");
+        result.ShouldContain("slack://••••••••");
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    public void MaskAppriseUrls_EmptyOrNull_ReturnsAsIs(string? input)
+    {
+        SensitiveDataHelper.MaskAppriseUrls(input).ShouldBe(input);
+    }
+}

code/backend/Cleanuparr.Api.Tests/Features/SensitiveData/SensitiveDataInputTests.cs

@@ -0,0 +1,381 @@
+using Cleanuparr.Api.Features.Arr.Contracts.Requests;
+using Cleanuparr.Api.Features.DownloadClient.Contracts.Requests;
+using Cleanuparr.Api.Features.Auth.Contracts.Requests;
+using Cleanuparr.Api.Features.General.Contracts.Requests;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Persistence.Models.Auth;
+using Cleanuparr.Persistence.Models.Configuration.Arr;
+using Cleanuparr.Persistence.Models.Configuration;
+using Cleanuparr.Shared.Helpers;
+using Shouldly;
+using ValidationException = Cleanuparr.Domain.Exceptions.ValidationException;
+
+namespace Cleanuparr.Api.Tests.Features.SensitiveData;
+
+/// <summary>
+/// Tests that placeholder values are correctly handled on the input side:
+/// - UPDATE operations preserve the existing DB value when a placeholder is sent
+/// - CREATE operations reject placeholder values
+/// - TEST operations reject placeholder values
+/// </summary>
+public class SensitiveDataInputTests
+{
+    private const string Placeholder = SensitiveDataHelper.Placeholder;
+
+    #region ArrInstanceRequest — UPDATE
+
+    [Fact]
+    public void ArrInstanceRequest_ApplyTo_WithPlaceholderApiKey_PreservesExistingValue()
+    {
+        var request = new ArrInstanceRequest
+        {
+            Name = "Updated Sonarr",
+            Url = "http://sonarr:8989",
+            ApiKey = Placeholder,
+            Version = 4,
+        };
+
+        var existingInstance = new ArrInstance
+        {
+            Name = "Sonarr",
+            Url = new Uri("http://sonarr:8989"),
+            ApiKey = "original-secret-key",
+            ArrConfigId = Guid.NewGuid(),
+            Version = 4,
+        };
+
+        request.ApplyTo(existingInstance);
+
+        existingInstance.ApiKey.ShouldBe("original-secret-key");
+        existingInstance.Name.ShouldBe("Updated Sonarr");
+    }
+
+    [Fact]
+    public void ArrInstanceRequest_ApplyTo_WithRealApiKey_UpdatesValue()
+    {
+        var request = new ArrInstanceRequest
+        {
+            Name = "Sonarr",
+            Url = "http://sonarr:8989",
+            ApiKey = "brand-new-api-key",
+            Version = 4,
+        };
+
+        var existingInstance = new ArrInstance
+        {
+            Name = "Sonarr",
+            Url = new Uri("http://sonarr:8989"),
+            ApiKey = "original-secret-key",
+            ArrConfigId = Guid.NewGuid(),
+            Version = 4,
+        };
+
+        request.ApplyTo(existingInstance);
+
+        existingInstance.ApiKey.ShouldBe("brand-new-api-key");
+    }
+
+    #endregion
+
+    #region ArrInstanceRequest — CREATE
+
+    [Fact]
+    public void ArrInstanceRequest_ToEntity_WithPlaceholderApiKey_ThrowsValidationException()
+    {
+        var request = new ArrInstanceRequest
+        {
+            Name = "Sonarr",
+            Url = "http://sonarr:8989",
+            ApiKey = Placeholder,
+            Version = 4,
+        };
+
+        Should.Throw<ValidationException>(() => request.ToEntity(Guid.NewGuid()));
+    }
+
+    [Fact]
+    public void ArrInstanceRequest_ToEntity_WithRealApiKey_Succeeds()
+    {
+        var request = new ArrInstanceRequest
+        {
+            Name = "Sonarr",
+            Url = "http://sonarr:8989",
+            ApiKey = "real-api-key-123",
+            Version = 4,
+        };
+
+        var entity = request.ToEntity(Guid.NewGuid());
+        entity.ApiKey.ShouldBe("real-api-key-123");
+    }
+
+    #endregion
+
+    #region TestArrInstanceRequest — TEST
+
+    [Fact]
+    public void TestArrInstanceRequest_ToTestInstance_WithPlaceholderApiKey_AndNoResolvedKey_ThrowsValidationException()
+    {
+        var request = new TestArrInstanceRequest
+        {
+            Url = "http://sonarr:8989",
+            ApiKey = Placeholder,
+            Version = 4,
+        };
+
+        Should.Throw<ValidationException>(() => request.ToTestInstance());
+    }
+
+    [Fact]
+    public void TestArrInstanceRequest_ToTestInstance_WithPlaceholderApiKey_AndResolvedKey_UsesResolvedKey()
+    {
+        var request = new TestArrInstanceRequest
+        {
+            Url = "http://sonarr:8989",
+            ApiKey = Placeholder,
+            Version = 4,
+            InstanceId = Guid.NewGuid(),
+        };
+
+        var instance = request.ToTestInstance("resolved-api-key-from-db");
+        instance.ApiKey.ShouldBe("resolved-api-key-from-db");
+    }
+
+    [Fact]
+    public void TestArrInstanceRequest_ToTestInstance_WithRealApiKey_Succeeds()
+    {
+        var request = new TestArrInstanceRequest
+        {
+            Url = "http://sonarr:8989",
+            ApiKey = "real-api-key",
+            Version = 4,
+        };
+
+        var instance = request.ToTestInstance();
+        instance.ApiKey.ShouldBe("real-api-key");
+    }
+
+    #endregion
+
+    #region UpdateDownloadClientRequest — UPDATE
+
+    [Fact]
+    public void UpdateDownloadClientRequest_ApplyTo_WithPlaceholderPassword_PreservesExistingValue()
+    {
+        var request = new UpdateDownloadClientRequest
+        {
+            Name = "Updated qBit",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Username = "admin",
+            Password = Placeholder,
+        };
+
+        var existing = new DownloadClientConfig
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = new Uri("http://qbit:8080"),
+            Username = "admin",
+            Password = "original-secret-password",
+        };
+
+        var result = request.ApplyTo(existing);
+
+        result.Password.ShouldBe("original-secret-password");
+        result.Name.ShouldBe("Updated qBit");
+    }
+
+    [Fact]
+    public void UpdateDownloadClientRequest_ApplyTo_WithRealPassword_UpdatesValue()
+    {
+        var request = new UpdateDownloadClientRequest
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Username = "admin",
+            Password = "new-password-123",
+        };
+
+        var existing = new DownloadClientConfig
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = new Uri("http://qbit:8080"),
+            Username = "admin",
+            Password = "original-secret-password",
+        };
+
+        var result = request.ApplyTo(existing);
+
+        result.Password.ShouldBe("new-password-123");
+    }
+
+    #endregion
+
+    #region CreateDownloadClientRequest — CREATE
+
+    [Fact]
+    public void CreateDownloadClientRequest_Validate_WithPlaceholderPassword_ThrowsValidationException()
+    {
+        var request = new CreateDownloadClientRequest
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Password = Placeholder,
+        };
+
+        Should.Throw<ValidationException>(() => request.Validate());
+    }
+
+    [Fact]
+    public void CreateDownloadClientRequest_Validate_WithRealPassword_Succeeds()
+    {
+        var request = new CreateDownloadClientRequest
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Password = "real-password",
+        };
+
+        Should.NotThrow(() => request.Validate());
+    }
+
+    [Fact]
+    public void CreateDownloadClientRequest_Validate_WithNullPassword_Succeeds()
+    {
+        var request = new CreateDownloadClientRequest
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Password = null,
+        };
+
+        Should.NotThrow(() => request.Validate());
+    }
+
+    #endregion
+
+    #region TestDownloadClientRequest — TEST
+
+    [Fact]
+    public void TestDownloadClientRequest_ToTestConfig_WithPlaceholderPassword_AndNoResolvedPassword_ThrowsValidationException()
+    {
+        var request = new TestDownloadClientRequest
+        {
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Password = Placeholder,
+        };
+
+        request.Validate();
+        Should.Throw<ValidationException>(() => request.ToTestConfig());
+    }
+
+    [Fact]
+    public void TestDownloadClientRequest_ToTestConfig_WithPlaceholderPassword_AndResolvedPassword_UsesResolvedPassword()
+    {
+        var request = new TestDownloadClientRequest
+        {
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Password = Placeholder,
+            ClientId = Guid.NewGuid(),
+        };
+
+        request.Validate();
+        var config = request.ToTestConfig("resolved-password-from-db");
+        config.Password.ShouldBe("resolved-password-from-db");
+    }
+
+    [Fact]
+    public void TestDownloadClientRequest_ToTestConfig_WithRealPassword_Succeeds()
+    {
+        var request = new TestDownloadClientRequest
+        {
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Password = "real-password",
+        };
+
+        request.Validate();
+        var config = request.ToTestConfig();
+        config.Password.ShouldBe("real-password");
+    }
+
+    #endregion
+
+    #region UpdateOidcConfigRequest — UPDATE
+
+    [Fact]
+    public void UpdateOidcConfigRequest_ApplyTo_WithPlaceholderClientSecret_PreservesExistingValue()
+    {
+        var request = new UpdateOidcConfigRequest
+        {
+            Enabled = true,
+            IssuerUrl = "http://localhost:8080/realms/test",
+            ClientId = "cleanuparr",
+            ClientSecret = Placeholder,
+            Scopes = "openid profile email",
+            ProviderName = "Keycloak",
+        };
+
+        var existingConfig = new OidcConfig
+        {
+            Enabled = true,
+            IssuerUrl = "http://localhost:8080/realms/test",
+            ClientId = "cleanuparr",
+            ClientSecret = "original-secret",
+            Scopes = "openid profile email",
+            ProviderName = "OIDC",
+        };
+
+        request.ApplyTo(existingConfig);
+
+        existingConfig.ClientSecret.ShouldBe("original-secret");
+        existingConfig.ProviderName.ShouldBe("Keycloak");
+    }
+
+    [Fact]
+    public void UpdateOidcConfigRequest_ApplyTo_WithRealClientSecret_UpdatesValue()
+    {
+        var request = new UpdateOidcConfigRequest
+        {
+            Enabled = true,
+            IssuerUrl = "http://localhost:8080/realms/test",
+            ClientId = "cleanuparr",
+            ClientSecret = "brand-new-secret",
+            Scopes = "openid profile email",
+            ProviderName = "Keycloak",
+        };
+
+        var existingConfig = new OidcConfig
+        {
+            Enabled = true,
+            IssuerUrl = "http://localhost:8080/realms/test",
+            ClientId = "cleanuparr",
+            ClientSecret = "original-secret",
+            Scopes = "openid profile email",
+            ProviderName = "OIDC",
+        };
+
+        request.ApplyTo(existingConfig);
+
+        existingConfig.ClientSecret.ShouldBe("brand-new-secret");
+    }
+
+    #endregion
+}

code/backend/Cleanuparr.Api.Tests/Features/SensitiveData/SensitiveDataResolverTests.cs

@@ -0,0 +1,461 @@
+using System.Text.Json;
+using System.Text.Json.Serialization.Metadata;
+using Cleanuparr.Api.Json;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Features.Arr.Dtos;
+using Cleanuparr.Persistence.Models.Configuration;
+using Cleanuparr.Persistence.Models.Configuration.Arr;
+using Cleanuparr.Persistence.Models.Configuration.Notification;
+using Cleanuparr.Shared.Helpers;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features.SensitiveData;
+
+/// <summary>
+/// Tests that the SensitiveDataResolver correctly masks all [SensitiveData] properties
+/// during JSON serialization — this is what controls the API response output.
+/// </summary>
+public class SensitiveDataResolverTests
+{
+    private readonly JsonSerializerOptions _options;
+    private const string Placeholder = SensitiveDataHelper.Placeholder;
+
+    public SensitiveDataResolverTests()
+    {
+        _options = new JsonSerializerOptions
+        {
+            TypeInfoResolver = new SensitiveDataResolver(new DefaultJsonTypeInfoResolver()),
+            PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
+        };
+    }
+
+    #region ArrInstance
+
+    [Fact]
+    public void ArrInstance_ApiKey_IsMasked()
+    {
+        var instance = new ArrInstance
+        {
+            Name = "Sonarr",
+            Url = new Uri("http://sonarr:8989"),
+            ApiKey = "super-secret-api-key-12345",
+            ArrConfigId = Guid.NewGuid(),
+            Version = 4
+        };
+
+        var json = JsonSerializer.Serialize(instance, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("apiKey").GetString().ShouldBe(Placeholder);
+    }
+
+    [Fact]
+    public void ArrInstance_NonSensitiveFields_AreVisible()
+    {
+        var instance = new ArrInstance
+        {
+            Name = "Sonarr",
+            Url = new Uri("http://sonarr:8989"),
+            ExternalUrl = new Uri("https://sonarr.example.com"),
+            ApiKey = "super-secret-api-key-12345",
+            ArrConfigId = Guid.NewGuid(),
+            Version = 4
+        };
+
+        var json = JsonSerializer.Serialize(instance, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("name").GetString().ShouldBe("Sonarr");
+        doc.RootElement.GetProperty("url").GetString().ShouldBe("http://sonarr:8989");
+        doc.RootElement.GetProperty("externalUrl").GetString().ShouldBe("https://sonarr.example.com");
+    }
+
+    [Fact]
+    public void ArrInstance_NullApiKey_RemainsNull()
+    {
+        // ApiKey is required, but let's test with the DTO which might handle null
+        var dto = new ArrInstanceDto
+        {
+            Name = "Sonarr",
+            Url = "http://sonarr:8989",
+            ApiKey = null!,
+            Version = 4
+        };
+
+        var json = JsonSerializer.Serialize(dto, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("apiKey").ValueKind.ShouldBe(JsonValueKind.Null);
+    }
+
+    #endregion
+
+    #region ArrInstanceDto
+
+    [Fact]
+    public void ArrInstanceDto_ApiKey_IsMasked()
+    {
+        var dto = new ArrInstanceDto
+        {
+            Id = Guid.NewGuid(),
+            Name = "Radarr",
+            Url = "http://radarr:7878",
+            ApiKey = "dto-secret-api-key-67890",
+            Version = 5
+        };
+
+        var json = JsonSerializer.Serialize(dto, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("apiKey").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("name").GetString().ShouldBe("Radarr");
+        doc.RootElement.GetProperty("url").GetString().ShouldBe("http://radarr:7878");
+    }
+
+    #endregion
+
+    #region DownloadClientConfig
+
+    [Fact]
+    public void DownloadClientConfig_Password_IsMasked()
+    {
+        var config = new DownloadClientConfig
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = new Uri("http://qbit:8080"),
+            Username = "admin",
+            Password = "my-secret-password",
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("password").GetString().ShouldBe(Placeholder);
+    }
+
+    [Fact]
+    public void DownloadClientConfig_Username_IsVisible()
+    {
+        var config = new DownloadClientConfig
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = new Uri("http://qbit:8080"),
+            Username = "admin",
+            Password = "my-secret-password",
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("username").GetString().ShouldBe("admin");
+        doc.RootElement.GetProperty("name").GetString().ShouldBe("qBittorrent");
+    }
+
+    [Fact]
+    public void DownloadClientConfig_NullPassword_RemainsNull()
+    {
+        var config = new DownloadClientConfig
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = new Uri("http://qbit:8080"),
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("password").ValueKind.ShouldBe(JsonValueKind.Null);
+    }
+
+    #endregion
+
+    #region NotifiarrConfig
+
+    [Fact]
+    public void NotifiarrConfig_ApiKey_IsMasked()
+    {
+        var config = new NotifiarrConfig
+        {
+            ApiKey = "notifiarr-api-key-secret",
+            ChannelId = "123456789"
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("apiKey").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("channelId").GetString().ShouldBe("123456789");
+    }
+
+    #endregion
+
+    #region DiscordConfig
+
+    [Fact]
+    public void DiscordConfig_WebhookUrl_IsMasked()
+    {
+        var config = new DiscordConfig
+        {
+            WebhookUrl = "https://discord.com/api/webhooks/123456/secret-token",
+            Username = "Cleanuparr Bot",
+            AvatarUrl = "https://example.com/avatar.png"
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("webhookUrl").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("username").GetString().ShouldBe("Cleanuparr Bot");
+        doc.RootElement.GetProperty("avatarUrl").GetString().ShouldBe("https://example.com/avatar.png");
+    }
+
+    #endregion
+
+    #region TelegramConfig
+
+    [Fact]
+    public void TelegramConfig_BotToken_IsMasked()
+    {
+        var config = new TelegramConfig
+        {
+            BotToken = "1234567890:ABCdefGHIjklmnoPQRstuvWXyz",
+            ChatId = "-1001234567890",
+            TopicId = "42",
+            SendSilently = true
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("botToken").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("chatId").GetString().ShouldBe("-1001234567890");
+        doc.RootElement.GetProperty("topicId").GetString().ShouldBe("42");
+    }
+
+    #endregion
+
+    #region NtfyConfig
+
+    [Fact]
+    public void NtfyConfig_PasswordAndAccessToken_AreMasked()
+    {
+        var config = new NtfyConfig
+        {
+            ServerUrl = "https://ntfy.example.com",
+            Topics = ["test-topic"],
+            AuthenticationType = NtfyAuthenticationType.BasicAuth,
+            Username = "ntfy-user",
+            Password = "ntfy-secret-password",
+            AccessToken = "ntfy-access-token-secret",
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("password").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("accessToken").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("serverUrl").GetString().ShouldBe("https://ntfy.example.com");
+        doc.RootElement.GetProperty("username").GetString().ShouldBe("ntfy-user");
+    }
+
+    [Fact]
+    public void NtfyConfig_NullPasswordAndAccessToken_RemainNull()
+    {
+        var config = new NtfyConfig
+        {
+            ServerUrl = "https://ntfy.example.com",
+            Topics = ["test-topic"],
+            AuthenticationType = NtfyAuthenticationType.None,
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("password").ValueKind.ShouldBe(JsonValueKind.Null);
+        doc.RootElement.GetProperty("accessToken").ValueKind.ShouldBe(JsonValueKind.Null);
+    }
+
+    #endregion
+
+    #region PushoverConfig
+
+    [Fact]
+    public void PushoverConfig_ApiTokenAndUserKey_AreMasked()
+    {
+        var config = new PushoverConfig
+        {
+            ApiToken = "pushover-api-token-secret",
+            UserKey = "pushover-user-key-secret",
+            Priority = PushoverPriority.Normal,
+            Devices = ["iphone", "desktop"]
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("apiToken").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("userKey").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("devices").GetArrayLength().ShouldBe(2);
+    }
+
+    #endregion
+
+    #region GotifyConfig
+
+    [Fact]
+    public void GotifyConfig_ApplicationToken_IsMasked()
+    {
+        var config = new GotifyConfig
+        {
+            ServerUrl = "https://gotify.example.com",
+            ApplicationToken = "gotify-app-token-secret",
+            Priority = 5
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("applicationToken").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("serverUrl").GetString().ShouldBe("https://gotify.example.com");
+    }
+
+    #endregion
+
+    #region AppriseConfig
+
+    [Fact]
+    public void AppriseConfig_Key_IsMasked_WithFullMask()
+    {
+        var config = new AppriseConfig
+        {
+            Mode = AppriseMode.Api,
+            Url = "https://apprise.example.com",
+            Key = "apprise-config-key-secret",
+            Tags = "urgent",
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("key").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("url").GetString().ShouldBe("https://apprise.example.com");
+    }
+
+    [Fact]
+    public void AppriseConfig_ServiceUrls_IsMasked_WithAppriseUrlMask()
+    {
+        var config = new AppriseConfig
+        {
+            Mode = AppriseMode.Cli,
+            ServiceUrls = "discord://webhook_id/webhook_token slack://tokenA/tokenB/tokenC"
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        var maskedUrls = doc.RootElement.GetProperty("serviceUrls").GetString();
+        maskedUrls.ShouldContain("discord://••••••••");
+        maskedUrls.ShouldContain("slack://••••••••");
+        maskedUrls.ShouldNotContain("webhook_id");
+        maskedUrls.ShouldNotContain("webhook_token");
+        maskedUrls.ShouldNotContain("tokenA");
+    }
+
+    [Fact]
+    public void AppriseConfig_NullServiceUrls_RemainsNull()
+    {
+        var config = new AppriseConfig
+        {
+            Mode = AppriseMode.Api,
+            Url = "https://apprise.example.com",
+            Key = "some-key",
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("serviceUrls").ValueKind.ShouldBe(JsonValueKind.Null);
+    }
+
+    #endregion
+
+    #region Polymorphic serialization (as used in NotificationProviderResponse)
+
+    [Fact]
+    public void PolymorphicSerialization_NotifiarrConfig_StillMasked()
+    {
+        // The notification providers endpoint casts configs to `object`.
+        // Verify that the resolver still masks when serializing as a concrete type at runtime.
+        object config = new NotifiarrConfig
+        {
+            ApiKey = "my-secret-notifiarr-key",
+            ChannelId = "987654321"
+        };
+
+        var json = JsonSerializer.Serialize(config, config.GetType(), _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("apiKey").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("channelId").GetString().ShouldBe("987654321");
+    }
+
+    [Fact]
+    public void PolymorphicSerialization_DiscordConfig_StillMasked()
+    {
+        object config = new DiscordConfig
+        {
+            WebhookUrl = "https://discord.com/api/webhooks/123/secret",
+            Username = "Bot"
+        };
+
+        var json = JsonSerializer.Serialize(config, config.GetType(), _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("webhookUrl").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("username").GetString().ShouldBe("Bot");
+    }
+
+    #endregion
+
+    #region Edge cases
+
+    [Fact]
+    public void EmptySensitiveString_IsMasked_NotReturnedEmpty()
+    {
+        var config = new NotifiarrConfig
+        {
+            ApiKey = "",
+            ChannelId = "123"
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        // Even empty strings get masked to the placeholder
+        doc.RootElement.GetProperty("apiKey").GetString().ShouldBe(Placeholder);
+    }
+
+    [Fact]
+    public void MultipleSensitiveFields_AllMasked()
+    {
+        var config = new PushoverConfig
+        {
+            ApiToken = "token-abc-123",
+            UserKey = "user-key-xyz-789",
+            Priority = PushoverPriority.High,
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("apiToken").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("userKey").GetString().ShouldBe(Placeholder);
+    }
+
+    #endregion
+}

code/backend/Cleanuparr.Api.Tests/TestCollections.cs

@@ -0,0 +1,9 @@
+namespace Cleanuparr.Api.Tests;
+
+/// <summary>
+/// Auth integration tests share the file-system config directory (users.db via
+/// SetupGuardMiddleware.CreateStaticInstance). Grouping them in one collection
+/// forces sequential execution and prevents inter-factory interference.
+/// </summary>
+[CollectionDefinition("Auth Integration Tests")]
+public class AuthIntegrationTestsCollection { }

code/backend/Cleanuparr.Api.Tests/xunit.runner.json

@@ -0,0 +1,5 @@
+{
+  "$schema": "https://xunit.net/schema/current/xunit.runner.schema.json",
+  "parallelizeAssembly": false,
+  "parallelizeTestCollections": false
+}

code/backend/Cleanuparr.Api/Auth/TrustedNetworkAuthenticationHandler.cs

@@ -0,0 +1,192 @@
+using System.Net;
+using System.Security.Claims;
+using System.Text.Encodings.Web;
+using Cleanuparr.Infrastructure.Extensions;
+using Cleanuparr.Persistence;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Options;
+
+namespace Cleanuparr.Api.Auth;
+
+public static class TrustedNetworkAuthenticationDefaults
+{
+    public const string AuthenticationScheme = "TrustedNetwork";
+}
+
+public class TrustedNetworkAuthenticationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
+{
+    public TrustedNetworkAuthenticationHandler(
+        IOptionsMonitor<AuthenticationSchemeOptions> options,
+        ILoggerFactory logger,
+        UrlEncoder encoder)
+        : base(options, logger, encoder)
+    {
+    }
+
+    protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
+    {
+        // Load auth config from database
+        await using var dataContext = DataContext.CreateStaticInstance();
+        var config = await dataContext.GeneralConfigs.AsNoTracking().FirstOrDefaultAsync();
+
+        if (config is null || !config.Auth.DisableAuthForLocalAddresses)
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        // Determine client IP
+        var clientIp = GetClientIp(config.Auth.TrustForwardedHeaders);
+        if (clientIp is null)
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        // Check if the client IP is trusted
+        if (!IsTrustedAddress(clientIp, config.Auth.TrustedNetworks))
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        // Load the admin user
+        await using var usersContext = UsersContext.CreateStaticInstance();
+        var user = await usersContext.Users
+            .AsNoTracking()
+            .FirstOrDefaultAsync(u => u.SetupCompleted);
+
+        if (user is null)
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        var claims = new[]
+        {
+            new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
+            new Claim(ClaimTypes.Name, user.Username),
+            new Claim("auth_method", "trusted_network")
+        };
+
+        var identity = new ClaimsIdentity(claims, TrustedNetworkAuthenticationDefaults.AuthenticationScheme);
+        var principal = new ClaimsPrincipal(identity);
+        var ticket = new AuthenticationTicket(principal, TrustedNetworkAuthenticationDefaults.AuthenticationScheme);
+
+        return AuthenticateResult.Success(ticket);
+    }
+
+    private IPAddress? GetClientIp(bool trustForwardedHeaders) =>
+        ResolveClientIp(Context, trustForwardedHeaders);
+
+    public static IPAddress? ResolveClientIp(HttpContext httpContext, bool trustForwardedHeaders)
+    {
+        var remoteIp = httpContext.Connection.RemoteIpAddress;
+        if (remoteIp is null)
+        {
+            return null;
+        }
+
+        // Only trust forwarded headers if the direct connection is from a local address
+        if (trustForwardedHeaders && remoteIp.IsLocalAddress())
+        {
+            // Check X-Forwarded-For first, then X-Real-IP
+            var forwardedFor = httpContext.Request.Headers["X-Forwarded-For"].FirstOrDefault();
+            if (!string.IsNullOrEmpty(forwardedFor))
+            {
+                // X-Forwarded-For can contain multiple IPs: client, proxy1, proxy2
+                // The first one is the original client
+                var firstIp = forwardedFor.Split(',')[0].Trim();
+                if (IPAddress.TryParse(firstIp, out var parsedIp))
+                {
+                    return parsedIp;
+                }
+            }
+
+            var realIp = httpContext.Request.Headers["X-Real-IP"].FirstOrDefault();
+            if (!string.IsNullOrEmpty(realIp) && IPAddress.TryParse(realIp, out var realParsedIp))
+            {
+                return realParsedIp;
+            }
+        }
+
+        return remoteIp;
+    }
+
+    public static bool IsTrustedAddress(IPAddress clientIp, List<string> trustedNetworks)
+    {
+        // Normalize IPv4-mapped IPv6 addresses
+        if (clientIp.IsIPv4MappedToIPv6)
+        {
+            clientIp = clientIp.MapToIPv4();
+        }
+
+        // Check if it's a local address (built-in ranges)
+        if (clientIp.IsLocalAddress())
+        {
+            return true;
+        }
+
+        // Check against custom trusted networks
+        foreach (var network in trustedNetworks)
+        {
+            if (MatchesCidr(clientIp, network))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    public static bool MatchesCidr(IPAddress address, string cidr)
+    {
+        if (cidr.Contains('/'))
+        {
+            var parts = cidr.Split('/');
+            if (!IPAddress.TryParse(parts[0], out var networkAddress) ||
+                !int.TryParse(parts[1], out var prefixLength))
+            {
+                return false;
+            }
+
+            // Normalize both addresses
+            if (networkAddress.IsIPv4MappedToIPv6)
+                networkAddress = networkAddress.MapToIPv4();
+            if (address.IsIPv4MappedToIPv6)
+                address = address.MapToIPv4();
+
+            // Must be same address family
+            if (address.AddressFamily != networkAddress.AddressFamily)
+                return false;
+
+            var addressBytes = address.GetAddressBytes();
+            var networkBytes = networkAddress.GetAddressBytes();
+
+            // Compare bytes up to prefix length
+            var fullBytes = prefixLength / 8;
+            var remainingBits = prefixLength % 8;
+
+            for (var i = 0; i < fullBytes && i < addressBytes.Length; i++)
+            {
+                if (addressBytes[i] != networkBytes[i])
+                    return false;
+            }
+
+            if (remainingBits > 0 && fullBytes < addressBytes.Length)
+            {
+                var mask = (byte)(0xFF << (8 - remainingBits));
+                if ((addressBytes[fullBytes] & mask) != (networkBytes[fullBytes] & mask))
+                    return false;
+            }
+
+            return true;
+        }
+
+        // Plain IP match
+        if (!IPAddress.TryParse(cidr, out var singleIp))
+            return false;
+
+        if (singleIp.IsIPv4MappedToIPv6)
+            singleIp = singleIp.MapToIPv4();
+
+        return address.Equals(singleIp);
+    }
+}

code/backend/Cleanuparr.Api/Controllers/ApiDocumentationController.cs

@@ -1,9 +1,11 @@
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Cleanuparr.Api.Controllers;
 
 [ApiController]
 [Route("api")]
+[Authorize]
 public class ApiDocumentationController : ControllerBase
 {
     [HttpGet]

code/backend/Cleanuparr.Api/Controllers/EventsController.cs

@@ -2,6 +2,7 @@ using System.Text.Json.Serialization;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Events;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 
@@ -9,6 +10,7 @@ namespace Cleanuparr.Api.Controllers;
 
 [ApiController]
 [Route("api/[controller]")]
+[Authorize]
 public class EventsController : ControllerBase
 {
     private readonly EventsContext _context;

code/backend/Cleanuparr.Api/Controllers/HealthCheckController.cs

@@ -1,4 +1,5 @@
 using Cleanuparr.Infrastructure.Health;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Cleanuparr.Api.Controllers;
@@ -8,6 +9,7 @@ namespace Cleanuparr.Api.Controllers;
 /// </summary>
 [ApiController]
 [Route("api/health")]
+[Authorize]
 public class HealthCheckController : ControllerBase
 {
     private readonly ILogger<HealthCheckController> _logger;

code/backend/Cleanuparr.Api/Controllers/HealthController.cs

@@ -1,3 +1,4 @@
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Diagnostics.HealthChecks;
 
@@ -8,6 +9,7 @@ namespace Cleanuparr.Api.Controllers;
 /// </summary>
 [ApiController]
 [Route("[controller]")]
+[Authorize]
 public class HealthController : ControllerBase
 {
     private readonly HealthCheckService _healthCheckService;
@@ -23,6 +25,7 @@ public class HealthController : ControllerBase
     /// Basic liveness probe - checks if the application is running
     /// Used by Docker HEALTHCHECK and Kubernetes liveness probes
     /// </summary>
+    [AllowAnonymous]
     [HttpGet]
     [Route("/health")]
     public async Task<IActionResult> GetHealth()
@@ -47,6 +50,7 @@ public class HealthController : ControllerBase
     /// Readiness probe - checks if the application is ready to serve traffic
     /// Used by Kubernetes readiness probes
     /// </summary>
+    [AllowAnonymous]
     [HttpGet]
     [Route("/health/ready")]
     public async Task<IActionResult> GetReadiness()

code/backend/Cleanuparr.Api/Controllers/JobsController.cs

@@ -2,12 +2,14 @@ using Cleanuparr.Api.Models;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Models;
 using Cleanuparr.Infrastructure.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Cleanuparr.Api.Controllers;
 
 [ApiController]
 [Route("api/[controller]")]
+[Authorize]
 public class JobsController : ControllerBase
 {
     private readonly IJobManagementService _jobManagementService;
@@ -55,8 +57,13 @@ public class JobsController : ControllerBase
     }
 
     [HttpPost("{jobType}/start")]
-    public async Task<IActionResult> StartJob(JobType jobType, [FromBody] ScheduleRequest scheduleRequest = null)
+    public async Task<IActionResult> StartJob(JobType jobType, [FromBody] ScheduleRequest scheduleRequest)
     {
+        if (jobType == JobType.Seeker)
+        {
+            return BadRequest("The Seeker job cannot be manually controlled");
+        }
+
         try
         {
             // Get the schedule from the request body if provided
@@ -80,6 +87,11 @@ public class JobsController : ControllerBase
     [HttpPost("{jobType}/trigger")]
     public async Task<IActionResult> TriggerJob(JobType jobType)
     {
+        if (jobType == JobType.Seeker)
+        {
+            return BadRequest("The Seeker job cannot be manually triggered");
+        }
+
         try
         {
             var result = await _jobManagementService.TriggerJobOnce(jobType);
@@ -100,6 +112,11 @@ public class JobsController : ControllerBase
     [HttpPut("{jobType}/schedule")]
     public async Task<IActionResult> UpdateJobSchedule(JobType jobType, [FromBody] ScheduleRequest scheduleRequest)
     {
+        if (jobType == JobType.Seeker)
+        {
+            return BadRequest("The Seeker job schedule cannot be manually modified");
+        }
+
         if (scheduleRequest?.Schedule == null)
         {
             return BadRequest("Schedule is required");

code/backend/Cleanuparr.Api/Controllers/ManualEventsController.cs

@@ -1,6 +1,7 @@
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Events;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 
@@ -8,6 +9,7 @@ namespace Cleanuparr.Api.Controllers;
 
 [ApiController]
 [Route("api/[controller]")]
+[Authorize]
 public class ManualEventsController : ControllerBase
 {
     private readonly EventsContext _context;

code/backend/Cleanuparr.Api/Controllers/StatsController.cs

@@ -1,4 +1,5 @@
 using Cleanuparr.Infrastructure.Stats;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Cleanuparr.Api.Controllers;
@@ -8,6 +9,7 @@ namespace Cleanuparr.Api.Controllers;
 /// </summary>
 [ApiController]
 [Route("api/[controller]")]
+[Authorize]
 public class StatsController : ControllerBase
 {
     private readonly ILogger<StatsController> _logger;

code/backend/Cleanuparr.Api/Controllers/StatusController.cs

@@ -2,6 +2,7 @@ using System.Diagnostics;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Features.Arr.Interfaces;
 using Cleanuparr.Persistence;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 
@@ -9,6 +10,7 @@ namespace Cleanuparr.Api.Controllers;
 
 [ApiController]
 [Route("api/[controller]")]
+[Authorize]
 public class StatusController : ControllerBase
 {
     private readonly ILogger<StatusController> _logger;

code/backend/Cleanuparr.Api/Controllers/StrikesController.cs

@@ -1,6 +1,7 @@
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.State;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 
@@ -8,6 +9,7 @@ namespace Cleanuparr.Api.Controllers;
 
 [ApiController]
 [Route("api/[controller]")]
+[Authorize]
 public class StrikesController : ControllerBase
 {
     private readonly EventsContext _context;
@@ -75,6 +77,7 @@ public class StrikesController : ControllerBase
             IsMarkedForRemoval = d.IsMarkedForRemoval,
             IsRemoved = d.IsRemoved,
             IsReturning = d.IsReturning,
+            HasDryRunStrikes = d.Strikes.Any(s => s.IsDryRun),
             Strikes = d.Strikes
                 .OrderByDescending(s => s.CreatedAt)
                 .Select(s => new StrikeDetailDto
@@ -84,6 +87,7 @@ public class StrikesController : ControllerBase
                     CreatedAt = s.CreatedAt,
                     LastDownloadedBytes = s.LastDownloadedBytes,
                     JobRunId = s.JobRunId,
+                    IsDryRun = s.IsDryRun,
                 }).ToList(),
         }).ToList();
 
@@ -118,6 +122,7 @@ public class StrikesController : ControllerBase
                 CreatedAt = s.CreatedAt,
                 DownloadId = s.DownloadItem.DownloadId,
                 Title = s.DownloadItem.Title,
+                IsDryRun = s.IsDryRun,
             })
             .ToListAsync();
 
@@ -167,6 +172,7 @@ public class DownloadItemStrikesDto
     public bool IsMarkedForRemoval { get; set; }
     public bool IsRemoved { get; set; }
     public bool IsReturning { get; set; }
+    public bool HasDryRunStrikes { get; set; }
     public List<StrikeDetailDto> Strikes { get; set; } = [];
 }
 
@@ -177,6 +183,7 @@ public class StrikeDetailDto
     public DateTime CreatedAt { get; set; }
     public long? LastDownloadedBytes { get; set; }
     public Guid JobRunId { get; set; }
+    public bool IsDryRun { get; set; }
 }
 
 public class RecentStrikeDto
@@ -186,4 +193,5 @@ public class RecentStrikeDto
     public DateTime CreatedAt { get; set; }
     public string DownloadId { get; set; } = string.Empty;
     public string Title { get; set; } = string.Empty;
+    public bool IsDryRun { get; set; }
 }

code/backend/Cleanuparr.Api/DependencyInjection/ApiDI.cs

@@ -1,4 +1,7 @@
 using System.Text.Json.Serialization;
+using System.Text.Json.Serialization.Metadata;
+using Cleanuparr.Api.Filters;
+using Cleanuparr.Api.Json;
 using Cleanuparr.Infrastructure.Health;
 using Cleanuparr.Infrastructure.Hubs;
 using Microsoft.AspNetCore.Http.Json;
@@ -17,12 +20,14 @@ public static class ApiDI
             options.SerializerOptions.PropertyNameCaseInsensitive = true;
             options.SerializerOptions.Converters.Add(new JsonStringEnumConverter());
             options.SerializerOptions.ReferenceHandler = ReferenceHandler.IgnoreCycles;
+            options.SerializerOptions.TypeInfoResolver = new SensitiveDataResolver(
+                options.SerializerOptions.TypeInfoResolver ?? new DefaultJsonTypeInfoResolver());
         });
-        
+
         // Make JsonSerializerOptions available for injection
         services.AddSingleton(sp =>
             sp.GetRequiredService<IOptions<JsonOptions>>().Value.SerializerOptions);
-        
+
         // Add API-specific services
         services
             .AddControllers()
@@ -31,9 +36,11 @@ public static class ApiDI
                 options.JsonSerializerOptions.PropertyNameCaseInsensitive = true;
                 options.JsonSerializerOptions.Converters.Add(new JsonStringEnumConverter());
                 options.JsonSerializerOptions.ReferenceHandler = ReferenceHandler.IgnoreCycles;
+                options.JsonSerializerOptions.TypeInfoResolver = new SensitiveDataResolver(
+                    options.JsonSerializerOptions.TypeInfoResolver ?? new DefaultJsonTypeInfoResolver());
             });
         services.AddEndpointsApiExplorer();
-        
+
         // Add SignalR for real-time updates
         services
             .AddSignalR()
@@ -41,6 +48,8 @@ public static class ApiDI
             {
                 options.PayloadSerializerOptions.PropertyNameCaseInsensitive = true;
                 options.PayloadSerializerOptions.Converters.Add(new JsonStringEnumConverter());
+                options.PayloadSerializerOptions.TypeInfoResolver = new SensitiveDataResolver(
+                    options.PayloadSerializerOptions.TypeInfoResolver ?? new DefaultJsonTypeInfoResolver());
             });
         
         // Add health status broadcaster
@@ -56,10 +65,10 @@ public static class ApiDI
         // Enable compression
         app.UseResponseCompression();
         
-        // Serve static files with caching
+        // Serve static files without caching
         app.UseStaticFiles(new StaticFileOptions
         {
-            OnPrepareResponse = _ => {}
+            OnPrepareResponse = ctx => NoCacheAttribute.Apply(ctx.Context.Response.Headers)
         });
         
         // Add the global exception handling middleware first
@@ -111,6 +120,7 @@ public static class ApiDI
             );
             
             context.Response.ContentType = "text/html";
+            NoCacheAttribute.Apply(context.Response.Headers);
             await context.Response.WriteAsync(indexContent, Encoding.UTF8);
         }).AllowAnonymous();
         

code/backend/Cleanuparr.Api/DependencyInjection/AuthDI.cs

@@ -29,7 +29,16 @@ public static class AuthDI
                         return ApiKeyAuthenticationDefaults.AuthenticationScheme;
                     }
 
-                    return JwtBearerDefaults.AuthenticationScheme;
+                    // Check for Bearer token or SignalR access_token
+                    if (context.Request.Headers.ContainsKey("Authorization") ||
+                        (context.Request.Path.StartsWithSegments("/api/hubs") &&
+                         context.Request.Query.ContainsKey("access_token")))
+                    {
+                        return JwtBearerDefaults.AuthenticationScheme;
+                    }
+
+                    // Fall through to trusted network handler (returns NoResult if disabled)
+                    return TrustedNetworkAuthenticationDefaults.AuthenticationScheme;
                 };
             })
             .AddJwtBearer(options =>
@@ -64,7 +73,9 @@ public static class AuthDI
                 };
             })
             .AddScheme<AuthenticationSchemeOptions, ApiKeyAuthenticationHandler>(
-                ApiKeyAuthenticationDefaults.AuthenticationScheme, _ => { });
+                ApiKeyAuthenticationDefaults.AuthenticationScheme, _ => { })
+            .AddScheme<AuthenticationSchemeOptions, TrustedNetworkAuthenticationHandler>(
+                TrustedNetworkAuthenticationDefaults.AuthenticationScheme, _ => { });
 
         services.AddAuthorization(options =>
         {

code/backend/Cleanuparr.Api/DependencyInjection/MainDI.cs

@@ -1,6 +1,5 @@
 using System.Text.Json.Serialization;
 using Cleanuparr.Domain.Entities.Arr;
-using Cleanuparr.Infrastructure.Features.DownloadHunter.Consumers;
 using Cleanuparr.Infrastructure.Features.DownloadRemover.Consumers;
 using Cleanuparr.Infrastructure.Features.Notifications.Consumers;
 using Cleanuparr.Infrastructure.Features.Notifications.Models;
@@ -30,9 +29,6 @@ public static class MainDI
                 
                 config.AddConsumer<DownloadRemoverConsumer<SearchItem>>();
                 config.AddConsumer<DownloadRemoverConsumer<SeriesSearchItem>>();
-                config.AddConsumer<DownloadHunterConsumer<SearchItem>>();
-                config.AddConsumer<DownloadHunterConsumer<SeriesSearchItem>>();
-                
                 config.AddConsumer<NotificationConsumer<FailedImportStrikeNotification>>();
                 config.AddConsumer<NotificationConsumer<StalledStrikeNotification>>();
                 config.AddConsumer<NotificationConsumer<SlowSpeedStrikeNotification>>();
@@ -60,14 +56,6 @@ public static class MainDI
                         e.PrefetchCount = 1;
                     });
                     
-                    cfg.ReceiveEndpoint("download-hunter-queue", e =>
-                    {
-                        e.ConfigureConsumer<DownloadHunterConsumer<SearchItem>>(context);
-                        e.ConfigureConsumer<DownloadHunterConsumer<SeriesSearchItem>>(context);
-                        e.ConcurrentMessageLimit = 1;
-                        e.PrefetchCount = 1;
-                    });
-                    
                     cfg.ReceiveEndpoint("notification-queue", e =>
                     {
                         e.ConfigureConsumer<NotificationConsumer<FailedImportStrikeNotification>>(context);
@@ -94,6 +82,9 @@ public static class MainDI
         // Add HTTP client for Plex authentication
         services.AddHttpClient("PlexAuth");
 
+        // Add HTTP client for OIDC authentication
+        services.AddHttpClient("OidcAuth");
+
         return services;
     }
 

code/backend/Cleanuparr.Api/DependencyInjection/ServicesDI.cs

@@ -5,8 +5,6 @@ using Cleanuparr.Infrastructure.Features.Arr.Interfaces;
 using Cleanuparr.Infrastructure.Features.Auth;
 using Cleanuparr.Infrastructure.Features.BlacklistSync;
 using Cleanuparr.Infrastructure.Features.DownloadClient;
-using Cleanuparr.Infrastructure.Features.DownloadHunter;
-using Cleanuparr.Infrastructure.Features.DownloadHunter.Interfaces;
 using Cleanuparr.Infrastructure.Features.DownloadRemover;
 using Cleanuparr.Infrastructure.Features.DownloadRemover.Interfaces;
 using Cleanuparr.Infrastructure.Features.Files;
@@ -33,6 +31,7 @@ public static class ServicesDI
             .AddSingleton<IPasswordService, PasswordService>()
             .AddSingleton<ITotpService, TotpService>()
             .AddScoped<IPlexAuthService, PlexAuthService>()
+            .AddScoped<IOidcAuthService, OidcAuthService>()
             .AddScoped<IEventPublisher, EventPublisher>()
             .AddHostedService<EventCleanupService>()
             .AddScoped<IDryRunInterceptor, DryRunInterceptor>()
@@ -48,8 +47,9 @@ public static class ServicesDI
             .AddScoped<BlacklistSynchronizer>()
             .AddScoped<MalwareBlocker>()
             .AddScoped<DownloadCleaner>()
+            .AddScoped<Seeker>()
+            .AddScoped<CustomFormatScoreSyncer>()
             .AddScoped<IQueueItemRemover, QueueItemRemover>()
-            .AddScoped<IDownloadHunter, DownloadHunter>()
             .AddScoped<IFilenameEvaluator, FilenameEvaluator>()
             .AddScoped<IHardLinkFileService, HardLinkFileService>()
             .AddScoped<IUnixHardLinkFileService, UnixHardLinkFileService>()
@@ -66,5 +66,6 @@ public static class ServicesDI
             .AddSingleton<IBlocklistProvider, BlocklistProvider>()
             .AddSingleton(TimeProvider.System)
             .AddSingleton<AppStatusSnapshot>()
-            .AddHostedService<AppStatusRefreshService>();
+            .AddHostedService<AppStatusRefreshService>()
+            .AddHostedService<SeekerCommandMonitor>();
 }

code/backend/Cleanuparr.Api/Extensions/HttpRequestExtensions.cs

@@ -0,0 +1,44 @@
+using Cleanuparr.Infrastructure.Extensions;
+
+namespace Cleanuparr.Api.Extensions;
+
+public static class HttpRequestExtensions
+{
+    /// <summary>
+    /// Returns the request PathBase as a safe relative path.
+    /// Rejects absolute URLs (e.g. "://" or "//") to prevent open redirect attacks.
+    /// </summary>
+    public static string GetSafeBasePath(this HttpRequest request)
+    {
+        var basePath = request.PathBase.Value?.TrimEnd('/') ?? "";
+        if (basePath.Contains("://") || basePath.StartsWith("//"))
+        {
+            return "";
+        }
+        return basePath;
+    }
+
+    /// <summary>
+    /// Returns the external base URL (scheme + host + basePath), respecting
+    /// X-Forwarded-Proto and X-Forwarded-Host headers when the connection
+    /// originates from a local address.
+    /// </summary>
+    public static string GetExternalBaseUrl(this HttpContext context)
+    {
+        var request = context.Request;
+        var scheme = request.Scheme;
+        var host = request.Host.ToString();
+        var remoteIp = context.Connection.RemoteIpAddress;
+
+        // Trust forwarded headers only from local connections
+        // (consistent with TrustedNetworkAuthenticationHandler)
+        if (remoteIp is not null && remoteIp.IsLocalAddress())
+        {
+            scheme = request.Headers["X-Forwarded-Proto"].FirstOrDefault() ?? scheme;
+            host = request.Headers["X-Forwarded-Host"].FirstOrDefault() ?? host;
+        }
+
+        var basePath = request.GetSafeBasePath();
+        return $"{scheme}://{host}{basePath}";
+    }
+}

code/backend/Cleanuparr.Api/Features/Arr/Contracts/Requests/ArrInstanceRequest.cs

@@ -1,7 +1,9 @@
 using System;
 using System.ComponentModel.DataAnnotations;
 
+using ValidationException = Cleanuparr.Domain.Exceptions.ValidationException;
 using Cleanuparr.Persistence.Models.Configuration.Arr;
+using Cleanuparr.Shared.Helpers;
 
 namespace Cleanuparr.Api.Features.Arr.Contracts.Requests;
 
@@ -23,16 +25,24 @@ public sealed record ArrInstanceRequest
 
     public string? ExternalUrl { get; init; }
 
-    public ArrInstance ToEntity(Guid configId) => new()
+    public ArrInstance ToEntity(Guid configId)
     {
-        Enabled = Enabled,
-        Name = Name,
-        Url = new Uri(Url),
-        ExternalUrl = ExternalUrl is not null ? new Uri(ExternalUrl) : null,
-        ApiKey = ApiKey,
-        ArrConfigId = configId,
-        Version = Version,
-    };
+        if (ApiKey.IsPlaceholder())
+        {
+            throw new ValidationException("API key is required when creating a new instance");
+        }
+
+        return new()
+        {
+            Enabled = Enabled,
+            Name = Name,
+            Url = new Uri(Url),
+            ExternalUrl = ExternalUrl is not null ? new Uri(ExternalUrl) : null,
+            ApiKey = ApiKey,
+            ArrConfigId = configId,
+            Version = Version,
+        };
+    }
 
     public void ApplyTo(ArrInstance instance)
     {
@@ -40,7 +50,7 @@ public sealed record ArrInstanceRequest
         instance.Name = Name;
         instance.Url = new Uri(Url);
         instance.ExternalUrl = ExternalUrl is not null ? new Uri(ExternalUrl) : null;
-        instance.ApiKey = ApiKey;
+        instance.ApiKey = ApiKey.IsPlaceholder() ? instance.ApiKey : ApiKey;
         instance.Version = Version;
     }
 }

code/backend/Cleanuparr.Api/Features/Arr/Contracts/Requests/TestArrInstanceRequest.cs

@@ -1,7 +1,9 @@
 using System;
 using System.ComponentModel.DataAnnotations;
 
+using ValidationException = Cleanuparr.Domain.Exceptions.ValidationException;
 using Cleanuparr.Persistence.Models.Configuration.Arr;
+using Cleanuparr.Shared.Helpers;
 
 namespace Cleanuparr.Api.Features.Arr.Contracts.Requests;
 
@@ -12,17 +14,29 @@ public sealed record TestArrInstanceRequest
 
     [Required]
     public required string ApiKey { get; init; }
-    
+
     [Required]
     public required float Version { get; init; }
 
-    public ArrInstance ToTestInstance() => new()
+    public Guid? InstanceId { get; init; }
+
+    public ArrInstance ToTestInstance(string? resolvedApiKey = null)
     {
-        Enabled = true,
-        Name = "Test Instance",
-        Url = new Uri(Url),
-        ApiKey = ApiKey,
-        ArrConfigId = Guid.Empty,
-        Version = Version,
-    };
+        var apiKey = resolvedApiKey ?? ApiKey;
+
+        if (apiKey.IsPlaceholder())
+        {
+            throw new ValidationException("API key cannot be a placeholder value");
+        }
+
+        return new()
+        {
+            Enabled = true,
+            Name = "Test Instance",
+            Url = new Uri(Url),
+            ApiKey = apiKey,
+            ArrConfigId = Guid.Empty,
+            Version = Version,
+        };
+    }
 }

code/backend/Cleanuparr.Api/Features/Arr/Controllers/ArrConfigController.cs

@@ -3,7 +3,9 @@ using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Features.Arr.Dtos;
 using Cleanuparr.Infrastructure.Features.Arr.Interfaces;
 using Cleanuparr.Persistence;
+using Cleanuparr.Shared.Helpers;
 using Mapster;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 
@@ -11,6 +13,7 @@ namespace Cleanuparr.Api.Features.Arr.Controllers;
 
 [ApiController]
 [Route("api/configuration")]
+[Authorize]
 public sealed class ArrConfigController : ControllerBase
 {
     private readonly ILogger<ArrConfigController> _logger;
@@ -282,7 +285,23 @@ public sealed class ArrConfigController : ControllerBase
     {
         try
         {
-            var testInstance = request.ToTestInstance();
+            string? resolvedApiKey = null;
+
+            if (request.ApiKey.IsPlaceholder() && request.InstanceId.HasValue)
+            {
+                var existingInstance = await _dataContext.ArrInstances
+                    .AsNoTracking()
+                    .FirstOrDefaultAsync(i => i.Id == request.InstanceId.Value);
+
+                if (existingInstance is null)
+                {
+                    return NotFound($"Instance with ID {request.InstanceId.Value} not found");
+                }
+
+                resolvedApiKey = existingInstance.ApiKey;
+            }
+
+            var testInstance = request.ToTestInstance(resolvedApiKey);
             var client = _arrClientFactory.GetClient(type, request.Version);
             await client.HealthCheckAsync(testInstance);
 

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/Disable2faRequest.cs

@@ -0,0 +1,13 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record Disable2faRequest
+{
+    [Required]
+    public required string Password { get; init; }
+
+    [Required]
+    [StringLength(6, MinimumLength = 6)]
+    public required string TotpCode { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/Enable2faRequest.cs

@@ -0,0 +1,9 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record Enable2faRequest
+{
+    [Required]
+    public required string Password { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/OidcExchangeRequest.cs

@@ -0,0 +1,9 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record OidcExchangeRequest
+{
+    [Required]
+    public required string Code { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/UpdateOidcConfigRequest.cs

@@ -0,0 +1,49 @@
+using Cleanuparr.Infrastructure.Features.Auth;
+using Cleanuparr.Persistence.Models.Auth;
+using Cleanuparr.Shared.Helpers;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record UpdateOidcConfigRequest
+{
+    public bool Enabled { get; init; }
+
+    public string IssuerUrl { get; init; } = string.Empty;
+
+    public string ClientId { get; init; } = string.Empty;
+
+    public string ClientSecret { get; init; } = string.Empty;
+
+    public string Scopes { get; init; } = "openid profile email";
+
+    public string ProviderName { get; init; } = "OIDC";
+
+    public string RedirectUrl { get; init; } = string.Empty;
+
+    public bool ExclusiveMode { get; init; }
+
+    public void ApplyTo(OidcConfig existingConfig)
+    {
+        var previousIssuerUrl = existingConfig.IssuerUrl;
+
+        existingConfig.Enabled = Enabled;
+        existingConfig.IssuerUrl = IssuerUrl;
+        existingConfig.ClientId = ClientId;
+        existingConfig.Scopes = Scopes;
+        existingConfig.ProviderName = ProviderName;
+        existingConfig.RedirectUrl = RedirectUrl;
+        existingConfig.ExclusiveMode = ExclusiveMode;
+
+        if (!ClientSecret.IsPlaceholder())
+        {
+            existingConfig.ClientSecret = ClientSecret;
+        }
+        
+        // AuthorizedSubject is intentionally NOT mapped here — it is set only via the OIDC link callback
+
+        if (previousIssuerUrl != IssuerUrl)
+        {
+            OidcAuthService.ClearDiscoveryCache();
+        }
+    }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Responses/AuthStatusResponse.cs

@@ -4,4 +4,8 @@ public sealed record AuthStatusResponse
 {
     public required bool SetupCompleted { get; init; }
     public bool PlexLinked { get; init; }
+    public bool AuthBypassActive { get; init; }
+    public bool OidcEnabled { get; init; }
+    public string OidcProviderName { get; init; } = string.Empty;
+    public bool OidcExclusiveMode { get; init; }
 }

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Responses/LoginResponse.cs

@@ -4,4 +4,5 @@ public sealed record LoginResponse
 {
     public required bool RequiresTwoFactor { get; init; }
     public string? LoginToken { get; init; }
+    public TokenResponse? Tokens { get; init; }
 }

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Responses/OidcStartResponse.cs

@@ -0,0 +1,6 @@
+namespace Cleanuparr.Api.Features.Auth.Contracts.Responses;
+
+public sealed record OidcStartResponse
+{
+    public required string AuthorizationUrl { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Controllers/AccountController.cs

@@ -1,25 +1,30 @@
 using System.Security.Claims;
 using System.Security.Cryptography;
+using Cleanuparr.Api.Extensions;
 using Cleanuparr.Api.Features.Auth.Contracts.Requests;
 using Cleanuparr.Api.Features.Auth.Contracts.Responses;
+using Cleanuparr.Api.Filters;
 using Cleanuparr.Infrastructure.Features.Auth;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Auth;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
+using ValidationException = Cleanuparr.Domain.Exceptions.ValidationException;
 
 namespace Cleanuparr.Api.Features.Auth.Controllers;
 
 [ApiController]
 [Route("api/account")]
 [Authorize]
+[NoCache]
 public sealed class AccountController : ControllerBase
 {
     private readonly UsersContext _usersContext;
     private readonly IPasswordService _passwordService;
     private readonly ITotpService _totpService;
     private readonly IPlexAuthService _plexAuthService;
+    private readonly IOidcAuthService _oidcAuthService;
     private readonly ILogger<AccountController> _logger;
 
     public AccountController(
@@ -27,12 +32,14 @@ public sealed class AccountController : ControllerBase
         IPasswordService passwordService,
         ITotpService totpService,
         IPlexAuthService plexAuthService,
+        IOidcAuthService oidcAuthService,
         ILogger<AccountController> logger)
     {
         _usersContext = usersContext;
         _passwordService = passwordService;
         _totpService = totpService;
         _plexAuthService = plexAuthService;
+        _oidcAuthService = oidcAuthService;
         _logger = logger;
     }
 
@@ -40,7 +47,10 @@ public sealed class AccountController : ControllerBase
     public async Task<IActionResult> GetAccountInfo()
     {
         var user = await GetCurrentUser();
-        if (user is null) return Unauthorized();
+        if (user is null)
+        {
+            return Unauthorized();
+        }
 
         return Ok(new AccountInfoResponse
         {
@@ -55,95 +65,230 @@ public sealed class AccountController : ControllerBase
     [HttpPut("password")]
     public async Task<IActionResult> ChangePassword([FromBody] ChangePasswordRequest request)
     {
-        await UsersContext.Lock.WaitAsync();
-        try
+        if (await IsOidcExclusiveModeActive())
         {
-            var user = await GetCurrentUser();
-            if (user is null) return Unauthorized();
-
-            if (!_passwordService.VerifyPassword(request.CurrentPassword, user.PasswordHash))
-            {
-                return BadRequest(new { error = "Current password is incorrect" });
-            }
-
-            user.PasswordHash = _passwordService.HashPassword(request.NewPassword);
-            user.UpdatedAt = DateTime.UtcNow;
-            await _usersContext.SaveChangesAsync();
-
-            _logger.LogInformation("Password changed for user {Username}", user.Username);
-
-            return Ok(new { message = "Password changed" });
+            return StatusCode(403, new { error = "Password changes are disabled while OIDC exclusive mode is active." });
         }
-        finally
+
+        var user = await GetCurrentUser();
+        if (user is null)
         {
-            UsersContext.Lock.Release();
+            return Unauthorized();
         }
+
+        if (!_passwordService.VerifyPassword(request.CurrentPassword, user.PasswordHash))
+        {
+            return BadRequest(new { error = "Current password is incorrect" });
+        }
+
+        DateTime now = DateTime.UtcNow;
+
+        user.PasswordHash = _passwordService.HashPassword(request.NewPassword);
+        user.UpdatedAt = now;
+
+        // Revoke all existing refresh tokens so old sessions can't be reused
+        var activeTokens = await _usersContext.RefreshTokens
+            .Where(r => r.UserId == user.Id && r.RevokedAt == null)
+            .ToListAsync();
+
+        foreach (var token in activeTokens)
+        {
+            token.RevokedAt = now;
+        }
+
+        await _usersContext.SaveChangesAsync();
+
+        _logger.LogInformation("Password changed for user {Username}", user.Username);
+
+        return Ok(new { message = "Password changed" });
     }
 
     [HttpPost("2fa/regenerate")]
     public async Task<IActionResult> Regenerate2fa([FromBody] Regenerate2faRequest request)
     {
-        await UsersContext.Lock.WaitAsync();
-        try
+        var user = await GetCurrentUser(includeRecoveryCodes: true);
+        if (user is null)
         {
-            var user = await GetCurrentUser(includeRecoveryCodes: true);
-            if (user is null) return Unauthorized();
+            return Unauthorized();
+        }
 
-            // Verify current credentials
-            if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash))
+        // Verify current credentials
+        if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash))
+        {
+            return BadRequest(new { error = "Incorrect password" });
+        }
+
+        if (!_totpService.ValidateCode(user.TotpSecret, request.TotpCode))
+        {
+            return BadRequest(new { error = "Invalid 2FA code" });
+        }
+
+        // Generate new TOTP
+        var secret = _totpService.GenerateSecret();
+        var qrUri = _totpService.GetQrCodeUri(secret, user.Username);
+        var recoveryCodes = _totpService.GenerateRecoveryCodes();
+
+        user.TotpSecret = secret;
+        user.UpdatedAt = DateTime.UtcNow;
+
+        // Replace recovery codes
+        _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
+
+        foreach (var code in recoveryCodes)
+        {
+            _usersContext.RecoveryCodes.Add(new RecoveryCode
             {
-                return BadRequest(new { error = "Incorrect password" });
-            }
-
-            if (!_totpService.ValidateCode(user.TotpSecret, request.TotpCode))
-            {
-                return BadRequest(new { error = "Invalid 2FA code" });
-            }
-
-            // Generate new TOTP
-            var secret = _totpService.GenerateSecret();
-            var qrUri = _totpService.GetQrCodeUri(secret, user.Username);
-            var recoveryCodes = _totpService.GenerateRecoveryCodes();
-
-            user.TotpSecret = secret;
-            user.UpdatedAt = DateTime.UtcNow;
-
-            // Replace recovery codes
-            _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
-
-            foreach (var code in recoveryCodes)
-            {
-                _usersContext.RecoveryCodes.Add(new RecoveryCode
-                {
-                    Id = Guid.NewGuid(),
-                    UserId = user.Id,
-                    CodeHash = _totpService.HashRecoveryCode(code),
-                    IsUsed = false
-                });
-            }
-
-            await _usersContext.SaveChangesAsync();
-
-            _logger.LogInformation("2FA regenerated for user {Username}", user.Username);
-
-            return Ok(new TotpSetupResponse
-            {
-                Secret = secret,
-                QrCodeUri = qrUri,
-                RecoveryCodes = recoveryCodes
+                Id = Guid.NewGuid(),
+                UserId = user.Id,
+                CodeHash = _totpService.HashRecoveryCode(code),
+                IsUsed = false
             });
         }
-        finally
+
+        await _usersContext.SaveChangesAsync();
+
+        _logger.LogInformation("2FA regenerated for user {Username}", user.Username);
+
+        return Ok(new TotpSetupResponse
         {
-            UsersContext.Lock.Release();
+            Secret = secret,
+            QrCodeUri = qrUri,
+            RecoveryCodes = recoveryCodes
+        });
+    }
+
+    [HttpPost("2fa/enable")]
+    public async Task<IActionResult> Enable2fa([FromBody] Enable2faRequest request)
+    {
+        var user = await GetCurrentUser(includeRecoveryCodes: true);
+        if (user is null)
+        {
+            return Unauthorized();
         }
+
+        if (user.TotpEnabled)
+        {
+            return Conflict(new { error = "2FA is already enabled" });
+        }
+
+        if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash))
+        {
+            return BadRequest(new { error = "Incorrect password" });
+        }
+
+        // Generate new TOTP
+        var secret = _totpService.GenerateSecret();
+        var qrUri = _totpService.GetQrCodeUri(secret, user.Username);
+        var recoveryCodes = _totpService.GenerateRecoveryCodes();
+
+        user.TotpSecret = secret;
+        user.UpdatedAt = DateTime.UtcNow;
+
+        // Replace any existing recovery codes
+        _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
+
+        foreach (var code in recoveryCodes)
+        {
+            _usersContext.RecoveryCodes.Add(new RecoveryCode
+            {
+                Id = Guid.NewGuid(),
+                UserId = user.Id,
+                CodeHash = _totpService.HashRecoveryCode(code),
+                IsUsed = false
+            });
+        }
+
+        await _usersContext.SaveChangesAsync();
+
+        _logger.LogInformation("2FA setup generated for user {Username}", user.Username);
+
+        return Ok(new TotpSetupResponse
+        {
+            Secret = secret,
+            QrCodeUri = qrUri,
+            RecoveryCodes = recoveryCodes
+        });
+    }
+
+    [HttpPost("2fa/enable/verify")]
+    public async Task<IActionResult> VerifyEnable2fa([FromBody] VerifyTotpRequest request)
+    {
+        var user = await GetCurrentUser();
+        if (user is null)
+        {
+            return Unauthorized();
+        }
+
+        if (user.TotpEnabled)
+        {
+            return Conflict(new { error = "2FA is already enabled" });
+        }
+
+        if (string.IsNullOrEmpty(user.TotpSecret))
+        {
+            return BadRequest(new { error = "Generate 2FA setup first" });
+        }
+
+        if (!_totpService.ValidateCode(user.TotpSecret, request.Code))
+        {
+            return BadRequest(new { error = "Invalid verification code" });
+        }
+
+        user.TotpEnabled = true;
+        user.UpdatedAt = DateTime.UtcNow;
+        await _usersContext.SaveChangesAsync();
+
+        _logger.LogInformation("2FA enabled for user {Username}", user.Username);
+
+        return Ok(new { message = "2FA enabled" });
+    }
+
+    [HttpPost("2fa/disable")]
+    public async Task<IActionResult> Disable2fa([FromBody] Disable2faRequest request)
+    {
+        var user = await GetCurrentUser(includeRecoveryCodes: true);
+        if (user is null)
+        {
+            return Unauthorized();
+        }
+
+        if (!user.TotpEnabled)
+        {
+            return BadRequest(new { error = "2FA is not enabled" });
+        }
+
+        if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash))
+        {
+            return BadRequest(new { error = "Incorrect password" });
+        }
+
+        if (!_totpService.ValidateCode(user.TotpSecret, request.TotpCode))
+        {
+            return BadRequest(new { error = "Invalid 2FA code" });
+        }
+
+        user.TotpEnabled = false;
+        user.TotpSecret = string.Empty;
+        user.UpdatedAt = DateTime.UtcNow;
+
+        // Remove all recovery codes
+        _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
+
+        await _usersContext.SaveChangesAsync();
+
+        _logger.LogInformation("2FA disabled for user {Username}", user.Username);
+
+        return Ok(new { message = "2FA disabled" });
     }
 
     [HttpGet("api-key")]
     public async Task<IActionResult> GetApiKey()
     {
         var user = await GetCurrentUser();
-        if (user is null) return Unauthorized();
+        if (user is null)
+        {
+            return Unauthorized();
+        }
 
         return Ok(new { apiKey = user.ApiKey });
     }
@@ -151,33 +296,33 @@ public sealed class AccountController : ControllerBase
     [HttpPost("api-key/regenerate")]
     public async Task<IActionResult> RegenerateApiKey()
     {
-        await UsersContext.Lock.WaitAsync();
-        try
+        var user = await GetCurrentUser();
+        if (user is null)
         {
-            var user = await GetCurrentUser();
-            if (user is null) return Unauthorized();
-
-            var bytes = new byte[32];
-            using var rng = RandomNumberGenerator.Create();
-            rng.GetBytes(bytes);
-
-            user.ApiKey = Convert.ToHexString(bytes).ToLowerInvariant();
-            user.UpdatedAt = DateTime.UtcNow;
-            await _usersContext.SaveChangesAsync();
-
-            _logger.LogInformation("API key regenerated for user {Username}", user.Username);
-
-            return Ok(new { apiKey = user.ApiKey });
-        }
-        finally
-        {
-            UsersContext.Lock.Release();
+            return Unauthorized();
         }
+
+        var bytes = new byte[32];
+        using var rng = RandomNumberGenerator.Create();
+        rng.GetBytes(bytes);
+
+        user.ApiKey = Convert.ToHexString(bytes).ToLowerInvariant();
+        user.UpdatedAt = DateTime.UtcNow;
+        await _usersContext.SaveChangesAsync();
+
+        _logger.LogInformation("API key regenerated for user {Username}", user.Username);
+
+        return Ok(new { apiKey = user.ApiKey });
     }
 
     [HttpPost("plex/link")]
     public async Task<IActionResult> StartPlexLink()
     {
+        if (await IsOidcExclusiveModeActive())
+        {
+            return StatusCode(403, new { error = "Plex account management is disabled while OIDC exclusive mode is active." });
+        }
+
         var pin = await _plexAuthService.RequestPin();
 
         return Ok(new { pinId = pin.PinId, authUrl = pin.AuthUrl });
@@ -186,6 +331,11 @@ public sealed class AccountController : ControllerBase
     [HttpPost("plex/link/verify")]
     public async Task<IActionResult> VerifyPlexLink([FromBody] PlexPinRequest request)
     {
+        if (await IsOidcExclusiveModeActive())
+        {
+            return StatusCode(403, new { error = "Plex account management is disabled while OIDC exclusive mode is active." });
+        }
+
         var pinResult = await _plexAuthService.CheckPin(request.PinId);
 
         if (!pinResult.Completed || pinResult.AuthToken is null)
@@ -195,23 +345,194 @@ public sealed class AccountController : ControllerBase
 
         var plexAccount = await _plexAuthService.GetAccount(pinResult.AuthToken);
 
+        var user = await GetCurrentUser();
+        if (user is null)
+        {
+            return Unauthorized();
+        }
+
+        user.PlexAccountId = plexAccount.AccountId;
+        user.PlexUsername = plexAccount.Username;
+        user.PlexEmail = plexAccount.Email;
+        user.PlexAuthToken = pinResult.AuthToken;
+        user.UpdatedAt = DateTime.UtcNow;
+        await _usersContext.SaveChangesAsync();
+
+        _logger.LogInformation("Plex account linked for user {Username}: {PlexUsername}",
+            user.Username, plexAccount.Username);
+
+        return Ok(new { completed = true, plexUsername = plexAccount.Username });
+    }
+
+    [HttpDelete("plex/link")]
+    public async Task<IActionResult> UnlinkPlex()
+    {
+        if (await IsOidcExclusiveModeActive())
+        {
+            return StatusCode(403, new { error = "Plex account management is disabled while OIDC exclusive mode is active." });
+        }
+
+        var user = await GetCurrentUser();
+        if (user is null)
+        {
+            return Unauthorized();
+        }
+
+        user.PlexAccountId = null;
+        user.PlexUsername = null;
+        user.PlexEmail = null;
+        user.PlexAuthToken = null;
+        user.UpdatedAt = DateTime.UtcNow;
+        await _usersContext.SaveChangesAsync();
+
+        _logger.LogInformation("Plex account unlinked for user {Username}", user.Username);
+
+        return Ok(new { message = "Plex account unlinked" });
+    }
+
+    [HttpGet("oidc")]
+    public async Task<IActionResult> GetOidcConfig()
+    {
+        var user = await GetCurrentUser();
+        if (user is null)
+        {
+            return Unauthorized();
+        }
+
+        return Ok(user.Oidc);
+    }
+
+    [HttpPut("oidc")]
+    public async Task<IActionResult> UpdateOidcConfig([FromBody] UpdateOidcConfigRequest request)
+    {
+        try
+        {
+            var user = await GetCurrentUser();
+            if (user is null)
+            {
+                return Unauthorized();
+            }
+
+            request.ApplyTo(user.Oidc);
+            user.Oidc.Validate();
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            return Ok(new { message = "OIDC configuration updated" });
+        }
+        catch (ValidationException ex)
+        {
+            return BadRequest(new { error = ex.Message });
+        }
+    }
+
+    [HttpPost("oidc/link")]
+    public async Task<IActionResult> StartOidcLink()
+    {
+        var user = await GetCurrentUser();
+        if (user is null)
+        {
+            return Unauthorized();
+        }
+
+        if (user.Oidc is not { Enabled: true })
+        {
+            return BadRequest(new { error = "OIDC is not enabled" });
+        }
+
+        var redirectUri = GetOidcLinkCallbackUrl(user.Oidc.RedirectUrl);
+        _logger.LogDebug("OIDC link start: using redirect URI {RedirectUri}", redirectUri);
+
+        try
+        {
+            var result = await _oidcAuthService.StartAuthorization(redirectUri, user.Id.ToString());
+            return Ok(new OidcStartResponse { AuthorizationUrl = result.AuthorizationUrl });
+        }
+        catch (InvalidOperationException ex)
+        {
+            _logger.LogWarning(ex, "Failed to start OIDC link authorization");
+            return StatusCode(429, new { error = ex.Message });
+        }
+    }
+
+    /// <remarks>
+    /// This endpoint must be [AllowAnonymous] because the IdP redirects the user's browser here
+    /// without a Bearer token. Security is ensured by validating that the OIDC flow was initiated
+    /// by an authenticated user (InitiatorUserId stored in the flow state during StartOidcLink).
+    /// </remarks>
+    [AllowAnonymous]
+    [HttpGet("oidc/link/callback")]
+    public async Task<IActionResult> OidcLinkCallback(
+        [FromQuery] string? code,
+        [FromQuery] string? state,
+        [FromQuery] string? error)
+    {
+        var basePath = HttpContext.Request.GetSafeBasePath();
+
+        if (!string.IsNullOrEmpty(error) || string.IsNullOrEmpty(code) || string.IsNullOrEmpty(state))
+        {
+            return Redirect($"{basePath}/settings/account?oidc_link_error=failed");
+        }
+
+        // Fetch any user to get the configured redirect URL for the OIDC callback
+        var oidcConfig = (await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync())?.Oidc;
+        var redirectUri = GetOidcLinkCallbackUrl(oidcConfig?.RedirectUrl);
+        _logger.LogDebug("OIDC link callback: using redirect URI {RedirectUri}", redirectUri);
+        var result = await _oidcAuthService.HandleCallback(code, state, redirectUri);
+
+        if (!result.Success || string.IsNullOrEmpty(result.Subject))
+        {
+            _logger.LogWarning("OIDC link callback failed: {Error}", result.Error);
+            return Redirect($"{basePath}/settings/account?oidc_link_error=failed");
+        }
+
+        // Verify the flow was initiated by an authenticated user
+        if (string.IsNullOrEmpty(result.InitiatorUserId) ||
+            !Guid.TryParse(result.InitiatorUserId, out var initiatorId))
+        {
+            _logger.LogWarning("OIDC link callback missing initiator user ID");
+            return Redirect($"{basePath}/settings/account?oidc_link_error=failed");
+        }
+
+        // Save the authorized subject to the user's OIDC config
+        var user = await _usersContext.Users.FirstOrDefaultAsync(u => u.Id == initiatorId);
+
+        if (user is null)
+        {
+            _logger.LogWarning("OIDC link callback initiator user not found: {UserId}", result.InitiatorUserId);
+            return Redirect($"{basePath}/settings/account?oidc_link_error=failed");
+        }
+
+        user.Oidc.AuthorizedSubject = result.Subject;
+        user.UpdatedAt = DateTime.UtcNow;
+        await _usersContext.SaveChangesAsync();
+
+        _logger.LogInformation("OIDC account linked with subject: {Subject} by user: {Username}",
+            result.Subject, user.Username);
+
+        return Redirect($"{basePath}/settings/account?oidc_link=success");
+    }
+
+    [HttpDelete("oidc/link")]
+    public async Task<IActionResult> UnlinkOidc()
+    {
         await UsersContext.Lock.WaitAsync();
         try
         {
             var user = await GetCurrentUser();
-            if (user is null) return Unauthorized();
+            if (user is null)
+            {
+                return Unauthorized();
+            }
 
-            user.PlexAccountId = plexAccount.AccountId;
-            user.PlexUsername = plexAccount.Username;
-            user.PlexEmail = plexAccount.Email;
-            user.PlexAuthToken = pinResult.AuthToken;
+            user.Oidc.AuthorizedSubject = string.Empty;
+            user.Oidc.ExclusiveMode = false;
             user.UpdatedAt = DateTime.UtcNow;
             await _usersContext.SaveChangesAsync();
 
-            _logger.LogInformation("Plex account linked for user {Username}: {PlexUsername}",
-                user.Username, plexAccount.Username);
+            _logger.LogInformation("OIDC account unlinked for user {Username}", user.Username);
 
-            return Ok(new { completed = true, plexUsername = plexAccount.Username });
+            return Ok(new { message = "OIDC account unlinked" });
         }
         finally
         {
@@ -219,30 +540,24 @@ public sealed class AccountController : ControllerBase
         }
     }
 
-    [HttpDelete("plex/link")]
-    public async Task<IActionResult> UnlinkPlex()
+    private string GetOidcLinkCallbackUrl(string? redirectUrl = null)
     {
-        await UsersContext.Lock.WaitAsync();
-        try
+        var baseUrl = string.IsNullOrEmpty(redirectUrl)
+            ? HttpContext.GetExternalBaseUrl()
+            : redirectUrl.TrimEnd('/');
+        return $"{baseUrl}/api/account/oidc/link/callback";
+    }
+
+    private async Task<bool> IsOidcExclusiveModeActive()
+    {
+        var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+        if (user is not { SetupCompleted: true })
         {
-            var user = await GetCurrentUser();
-            if (user is null) return Unauthorized();
-
-            user.PlexAccountId = null;
-            user.PlexUsername = null;
-            user.PlexEmail = null;
-            user.PlexAuthToken = null;
-            user.UpdatedAt = DateTime.UtcNow;
-            await _usersContext.SaveChangesAsync();
-
-            _logger.LogInformation("Plex account unlinked for user {Username}", user.Username);
-
-            return Ok(new { message = "Plex account unlinked" });
-        }
-        finally
-        {
-            UsersContext.Lock.Release();
+            return false;
         }
+
+        var oidc = user.Oidc;
+        return oidc is { Enabled: true, ExclusiveMode: true };
     }
 
     private async Task<User?> GetCurrentUser(bool includeRecoveryCodes = false)

code/backend/Cleanuparr.Api/Features/Auth/Controllers/AuthController.cs

@@ -1,6 +1,9 @@
 using System.Security.Cryptography;
+using Cleanuparr.Api.Auth;
+using Cleanuparr.Api.Extensions;
 using Cleanuparr.Api.Features.Auth.Contracts.Requests;
 using Cleanuparr.Api.Features.Auth.Contracts.Responses;
+using Cleanuparr.Api.Filters;
 using Cleanuparr.Infrastructure.Features.Auth;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Auth;
@@ -13,28 +16,35 @@ namespace Cleanuparr.Api.Features.Auth.Controllers;
 [ApiController]
 [Route("api/auth")]
 [AllowAnonymous]
+[NoCache]
 public sealed class AuthController : ControllerBase
 {
     private readonly UsersContext _usersContext;
+    private readonly DataContext _dataContext;
     private readonly IJwtService _jwtService;
     private readonly IPasswordService _passwordService;
     private readonly ITotpService _totpService;
     private readonly IPlexAuthService _plexAuthService;
+    private readonly IOidcAuthService _oidcAuthService;
     private readonly ILogger<AuthController> _logger;
 
     public AuthController(
         UsersContext usersContext,
+        DataContext dataContext,
         IJwtService jwtService,
         IPasswordService passwordService,
         ITotpService totpService,
         IPlexAuthService plexAuthService,
+        IOidcAuthService oidcAuthService,
         ILogger<AuthController> logger)
     {
         _usersContext = usersContext;
+        _dataContext = dataContext;
         _jwtService = jwtService;
         _passwordService = passwordService;
         _totpService = totpService;
         _plexAuthService = plexAuthService;
+        _oidcAuthService = oidcAuthService;
         _logger = logger;
     }
 
@@ -43,10 +53,34 @@ public sealed class AuthController : ControllerBase
     {
         var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
 
+        var authBypass = false;
+        var generalConfig = await _dataContext.GeneralConfigs.AsNoTracking().FirstOrDefaultAsync();
+        if (generalConfig is { Auth.DisableAuthForLocalAddresses: true })
+        {
+            var clientIp = TrustedNetworkAuthenticationHandler.ResolveClientIp(
+                HttpContext, generalConfig.Auth.TrustForwardedHeaders);
+            if (clientIp is not null)
+            {
+                authBypass = TrustedNetworkAuthenticationHandler.IsTrustedAddress(
+                    clientIp, generalConfig.Auth.TrustedNetworks);
+            }
+        }
+
+        var oidcConfig = user?.Oidc;
+        var oidcEnabled = oidcConfig is { Enabled: true } &&
+                          !string.IsNullOrEmpty(oidcConfig.IssuerUrl) &&
+                          !string.IsNullOrEmpty(oidcConfig.ClientId);
+
+        var oidcExclusiveMode = oidcEnabled && oidcConfig!.ExclusiveMode;
+
         return Ok(new AuthStatusResponse
         {
             SetupCompleted = user is { SetupCompleted: true },
-            PlexLinked = user?.PlexAccountId is not null
+            PlexLinked = user?.PlexAccountId is not null,
+            AuthBypassActive = authBypass,
+            OidcEnabled = oidcEnabled,
+            OidcProviderName = oidcEnabled ? oidcConfig!.ProviderName : string.Empty,
+            OidcExclusiveMode = oidcExclusiveMode
         });
     }
 
@@ -103,9 +137,9 @@ public sealed class AuthController : ControllerBase
                 return BadRequest(new { error = "Create an account first" });
             }
 
-            if (user.SetupCompleted && user.TotpEnabled)
+            if (user.SetupCompleted)
             {
-                return Conflict(new { error = "2FA is already configured" });
+                return Conflict(new { error = "Setup already completed. Use account settings to manage 2FA." });
             }
 
             // Generate new TOTP secret
@@ -160,6 +194,11 @@ public sealed class AuthController : ControllerBase
                 return BadRequest(new { error = "Create an account first" });
             }
 
+            if (user.SetupCompleted)
+            {
+                return Conflict(new { error = "Setup already completed. Use account settings to manage 2FA." });
+            }
+
             if (string.IsNullOrEmpty(user.TotpSecret))
             {
                 return BadRequest(new { error = "Generate 2FA setup first" });
@@ -196,9 +235,9 @@ public sealed class AuthController : ControllerBase
                 return BadRequest(new { error = "Create an account first" });
             }
 
-            if (!user.TotpEnabled)
+            if (user.SetupCompleted)
             {
-                return BadRequest(new { error = "2FA must be configured before completing setup" });
+                return Conflict(new { error = "Setup already completed" });
             }
 
             user.SetupCompleted = true;
@@ -218,8 +257,18 @@ public sealed class AuthController : ControllerBase
     [HttpPost("login")]
     public async Task<IActionResult> Login([FromBody] LoginRequest request)
     {
+        if (await IsOidcExclusiveModeActive())
+        {
+            return StatusCode(403, new { error = "Login with credentials is disabled. Use OIDC to sign in." });
+        }
+
         var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
 
+        // Always verify the submitted password to prevent timing-based username enumeration
+        var userHasPassword = user?.PasswordHash is not null;
+        var passwordHash = user?.PasswordHash ?? _passwordService.DummyHash;
+        var passwordValid = _passwordService.VerifyPassword(request.Password, passwordHash) && userHasPassword;
+
         if (user is null || !user.SetupCompleted)
         {
             return Unauthorized(new { error = "Invalid credentials" });
@@ -228,12 +277,11 @@ public sealed class AuthController : ControllerBase
         // Check lockout
         if (user.LockoutEnd.HasValue && user.LockoutEnd.Value > DateTime.UtcNow)
         {
-            var remaining = (int)(user.LockoutEnd.Value - DateTime.UtcNow).TotalSeconds;
+            var remaining = (int)Math.Ceiling((user.LockoutEnd.Value - DateTime.UtcNow).TotalSeconds);
             return StatusCode(429, new { error = "Account is locked", retryAfterSeconds = remaining });
         }
 
-        if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash) ||
-            !string.Equals(user.Username, request.Username, StringComparison.OrdinalIgnoreCase))
+        if (!passwordValid || !string.Equals(user.Username, request.Username, StringComparison.OrdinalIgnoreCase))
         {
             var retryAfterSeconds = await IncrementFailedAttempts(user.Id);
             return Unauthorized(new { error = "Invalid credentials", retryAfterSeconds });
@@ -242,6 +290,22 @@ public sealed class AuthController : ControllerBase
         // Reset failed attempts on successful password verification
         await ResetFailedAttempts(user.Id);
 
+        // If 2FA is not enabled, issue tokens directly
+        if (!user.TotpEnabled)
+        {
+            // Re-fetch with tracking since the query above used AsNoTracking
+            var trackedUser = await _usersContext.Users.FirstAsync(u => u.Id == user.Id);
+            var tokenResponse = await GenerateTokenResponse(trackedUser);
+
+            _logger.LogInformation("User {Username} logged in (2FA disabled)", user.Username);
+
+            return Ok(new LoginResponse
+            {
+                RequiresTwoFactor = false,
+                Tokens = tokenResponse
+            });
+        }
+
         // Password valid - require 2FA
         var loginToken = _jwtService.GenerateLoginToken(user.Id);
 
@@ -255,6 +319,11 @@ public sealed class AuthController : ControllerBase
     [HttpPost("login/2fa")]
     public async Task<IActionResult> VerifyTwoFactor([FromBody] TwoFactorRequest request)
     {
+        if (await IsOidcExclusiveModeActive())
+        {
+            return StatusCode(403, new { error = "Login with credentials is disabled. Use OIDC to sign in." });
+        }
+
         var userId = _jwtService.ValidateLoginToken(request.LoginToken);
         if (userId is null)
         {
@@ -355,6 +424,11 @@ public sealed class AuthController : ControllerBase
             return BadRequest(new { error = "Create an account first" });
         }
 
+        if (user.SetupCompleted)
+        {
+            return Conflict(new { error = "Setup already completed. Use account settings to manage Plex." });
+        }
+
         var pin = await _plexAuthService.RequestPin();
 
         return Ok(new PlexPinStatusResponse
@@ -385,6 +459,11 @@ public sealed class AuthController : ControllerBase
                 return BadRequest(new { error = "Create an account first" });
             }
 
+            if (user.SetupCompleted)
+            {
+                return Conflict(new { error = "Setup already completed. Use account settings to manage Plex." });
+            }
+
             user.PlexAccountId = plexAccount.AccountId;
             user.PlexUsername = plexAccount.Username;
             user.PlexEmail = plexAccount.Email;
@@ -406,6 +485,11 @@ public sealed class AuthController : ControllerBase
     [HttpPost("login/plex/pin")]
     public async Task<IActionResult> RequestPlexPin()
     {
+        if (await IsOidcExclusiveModeActive())
+        {
+            return StatusCode(403, new { error = "Plex login is disabled. Use OIDC to sign in." });
+        }
+
         var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
         if (user is null || !user.SetupCompleted || user.PlexAccountId is null)
         {
@@ -424,6 +508,11 @@ public sealed class AuthController : ControllerBase
     [HttpPost("login/plex/verify")]
     public async Task<IActionResult> VerifyPlexLogin([FromBody] PlexPinRequest request)
     {
+        if (await IsOidcExclusiveModeActive())
+        {
+            return StatusCode(403, new { error = "Plex login is disabled. Use OIDC to sign in." });
+        }
+
         var user = await _usersContext.Users.FirstOrDefaultAsync();
         if (user is null || !user.SetupCompleted || user.PlexAccountId is null)
         {
@@ -445,7 +534,10 @@ public sealed class AuthController : ControllerBase
             return Unauthorized(new { error = "Plex account does not match the linked account" });
         }
 
-        // Plex login bypasses 2FA
+        // Plex OAuth acts as a trusted identity provider — the user explicitly linked their
+        // Plex account during setup or via account settings (both require authentication).
+        // Since Plex login verifies the exact same Plex account ID that was linked,
+        // 2FA is not required for Plex login.
         _logger.LogInformation("User {Username} logged in via Plex", user.Username);
 
         var tokenResponse = await GenerateTokenResponse(user);
@@ -457,6 +549,119 @@ public sealed class AuthController : ControllerBase
         });
     }
 
+    [HttpPost("oidc/start")]
+    public async Task<IActionResult> StartOidc()
+    {
+        var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+        var oidcConfig = user?.Oidc;
+
+        if (oidcConfig is not { Enabled: true } ||
+            string.IsNullOrEmpty(oidcConfig.IssuerUrl) ||
+            string.IsNullOrEmpty(oidcConfig.ClientId))
+        {
+            return BadRequest(new { error = "OIDC is not enabled or not configured" });
+        }
+
+        var redirectUri = GetOidcCallbackUrl(oidcConfig.RedirectUrl);
+        _logger.LogDebug("OIDC login start: using redirect URI {RedirectUri}", redirectUri);
+
+        try
+        {
+            var result = await _oidcAuthService.StartAuthorization(redirectUri);
+            return Ok(new OidcStartResponse { AuthorizationUrl = result.AuthorizationUrl });
+        }
+        catch (InvalidOperationException ex)
+        {
+            _logger.LogWarning(ex, "Failed to start OIDC authorization");
+            return StatusCode(429, new { error = ex.Message });
+        }
+    }
+
+    [HttpGet("oidc/callback")]
+    public async Task<IActionResult> OidcCallback(
+        [FromQuery] string? code,
+        [FromQuery] string? state,
+        [FromQuery] string? error)
+    {
+        var basePath = HttpContext.Request.GetSafeBasePath();
+
+        // Handle IdP error responses
+        if (!string.IsNullOrEmpty(error))
+        {
+            _logger.LogWarning("OIDC callback received error: {Error}", error);
+            return Redirect($"{basePath}/auth/login?oidc_error=provider_error");
+        }
+
+        if (string.IsNullOrEmpty(code) || string.IsNullOrEmpty(state))
+        {
+            return Redirect($"{basePath}/auth/login?oidc_error=invalid_request");
+        }
+
+        // Load the user early so we can use the configured redirect URL
+        var user = await _usersContext.Users.FirstOrDefaultAsync(u => u.SetupCompleted);
+        if (user is null)
+        {
+            return Redirect($"{basePath}/auth/login?oidc_error=no_account");
+        }
+
+        var redirectUri = GetOidcCallbackUrl(user.Oidc.RedirectUrl);
+        _logger.LogDebug("OIDC login callback: using redirect URI {RedirectUri}", redirectUri);
+        var result = await _oidcAuthService.HandleCallback(code, state, redirectUri);
+
+        if (!result.Success)
+        {
+            _logger.LogWarning("OIDC callback failed: {Error}", result.Error);
+            return Redirect($"{basePath}/auth/login?oidc_error=authentication_failed");
+        }
+
+        if (!string.IsNullOrEmpty(user.Oidc.AuthorizedSubject) &&
+            result.Subject != user.Oidc.AuthorizedSubject)
+        {
+            _logger.LogWarning("OIDC subject mismatch. Expected: {Expected}, Got: {Got}",
+                user.Oidc.AuthorizedSubject, result.Subject);
+            return Redirect($"{basePath}/auth/login?oidc_error=unauthorized");
+        }
+
+        var tokenResponse = await GenerateTokenResponse(user);
+
+        // Store tokens with a one-time code (never put tokens in the URL)
+        var oneTimeCode = _oidcAuthService.StoreOneTimeCode(
+            tokenResponse.AccessToken,
+            tokenResponse.RefreshToken,
+            tokenResponse.ExpiresIn);
+
+        _logger.LogInformation("User {Username} authenticated via OIDC (subject: {Subject})",
+            user.Username, result.Subject);
+
+        return Redirect($"{basePath}/auth/oidc/callback?code={Uri.EscapeDataString(oneTimeCode)}");
+    }
+
+    [HttpPost("oidc/exchange")]
+    public IActionResult ExchangeOidcCode([FromBody] OidcExchangeRequest request)
+    {
+        var result = _oidcAuthService.ExchangeOneTimeCode(request.Code);
+
+        if (result is null)
+        {
+            return NotFound(new { error = "Invalid or expired code" });
+        }
+
+        return Ok(new TokenResponse
+        {
+            AccessToken = result.AccessToken,
+            RefreshToken = result.RefreshToken,
+            ExpiresIn = result.ExpiresIn
+        });
+    }
+
+    private string GetOidcCallbackUrl(string? redirectUrl = null)
+    {
+        var baseUrl = string.IsNullOrEmpty(redirectUrl)
+            ? HttpContext.GetExternalBaseUrl()
+            : redirectUrl.TrimEnd('/');
+        return $"{baseUrl}/api/auth/oidc/callback";
+    }
+
     private async Task<TokenResponse> GenerateTokenResponse(User user)
     {
         var accessToken = _jwtService.GenerateAccessToken(user);
@@ -477,7 +682,7 @@ public sealed class AuthController : ControllerBase
         {
             AccessToken = accessToken,
             RefreshToken = refreshToken,
-            ExpiresIn = 60 // seconds
+            ExpiresIn = 3600 // seconds
         };
     }
 
@@ -558,4 +763,16 @@ public sealed class AuthController : ControllerBase
         var hash = SHA256.HashData(bytes);
         return Convert.ToBase64String(hash);
     }
+
+    private async Task<bool> IsOidcExclusiveModeActive()
+    {
+        var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
+        if (user is not { SetupCompleted: true })
+        {
+            return false;
+        }
+
+        var oidc = user.Oidc;
+        return oidc is { Enabled: true, ExclusiveMode: true };
+    }
 }

code/backend/Cleanuparr.Api/Features/BlacklistSync/Controllers/BlacklistSyncConfigController.cs

@@ -6,6 +6,7 @@ using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration.BlacklistSync;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
@@ -14,6 +15,7 @@ namespace Cleanuparr.Api.Features.BlacklistSync.Controllers;
 
 [ApiController]
 [Route("api/configuration")]
+[Authorize]
 public sealed class BlacklistSyncConfigController : ControllerBase
 {
     private readonly ILogger<BlacklistSyncConfigController> _logger;

code/backend/Cleanuparr.Api/Features/DownloadCleaner/Controllers/DownloadCleanerConfigController.cs

@@ -9,6 +9,7 @@ using Cleanuparr.Infrastructure.Utilities;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration;
 using Cleanuparr.Persistence.Models.Configuration.DownloadCleaner;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
@@ -17,6 +18,7 @@ namespace Cleanuparr.Api.Features.DownloadCleaner.Controllers;
 
 [ApiController]
 [Route("api/configuration")]
+[Authorize]
 public sealed class DownloadCleanerConfigController : ControllerBase
 {
     private readonly ILogger<DownloadCleanerConfigController> _logger;

code/backend/Cleanuparr.Api/Features/DownloadClient/Contracts/Requests/CreateDownloadClientRequest.cs

@@ -3,6 +3,7 @@ using System;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Domain.Exceptions;
 using Cleanuparr.Persistence.Models.Configuration;
+using Cleanuparr.Shared.Helpers;
 
 namespace Cleanuparr.Api.Features.DownloadClient.Contracts.Requests;
 
@@ -47,6 +48,11 @@ public sealed record CreateDownloadClientRequest
         {
             throw new ValidationException("External URL is not a valid URL");
         }
+
+        if (Password.IsPlaceholder())
+        {
+            throw new ValidationException("Password cannot be a placeholder value");
+        }
     }
 
     public DownloadClientConfig ToEntity() => new()

code/backend/Cleanuparr.Api/Features/DownloadClient/Contracts/Requests/TestDownloadClientRequest.cs

@@ -3,6 +3,7 @@ using System;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Domain.Exceptions;
 using Cleanuparr.Persistence.Models.Configuration;
+using Cleanuparr.Shared.Helpers;
 
 namespace Cleanuparr.Api.Features.DownloadClient.Contracts.Requests;
 
@@ -20,6 +21,8 @@ public sealed record TestDownloadClientRequest
 
     public string? UrlBase { get; init; }
 
+    public Guid? ClientId { get; init; }
+
     public void Validate()
     {
         if (string.IsNullOrWhiteSpace(Host))
@@ -33,16 +36,26 @@ public sealed record TestDownloadClientRequest
         }
     }
 
-    public DownloadClientConfig ToTestConfig() => new()
+    public DownloadClientConfig ToTestConfig(string? resolvedPassword = null)
     {
-        Id = Guid.NewGuid(),
-        Enabled = true,
-        Name = "Test Client",
-        TypeName = TypeName,
-        Type = Type,
-        Host = new Uri(Host!, UriKind.RelativeOrAbsolute),
-        Username = Username,
-        Password = Password,
-        UrlBase = UrlBase,
-    };
+        var password = resolvedPassword ?? Password;
+
+        if (password.IsPlaceholder())
+        {
+            throw new ValidationException("Password cannot be a placeholder value");
+        }
+
+        return new()
+        {
+            Id = Guid.NewGuid(),
+            Enabled = true,
+            Name = "Test Client",
+            TypeName = TypeName,
+            Type = Type,
+            Host = new Uri(Host!, UriKind.RelativeOrAbsolute),
+            Username = Username,
+            Password = password,
+            UrlBase = UrlBase,
+        };
+    }
 }

code/backend/Cleanuparr.Api/Features/DownloadClient/Contracts/Requests/UpdateDownloadClientRequest.cs

@@ -3,6 +3,7 @@ using System;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Domain.Exceptions;
 using Cleanuparr.Persistence.Models.Configuration;
+using Cleanuparr.Shared.Helpers;
 
 namespace Cleanuparr.Api.Features.DownloadClient.Contracts.Requests;
 
@@ -57,7 +58,7 @@ public sealed record UpdateDownloadClientRequest
         Type = Type,
         Host = new Uri(Host!, UriKind.RelativeOrAbsolute),
         Username = Username,
-        Password = Password,
+        Password = Password.IsPlaceholder() ? existing.Password : Password,
         UrlBase = UrlBase,
         ExternalUrl = !string.IsNullOrWhiteSpace(ExternalUrl) ? new Uri(ExternalUrl, UriKind.RelativeOrAbsolute) : null,
     };

code/backend/Cleanuparr.Api/Features/DownloadClient/Controllers/DownloadClientController.cs

@@ -5,6 +5,8 @@ using Cleanuparr.Api.Features.DownloadClient.Contracts.Requests;
 using Cleanuparr.Infrastructure.Features.DownloadClient;
 using Cleanuparr.Infrastructure.Http.DynamicHttpClientSystem;
 using Cleanuparr.Persistence;
+using Cleanuparr.Shared.Helpers;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 
@@ -12,6 +14,7 @@ namespace Cleanuparr.Api.Features.DownloadClient.Controllers;
 
 [ApiController]
 [Route("api/configuration")]
+[Authorize]
 public sealed class DownloadClientController : ControllerBase
 {
     private readonly ILogger<DownloadClientController> _logger;
@@ -156,7 +159,23 @@ public sealed class DownloadClientController : ControllerBase
         {
             request.Validate();
 
-            var testConfig = request.ToTestConfig();
+            string? resolvedPassword = null;
+
+            if (request.Password.IsPlaceholder() && request.ClientId.HasValue)
+            {
+                var existingClient = await _dataContext.DownloadClients
+                    .AsNoTracking()
+                    .FirstOrDefaultAsync(c => c.Id == request.ClientId.Value);
+
+                if (existingClient is null)
+                {
+                    return NotFound($"Download client with ID {request.ClientId.Value} not found");
+                }
+
+                resolvedPassword = existingClient.Password;
+            }
+
+            var testConfig = request.ToTestConfig(resolvedPassword);
             using var downloadService = _downloadServiceFactory.GetDownloadService(testConfig);
             var healthResult = await downloadService.HealthCheckAsync();
 

code/backend/Cleanuparr.Api/Features/General/Contracts/Requests/UpdateGeneralConfigRequest.cs

@@ -2,7 +2,6 @@ using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Http.DynamicHttpClientSystem;
 using Cleanuparr.Infrastructure.Logging;
 using Cleanuparr.Persistence.Models.Configuration.General;
-using Cleanuparr.Shared.Helpers;
 using Serilog.Events;
 using ValidationException = Cleanuparr.Domain.Exceptions.ValidationException;
 
@@ -20,10 +19,6 @@ public sealed record UpdateGeneralConfigRequest
 
     public CertificateValidationType HttpCertificateValidation { get; init; } = CertificateValidationType.Enabled;
 
-    public bool SearchEnabled { get; init; } = true;
-
-    public ushort SearchDelay { get; init; } = Constants.DefaultSearchDelaySeconds;
-
     public bool StatusCheckEnabled { get; init; } = true;
 
     public string EncryptionKey { get; init; } = Guid.NewGuid().ToString();
@@ -34,6 +29,8 @@ public sealed record UpdateGeneralConfigRequest
 
     public UpdateLoggingConfigRequest Log { get; init; } = new();
 
+    public UpdateAuthConfigRequest Auth { get; init; } = new();
+
     public GeneralConfig ApplyTo(GeneralConfig existingConfig, IServiceProvider services, ILogger logger)
     {
         existingConfig.DisplaySupportBanner = DisplaySupportBanner;
@@ -41,14 +38,13 @@ public sealed record UpdateGeneralConfigRequest
         existingConfig.HttpMaxRetries = HttpMaxRetries;
         existingConfig.HttpTimeout = HttpTimeout;
         existingConfig.HttpCertificateValidation = HttpCertificateValidation;
-        existingConfig.SearchEnabled = SearchEnabled;
-        existingConfig.SearchDelay = SearchDelay;
         existingConfig.StatusCheckEnabled = StatusCheckEnabled;
         existingConfig.EncryptionKey = EncryptionKey;
         existingConfig.IgnoredDownloads = IgnoredDownloads;
         existingConfig.StrikeInactivityWindowHours = StrikeInactivityWindowHours;
 
         bool loggingChanged = Log.ApplyTo(existingConfig.Log);
+        Auth.ApplyTo(existingConfig.Auth);
 
         Validate(existingConfig);
 
@@ -75,6 +71,7 @@ public sealed record UpdateGeneralConfigRequest
         }
 
         config.Log.Validate();
+        config.Auth.Validate();
     }
 
     private void ApplySideEffects(GeneralConfig config, IServiceProvider services, ILogger logger, bool loggingChanged)
@@ -145,3 +142,19 @@ public sealed record UpdateLoggingConfigRequest
 
     public bool LevelOnlyChange { get; private set; }
 }
+
+public sealed record UpdateAuthConfigRequest
+{
+    public bool DisableAuthForLocalAddresses { get; init; }
+
+    public bool TrustForwardedHeaders { get; init; }
+
+    public List<string> TrustedNetworks { get; init; } = [];
+
+    public void ApplyTo(AuthConfig existingConfig)
+    {
+        existingConfig.DisableAuthForLocalAddresses = DisableAuthForLocalAddresses;
+        existingConfig.TrustForwardedHeaders = TrustForwardedHeaders;
+        existingConfig.TrustedNetworks = TrustedNetworks;
+    }
+}

code/backend/Cleanuparr.Api/Features/General/Controllers/GeneralConfigController.cs

@@ -4,6 +4,7 @@ using System.Threading.Tasks;
 
 using Cleanuparr.Api.Features.General.Contracts.Requests;
 using Cleanuparr.Persistence;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
@@ -12,6 +13,7 @@ namespace Cleanuparr.Api.Features.General.Controllers;
 
 [ApiController]
 [Route("api/configuration")]
+[Authorize]
 public sealed class GeneralConfigController : ControllerBase
 {
     private readonly ILogger<GeneralConfigController> _logger;
@@ -61,14 +63,38 @@ public sealed class GeneralConfigController : ControllerBase
 
             if (wasDryRun && !config.DryRun)
             {
-                var deletedStrikes = await eventsContext.Strikes.ExecuteDeleteAsync();
-                var deletedItems = await eventsContext.DownloadItems
-                    .Where(d => !d.Strikes.Any())
-                    .ExecuteDeleteAsync();
+                await using var transaction = await eventsContext.Database.BeginTransactionAsync();
 
-                _logger.LogWarning(
-                    "Dry run disabled — purged all strikes: {Strikes} strikes, {Items} download items removed",
-                    deletedStrikes, deletedItems);
+                try
+                {
+                    var deletedStrikes = await eventsContext.Strikes
+                        .Where(s => s.IsDryRun)
+                        .ExecuteDeleteAsync();
+                    var deletedEvents = await eventsContext.Events
+                        .Where(e => e.IsDryRun)
+                        .ExecuteDeleteAsync();
+                    var deletedManualEvents = await eventsContext.ManualEvents
+                        .Where(e => e.IsDryRun)
+                        .ExecuteDeleteAsync();
+                    var deletedItems = await eventsContext.DownloadItems
+                        .Where(d => !d.Strikes.Any())
+                        .ExecuteDeleteAsync();
+
+                    var deletedHistory = await _dataContext.SeekerHistory
+                        .Where(h => h.IsDryRun)
+                        .ExecuteDeleteAsync();
+
+                    _logger.LogWarning(
+                        "Dry run disabled — purged dry-run data: {Strikes} strikes, {Events} events, {ManualEvents} manual events, {Items} orphaned download items, {History} search history entries removed",
+                        deletedStrikes, deletedEvents, deletedManualEvents, deletedItems, deletedHistory);
+
+                    await transaction.CommitAsync();
+                }
+                catch
+                {
+                    await transaction.RollbackAsync();
+                    throw;
+                }
             }
 
             return Ok(new { Message = "General configuration updated successfully" });

code/backend/Cleanuparr.Api/Features/MalwareBlocker/Contracts/Requests/UpdateMalwareBlockerConfigRequest.cs

@@ -16,7 +16,7 @@ public sealed record UpdateMalwareBlockerConfigRequest
 
     public bool DeletePrivate { get; init; }
 
-    public bool DeleteKnownMalware { get; init; }
+    public bool ProcessNoContentId { get; init; }
 
     public BlocklistSettings Sonarr { get; init; } = new();
 
@@ -37,7 +37,7 @@ public sealed record UpdateMalwareBlockerConfigRequest
         config.UseAdvancedScheduling = UseAdvancedScheduling;
         config.IgnorePrivate = IgnorePrivate;
         config.DeletePrivate = DeletePrivate;
-        config.DeleteKnownMalware = DeleteKnownMalware;
+        config.ProcessNoContentId = ProcessNoContentId;
         config.Sonarr = Sonarr;
         config.Radarr = Radarr;
         config.Lidarr = Lidarr;

code/backend/Cleanuparr.Api/Features/MalwareBlocker/Controllers/MalwareBlockerConfigController.cs

@@ -8,6 +8,7 @@ using Cleanuparr.Infrastructure.Utilities;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration;
 using Cleanuparr.Persistence.Models.Configuration.MalwareBlocker;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
@@ -16,6 +17,7 @@ namespace Cleanuparr.Api.Features.MalwareBlocker.Controllers;
 
 [ApiController]
 [Route("api/configuration")]
+[Authorize]
 public sealed class MalwareBlockerConfigController : ControllerBase
 {
     private readonly ILogger<MalwareBlockerConfigController> _logger;

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/CreateNotificationProviderRequestBase.cs

@@ -17,4 +17,6 @@ public abstract record CreateNotificationProviderRequestBase
     public bool OnDownloadCleaned { get; init; }
     
     public bool OnCategoryChanged { get; init; }
+
+    public bool OnSearchTriggered { get; init; }
 }

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/TestAppriseProviderRequest.cs

@@ -15,4 +15,6 @@ public record TestAppriseProviderRequest
 
     // CLI mode fields
     public string? ServiceUrls { get; init; }
+
+    public Guid? ProviderId { get; init; }
 }

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/TestDiscordProviderRequest.cs

@@ -7,4 +7,6 @@ public record TestDiscordProviderRequest
     public string Username { get; init; } = string.Empty;
 
     public string AvatarUrl { get; init; } = string.Empty;
+
+    public Guid? ProviderId { get; init; }
 }

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/TestGotifyProviderRequest.cs

@@ -7,4 +7,6 @@ public record TestGotifyProviderRequest
     public string ApplicationToken { get; init; } = string.Empty;
 
     public int Priority { get; init; } = 5;
+
+    public Guid? ProviderId { get; init; }
 }

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/TestNotifiarrProviderRequest.cs

@@ -3,6 +3,8 @@ namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
 public record TestNotifiarrProviderRequest
 {
     public string ApiKey { get; init; } = string.Empty;
-    
+
     public string ChannelId { get; init; } = string.Empty;
+
+    public Guid? ProviderId { get; init; }
 }

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/TestNtfyProviderRequest.cs

@@ -19,4 +19,6 @@ public record TestNtfyProviderRequest
     public NtfyPriority Priority { get; init; } = NtfyPriority.Default;
     
     public List<string> Tags { get; init; } = [];
+
+    public Guid? ProviderId { get; init; }
 }

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/TestPushoverProviderRequest.cs

@@ -19,4 +19,6 @@ public record TestPushoverProviderRequest
     public int? Expire { get; init; }
 
     public List<string> Tags { get; init; } = [];
+
+    public Guid? ProviderId { get; init; }
 }

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/TestTelegramProviderRequest.cs

@@ -9,4 +9,6 @@ public sealed record TestTelegramProviderRequest
     public string? TopicId { get; init; }
 
     public bool SendSilently { get; init; }
+
+    public Guid? ProviderId { get; init; }
 }

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/UpdateNotificationProviderRequestBase.cs

@@ -17,4 +17,6 @@ public abstract record UpdateNotificationProviderRequestBase
     public bool OnDownloadCleaned { get; init; }
     
     public bool OnCategoryChanged { get; init; }
+
+    public bool OnSearchTriggered { get; init; }
 }

code/backend/Cleanuparr.Api/Features/Notifications/Controllers/NotificationProvidersController.cs

@@ -11,6 +11,8 @@ using Cleanuparr.Infrastructure.Features.Notifications.Telegram;
 using Cleanuparr.Infrastructure.Features.Notifications.Gotify;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration.Notification;
+using Cleanuparr.Shared.Helpers;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 
@@ -18,6 +20,7 @@ namespace Cleanuparr.Api.Features.Notifications.Controllers;
 
 [ApiController]
 [Route("api/configuration/notification_providers")]
+[Authorize]
 public sealed class NotificationProvidersController : ControllerBase
 {
     private readonly ILogger<NotificationProvidersController> _logger;
@@ -71,7 +74,8 @@ public sealed class NotificationProvidersController : ControllerBase
                         OnSlowStrike = p.OnSlowStrike,
                         OnQueueItemDeleted = p.OnQueueItemDeleted,
                         OnDownloadCleaned = p.OnDownloadCleaned,
-                        OnCategoryChanged = p.OnCategoryChanged
+                        OnCategoryChanged = p.OnCategoryChanged,
+                        OnSearchTriggered = p.OnSearchTriggered
                     },
                     Configuration = p.Type switch
                     {
@@ -127,6 +131,11 @@ public sealed class NotificationProvidersController : ControllerBase
                 return BadRequest("A provider with this name already exists");
             }
 
+            if (newProvider.ApiKey.IsPlaceholder())
+            {
+                return BadRequest("API key cannot be a placeholder value");
+            }
+
             var notifiarrConfig = new NotifiarrConfig
             {
                 ApiKey = newProvider.ApiKey,
@@ -145,6 +154,7 @@ public sealed class NotificationProvidersController : ControllerBase
                 OnQueueItemDeleted = newProvider.OnQueueItemDeleted,
                 OnDownloadCleaned = newProvider.OnDownloadCleaned,
                 OnCategoryChanged = newProvider.OnCategoryChanged,
+                OnSearchTriggered = newProvider.OnSearchTriggered,
                 NotifiarrConfiguration = notifiarrConfig
             };
 
@@ -184,6 +194,16 @@ public sealed class NotificationProvidersController : ControllerBase
                 return BadRequest("A provider with this name already exists");
             }
 
+            if (newProvider.Key.IsPlaceholder())
+            {
+                return BadRequest("Key cannot be a placeholder value");
+            }
+
+            if (newProvider.ServiceUrls.IsPlaceholder())
+            {
+                return BadRequest("Service URLs cannot be a placeholder value");
+            }
+
             var appriseConfig = new AppriseConfig
             {
                 Mode = newProvider.Mode,
@@ -205,6 +225,7 @@ public sealed class NotificationProvidersController : ControllerBase
                 OnQueueItemDeleted = newProvider.OnQueueItemDeleted,
                 OnDownloadCleaned = newProvider.OnDownloadCleaned,
                 OnCategoryChanged = newProvider.OnCategoryChanged,
+                OnSearchTriggered = newProvider.OnSearchTriggered,
                 AppriseConfiguration = appriseConfig
             };
 
@@ -248,6 +269,16 @@ public sealed class NotificationProvidersController : ControllerBase
                 return BadRequest("A provider with this name already exists");
             }
 
+            if (newProvider.Password.IsPlaceholder())
+            {
+                return BadRequest("Password cannot be a placeholder value");
+            }
+
+            if (newProvider.AccessToken.IsPlaceholder())
+            {
+                return BadRequest("Access token cannot be a placeholder value");
+            }
+
             var ntfyConfig = new NtfyConfig
             {
                 ServerUrl = newProvider.ServerUrl,
@@ -272,6 +303,7 @@ public sealed class NotificationProvidersController : ControllerBase
                 OnQueueItemDeleted = newProvider.OnQueueItemDeleted,
                 OnDownloadCleaned = newProvider.OnDownloadCleaned,
                 OnCategoryChanged = newProvider.OnCategoryChanged,
+                OnSearchTriggered = newProvider.OnSearchTriggered,
                 NtfyConfiguration = ntfyConfig
             };
 
@@ -315,6 +347,11 @@ public sealed class NotificationProvidersController : ControllerBase
                 return BadRequest("A provider with this name already exists");
             }
 
+            if (newProvider.BotToken.IsPlaceholder())
+            {
+                return BadRequest("Bot token cannot be a placeholder value");
+            }
+
             var telegramConfig = new TelegramConfig
             {
                 BotToken = newProvider.BotToken,
@@ -335,6 +372,7 @@ public sealed class NotificationProvidersController : ControllerBase
                 OnQueueItemDeleted = newProvider.OnQueueItemDeleted,
                 OnDownloadCleaned = newProvider.OnDownloadCleaned,
                 OnCategoryChanged = newProvider.OnCategoryChanged,
+                OnSearchTriggered = newProvider.OnSearchTriggered,
                 TelegramConfiguration = telegramConfig
             };
 
@@ -392,7 +430,9 @@ public sealed class NotificationProvidersController : ControllerBase
 
             var notifiarrConfig = new NotifiarrConfig
             {
-                ApiKey = updatedProvider.ApiKey,
+                ApiKey = updatedProvider.ApiKey.IsPlaceholder()
+                    ? existingProvider.NotifiarrConfiguration!.ApiKey
+                    : updatedProvider.ApiKey,
                 ChannelId = updatedProvider.ChannelId
             };
 
@@ -412,6 +452,7 @@ public sealed class NotificationProvidersController : ControllerBase
                 OnQueueItemDeleted = updatedProvider.OnQueueItemDeleted,
                 OnDownloadCleaned = updatedProvider.OnDownloadCleaned,
                 OnCategoryChanged = updatedProvider.OnCategoryChanged,
+                OnSearchTriggered = updatedProvider.OnSearchTriggered,
                 NotifiarrConfiguration = notifiarrConfig,
                 UpdatedAt = DateTime.UtcNow
             };
@@ -473,9 +514,13 @@ public sealed class NotificationProvidersController : ControllerBase
             {
                 Mode = updatedProvider.Mode,
                 Url = updatedProvider.Url,
-                Key = updatedProvider.Key,
+                Key = updatedProvider.Key.IsPlaceholder()
+                    ? existingProvider.AppriseConfiguration!.Key
+                    : updatedProvider.Key,
                 Tags = updatedProvider.Tags,
-                ServiceUrls = updatedProvider.ServiceUrls
+                ServiceUrls = updatedProvider.ServiceUrls.IsPlaceholder()
+                    ? existingProvider.AppriseConfiguration!.ServiceUrls
+                    : updatedProvider.ServiceUrls
             };
 
             if (existingProvider.AppriseConfiguration != null)
@@ -494,6 +539,7 @@ public sealed class NotificationProvidersController : ControllerBase
                 OnQueueItemDeleted = updatedProvider.OnQueueItemDeleted,
                 OnDownloadCleaned = updatedProvider.OnDownloadCleaned,
                 OnCategoryChanged = updatedProvider.OnCategoryChanged,
+                OnSearchTriggered = updatedProvider.OnSearchTriggered,
                 AppriseConfiguration = appriseConfig,
                 UpdatedAt = DateTime.UtcNow
             };
@@ -557,8 +603,12 @@ public sealed class NotificationProvidersController : ControllerBase
                 Topics = updatedProvider.Topics,
                 AuthenticationType = updatedProvider.AuthenticationType,
                 Username = updatedProvider.Username,
-                Password = updatedProvider.Password,
-                AccessToken = updatedProvider.AccessToken,
+                Password = updatedProvider.Password.IsPlaceholder()
+                    ? existingProvider.NtfyConfiguration!.Password
+                    : updatedProvider.Password,
+                AccessToken = updatedProvider.AccessToken.IsPlaceholder()
+                    ? existingProvider.NtfyConfiguration!.AccessToken
+                    : updatedProvider.AccessToken,
                 Priority = updatedProvider.Priority,
                 Tags = updatedProvider.Tags
             };
@@ -579,6 +629,7 @@ public sealed class NotificationProvidersController : ControllerBase
                 OnQueueItemDeleted = updatedProvider.OnQueueItemDeleted,
                 OnDownloadCleaned = updatedProvider.OnDownloadCleaned,
                 OnCategoryChanged = updatedProvider.OnCategoryChanged,
+                OnSearchTriggered = updatedProvider.OnSearchTriggered,
                 NtfyConfiguration = ntfyConfig,
                 UpdatedAt = DateTime.UtcNow
             };
@@ -638,7 +689,9 @@ public sealed class NotificationProvidersController : ControllerBase
 
             var telegramConfig = new TelegramConfig
             {
-                BotToken = updatedProvider.BotToken,
+                BotToken = updatedProvider.BotToken.IsPlaceholder()
+                    ? existingProvider.TelegramConfiguration!.BotToken
+                    : updatedProvider.BotToken,
                 ChatId = updatedProvider.ChatId,
                 TopicId = updatedProvider.TopicId,
                 SendSilently = updatedProvider.SendSilently
@@ -660,6 +713,7 @@ public sealed class NotificationProvidersController : ControllerBase
                 OnQueueItemDeleted = updatedProvider.OnQueueItemDeleted,
                 OnDownloadCleaned = updatedProvider.OnDownloadCleaned,
                 OnCategoryChanged = updatedProvider.OnCategoryChanged,
+                OnSearchTriggered = updatedProvider.OnSearchTriggered,
                 TelegramConfiguration = telegramConfig,
                 UpdatedAt = DateTime.UtcNow
             };
@@ -735,9 +789,24 @@ public sealed class NotificationProvidersController : ControllerBase
     {
         try
         {
+            var apiKey = testRequest.ApiKey;
+
+            if (apiKey.IsPlaceholder())
+            {
+                var existing = await GetExistingProviderConfig<NotifiarrConfig>(
+                    testRequest.ProviderId, NotificationProviderType.Notifiarr, p => p.NotifiarrConfiguration);
+
+                if (existing is null)
+                {
+                    return BadRequest(new { Message = "API key cannot be a placeholder value" });
+                }
+
+                apiKey = existing.ApiKey;
+            }
+
             var notifiarrConfig = new NotifiarrConfig
             {
-                ApiKey = testRequest.ApiKey,
+                ApiKey = apiKey,
                 ChannelId = testRequest.ChannelId
             };
             notifiarrConfig.Validate();
@@ -755,7 +824,8 @@ public sealed class NotificationProvidersController : ControllerBase
                     OnSlowStrike = false,
                     OnQueueItemDeleted = false,
                     OnDownloadCleaned = false,
-                    OnCategoryChanged = false
+                    OnCategoryChanged = false,
+                    OnSearchTriggered = false
                 },
                 Configuration = notifiarrConfig
             };
@@ -775,13 +845,37 @@ public sealed class NotificationProvidersController : ControllerBase
     {
         try
         {
+            var key = testRequest.Key;
+            var serviceUrls = testRequest.ServiceUrls;
+
+            if (key.IsPlaceholder() || serviceUrls.IsPlaceholder())
+            {
+                var existing = await GetExistingProviderConfig<AppriseConfig>(
+                    testRequest.ProviderId, NotificationProviderType.Apprise, p => p.AppriseConfiguration);
+
+                if (existing is null)
+                {
+                    return BadRequest(new { Message = "Sensitive fields cannot be placeholder values" });
+                }
+
+                if (key.IsPlaceholder())
+                {
+                    key = existing.Key;
+                }
+
+                if (serviceUrls.IsPlaceholder())
+                {
+                    serviceUrls = existing.ServiceUrls;
+                }
+            }
+
             var appriseConfig = new AppriseConfig
             {
                 Mode = testRequest.Mode,
                 Url = testRequest.Url,
-                Key = testRequest.Key,
+                Key = key,
                 Tags = testRequest.Tags,
-                ServiceUrls = testRequest.ServiceUrls
+                ServiceUrls = serviceUrls
             };
             appriseConfig.Validate();
 
@@ -798,7 +892,8 @@ public sealed class NotificationProvidersController : ControllerBase
                     OnSlowStrike = false,
                     OnQueueItemDeleted = false,
                     OnDownloadCleaned = false,
-                    OnCategoryChanged = false
+                    OnCategoryChanged = false,
+                    OnSearchTriggered = false
                 },
                 Configuration = appriseConfig
             };
@@ -822,14 +917,38 @@ public sealed class NotificationProvidersController : ControllerBase
     {
         try
         {
+            var password = testRequest.Password;
+            var accessToken = testRequest.AccessToken;
+
+            if (password.IsPlaceholder() || accessToken.IsPlaceholder())
+            {
+                var existing = await GetExistingProviderConfig<NtfyConfig>(
+                    testRequest.ProviderId, NotificationProviderType.Ntfy, p => p.NtfyConfiguration);
+
+                if (existing is null)
+                {
+                    return BadRequest(new { Message = "Sensitive fields cannot be placeholder values" });
+                }
+
+                if (password.IsPlaceholder())
+                {
+                    password = existing.Password;
+                }
+
+                if (accessToken.IsPlaceholder())
+                {
+                    accessToken = existing.AccessToken;
+                }
+            }
+
             var ntfyConfig = new NtfyConfig
             {
                 ServerUrl = testRequest.ServerUrl,
                 Topics = testRequest.Topics,
                 AuthenticationType = testRequest.AuthenticationType,
                 Username = testRequest.Username,
-                Password = testRequest.Password,
-                AccessToken = testRequest.AccessToken,
+                Password = password,
+                AccessToken = accessToken,
                 Priority = testRequest.Priority,
                 Tags = testRequest.Tags
             };
@@ -848,7 +967,8 @@ public sealed class NotificationProvidersController : ControllerBase
                     OnSlowStrike = false,
                     OnQueueItemDeleted = false,
                     OnDownloadCleaned = false,
-                    OnCategoryChanged = false
+                    OnCategoryChanged = false,
+                    OnSearchTriggered = false
                 },
                 Configuration = ntfyConfig
             };
@@ -868,9 +988,24 @@ public sealed class NotificationProvidersController : ControllerBase
     {
         try
         {
+            var botToken = testRequest.BotToken;
+
+            if (botToken.IsPlaceholder())
+            {
+                var existing = await GetExistingProviderConfig<TelegramConfig>(
+                    testRequest.ProviderId, NotificationProviderType.Telegram, p => p.TelegramConfiguration);
+
+                if (existing is null)
+                {
+                    return BadRequest(new { Message = "Bot token cannot be a placeholder value" });
+                }
+
+                botToken = existing.BotToken;
+            }
+
             var telegramConfig = new TelegramConfig
             {
-                BotToken = testRequest.BotToken,
+                BotToken = botToken,
                 ChatId = testRequest.ChatId,
                 TopicId = testRequest.TopicId,
                 SendSilently = testRequest.SendSilently
@@ -890,7 +1025,8 @@ public sealed class NotificationProvidersController : ControllerBase
                     OnSlowStrike = false,
                     OnQueueItemDeleted = false,
                     OnDownloadCleaned = false,
-                    OnCategoryChanged = false
+                    OnCategoryChanged = false,
+                    OnSearchTriggered = false
                 },
                 Configuration = telegramConfig
             };
@@ -925,7 +1061,8 @@ public sealed class NotificationProvidersController : ControllerBase
                 OnSlowStrike = provider.OnSlowStrike,
                 OnQueueItemDeleted = provider.OnQueueItemDeleted,
                 OnDownloadCleaned = provider.OnDownloadCleaned,
-                OnCategoryChanged = provider.OnCategoryChanged
+                OnCategoryChanged = provider.OnCategoryChanged,
+                OnSearchTriggered = provider.OnSearchTriggered
             },
             Configuration = provider.Type switch
             {
@@ -958,6 +1095,11 @@ public sealed class NotificationProvidersController : ControllerBase
                 return BadRequest("A provider with this name already exists");
             }
 
+            if (newProvider.WebhookUrl.IsPlaceholder())
+            {
+                return BadRequest("Webhook URL cannot be a placeholder value");
+            }
+
             var discordConfig = new DiscordConfig
             {
                 WebhookUrl = newProvider.WebhookUrl,
@@ -977,6 +1119,7 @@ public sealed class NotificationProvidersController : ControllerBase
                 OnQueueItemDeleted = newProvider.OnQueueItemDeleted,
                 OnDownloadCleaned = newProvider.OnDownloadCleaned,
                 OnCategoryChanged = newProvider.OnCategoryChanged,
+                OnSearchTriggered = newProvider.OnSearchTriggered,
                 DiscordConfiguration = discordConfig
             };
 
@@ -1034,7 +1177,9 @@ public sealed class NotificationProvidersController : ControllerBase
 
             var discordConfig = new DiscordConfig
             {
-                WebhookUrl = updatedProvider.WebhookUrl,
+                WebhookUrl = updatedProvider.WebhookUrl.IsPlaceholder()
+                    ? existingProvider.DiscordConfiguration!.WebhookUrl
+                    : updatedProvider.WebhookUrl,
                 Username = updatedProvider.Username,
                 AvatarUrl = updatedProvider.AvatarUrl
             };
@@ -1055,6 +1200,7 @@ public sealed class NotificationProvidersController : ControllerBase
                 OnQueueItemDeleted = updatedProvider.OnQueueItemDeleted,
                 OnDownloadCleaned = updatedProvider.OnDownloadCleaned,
                 OnCategoryChanged = updatedProvider.OnCategoryChanged,
+                OnSearchTriggered = updatedProvider.OnSearchTriggered,
                 DiscordConfiguration = discordConfig,
                 UpdatedAt = DateTime.UtcNow
             };
@@ -1088,9 +1234,24 @@ public sealed class NotificationProvidersController : ControllerBase
     {
         try
         {
+            var webhookUrl = testRequest.WebhookUrl;
+
+            if (webhookUrl.IsPlaceholder())
+            {
+                var existing = await GetExistingProviderConfig<DiscordConfig>(
+                    testRequest.ProviderId, NotificationProviderType.Discord, p => p.DiscordConfiguration);
+
+                if (existing is null)
+                {
+                    return BadRequest(new { Message = "Webhook URL cannot be a placeholder value" });
+                }
+
+                webhookUrl = existing.WebhookUrl;
+            }
+
             var discordConfig = new DiscordConfig
             {
-                WebhookUrl = testRequest.WebhookUrl,
+                WebhookUrl = webhookUrl,
                 Username = testRequest.Username,
                 AvatarUrl = testRequest.AvatarUrl
             };
@@ -1109,7 +1270,8 @@ public sealed class NotificationProvidersController : ControllerBase
                     OnSlowStrike = false,
                     OnQueueItemDeleted = false,
                     OnDownloadCleaned = false,
-                    OnCategoryChanged = false
+                    OnCategoryChanged = false,
+                    OnSearchTriggered = false
                 },
                 Configuration = discordConfig
             };
@@ -1146,6 +1308,16 @@ public sealed class NotificationProvidersController : ControllerBase
                 return BadRequest("A provider with this name already exists");
             }
 
+            if (newProvider.ApiToken.IsPlaceholder())
+            {
+                return BadRequest("API token cannot be a placeholder value");
+            }
+
+            if (newProvider.UserKey.IsPlaceholder())
+            {
+                return BadRequest("User key cannot be a placeholder value");
+            }
+
             var pushoverConfig = new PushoverConfig
             {
                 ApiToken = newProvider.ApiToken,
@@ -1170,6 +1342,7 @@ public sealed class NotificationProvidersController : ControllerBase
                 OnQueueItemDeleted = newProvider.OnQueueItemDeleted,
                 OnDownloadCleaned = newProvider.OnDownloadCleaned,
                 OnCategoryChanged = newProvider.OnCategoryChanged,
+                OnSearchTriggered = newProvider.OnSearchTriggered,
                 PushoverConfiguration = pushoverConfig
             };
 
@@ -1227,8 +1400,12 @@ public sealed class NotificationProvidersController : ControllerBase
 
             var pushoverConfig = new PushoverConfig
             {
-                ApiToken = updatedProvider.ApiToken,
-                UserKey = updatedProvider.UserKey,
+                ApiToken = updatedProvider.ApiToken.IsPlaceholder()
+                    ? existingProvider.PushoverConfiguration!.ApiToken
+                    : updatedProvider.ApiToken,
+                UserKey = updatedProvider.UserKey.IsPlaceholder()
+                    ? existingProvider.PushoverConfiguration!.UserKey
+                    : updatedProvider.UserKey,
                 Devices = updatedProvider.Devices,
                 Priority = updatedProvider.Priority,
                 Sound = updatedProvider.Sound,
@@ -1253,6 +1430,7 @@ public sealed class NotificationProvidersController : ControllerBase
                 OnQueueItemDeleted = updatedProvider.OnQueueItemDeleted,
                 OnDownloadCleaned = updatedProvider.OnDownloadCleaned,
                 OnCategoryChanged = updatedProvider.OnCategoryChanged,
+                OnSearchTriggered = updatedProvider.OnSearchTriggered,
                 PushoverConfiguration = pushoverConfig,
                 UpdatedAt = DateTime.UtcNow
             };
@@ -1286,10 +1464,34 @@ public sealed class NotificationProvidersController : ControllerBase
     {
         try
         {
+            var apiToken = testRequest.ApiToken;
+            var userKey = testRequest.UserKey;
+
+            if (apiToken.IsPlaceholder() || userKey.IsPlaceholder())
+            {
+                var existing = await GetExistingProviderConfig<PushoverConfig>(
+                    testRequest.ProviderId, NotificationProviderType.Pushover, p => p.PushoverConfiguration);
+
+                if (existing is null)
+                {
+                    return BadRequest(new { Message = "Sensitive fields cannot be placeholder values" });
+                }
+
+                if (apiToken.IsPlaceholder())
+                {
+                    apiToken = existing.ApiToken;
+                }
+
+                if (userKey.IsPlaceholder())
+                {
+                    userKey = existing.UserKey;
+                }
+            }
+
             var pushoverConfig = new PushoverConfig
             {
-                ApiToken = testRequest.ApiToken,
-                UserKey = testRequest.UserKey,
+                ApiToken = apiToken,
+                UserKey = userKey,
                 Devices = testRequest.Devices,
                 Priority = testRequest.Priority,
                 Sound = testRequest.Sound,
@@ -1312,7 +1514,8 @@ public sealed class NotificationProvidersController : ControllerBase
                     OnSlowStrike = false,
                     OnQueueItemDeleted = false,
                     OnDownloadCleaned = false,
-                    OnCategoryChanged = false
+                    OnCategoryChanged = false,
+                    OnSearchTriggered = false
                 },
                 Configuration = pushoverConfig
             };
@@ -1344,6 +1547,11 @@ public sealed class NotificationProvidersController : ControllerBase
                 return BadRequest("A provider with this name already exists");
             }
 
+            if (newProvider.ApplicationToken.IsPlaceholder())
+            {
+                return BadRequest("Application token cannot be a placeholder value");
+            }
+
             var gotifyConfig = new GotifyConfig
             {
                 ServerUrl = newProvider.ServerUrl,
@@ -1363,6 +1571,7 @@ public sealed class NotificationProvidersController : ControllerBase
                 OnQueueItemDeleted = newProvider.OnQueueItemDeleted,
                 OnDownloadCleaned = newProvider.OnDownloadCleaned,
                 OnCategoryChanged = newProvider.OnCategoryChanged,
+                OnSearchTriggered = newProvider.OnSearchTriggered,
                 GotifyConfiguration = gotifyConfig
             };
 
@@ -1421,7 +1630,9 @@ public sealed class NotificationProvidersController : ControllerBase
             var gotifyConfig = new GotifyConfig
             {
                 ServerUrl = updatedProvider.ServerUrl,
-                ApplicationToken = updatedProvider.ApplicationToken,
+                ApplicationToken = updatedProvider.ApplicationToken.IsPlaceholder()
+                    ? existingProvider.GotifyConfiguration!.ApplicationToken
+                    : updatedProvider.ApplicationToken,
                 Priority = updatedProvider.Priority
             };
 
@@ -1441,6 +1652,7 @@ public sealed class NotificationProvidersController : ControllerBase
                 OnQueueItemDeleted = updatedProvider.OnQueueItemDeleted,
                 OnDownloadCleaned = updatedProvider.OnDownloadCleaned,
                 OnCategoryChanged = updatedProvider.OnCategoryChanged,
+                OnSearchTriggered = updatedProvider.OnSearchTriggered,
                 GotifyConfiguration = gotifyConfig,
                 UpdatedAt = DateTime.UtcNow
             };
@@ -1474,10 +1686,23 @@ public sealed class NotificationProvidersController : ControllerBase
     {
         try
         {
+            var applicationToken = testRequest.ApplicationToken;
+
+            if (applicationToken.IsPlaceholder())
+            {
+                var existing = await GetExistingProviderConfig<GotifyConfig>(
+                    testRequest.ProviderId, NotificationProviderType.Gotify, p => p.GotifyConfiguration);
+
+                if (existing is null)
+                    return BadRequest(new { Message = "Application token cannot be a placeholder value" });
+
+                applicationToken = existing.ApplicationToken;
+            }
+
             var gotifyConfig = new GotifyConfig
             {
                 ServerUrl = testRequest.ServerUrl,
-                ApplicationToken = testRequest.ApplicationToken,
+                ApplicationToken = applicationToken,
                 Priority = testRequest.Priority
             };
             gotifyConfig.Validate();
@@ -1495,7 +1720,8 @@ public sealed class NotificationProvidersController : ControllerBase
                     OnSlowStrike = false,
                     OnQueueItemDeleted = false,
                     OnDownloadCleaned = false,
-                    OnCategoryChanged = false
+                    OnCategoryChanged = false,
+                    OnSearchTriggered = false
                 },
                 Configuration = gotifyConfig
             };
@@ -1514,4 +1740,34 @@ public sealed class NotificationProvidersController : ControllerBase
             return BadRequest(new { Message = $"Test failed: {ex.Message}" });
         }
     }
+
+    private async Task<T?> GetExistingProviderConfig<T>(
+        Guid? providerId,
+        NotificationProviderType expectedType,
+        Func<NotificationConfig, T?> configSelector) where T : class
+    {
+        if (!providerId.HasValue)
+        {
+            return null;
+        }
+
+        IQueryable<NotificationConfig> query = _dataContext.NotificationConfigs.AsNoTracking();
+
+        query = expectedType switch
+        {
+            NotificationProviderType.Notifiarr => query.Include(p => p.NotifiarrConfiguration),
+            NotificationProviderType.Apprise => query.Include(p => p.AppriseConfiguration),
+            NotificationProviderType.Ntfy => query.Include(p => p.NtfyConfiguration),
+            NotificationProviderType.Pushover => query.Include(p => p.PushoverConfiguration),
+            NotificationProviderType.Telegram => query.Include(p => p.TelegramConfiguration),
+            NotificationProviderType.Discord => query.Include(p => p.DiscordConfiguration),
+            NotificationProviderType.Gotify => query.Include(p => p.GotifyConfiguration),
+            _ => query
+        };
+
+        var provider = await query
+            .FirstOrDefaultAsync(p => p.Id == providerId.Value && p.Type == expectedType);
+
+        return provider is null ? null : configSelector(provider);
+    }
 }

code/backend/Cleanuparr.Api/Features/QueueCleaner/Contracts/Requests/UpdateQueueCleanerConfigRequest.cs

@@ -13,6 +13,8 @@ public sealed record UpdateQueueCleanerConfigRequest
     public FailedImportConfig FailedImport { get; init; } = new();
 
     public ushort DownloadingMetadataMaxStrikes { get; init; }
-    
+
+    public bool ProcessNoContentId { get; init; }
+
     public List<string> IgnoredDownloads { get; set; } = [];
 }

code/backend/Cleanuparr.Api/Features/QueueCleaner/Controllers/QueueCleanerConfigController.cs

@@ -7,6 +7,7 @@ using Cleanuparr.Infrastructure.Utilities;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration;
 using Cleanuparr.Persistence.Models.Configuration.QueueCleaner;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
@@ -15,6 +16,7 @@ namespace Cleanuparr.Api.Features.QueueCleaner.Controllers;
 
 [ApiController]
 [Route("api/configuration")]
+[Authorize]
 public sealed class QueueCleanerConfigController : ControllerBase
 {
     private readonly ILogger<QueueCleanerConfigController> _logger;
@@ -67,6 +69,7 @@ public sealed class QueueCleanerConfigController : ControllerBase
             oldConfig.UseAdvancedScheduling = newConfigDto.UseAdvancedScheduling;
             oldConfig.FailedImport = newConfigDto.FailedImport;
             oldConfig.DownloadingMetadataMaxStrikes = newConfigDto.DownloadingMetadataMaxStrikes;
+            oldConfig.ProcessNoContentId = newConfigDto.ProcessNoContentId;
             oldConfig.IgnoredDownloads = newConfigDto.IgnoredDownloads;
             
             oldConfig.Validate();

code/backend/Cleanuparr.Api/Features/QueueCleaner/Controllers/QueueRulesController.cs

@@ -3,6 +3,7 @@ using Cleanuparr.Domain.Exceptions;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration.QueueCleaner;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
@@ -11,6 +12,7 @@ namespace Cleanuparr.Api.Features.QueueCleaner.Controllers;
 
 [ApiController]
 [Route("api/queue-rules")]
+[Authorize]
 public class QueueRulesController : ControllerBase
 {
     private readonly ILogger<QueueRulesController> _logger;

code/backend/Cleanuparr.Api/Features/Seeker/Contracts/Requests/UpdateSeekerConfigRequest.cs

@@ -0,0 +1,42 @@
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Persistence.Models.Configuration.Seeker;
+
+namespace Cleanuparr.Api.Features.Seeker.Contracts.Requests;
+
+public sealed record UpdateSeekerConfigRequest
+{
+    public bool SearchEnabled { get; init; } = true;
+
+    public ushort SearchInterval { get; init; } = 3;
+
+    public bool ProactiveSearchEnabled { get; init; }
+
+    public SelectionStrategy SelectionStrategy { get; init; } = SelectionStrategy.BalancedWeighted;
+
+    public bool MonitoredOnly { get; init; } = true;
+
+    public bool UseCutoff { get; init; }
+
+    public bool UseCustomFormatScore { get; init; }
+
+    public bool UseRoundRobin { get; init; } = true;
+
+    public int PostReleaseGraceHours { get; init; } = 6;
+
+    public List<UpdateSeekerInstanceConfigRequest> Instances { get; init; } = [];
+
+    public SeekerConfig ApplyTo(SeekerConfig config)
+    {
+        config.SearchEnabled = SearchEnabled;
+        config.SearchInterval = SearchInterval;
+        config.ProactiveSearchEnabled = ProactiveSearchEnabled;
+        config.SelectionStrategy = SelectionStrategy;
+        config.MonitoredOnly = MonitoredOnly;
+        config.UseCutoff = UseCutoff;
+        config.UseCustomFormatScore = UseCustomFormatScore;
+        config.UseRoundRobin = UseRoundRobin;
+        config.PostReleaseGraceHours = PostReleaseGraceHours;
+
+        return config;
+    }
+}

code/backend/Cleanuparr.Api/Features/Seeker/Contracts/Requests/UpdateSeekerInstanceConfigRequest.cs

@@ -0,0 +1,14 @@
+namespace Cleanuparr.Api.Features.Seeker.Contracts.Requests;
+
+public sealed record UpdateSeekerInstanceConfigRequest
+{
+    public Guid ArrInstanceId { get; init; }
+
+    public bool Enabled { get; init; } = true;
+
+    public List<string> SkipTags { get; init; } = [];
+
+    public int ActiveDownloadLimit { get; init; } = 3;
+
+    public int MinCycleTimeDays { get; init; } = 7;
+}

code/backend/Cleanuparr.Api/Features/Seeker/Contracts/Responses/CustomFormatScoreEntryResponse.cs

@@ -0,0 +1,20 @@
+using Cleanuparr.Domain.Enums;
+
+namespace Cleanuparr.Api.Features.Seeker.Contracts.Responses;
+
+public sealed record CustomFormatScoreEntryResponse
+{
+    public Guid Id { get; init; }
+    public Guid ArrInstanceId { get; init; }
+    public long ExternalItemId { get; init; }
+    public long EpisodeId { get; init; }
+    public InstanceType ItemType { get; init; }
+    public string Title { get; init; } = string.Empty;
+    public long FileId { get; init; }
+    public int CurrentScore { get; init; }
+    public int CutoffScore { get; init; }
+    public string QualityProfileName { get; init; } = string.Empty;
+    public bool IsBelowCutoff { get; init; }
+    public bool IsMonitored { get; init; }
+    public DateTime LastSyncedAt { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Seeker/Contracts/Responses/CustomFormatScoreHistoryEntryResponse.cs

@@ -0,0 +1,8 @@
+namespace Cleanuparr.Api.Features.Seeker.Contracts.Responses;
+
+public sealed record CustomFormatScoreHistoryEntryResponse
+{
+    public int Score { get; init; }
+    public int CutoffScore { get; init; }
+    public DateTime RecordedAt { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Seeker/Contracts/Responses/CustomFormatScoreStatsResponse.cs

@@ -0,0 +1,25 @@
+namespace Cleanuparr.Api.Features.Seeker.Contracts.Responses;
+
+public sealed record CustomFormatScoreStatsResponse
+{
+    public int TotalTracked { get; init; }
+    public int BelowCutoff { get; init; }
+    public int AtOrAboveCutoff { get; init; }
+    public int Monitored { get; init; }
+    public int Unmonitored { get; init; }
+    public int RecentUpgrades { get; init; }
+    public List<InstanceCfScoreStat> PerInstanceStats { get; init; } = [];
+}
+
+public sealed record InstanceCfScoreStat
+{
+    public Guid InstanceId { get; init; }
+    public string InstanceName { get; init; } = string.Empty;
+    public string InstanceType { get; init; } = string.Empty;
+    public int TotalTracked { get; init; }
+    public int BelowCutoff { get; init; }
+    public int AtOrAboveCutoff { get; init; }
+    public int Monitored { get; init; }
+    public int Unmonitored { get; init; }
+    public int RecentUpgrades { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Seeker/Contracts/Responses/CustomFormatScoreUpgradeResponse.cs

@@ -0,0 +1,16 @@
+using Cleanuparr.Domain.Enums;
+
+namespace Cleanuparr.Api.Features.Seeker.Contracts.Responses;
+
+public sealed record CustomFormatScoreUpgradeResponse
+{
+    public Guid ArrInstanceId { get; init; }
+    public long ExternalItemId { get; init; }
+    public long EpisodeId { get; init; }
+    public InstanceType ItemType { get; init; }
+    public string Title { get; init; } = string.Empty;
+    public int PreviousScore { get; init; }
+    public int NewScore { get; init; }
+    public int CutoffScore { get; init; }
+    public DateTime UpgradedAt { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Seeker/Contracts/Responses/InstanceSearchStat.cs

@@ -0,0 +1,16 @@
+namespace Cleanuparr.Api.Features.Seeker.Contracts.Responses;
+
+public sealed record InstanceSearchStat
+{
+    public Guid InstanceId { get; init; }
+    public string InstanceName { get; init; } = string.Empty;
+    public string InstanceType { get; init; } = string.Empty;
+    public int ItemsTracked { get; init; }
+    public int TotalSearchCount { get; init; }
+    public DateTime? LastSearchedAt { get; init; }
+    public DateTime? LastProcessedAt { get; init; }
+    public Guid? CurrentCycleId { get; init; }
+    public int CycleItemsSearched { get; init; }
+    public int CycleItemsTotal { get; init; }
+    public DateTime? CycleStartedAt { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Seeker/Contracts/Responses/SearchEventResponse.cs

@@ -0,0 +1,19 @@
+using Cleanuparr.Domain.Enums;
+
+namespace Cleanuparr.Api.Features.Seeker.Contracts.Responses;
+
+public sealed record SearchEventResponse
+{
+    public Guid Id { get; init; }
+    public DateTime Timestamp { get; init; }
+    public string InstanceName { get; init; } = string.Empty;
+    public string? InstanceType { get; init; }
+    public int ItemCount { get; init; }
+    public List<string> Items { get; init; } = [];
+    public SeekerSearchType SearchType { get; init; }
+    public SearchCommandStatus? SearchStatus { get; init; }
+    public DateTime? CompletedAt { get; init; }
+    public object? GrabbedItems { get; init; }
+    public Guid? CycleId { get; init; }
+    public bool IsDryRun { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Seeker/Contracts/Responses/SearchStatsSummaryResponse.cs

@@ -0,0 +1,12 @@
+namespace Cleanuparr.Api.Features.Seeker.Contracts.Responses;
+
+public sealed record SearchStatsSummaryResponse
+{
+    public int TotalSearchesAllTime { get; init; }
+    public int SearchesLast7Days { get; init; }
+    public int SearchesLast30Days { get; init; }
+    public int UniqueItemsSearched { get; init; }
+    public int PendingReplacementSearches { get; init; }
+    public int EnabledInstances { get; init; }
+    public List<InstanceSearchStat> PerInstanceStats { get; init; } = [];
+}

code/backend/Cleanuparr.Api/Features/Seeker/Contracts/Responses/SeekerConfigResponse.cs

@@ -0,0 +1,26 @@
+using Cleanuparr.Domain.Enums;
+
+namespace Cleanuparr.Api.Features.Seeker.Contracts.Responses;
+
+public sealed record SeekerConfigResponse
+{
+    public bool SearchEnabled { get; init; }
+
+    public ushort SearchInterval { get; init; }
+
+    public bool ProactiveSearchEnabled { get; init; }
+
+    public SelectionStrategy SelectionStrategy { get; init; }
+
+    public bool MonitoredOnly { get; init; }
+
+    public bool UseCutoff { get; init; }
+
+    public bool UseCustomFormatScore { get; init; }
+
+    public bool UseRoundRobin { get; init; }
+
+    public int PostReleaseGraceHours { get; init; }
+
+    public List<SeekerInstanceConfigResponse> Instances { get; init; } = [];
+}

code/backend/Cleanuparr.Api/Features/Seeker/Contracts/Responses/SeekerInstanceConfigResponse.cs

@@ -0,0 +1,24 @@
+using Cleanuparr.Domain.Enums;
+
+namespace Cleanuparr.Api.Features.Seeker.Contracts.Responses;
+
+public sealed record SeekerInstanceConfigResponse
+{
+    public Guid ArrInstanceId { get; init; }
+    
+    public string InstanceName { get; init; } = string.Empty;
+    
+    public InstanceType InstanceType { get; init; }
+    
+    public bool Enabled { get; init; }
+    
+    public List<string> SkipTags { get; init; } = [];
+    
+    public DateTime? LastProcessedAt { get; init; }
+
+    public bool ArrInstanceEnabled { get; init; }
+
+    public int ActiveDownloadLimit { get; init; }
+
+    public int MinCycleTimeDays { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Seeker/Controllers/CustomFormatScoreController.cs

@@ -0,0 +1,311 @@
+using Cleanuparr.Api.Features.Seeker.Contracts.Responses;
+using Cleanuparr.Persistence;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Api.Features.Seeker.Controllers;
+
+[ApiController]
+[Route("api/seeker/cf-scores")]
+[Authorize]
+public sealed class CustomFormatScoreController : ControllerBase
+{
+    private readonly DataContext _dataContext;
+
+    public CustomFormatScoreController(DataContext dataContext)
+    {
+        _dataContext = dataContext;
+    }
+
+    /// <summary>
+    /// Gets current CF scores with pagination, optionally filtered by instance.
+    /// </summary>
+    [HttpGet]
+    public async Task<IActionResult> GetCustomFormatScores(
+        [FromQuery] int page = 1,
+        [FromQuery] int pageSize = 50,
+        [FromQuery] Guid? instanceId = null,
+        [FromQuery] string? search = null,
+        [FromQuery] string sortBy = "title",
+        [FromQuery] bool hideMet = false)
+    {
+        if (page < 1) page = 1;
+        if (pageSize < 1) pageSize = 50;
+        if (pageSize > 100) pageSize = 100;
+
+        var query = _dataContext.CustomFormatScoreEntries
+            .AsNoTracking()
+            .AsQueryable();
+
+        if (instanceId.HasValue)
+        {
+            query = query.Where(e => e.ArrInstanceId == instanceId.Value);
+        }
+
+        if (!string.IsNullOrWhiteSpace(search))
+        {
+            query = query.Where(e => e.Title.ToLower().Contains(search.ToLower()));
+        }
+
+        if (hideMet)
+        {
+            query = query.Where(e => e.CurrentScore < e.CutoffScore);
+        }
+
+        int totalCount = await query.CountAsync();
+
+        var items = await (sortBy == "date"
+                ? query.OrderByDescending(e => e.LastSyncedAt)
+                : query.OrderBy(e => e.Title))
+            .Skip((page - 1) * pageSize)
+            .Take(pageSize)
+            .Select(e => new CustomFormatScoreEntryResponse
+            {
+                Id = e.Id,
+                ArrInstanceId = e.ArrInstanceId,
+                ExternalItemId = e.ExternalItemId,
+                EpisodeId = e.EpisodeId,
+                ItemType = e.ItemType,
+                Title = e.Title,
+                FileId = e.FileId,
+                CurrentScore = e.CurrentScore,
+                CutoffScore = e.CutoffScore,
+                QualityProfileName = e.QualityProfileName,
+                IsBelowCutoff = e.CurrentScore < e.CutoffScore,
+                IsMonitored = e.IsMonitored,
+                LastSyncedAt = e.LastSyncedAt,
+            })
+            .ToListAsync();
+
+        return Ok(new
+        {
+            Items = items,
+            Page = page,
+            PageSize = pageSize,
+            TotalCount = totalCount,
+            TotalPages = (int)Math.Ceiling(totalCount / (double)pageSize),
+        });
+    }
+
+    /// <summary>
+    /// Gets recent CF score upgrades (where score improved in history).
+    /// </summary>
+    [HttpGet("upgrades")]
+    public async Task<IActionResult> GetRecentUpgrades(
+        [FromQuery] int page = 1,
+        [FromQuery] int pageSize = 20,
+        [FromQuery] Guid? instanceId = null,
+        [FromQuery] int days = 30)
+    {
+        if (page < 1) page = 1;
+        if (pageSize < 1) pageSize = 20;
+        if (pageSize > 100) pageSize = 100;
+
+        // Find history entries where a newer entry has a higher score than an older one
+        // We group by item and look for score increases between consecutive records
+        var query = _dataContext.CustomFormatScoreHistory
+            .AsNoTracking()
+            .AsQueryable();
+
+        if (instanceId.HasValue)
+        {
+            query = query.Where(h => h.ArrInstanceId == instanceId.Value);
+        }
+
+        var allHistory = await query
+            .Where(h => h.RecordedAt >= DateTime.UtcNow.AddDays(-days))
+            .OrderByDescending(h => h.RecordedAt)
+            .ToListAsync();
+
+        var upgrades = new List<CustomFormatScoreUpgradeResponse>();
+
+        // Group by (ArrInstanceId, ExternalItemId, EpisodeId) and find score increases
+        var grouped = allHistory
+            .GroupBy(h => new { h.ArrInstanceId, h.ExternalItemId, h.EpisodeId });
+
+        foreach (var group in grouped)
+        {
+            var entries = group.OrderBy(h => h.RecordedAt).ToList();
+            for (int i = 1; i < entries.Count; i++)
+            {
+                if (entries[i].Score > entries[i - 1].Score)
+                {
+                    upgrades.Add(new CustomFormatScoreUpgradeResponse
+                    {
+                        ArrInstanceId = entries[i].ArrInstanceId,
+                        ExternalItemId = entries[i].ExternalItemId,
+                        EpisodeId = entries[i].EpisodeId,
+                        ItemType = entries[i].ItemType,
+                        Title = entries[i].Title,
+                        PreviousScore = entries[i - 1].Score,
+                        NewScore = entries[i].Score,
+                        CutoffScore = entries[i].CutoffScore,
+                        UpgradedAt = entries[i].RecordedAt,
+                    });
+                }
+            }
+        }
+
+        // Sort by most recent upgrade first
+        upgrades = upgrades.OrderByDescending(u => u.UpgradedAt).ToList();
+
+        int totalCount = upgrades.Count;
+        var paged = upgrades
+            .Skip((page - 1) * pageSize)
+            .Take(pageSize)
+            .ToList();
+
+        return Ok(new
+        {
+            Items = paged,
+            Page = page,
+            PageSize = pageSize,
+            TotalCount = totalCount,
+            TotalPages = (int)Math.Ceiling(totalCount / (double)pageSize),
+        });
+    }
+
+    [HttpGet("instances")]
+    public async Task<IActionResult> GetInstances()
+    {
+        var instances = await _dataContext.CustomFormatScoreEntries
+            .AsNoTracking()
+            .Select(e => new { e.ArrInstanceId, e.ItemType })
+            .Distinct()
+            .Join(
+                _dataContext.ArrInstances.AsNoTracking(),
+                e => e.ArrInstanceId,
+                a => a.Id,
+                (e, a) => new
+                {
+                    Id = e.ArrInstanceId,
+                    a.Name,
+                    e.ItemType,
+                })
+            .OrderBy(x => x.Name)
+            .ToListAsync();
+
+        return Ok(new { Instances = instances });
+    }
+
+    /// <summary>
+    /// Gets summary statistics for CF score tracking.
+    /// </summary>
+    [HttpGet("stats")]
+    public async Task<IActionResult> GetStats()
+    {
+        var entries = await _dataContext.CustomFormatScoreEntries
+            .AsNoTracking()
+            .ToListAsync();
+
+        int totalTracked = entries.Count;
+        int belowCutoff = entries.Count(e => e.CurrentScore < e.CutoffScore);
+        int atOrAboveCutoff = totalTracked - belowCutoff;
+        int monitored = entries.Count(e => e.IsMonitored);
+        int unmonitored = totalTracked - monitored;
+
+        // Count upgrades in the last 7 days
+        var sevenDaysAgo = DateTime.UtcNow.AddDays(-7);
+        var recentHistory = await _dataContext.CustomFormatScoreHistory
+            .AsNoTracking()
+            .Where(h => h.RecordedAt >= sevenDaysAgo)
+            .OrderBy(h => h.RecordedAt)
+            .ToListAsync();
+
+        int recentUpgrades = 0;
+        var recentGrouped = recentHistory
+            .GroupBy(h => new { h.ArrInstanceId, h.ExternalItemId, h.EpisodeId });
+
+        foreach (var group in recentGrouped)
+        {
+            var ordered = group.OrderBy(h => h.RecordedAt).ToList();
+            for (int i = 1; i < ordered.Count; i++)
+            {
+                if (ordered[i].Score > ordered[i - 1].Score)
+                    recentUpgrades++;
+            }
+        }
+
+        // Per-instance stats
+        var instanceIds = entries.Select(e => e.ArrInstanceId).Distinct().ToList();
+        var instances = await _dataContext.ArrInstances
+            .AsNoTracking()
+            .Include(a => a.ArrConfig)
+            .Where(a => instanceIds.Contains(a.Id))
+            .ToListAsync();
+
+        var perInstanceStats = instanceIds.Select(instanceId =>
+        {
+            var instanceEntries = entries.Where(e => e.ArrInstanceId == instanceId).ToList();
+            int instTracked = instanceEntries.Count;
+            int instBelow = instanceEntries.Count(e => e.CurrentScore < e.CutoffScore);
+            int instMonitored = instanceEntries.Count(e => e.IsMonitored);
+
+            int instUpgrades = 0;
+            var instHistory = recentGrouped
+                .Where(g => g.Key.ArrInstanceId == instanceId);
+            foreach (var group in instHistory)
+            {
+                var ordered = group.OrderBy(h => h.RecordedAt).ToList();
+                for (int i = 1; i < ordered.Count; i++)
+                {
+                    if (ordered[i].Score > ordered[i - 1].Score)
+                        instUpgrades++;
+                }
+            }
+
+            var instance = instances.FirstOrDefault(a => a.Id == instanceId);
+            return new InstanceCfScoreStat
+            {
+                InstanceId = instanceId,
+                InstanceName = instance?.Name ?? "Unknown",
+                InstanceType = instance?.ArrConfig.Type.ToString() ?? "Unknown",
+                TotalTracked = instTracked,
+                BelowCutoff = instBelow,
+                AtOrAboveCutoff = instTracked - instBelow,
+                Monitored = instMonitored,
+                Unmonitored = instTracked - instMonitored,
+                RecentUpgrades = instUpgrades,
+            };
+        }).OrderBy(s => s.InstanceName).ToList();
+
+        return Ok(new CustomFormatScoreStatsResponse
+        {
+            TotalTracked = totalTracked,
+            BelowCutoff = belowCutoff,
+            AtOrAboveCutoff = atOrAboveCutoff,
+            Monitored = monitored,
+            Unmonitored = unmonitored,
+            RecentUpgrades = recentUpgrades,
+            PerInstanceStats = perInstanceStats,
+        });
+    }
+
+    /// <summary>
+    /// Gets CF score history for a specific item.
+    /// </summary>
+    [HttpGet("{instanceId}/{itemId}/history")]
+    public async Task<IActionResult> GetItemHistory(
+        Guid instanceId,
+        long itemId,
+        [FromQuery] long episodeId = 0)
+    {
+        var history = await _dataContext.CustomFormatScoreHistory
+            .AsNoTracking()
+            .Where(h => h.ArrInstanceId == instanceId
+                        && h.ExternalItemId == itemId
+                        && h.EpisodeId == episodeId)
+            .OrderByDescending(h => h.RecordedAt)
+            .Select(h => new CustomFormatScoreHistoryEntryResponse
+            {
+                Score = h.Score,
+                CutoffScore = h.CutoffScore,
+                RecordedAt = h.RecordedAt,
+            })
+            .ToListAsync();
+
+        return Ok(new { Entries = history });
+    }
+}
+

code/backend/Cleanuparr.Api/Features/Seeker/Controllers/SearchStatsController.cs

@@ -0,0 +1,250 @@
+using System.Text.Json;
+using Cleanuparr.Api.Features.Seeker.Contracts.Responses;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Configuration.Seeker;
+using Cleanuparr.Persistence.Models.State;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Api.Features.Seeker.Controllers;
+
+[ApiController]
+[Route("api/seeker/search-stats")]
+[Authorize]
+public sealed class SearchStatsController : ControllerBase
+{
+    private readonly DataContext _dataContext;
+    private readonly EventsContext _eventsContext;
+
+    public SearchStatsController(DataContext dataContext, EventsContext eventsContext)
+    {
+        _dataContext = dataContext;
+        _eventsContext = eventsContext;
+    }
+
+    /// <summary>
+    /// Gets aggregate search statistics across all instances.
+    /// </summary>
+    [HttpGet("summary")]
+    public async Task<IActionResult> GetSummary()
+    {
+        DateTime sevenDaysAgo = DateTime.UtcNow.AddDays(-7);
+        DateTime thirtyDaysAgo = DateTime.UtcNow.AddDays(-30);
+
+        // Event counts from EventsContext
+        var searchEvents = _eventsContext.Events
+            .AsNoTracking()
+            .Where(e => e.EventType == EventType.SearchTriggered);
+
+        int totalSearchesAllTime = await searchEvents.CountAsync();
+        int searchesLast7Days = await searchEvents.CountAsync(e => e.Timestamp >= sevenDaysAgo);
+        int searchesLast30Days = await searchEvents.CountAsync(e => e.Timestamp >= thirtyDaysAgo);
+
+        // History stats from DataContext
+        int uniqueItemsSearched = await _dataContext.SeekerHistory
+            .AsNoTracking()
+            .Select(h => h.ExternalItemId)
+            .Distinct()
+            .CountAsync();
+
+        int pendingReplacementSearches = await _dataContext.SearchQueue.CountAsync();
+
+        // Per-instance stats
+        List<SeekerInstanceConfig> instanceConfigs = await _dataContext.SeekerInstanceConfigs
+            .AsNoTracking()
+            .Include(s => s.ArrInstance)
+                .ThenInclude(a => a.ArrConfig)
+            .Where(s => s.Enabled && s.ArrInstance.Enabled)
+            .ToListAsync();
+
+        var historyByInstance = await _dataContext.SeekerHistory
+            .AsNoTracking()
+            .GroupBy(h => h.ArrInstanceId)
+            .Select(g => new
+            {
+                InstanceId = g.Key,
+                ItemsTracked = g.Select(h => h.ExternalItemId).Distinct().Count(),
+                LastSearchedAt = g.Max(h => h.LastSearchedAt),
+                TotalSearchCount = g.Sum(h => h.SearchCount),
+            })
+            .ToListAsync();
+
+        // Count items searched in current cycle per instance
+        List<Guid> currentCycleIds = instanceConfigs.Select(ic => ic.CurrentCycleId).ToList();
+        var cycleItemsByInstance = await _dataContext.SeekerHistory
+            .AsNoTracking()
+            .Where(h => currentCycleIds.Contains(h.CycleId))
+            .GroupBy(h => h.ArrInstanceId)
+            .Select(g => new
+            {
+                InstanceId = g.Key,
+                CycleItemsSearched = g.Select(h => h.ExternalItemId).Distinct().Count(),
+                CycleStartedAt = (DateTime?)g.Min(h => h.LastSearchedAt),
+            })
+            .ToListAsync();
+
+        var perInstanceStats = instanceConfigs.Select(ic =>
+        {
+            var history = historyByInstance.FirstOrDefault(h => h.InstanceId == ic.ArrInstanceId);
+            var cycleProgress = cycleItemsByInstance.FirstOrDefault(c => c.InstanceId == ic.ArrInstanceId);
+            return new InstanceSearchStat
+            {
+                InstanceId = ic.ArrInstanceId,
+                InstanceName = ic.ArrInstance.Name,
+                InstanceType = ic.ArrInstance.ArrConfig.Type.ToString(),
+                ItemsTracked = history?.ItemsTracked ?? 0,
+                TotalSearchCount = history?.TotalSearchCount ?? 0,
+                LastSearchedAt = history?.LastSearchedAt,
+                LastProcessedAt = ic.LastProcessedAt,
+                CurrentCycleId = ic.CurrentCycleId,
+                CycleItemsSearched = cycleProgress?.CycleItemsSearched ?? 0,
+                CycleItemsTotal = ic.TotalEligibleItems,
+                CycleStartedAt = cycleProgress?.CycleStartedAt,
+            };
+        }).ToList();
+
+        return Ok(new SearchStatsSummaryResponse
+        {
+            TotalSearchesAllTime = totalSearchesAllTime,
+            SearchesLast7Days = searchesLast7Days,
+            SearchesLast30Days = searchesLast30Days,
+            UniqueItemsSearched = uniqueItemsSearched,
+            PendingReplacementSearches = pendingReplacementSearches,
+            EnabledInstances = instanceConfigs.Count,
+            PerInstanceStats = perInstanceStats,
+        });
+    }
+
+    /// <summary>
+    /// Gets paginated search-triggered events with decoded data.
+    /// Supports optional text search across item names in event data.
+    /// </summary>
+    [HttpGet("events")]
+    public async Task<IActionResult> GetEvents(
+        [FromQuery] int page = 1,
+        [FromQuery] int pageSize = 50,
+        [FromQuery] Guid? instanceId = null,
+        [FromQuery] Guid? cycleId = null,
+        [FromQuery] string? search = null)
+    {
+        if (page < 1) page = 1;
+        if (pageSize < 1) pageSize = 50;
+        if (pageSize > 100) pageSize = 100;
+
+        var query = _eventsContext.Events
+            .AsNoTracking()
+            .Where(e => e.EventType == EventType.SearchTriggered);
+
+        // Filter by instance URL if instanceId provided
+        if (instanceId.HasValue)
+        {
+            var instance = await _dataContext.ArrInstances
+                .AsNoTracking()
+                .FirstOrDefaultAsync(a => a.Id == instanceId.Value);
+
+            if (instance is not null)
+            {
+                string url = (instance.ExternalUrl ?? instance.Url).ToString();
+                query = query.Where(e => e.InstanceUrl == url);
+            }
+        }
+
+        // Filter by cycle ID
+        if (cycleId.HasValue)
+        {
+            query = query.Where(e => e.CycleId == cycleId.Value);
+        }
+
+        // Pre-filter by search term on the JSON data field
+        if (!string.IsNullOrWhiteSpace(search))
+        {
+            query = query.Where(e => e.Data != null && e.Data.ToLower().Contains(search.ToLower()));
+        }
+
+        int totalCount = await query.CountAsync();
+
+        var rawEvents = await query
+            .OrderByDescending(e => e.Timestamp)
+            .Skip((page - 1) * pageSize)
+            .Take(pageSize)
+            .ToListAsync();
+
+        var items = rawEvents.Select(e =>
+        {
+            var parsed = ParseEventData(e.Data);
+            return new SearchEventResponse
+            {
+                Id = e.Id,
+                Timestamp = e.Timestamp,
+                InstanceName = parsed.InstanceName,
+                InstanceType = e.InstanceType?.ToString(),
+                ItemCount = parsed.ItemCount,
+                Items = parsed.Items,
+                SearchType = parsed.SearchType,
+                SearchStatus = e.SearchStatus,
+                CompletedAt = e.CompletedAt,
+                GrabbedItems = parsed.GrabbedItems,
+                CycleId = e.CycleId,
+                IsDryRun = e.IsDryRun,
+            };
+        }).ToList();
+
+        return Ok(new
+        {
+            Items = items,
+            Page = page,
+            PageSize = pageSize,
+            TotalCount = totalCount,
+            TotalPages = (int)Math.Ceiling(totalCount / (double)pageSize),
+        });
+    }
+
+    private static (string InstanceName, int ItemCount, List<string> Items, SeekerSearchType SearchType, object? GrabbedItems) ParseEventData(string? data)
+    {
+        if (string.IsNullOrWhiteSpace(data))
+        {
+            return ("Unknown", 0, [], SeekerSearchType.Proactive, null);
+        }
+
+        try
+        {
+            using JsonDocument doc = JsonDocument.Parse(data);
+            JsonElement root = doc.RootElement;
+
+            string instanceName = root.TryGetProperty("InstanceName", out var nameEl)
+                ? nameEl.GetString() ?? "Unknown"
+                : "Unknown";
+
+            int itemCount = root.TryGetProperty("ItemCount", out var countEl)
+                ? countEl.GetInt32()
+                : 0;
+
+            var items = new List<string>();
+            if (root.TryGetProperty("Items", out var itemsEl) && itemsEl.ValueKind == JsonValueKind.Array)
+            {
+                foreach (JsonElement item in itemsEl.EnumerateArray())
+                {
+                    string? val = item.GetString();
+                    if (val is not null) items.Add(val);
+                }
+            }
+
+            SeekerSearchType searchType = root.TryGetProperty("SearchType", out var typeEl)
+                && Enum.TryParse<SeekerSearchType>(typeEl.GetString(), out var parsed)
+                ? parsed
+                : SeekerSearchType.Proactive;
+
+            object? grabbedItems = root.TryGetProperty("GrabbedItems", out var grabbedEl)
+                ? JsonSerializer.Deserialize<object>(grabbedEl.GetRawText())
+                : null;
+
+            return (instanceName, itemCount, items, searchType, grabbedItems);
+        }
+        catch (JsonException)
+        {
+            return ("Unknown", 0, [], SeekerSearchType.Proactive, null);
+        }
+    }
+}

code/backend/Cleanuparr.Api/Features/Seeker/Controllers/SeekerConfigController.cs

@@ -0,0 +1,206 @@
+using Cleanuparr.Api.Features.Seeker.Contracts.Requests;
+using Cleanuparr.Shared.Helpers;
+using Cleanuparr.Api.Features.Seeker.Contracts.Responses;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Services.Interfaces;
+using Cleanuparr.Persistence;
+using Cleanuparr.Persistence.Models.Configuration.Seeker;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+
+namespace Cleanuparr.Api.Features.Seeker.Controllers;
+
+[ApiController]
+[Route("api/configuration")]
+[Authorize]
+public sealed class SeekerConfigController : ControllerBase
+{
+    private readonly ILogger<SeekerConfigController> _logger;
+    private readonly DataContext _dataContext;
+    private readonly IJobManagementService _jobManagementService;
+
+    public SeekerConfigController(
+        ILogger<SeekerConfigController> logger,
+        DataContext dataContext,
+        IJobManagementService jobManagementService)
+    {
+        _logger = logger;
+        _dataContext = dataContext;
+        _jobManagementService = jobManagementService;
+    }
+
+    [HttpGet("seeker")]
+    public async Task<IActionResult> GetSeekerConfig()
+    {
+        var config = await _dataContext.SeekerConfigs
+            .AsNoTracking()
+            .FirstAsync();
+
+        // Get all Sonarr/Radarr instances with their seeker configs
+        var arrInstances = await _dataContext.ArrInstances
+            .AsNoTracking()
+            .Include(a => a.ArrConfig)
+            .Where(a => a.ArrConfig.Type == InstanceType.Sonarr || a.ArrConfig.Type == InstanceType.Radarr)
+            .ToListAsync();
+
+        var arrInstanceIds = arrInstances.Select(a => a.Id).ToHashSet();
+        var seekerInstanceConfigs = await _dataContext.SeekerInstanceConfigs
+            .AsNoTracking()
+            .Where(s => arrInstanceIds.Contains(s.ArrInstanceId))
+            .ToListAsync();
+
+        var instanceResponses = arrInstances.Select(instance =>
+        {
+            var seekerConfig = seekerInstanceConfigs.FirstOrDefault(s => s.ArrInstanceId == instance.Id);
+            return new SeekerInstanceConfigResponse
+            {
+                ArrInstanceId = instance.Id,
+                InstanceName = instance.Name,
+                InstanceType = instance.ArrConfig.Type,
+                Enabled = seekerConfig?.Enabled ?? false,
+                SkipTags = seekerConfig?.SkipTags ?? [],
+                LastProcessedAt = seekerConfig?.LastProcessedAt,
+                ArrInstanceEnabled = instance.Enabled,
+                ActiveDownloadLimit = seekerConfig?.ActiveDownloadLimit ?? 3,
+                MinCycleTimeDays = seekerConfig?.MinCycleTimeDays ?? 7,
+            };
+        }).ToList();
+
+        var response = new SeekerConfigResponse
+        {
+            SearchEnabled = config.SearchEnabled,
+            SearchInterval = config.SearchInterval,
+            ProactiveSearchEnabled = config.ProactiveSearchEnabled,
+            SelectionStrategy = config.SelectionStrategy,
+            MonitoredOnly = config.MonitoredOnly,
+            UseCutoff = config.UseCutoff,
+            UseCustomFormatScore = config.UseCustomFormatScore,
+            UseRoundRobin = config.UseRoundRobin,
+            PostReleaseGraceHours = config.PostReleaseGraceHours,
+            Instances = instanceResponses,
+        };
+
+        return Ok(response);
+    }
+
+    [HttpPut("seeker")]
+    public async Task<IActionResult> UpdateSeekerConfig([FromBody] UpdateSeekerConfigRequest request)
+    {
+        if (!await DataContext.Lock.WaitAsync(TimeSpan.FromSeconds(30)))
+        {
+            return StatusCode(503, "Database is busy, please try again");
+        }
+
+        try
+        {
+            var config = await _dataContext.SeekerConfigs.FirstAsync();
+
+            ushort previousInterval = config.SearchInterval;
+            bool previousUseCustomFormatScore = config.UseCustomFormatScore;
+            bool previousSearchEnabled = config.SearchEnabled;
+            bool previousProactiveSearchEnabled = config.ProactiveSearchEnabled;
+
+            request.ApplyTo(config);
+            config.Validate();
+
+            if (request.ProactiveSearchEnabled && !request.Instances.Any(i => i.Enabled))
+            {
+                throw new Domain.Exceptions.ValidationException(
+                    "At least one instance must be enabled when proactive search is enabled");
+            }
+
+            // Sync instance configs
+            var existingInstanceConfigs = await _dataContext.SeekerInstanceConfigs.ToListAsync();
+
+            foreach (var instanceReq in request.Instances)
+            {
+                var existing = existingInstanceConfigs
+                    .FirstOrDefault(e => e.ArrInstanceId == instanceReq.ArrInstanceId);
+
+                if (existing is not null)
+                {
+                    existing.Enabled = instanceReq.Enabled;
+                    existing.SkipTags = instanceReq.SkipTags;
+                    existing.ActiveDownloadLimit = instanceReq.ActiveDownloadLimit;
+                    existing.MinCycleTimeDays = instanceReq.MinCycleTimeDays;
+                }
+                else
+                {
+                    _dataContext.SeekerInstanceConfigs.Add(new SeekerInstanceConfig
+                    {
+                        ArrInstanceId = instanceReq.ArrInstanceId,
+                        Enabled = instanceReq.Enabled,
+                        SkipTags = instanceReq.SkipTags,
+                        ActiveDownloadLimit = instanceReq.ActiveDownloadLimit,
+                        MinCycleTimeDays = instanceReq.MinCycleTimeDays,
+                    });
+                }
+            }
+
+            await _dataContext.SaveChangesAsync();
+
+            // Start/stop Seeker based on SearchEnabled toggle
+            if (config.SearchEnabled != previousSearchEnabled)
+            {
+                if (config.SearchEnabled)
+                {
+                    _logger.LogInformation("SearchEnabled turned on, starting Seeker job");
+                    await _jobManagementService.StartJob(JobType.Seeker, null, config.ToCronExpression());
+                }
+                else
+                {
+                    _logger.LogInformation("SearchEnabled turned off, stopping Seeker job");
+                    await _jobManagementService.StopJob(JobType.Seeker);
+                }
+            }
+            // Update Quartz trigger if SearchInterval changed (only while search is enabled)
+            else if (config.SearchEnabled && config.SearchInterval != previousInterval)
+            {
+                _logger.LogInformation("Search interval changed from {Old} to {New} minutes, updating Seeker schedule",
+                    previousInterval, config.SearchInterval);
+                await _jobManagementService.StartJob(JobType.Seeker, null, config.ToCronExpression());
+            }
+
+            // Toggle CustomFormatScoreSyncer job when UseCustomFormatScore changes
+            if (config.UseCustomFormatScore != previousUseCustomFormatScore)
+            {
+                if (config.UseCustomFormatScore)
+                {
+                    _logger.LogInformation("UseCustomFormatScore enabled, starting CustomFormatScoreSyncer job");
+                    await _jobManagementService.StartJob(JobType.CustomFormatScoreSyncer, null, Constants.CustomFormatScoreSyncerCron);
+                    await _jobManagementService.TriggerJobOnce(JobType.CustomFormatScoreSyncer);
+                }
+                else
+                {
+                    _logger.LogInformation("UseCustomFormatScore disabled, stopping CustomFormatScoreSyncer job");
+                    await _jobManagementService.StopJob(JobType.CustomFormatScoreSyncer);
+                }
+            }
+
+            // Trigger CustomFormatScoreSyncer once when search or proactive search is re-enabled with custom format scores active
+            if (previousUseCustomFormatScore && config.UseCustomFormatScore)
+            {
+                bool searchJustEnabled = !previousSearchEnabled && config.SearchEnabled;
+                bool proactiveJustEnabled = !previousProactiveSearchEnabled && config.ProactiveSearchEnabled;
+
+                if (searchJustEnabled || proactiveJustEnabled)
+                {
+                    _logger.LogInformation("Search re-enabled with UseCustomFormatScore active, triggering CustomFormatScoreSyncer");
+                    await _jobManagementService.TriggerJobOnce(JobType.CustomFormatScoreSyncer);
+                }
+            }
+
+            return Ok(new { Message = "Seeker configuration updated successfully" });
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to save Seeker configuration");
+            throw;
+        }
+        finally
+        {
+            DataContext.Lock.Release();
+        }
+    }
+}

code/backend/Cleanuparr.Api/Filters/NoCacheAttribute.cs

@@ -0,0 +1,25 @@
+using Microsoft.AspNetCore.Mvc.Filters;
+
+namespace Cleanuparr.Api.Filters;
+
+/// <summary>
+/// Prevents caching of sensitive responses by setting appropriate HTTP headers.
+/// Applies Cache-Control: no-cache, no-store, Pragma: no-cache, and a past Expires date
+/// for maximum compatibility with HTTP/1.0 and HTTP/1.1 clients and intermediaries.
+/// </summary>
+[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
+public sealed class NoCacheAttribute : ActionFilterAttribute
+{
+    public static void Apply(IHeaderDictionary headers)
+    {
+        headers.CacheControl = "no-cache, no-store";
+        headers.Pragma = "no-cache";
+        headers.Expires = "Thu, 01 Jan 1970 00:00:00 GMT";
+    }
+
+    public override void OnResultExecuting(ResultExecutingContext context)
+    {
+        Apply(context.HttpContext.Response.Headers);
+        base.OnResultExecuting(context);
+    }
+}

code/backend/Cleanuparr.Api/HostExtensions.cs

@@ -1,6 +1,4 @@
 using System.Reflection;
-using Cleanuparr.Infrastructure.Health;
-using Cleanuparr.Infrastructure.Logging;
 using Cleanuparr.Infrastructure.Services;
 using Cleanuparr.Persistence;
 using Microsoft.EntityFrameworkCore;

code/backend/Cleanuparr.Api/Jobs/BackgroundJobManager.cs

@@ -6,6 +6,8 @@ using Cleanuparr.Persistence.Models.Configuration.DownloadCleaner;
 using Cleanuparr.Persistence.Models.Configuration.MalwareBlocker;
 using Cleanuparr.Persistence.Models.Configuration.QueueCleaner;
 using Cleanuparr.Persistence.Models.Configuration.BlacklistSync;
+using Cleanuparr.Persistence.Models.Configuration.Seeker;
+using SeekerJob = Cleanuparr.Infrastructure.Features.Jobs.Seeker;
 using Cleanuparr.Shared.Helpers;
 using Microsoft.EntityFrameworkCore;
 using Quartz;
@@ -100,12 +102,17 @@ public class BackgroundJobManager : IHostedService
         BlacklistSyncConfig blacklistSyncConfig = await dataContext.BlacklistSyncConfigs
             .AsNoTracking()
             .FirstAsync(cancellationToken);
-        
+        SeekerConfig seekerConfig = await dataContext.SeekerConfigs
+            .AsNoTracking()
+            .FirstAsync(cancellationToken);
+
         // Always register jobs, regardless of enabled status
         await RegisterQueueCleanerJob(queueCleanerConfig, cancellationToken);
         await RegisterMalwareBlockerJob(malwareBlockerConfig, cancellationToken);
         await RegisterDownloadCleanerJob(downloadCleanerConfig, cancellationToken);
         await RegisterBlacklistSyncJob(blacklistSyncConfig, cancellationToken);
+        await RegisterSeekerJob(seekerConfig, cancellationToken);
+        await RegisterCustomFormatScoreSyncJob(seekerConfig, cancellationToken);
     }
     
     /// <summary>
@@ -171,6 +178,33 @@ public class BackgroundJobManager : IHostedService
         }
     }
     
+    /// <summary>
+    /// Registers the Seeker job with a trigger based on SearchInterval.
+    /// The Seeker is always running.
+    /// </summary>
+    public async Task RegisterSeekerJob(SeekerConfig config, CancellationToken cancellationToken = default)
+    {
+        await AddJobWithoutTrigger<SeekerJob>(cancellationToken);
+        if (config.SearchEnabled)
+        {
+            await AddTriggersForJob<SeekerJob>(config.ToCronExpression(), cancellationToken);
+        }
+    }
+
+    /// <summary>
+    /// Registers the CustomFormatScoreSyncer job. Only adds triggers when UseCustomFormatScore is enabled.
+    /// Runs every 30 minutes to sync custom format scores from arr instances.
+    /// </summary>
+    public async Task RegisterCustomFormatScoreSyncJob(SeekerConfig config, CancellationToken cancellationToken = default)
+    {
+        await AddJobWithoutTrigger<CustomFormatScoreSyncer>(cancellationToken);
+
+        if (config.UseCustomFormatScore)
+        {
+            await AddTriggersForJob<CustomFormatScoreSyncer>(Constants.CustomFormatScoreSyncerCron, cancellationToken);
+        }
+    }
+
     /// <summary>
     /// Helper method to add triggers for an existing job.
     /// </summary>
@@ -204,7 +238,11 @@ public class BackgroundJobManager : IHostedService
                 throw new ValidationException($"{cronExpression} should have a fire time of maximum {Constants.TriggerMaxLimit.TotalHours} hours");
             }
             
-            if (typeof(T) != typeof(MalwareBlocker) && triggerValue < Constants.TriggerMinLimit)
+            if (typeof(T) == typeof(SeekerJob) && triggerValue < Constants.SeekerMinLimit)
+            {
+                throw new ValidationException($"{cronExpression} should have a fire time of minimum {Constants.SeekerMinLimit.TotalMinutes} minutes");
+            }
+            else if (typeof(T) != typeof(MalwareBlocker) && triggerValue < Constants.TriggerMinLimit)
             {
                 throw new ValidationException($"{cronExpression} should have a fire time of minimum {Constants.TriggerMinLimit.TotalSeconds} seconds");
             }

code/backend/Cleanuparr.Api/Jobs/GenericJob.cs

@@ -51,7 +51,7 @@ public sealed class GenericJob<T> : IJob
             await BroadcastJobStatus(hubContext, jobManagementService, jobType, false);
 
             var handler = scope.ServiceProvider.GetRequiredService<T>();
-            await handler.ExecuteAsync();
+            await handler.ExecuteAsync(context.CancellationToken);
 
             status = JobRunStatus.Completed;
             await BroadcastJobStatus(hubContext, jobManagementService, jobType, true);

code/backend/Cleanuparr.Api/Json/SensitiveDataResolver.cs

@@ -0,0 +1,70 @@
+using System.Reflection;
+using System.Text.Json;
+using System.Text.Json.Serialization.Metadata;
+
+using Cleanuparr.Shared.Attributes;
+using Cleanuparr.Shared.Helpers;
+
+namespace Cleanuparr.Api.Json;
+
+/// <summary>
+/// JSON type info resolver that masks properties decorated with <see cref="SensitiveDataAttribute"/>
+/// by replacing their serialized values with the appropriate placeholder during serialization.
+/// </summary>
+public sealed class SensitiveDataResolver : IJsonTypeInfoResolver
+{
+    private readonly IJsonTypeInfoResolver _innerResolver;
+
+    public SensitiveDataResolver(IJsonTypeInfoResolver innerResolver)
+    {
+        _innerResolver = innerResolver;
+    }
+
+    public JsonTypeInfo? GetTypeInfo(Type type, JsonSerializerOptions options)
+    {
+        var typeInfo = _innerResolver.GetTypeInfo(type, options);
+
+        if (typeInfo?.Kind != JsonTypeInfoKind.Object)
+            return typeInfo;
+
+        foreach (var property in typeInfo.Properties)
+        {
+            if (property.AttributeProvider is not PropertyInfo propertyInfo)
+                continue;
+
+            var sensitiveAttr = propertyInfo.GetCustomAttribute<SensitiveDataAttribute>();
+            if (sensitiveAttr is null)
+                continue;
+
+            ApplyMasking(property, sensitiveAttr.Type);
+        }
+
+        return typeInfo;
+    }
+
+    private static void ApplyMasking(JsonPropertyInfo property, SensitiveDataType maskType)
+    {
+        var originalGet = property.Get;
+        if (originalGet is null)
+        {
+            return;
+        }
+
+        property.Get = maskType switch
+        {
+            SensitiveDataType.Full => obj =>
+            {
+                var value = originalGet(obj);
+                return value is string ? SensitiveDataHelper.Placeholder : value;
+            },
+
+            SensitiveDataType.AppriseUrl => obj =>
+            {
+                var value = originalGet(obj);
+                return value is string s ? SensitiveDataHelper.MaskAppriseUrls(s) : value;
+            },
+
+            _ => originalGet,
+        };
+    }
+}

code/backend/Cleanuparr.Api/Middleware/SetupGuardMiddleware.cs

@@ -15,52 +15,75 @@ public class SetupGuardMiddleware
 
     public async Task InvokeAsync(HttpContext context)
     {
-        // Fast path: setup already completed
+        string path = context.Request.Path.Value?.ToLowerInvariant() ?? "";
+
+        // Always allow health checks and non-API paths (static files, SPA, etc.)
+        if (path.StartsWith("/health") || !path.StartsWith("/api/"))
+        {
+            await _next(context);
+            return;
+        }
+
+        // Setup-only paths (/api/auth/setup/*) require setup to NOT be complete
+        if (IsSetupOnlyPath(path))
+        {
+            if (await IsSetupCompleted())
+            {
+                context.Response.StatusCode = StatusCodes.Status403Forbidden;
+                context.Response.ContentType = "application/json";
+                await context.Response.WriteAsJsonAsync(new { error = "Setup already completed" });
+                return;
+            }
+
+            await _next(context);
+            return;
+        }
+
+        // Non-setup auth paths (login, refresh, logout, status) are always allowed
+        if (path.StartsWith("/api/auth/") || path == "/api/auth")
+        {
+            await _next(context);
+            return;
+        }
+
+        // All other API paths require setup to be complete
+        if (!await IsSetupCompleted())
+        {
+            context.Response.StatusCode = StatusCodes.Status403Forbidden;
+            context.Response.ContentType = "application/json";
+            await context.Response.WriteAsJsonAsync(new { error = "Setup required" });
+            return;
+        }
+
+        await _next(context);
+    }
+
+    public void ResetSetupState()
+    {
+        _setupCompleted = false;
+    }
+
+    private async Task<bool> IsSetupCompleted()
+    {
         if (_setupCompleted)
         {
-            await _next(context);
-            return;
+            return true;
         }
 
-        var path = context.Request.Path.Value?.ToLowerInvariant() ?? "";
-
-        // Always allow these paths regardless of setup state
-        if (IsAllowedPath(path))
-        {
-            await _next(context);
-            return;
-        }
-
-        // Check database for setup completion
         await using var usersContext = UsersContext.CreateStaticInstance();
         var user = await usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
 
         if (user is { SetupCompleted: true })
         {
             _setupCompleted = true;
-            await _next(context);
-            return;
+            return true;
         }
 
-        // Setup not complete - block non-auth requests
-        context.Response.StatusCode = StatusCodes.Status403Forbidden;
-        context.Response.ContentType = "application/json";
-        await context.Response.WriteAsJsonAsync(new { error = "Setup required" });
+        return false;
     }
 
-    /// <summary>
-    /// Resets the cached setup state. Call this if the user database is reset.
-    /// </summary>
-    public void ResetSetupState()
+    private static bool IsSetupOnlyPath(string path)
     {
-        _setupCompleted = false;
-    }
-
-    private static bool IsAllowedPath(string path)
-    {
-        return path.StartsWith("/api/auth/")
-               || path == "/api/auth"
-               || path.StartsWith("/health")
-               || !path.StartsWith("/api/");
+        return path.StartsWith("/api/auth/setup/") || path == "/api/auth/setup";
     }
 }