Keep form-based invitation screens open on account creation failures so users can see errors without replaying the welcome animation.
Centralize join form template context, preserve theming across invite routes, and add regression coverage for validation and E2E flows.
Default wizard steps were duplicated once per server instance of the same
type (e.g., 2 Plex servers → 6 steps instead of 3). Deduplicate the
server type list before loading steps so each type's steps appear only once.
Also add the missing wizard_bundle_id parameter to the invitation creation
API, matching the existing web UI capability.
Closes#1219
- Fix 55 test failures caused by missing request contexts and incorrect
session_transaction() usage across 8 test files
- Fix ruff import sorting errors and unused imports
- Fix 122 type errors: rename method override parameters to match base
classes, add None guards for fetchone()/datetime, widen dict type
annotations, add type: ignore for SQLAlchemy stub limitations
- Add [tool.ty.rules] config to suppress unsupported-base warnings
- Fix _ variable shadowing gettext in wizard routes
- Add noqa: ARG002 for unused method arguments required by base class
- Fix SUBTREE→BASE scope in _fetch_user_attributes (security)
- Remove is_ldap_user threading from all 8 media client interfaces;
set flag after join via workflow-level User.query.update instead
- Use find_user_dn (search-based) instead of build_user_dn (concatenation)
in delete_user and reset_user_password for robustness
- Wrap all user-facing strings in _() for i18n in ldap_auth.py
- Fix username fallback from hardcoded "wizarr" to unique per-user
- Return failure from _update_existing_user when password update fails
- Replace dynamic Tailwind classes with explicit conditionals in alert
- Add stale group cleanup and upsert in sync_ldap_groups
- Remove fake @ldap.local email fallback in user_sync
When a user who already has a Plex share uses a new invite link, the
"already sharing" error from the Plex API is now handled gracefully by
calling update_user_libraries() and update_user_permissions() instead of
propagating the error to the end-user. The route layer also switches to
a generic, translatable user-facing error message backed by structlog for
admin-visible diagnostics.
Add created_at column to the User model, an Alembic migration to
backfill existing rows via server_default, and update the API
serialization and OpenAPI spec from the stale `created` field to
`created_at` so the joined/created date is no longer returned as null.
When the legacy AdminUser (id="admin", a string) is logged in and tries
to create an API key, the string id was being passed to the Integer FK
column created_by_id on ApiKey, causing a DB type mismatch error. Resolve
the id by looking up the first AdminAccount row instead. Also adds a
try/except with session rollback around the DB write so failures surface
as a flash message rather than a 500.
Stop mutating primary.expires in _group_users_for_display(); store the
computed earliest date in primary.earliest_expires instead so each
account's individual expires value remains intact for the mixed-expiry
detection logic in user_card.html.
Security:
- Fix XSS in HTMX responses by replacing f-string HTML with Jinja partials
- Fix TLS verify_cert not being applied (add Tls config to ldap3 Server)
- Fix password_hash NOT NULL conflict for LDAP-only admin accounts
- Fix should_create_ldap_user defaulting to True for existing invitations
Correctness:
- Fix DN reconstruction fragility using escape_rdn for special characters
- Fix connection leaks with try/finally in all LDAPClient methods
- Fix sync interval logic (check FLASK_ENV not WIZARR_ENABLE_SCHEDULER)
- Only register LDAP sync job when LDAP is actually configured
- Make find_user_dn and service_connection public API methods
Cleanup:
- Squash 5 incremental LDAP migrations into single 20251226_add_ldap_support
- Remove duplicate imports/queries in auth routes
- Replace f-string logging with %s formatting
- Extract inline HTML to Jinja template partials
This fixes a long-standing issue where scanning a library would cause an
unintended cascade delete of the invite_library table and would reset
the associated invite's permissions.
Introduces Telegram as a notification agent, including backend logic, form fields, and database columns for bot token and chat ID. Updates creation and editing flows, notification service, and UI to support Telegram integration. Includes a migration to add the new fields to the Notification model.
- Added a preview link for bundles in the wizard settings page. closes#1048
- Enhanced the wizard steps template to handle bundle preview mode.
- Updated JavaScript to generate URLs for bundle preview and runtime modes.
- Improved test coverage for password reset token generation by asserting token creation.
- A new API endpoint for requesting a password reset token, which can be accessed either through an API key or an authenticated session.
- A public route for handling the password reset process using the generated token.
- Updates media client to allow password resets.
- Updated the sub-navigation for the wizard to conditionally display step creation options based on the default state and available bundles.
- Improved the bundles page layout by categorizing steps into pre-invite, post-invite, and additional categories, enhancing user experience.
- Added orphaned step handling to allow users to remove steps that no longer have an associated entry.
- Displayed the associated wizard bundle name in the invite card if applicable.
- Adjusted JavaScript routing for bundle steps in the wizard.
- Modified the development script to set the NODE_ENV to development when installing npm dependencies, ensuring proper handling of devDependencies.
- Updated the subproject reference in the plus directory to indicate a dirty state.
- Convert Discord notifications from plaintext to rich embeds
- Add Wizarr application icon and branding to all notifications
- Include structured version fields for update notifications
- Update test notifications to use proper titles
Closes#935
fix: correct key for transcoding info in admin routes
feat: enhance Jellyfin client to extract additional session and media details
fix: update template to reflect changes in transcoding info structure
chore: update submodule reference for plus
