merged in dev

.dockerignore

@@ -29,5 +29,5 @@
 **/secrets.dev.yaml
 **/values.dev.yaml
 LICENSE
-README.md
 data/
+docker/data/

.github/workflows/base-image.yml

@@ -6,13 +6,13 @@ on:
     paths:
       - 'docker/DispatcharrBase'
       - '.github/workflows/base-image.yml'
-      - 'requirements.txt'
+      - 'pyproject.toml'
   pull_request:
     branches: [main, dev]
     paths:
       - 'docker/DispatcharrBase'
       - '.github/workflows/base-image.yml'
-      - 'requirements.txt'
+      - 'pyproject.toml'
   workflow_dispatch: # Allow manual triggering
 
 permissions:
@@ -101,6 +101,28 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
+      - name: Extract metadata for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ghcr.io/${{ needs.prepare.outputs.repo_owner }}/${{ needs.prepare.outputs.repo_name }}
+            docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${{ needs.prepare.outputs.repo_name }}
+          labels: |
+            org.opencontainers.image.title=${{ needs.prepare.outputs.repo_name }}
+            org.opencontainers.image.description=Your ultimate IPTV & stream Management companion.
+            org.opencontainers.image.url=https://github.com/${{ github.repository }}
+            org.opencontainers.image.source=https://github.com/${{ github.repository }}
+            org.opencontainers.image.version=${{ needs.prepare.outputs.branch_tag }}-${{ needs.prepare.outputs.timestamp }}
+            org.opencontainers.image.created=${{ needs.prepare.outputs.timestamp }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.licenses=See repository
+            org.opencontainers.image.documentation=https://dispatcharr.github.io/Dispatcharr-Docs/
+            org.opencontainers.image.vendor=${{ needs.prepare.outputs.repo_owner }}
+            org.opencontainers.image.authors=${{ github.actor }}
+            maintainer=${{ github.actor }}
+            build_version=DispatcharrBase version: ${{ needs.prepare.outputs.branch_tag }}-${{ needs.prepare.outputs.timestamp }}
+
       - name: Build and push Docker base image
         uses: docker/build-push-action@v4
         with:
@@ -113,6 +135,7 @@ jobs:
             ghcr.io/${{ needs.prepare.outputs.repo_owner }}/${{ needs.prepare.outputs.repo_name }}:${{ needs.prepare.outputs.branch_tag }}-${{ needs.prepare.outputs.timestamp }}-${{ matrix.platform }}
             docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${{ needs.prepare.outputs.repo_name }}:${{ needs.prepare.outputs.branch_tag }}-${{ matrix.platform }}
             docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${{ needs.prepare.outputs.repo_name }}:${{ needs.prepare.outputs.branch_tag }}-${{ needs.prepare.outputs.timestamp }}-${{ matrix.platform }}
+          labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             REPO_OWNER=${{ needs.prepare.outputs.repo_owner }}
             REPO_NAME=${{ needs.prepare.outputs.repo_name }}
@@ -154,18 +177,74 @@ jobs:
 
           # GitHub Container Registry manifests
           # branch tag (e.g. base or base-dev)
-          docker buildx imagetools create --tag ghcr.io/${OWNER}/${REPO}:${BRANCH_TAG} \
+          docker buildx imagetools create \
+            --annotation "index:org.opencontainers.image.title=${{ needs.prepare.outputs.repo_name }}" \
+            --annotation "index:org.opencontainers.image.description=Your ultimate IPTV & stream Management companion." \
+            --annotation "index:org.opencontainers.image.url=https://github.com/${{ github.repository }}" \
+            --annotation "index:org.opencontainers.image.source=https://github.com/${{ github.repository }}" \
+            --annotation "index:org.opencontainers.image.version=${BRANCH_TAG}-${TIMESTAMP}" \
+            --annotation "index:org.opencontainers.image.created=${TIMESTAMP}" \
+            --annotation "index:org.opencontainers.image.revision=${{ github.sha }}" \
+            --annotation "index:org.opencontainers.image.licenses=See repository" \
+            --annotation "index:org.opencontainers.image.documentation=https://dispatcharr.github.io/Dispatcharr-Docs/" \
+            --annotation "index:org.opencontainers.image.vendor=${OWNER}" \
+            --annotation "index:org.opencontainers.image.authors=${{ github.actor }}" \
+            --annotation "index:maintainer=${{ github.actor }}" \
+            --annotation "index:build_version=DispatcharrBase version: ${BRANCH_TAG}-${TIMESTAMP}" \
+            --tag ghcr.io/${OWNER}/${REPO}:${BRANCH_TAG} \
             ghcr.io/${OWNER}/${REPO}:${BRANCH_TAG}-amd64 ghcr.io/${OWNER}/${REPO}:${BRANCH_TAG}-arm64
 
           # branch + timestamp tag
-          docker buildx imagetools create --tag ghcr.io/${OWNER}/${REPO}:${BRANCH_TAG}-${TIMESTAMP} \
+          docker buildx imagetools create \
+            --annotation "index:org.opencontainers.image.title=${{ needs.prepare.outputs.repo_name }}" \
+            --annotation "index:org.opencontainers.image.description=Your ultimate IPTV & stream Management companion." \
+            --annotation "index:org.opencontainers.image.url=https://github.com/${{ github.repository }}" \
+            --annotation "index:org.opencontainers.image.source=https://github.com/${{ github.repository }}" \
+            --annotation "index:org.opencontainers.image.version=${BRANCH_TAG}-${TIMESTAMP}" \
+            --annotation "index:org.opencontainers.image.created=${TIMESTAMP}" \
+            --annotation "index:org.opencontainers.image.revision=${{ github.sha }}" \
+            --annotation "index:org.opencontainers.image.licenses=See repository" \
+            --annotation "index:org.opencontainers.image.documentation=https://dispatcharr.github.io/Dispatcharr-Docs/" \
+            --annotation "index:org.opencontainers.image.vendor=${OWNER}" \
+            --annotation "index:org.opencontainers.image.authors=${{ github.actor }}" \
+            --annotation "index:maintainer=${{ github.actor }}" \
+            --annotation "index:build_version=DispatcharrBase version: ${BRANCH_TAG}-${TIMESTAMP}" \
+            --tag ghcr.io/${OWNER}/${REPO}:${BRANCH_TAG}-${TIMESTAMP} \
             ghcr.io/${OWNER}/${REPO}:${BRANCH_TAG}-${TIMESTAMP}-amd64 ghcr.io/${OWNER}/${REPO}:${BRANCH_TAG}-${TIMESTAMP}-arm64
 
           # Docker Hub manifests
           # branch tag (e.g. base or base-dev)
-          docker buildx imagetools create --tag docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:${BRANCH_TAG} \
+          docker buildx imagetools create \
+            --annotation "index:org.opencontainers.image.title=${{ needs.prepare.outputs.repo_name }}" \
+            --annotation "index:org.opencontainers.image.description=Your ultimate IPTV & stream Management companion." \
+            --annotation "index:org.opencontainers.image.url=https://github.com/${{ github.repository }}" \
+            --annotation "index:org.opencontainers.image.source=https://github.com/${{ github.repository }}" \
+            --annotation "index:org.opencontainers.image.version=${BRANCH_TAG}-${TIMESTAMP}" \
+            --annotation "index:org.opencontainers.image.created=${TIMESTAMP}" \
+            --annotation "index:org.opencontainers.image.revision=${{ github.sha }}" \
+            --annotation "index:org.opencontainers.image.licenses=See repository" \
+            --annotation "index:org.opencontainers.image.documentation=https://dispatcharr.github.io/Dispatcharr-Docs/" \
+            --annotation "index:org.opencontainers.image.vendor=${OWNER}" \
+            --annotation "index:org.opencontainers.image.authors=${{ github.actor }}" \
+            --annotation "index:maintainer=${{ github.actor }}" \
+            --annotation "index:build_version=DispatcharrBase version: ${BRANCH_TAG}-${TIMESTAMP}" \
+            --tag docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:${BRANCH_TAG} \
             docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:${BRANCH_TAG}-amd64 docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:${BRANCH_TAG}-arm64
 
           # branch + timestamp tag
-          docker buildx imagetools create --tag docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:${BRANCH_TAG}-${TIMESTAMP} \
+          docker buildx imagetools create \
+            --annotation "index:org.opencontainers.image.title=${{ needs.prepare.outputs.repo_name }}" \
+            --annotation "index:org.opencontainers.image.description=Your ultimate IPTV & stream Management companion." \
+            --annotation "index:org.opencontainers.image.url=https://github.com/${{ github.repository }}" \
+            --annotation "index:org.opencontainers.image.source=https://github.com/${{ github.repository }}" \
+            --annotation "index:org.opencontainers.image.version=${BRANCH_TAG}-${TIMESTAMP}" \
+            --annotation "index:org.opencontainers.image.created=${TIMESTAMP}" \
+            --annotation "index:org.opencontainers.image.revision=${{ github.sha }}" \
+            --annotation "index:org.opencontainers.image.licenses=See repository" \
+            --annotation "index:org.opencontainers.image.documentation=https://dispatcharr.github.io/Dispatcharr-Docs/" \
+            --annotation "index:org.opencontainers.image.vendor=${OWNER}" \
+            --annotation "index:org.opencontainers.image.authors=${{ github.actor }}" \
+            --annotation "index:maintainer=${{ github.actor }}" \
+            --annotation "index:build_version=DispatcharrBase version: ${BRANCH_TAG}-${TIMESTAMP}" \
+            --tag docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:${BRANCH_TAG}-${TIMESTAMP} \
             docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:${BRANCH_TAG}-${TIMESTAMP}-amd64 docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:${BRANCH_TAG}-${TIMESTAMP}-arm64

.github/workflows/ci.yml

@@ -119,7 +119,27 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      # use metadata from the prepare job
+      - name: Extract metadata for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ghcr.io/${{ needs.prepare.outputs.repo_owner }}/${{ needs.prepare.outputs.repo_name }}
+            docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${{ needs.prepare.outputs.repo_name }}
+          labels: |
+            org.opencontainers.image.title=${{ needs.prepare.outputs.repo_name }}
+            org.opencontainers.image.description=Your ultimate IPTV & stream Management companion.
+            org.opencontainers.image.url=https://github.com/${{ github.repository }}
+            org.opencontainers.image.source=https://github.com/${{ github.repository }}
+            org.opencontainers.image.version=${{ needs.prepare.outputs.version }}-${{ needs.prepare.outputs.timestamp }}
+            org.opencontainers.image.created=${{ needs.prepare.outputs.timestamp }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.licenses=See repository
+            org.opencontainers.image.documentation=https://dispatcharr.github.io/Dispatcharr-Docs/
+            org.opencontainers.image.vendor=${{ needs.prepare.outputs.repo_owner }}
+            org.opencontainers.image.authors=${{ github.actor }}
+            maintainer=${{ github.actor }}
+            build_version=Dispatcharr version: ${{ needs.prepare.outputs.version }}-${{ needs.prepare.outputs.timestamp }}
 
       - name: Build and push Docker image
         uses: docker/build-push-action@v4
@@ -137,6 +157,7 @@ jobs:
             ghcr.io/${{ needs.prepare.outputs.repo_owner }}/${{ needs.prepare.outputs.repo_name }}:${{ needs.prepare.outputs.version }}-${{ needs.prepare.outputs.timestamp }}-${{ matrix.platform }}
             docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${{ needs.prepare.outputs.repo_name }}:${{ needs.prepare.outputs.branch_tag }}-${{ matrix.platform }}
             docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${{ needs.prepare.outputs.repo_name }}:${{ needs.prepare.outputs.version }}-${{ needs.prepare.outputs.timestamp }}-${{ matrix.platform }}
+          labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             REPO_OWNER=${{ needs.prepare.outputs.repo_owner }}
             REPO_NAME=${{ needs.prepare.outputs.repo_name }}
@@ -180,17 +201,42 @@ jobs:
 
           echo "Creating multi-arch manifest for ${OWNER}/${REPO}"
 
-          # branch tag (e.g. latest or dev)
-          docker buildx imagetools create --tag ghcr.io/${OWNER}/${REPO}:${BRANCH_TAG} \
+          # ghcr.io: both the branch tag (e.g. dev) and the version+timestamp tag
+          # point to the same manifest by using multiple --tag flags in one call,
+          # which prevents orphaned untagged images on each new build
+          docker buildx imagetools create \
+            --annotation "index:org.opencontainers.image.title=${{ needs.prepare.outputs.repo_name }}" \
+            --annotation "index:org.opencontainers.image.description=Your ultimate IPTV & stream Management companion." \
+            --annotation "index:org.opencontainers.image.url=https://github.com/${{ github.repository }}" \
+            --annotation "index:org.opencontainers.image.source=https://github.com/${{ github.repository }}" \
+            --annotation "index:org.opencontainers.image.version=${VERSION}-${TIMESTAMP}" \
+            --annotation "index:org.opencontainers.image.created=${TIMESTAMP}" \
+            --annotation "index:org.opencontainers.image.revision=${{ github.sha }}" \
+            --annotation "index:org.opencontainers.image.licenses=See repository" \
+            --annotation "index:org.opencontainers.image.documentation=https://dispatcharr.github.io/Dispatcharr-Docs/" \
+            --annotation "index:org.opencontainers.image.vendor=${OWNER}" \
+            --annotation "index:org.opencontainers.image.authors=${{ github.actor }}" \
+            --annotation "index:maintainer=${{ github.actor }}" \
+            --annotation "index:build_version=Dispatcharr version: ${VERSION}-${TIMESTAMP}" \
+            --tag ghcr.io/${OWNER}/${REPO}:${BRANCH_TAG} \
+            --tag ghcr.io/${OWNER}/${REPO}:${VERSION}-${TIMESTAMP} \
             ghcr.io/${OWNER}/${REPO}:${BRANCH_TAG}-amd64 ghcr.io/${OWNER}/${REPO}:${BRANCH_TAG}-arm64
 
-          # version + timestamp tag
-          docker buildx imagetools create --tag ghcr.io/${OWNER}/${REPO}:${VERSION}-${TIMESTAMP} \
-            ghcr.io/${OWNER}/${REPO}:${VERSION}-${TIMESTAMP}-amd64 ghcr.io/${OWNER}/${REPO}:${VERSION}-${TIMESTAMP}-arm64
-
-          # also create Docker Hub manifests using the same username
-          docker buildx imagetools create --tag docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:${BRANCH_TAG} \
+          # Docker Hub: same single call with both tags
+          docker buildx imagetools create \
+            --annotation "index:org.opencontainers.image.title=${{ needs.prepare.outputs.repo_name }}" \
+            --annotation "index:org.opencontainers.image.description=Your ultimate IPTV & stream Management companion." \
+            --annotation "index:org.opencontainers.image.url=https://github.com/${{ github.repository }}" \
+            --annotation "index:org.opencontainers.image.source=https://github.com/${{ github.repository }}" \
+            --annotation "index:org.opencontainers.image.version=${VERSION}-${TIMESTAMP}" \
+            --annotation "index:org.opencontainers.image.created=${TIMESTAMP}" \
+            --annotation "index:org.opencontainers.image.revision=${{ github.sha }}" \
+            --annotation "index:org.opencontainers.image.licenses=See repository" \
+            --annotation "index:org.opencontainers.image.documentation=https://dispatcharr.github.io/Dispatcharr-Docs/" \
+            --annotation "index:org.opencontainers.image.vendor=${OWNER}" \
+            --annotation "index:org.opencontainers.image.authors=${{ github.actor }}" \
+            --annotation "index:maintainer=${{ github.actor }}" \
+            --annotation "index:build_version=Dispatcharr version: ${VERSION}-${TIMESTAMP}" \
+            --tag docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:${BRANCH_TAG} \
+            --tag docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:${VERSION}-${TIMESTAMP} \
             docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:${BRANCH_TAG}-amd64 docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:${BRANCH_TAG}-arm64
-
-          docker buildx imagetools create --tag docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:${VERSION}-${TIMESTAMP} \
-            docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:${VERSION}-${TIMESTAMP}-amd64 docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:${VERSION}-${TIMESTAMP}-arm64

.github/workflows/frontend-tests.yml

@@ -0,0 +1,41 @@
+name: Frontend Tests
+
+on:
+  push:
+    branches: [main, dev]
+    paths:
+      - 'frontend/**'
+      - '.github/workflows/frontend-tests.yml'
+  pull_request:
+    branches: [main, dev]
+    paths:
+      - 'frontend/**'
+      - '.github/workflows/frontend-tests.yml'
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        working-directory: ./frontend
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          cache: 'npm'
+          cache-dependency-path: './frontend/package-lock.json'
+
+      - name: Install dependencies
+        run: npm ci
+
+      #      - name: Run linter
+      #        run: npm run lint
+
+      - name: Run tests
+        run: npm test

.github/workflows/release.yml

@@ -25,6 +25,7 @@ jobs:
       new_version: ${{ steps.update_version.outputs.new_version }}
       repo_owner: ${{ steps.meta.outputs.repo_owner }}
       repo_name: ${{ steps.meta.outputs.repo_name }}
+      timestamp: ${{ steps.timestamp.outputs.timestamp }}
     steps:
       - uses: actions/checkout@v3
         with:
@@ -56,6 +57,12 @@ jobs:
           REPO_NAME=$(echo "${{ github.repository }}" | cut -d '/' -f 2 | tr '[:upper:]' '[:lower:]')
           echo "repo_name=${REPO_NAME}" >> $GITHUB_OUTPUT
 
+      - name: Generate timestamp for build
+        id: timestamp
+        run: |
+          TIMESTAMP=$(date -u +'%Y%m%d%H%M%S')
+          echo "timestamp=${TIMESTAMP}" >> $GITHUB_OUTPUT
+
       - name: Commit and Tag
         run: |
           git add version.py CHANGELOG.md
@@ -104,6 +111,28 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
+      - name: Extract metadata for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ghcr.io/${{ needs.prepare.outputs.repo_owner }}/${{ needs.prepare.outputs.repo_name }}
+            docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${{ needs.prepare.outputs.repo_name }}
+          labels: |
+            org.opencontainers.image.title=${{ needs.prepare.outputs.repo_name }}
+            org.opencontainers.image.description=Your ultimate IPTV & stream Management companion.
+            org.opencontainers.image.url=https://github.com/${{ github.repository }}
+            org.opencontainers.image.source=https://github.com/${{ github.repository }}
+            org.opencontainers.image.version=${{ needs.prepare.outputs.new_version }}
+            org.opencontainers.image.created=${{ needs.prepare.outputs.timestamp }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.licenses=See repository
+            org.opencontainers.image.documentation=https://dispatcharr.github.io/Dispatcharr-Docs/
+            org.opencontainers.image.vendor=${{ needs.prepare.outputs.repo_owner }}
+            org.opencontainers.image.authors=${{ github.actor }}
+            maintainer=${{ github.actor }}
+            build_version=Dispatcharr version: ${{ needs.prepare.outputs.new_version }} Build date: ${{ needs.prepare.outputs.timestamp }}
+
       - name: Build and push Docker image
         uses: docker/build-push-action@v4
         with:
@@ -115,6 +144,7 @@ jobs:
             ghcr.io/${{ needs.prepare.outputs.repo_owner }}/${{ needs.prepare.outputs.repo_name }}:${{ needs.prepare.outputs.new_version }}-${{ matrix.platform }}
             docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${{ needs.prepare.outputs.repo_name }}:latest-${{ matrix.platform }}
             docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${{ needs.prepare.outputs.repo_name }}:${{ needs.prepare.outputs.new_version }}-${{ matrix.platform }}
+          labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             REPO_OWNER=${{ needs.prepare.outputs.repo_owner }}
             REPO_NAME=${{ needs.prepare.outputs.repo_name }}
@@ -149,25 +179,48 @@ jobs:
           OWNER=${{ needs.prepare.outputs.repo_owner }}
           REPO=${{ needs.prepare.outputs.repo_name }}
           VERSION=${{ needs.prepare.outputs.new_version }}
+          TIMESTAMP=${{ needs.prepare.outputs.timestamp }}
 
           echo "Creating multi-arch manifest for ${OWNER}/${REPO}"
 
           # GitHub Container Registry manifests
-          # latest tag
-          docker buildx imagetools create --tag ghcr.io/${OWNER}/${REPO}:latest \
-            ghcr.io/${OWNER}/${REPO}:latest-amd64 ghcr.io/${OWNER}/${REPO}:latest-arm64
-
-          # version tag
-          docker buildx imagetools create --tag ghcr.io/${OWNER}/${REPO}:${VERSION} \
+          # Create one manifest with both latest and version tags
+          docker buildx imagetools create \
+            --annotation "index:org.opencontainers.image.title=${{ needs.prepare.outputs.repo_name }}" \
+            --annotation "index:org.opencontainers.image.description=Your ultimate IPTV & stream Management companion." \
+            --annotation "index:org.opencontainers.image.url=https://github.com/${{ github.repository }}" \
+            --annotation "index:org.opencontainers.image.source=https://github.com/${{ github.repository }}" \
+            --annotation "index:org.opencontainers.image.version=${VERSION}" \
+            --annotation "index:org.opencontainers.image.created=${TIMESTAMP}" \
+            --annotation "index:org.opencontainers.image.revision=${{ github.sha }}" \
+            --annotation "index:org.opencontainers.image.licenses=See repository" \
+            --annotation "index:org.opencontainers.image.documentation=https://dispatcharr.github.io/Dispatcharr-Docs/" \
+            --annotation "index:org.opencontainers.image.vendor=${OWNER}" \
+            --annotation "index:org.opencontainers.image.authors=${{ github.actor }}" \
+            --annotation "index:maintainer=${{ github.actor }}" \
+            --annotation "index:build_version=Dispatcharr version: ${VERSION} Build date: ${TIMESTAMP}" \
+            --tag ghcr.io/${OWNER}/${REPO}:latest \
+            --tag ghcr.io/${OWNER}/${REPO}:${VERSION} \
             ghcr.io/${OWNER}/${REPO}:${VERSION}-amd64 ghcr.io/${OWNER}/${REPO}:${VERSION}-arm64
 
           # Docker Hub manifests
-          # latest tag
-          docker buildx imagetools create --tag docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:latest \
-            docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:latest-amd64 docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:latest-arm64
-
-          # version tag
-          docker buildx imagetools create --tag docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:${VERSION} \
+          # Create one manifest with both latest and version tags
+          docker buildx imagetools create \
+            --annotation "index:org.opencontainers.image.title=${{ needs.prepare.outputs.repo_name }}" \
+            --annotation "index:org.opencontainers.image.description=Your ultimate IPTV & stream Management companion." \
+            --annotation "index:org.opencontainers.image.url=https://github.com/${{ github.repository }}" \
+            --annotation "index:org.opencontainers.image.source=https://github.com/${{ github.repository }}" \
+            --annotation "index:org.opencontainers.image.version=${VERSION}" \
+            --annotation "index:org.opencontainers.image.created=${TIMESTAMP}" \
+            --annotation "index:org.opencontainers.image.revision=${{ github.sha }}" \
+            --annotation "index:org.opencontainers.image.licenses=See repository" \
+            --annotation "index:org.opencontainers.image.documentation=https://dispatcharr.github.io/Dispatcharr-Docs/" \
+            --annotation "index:org.opencontainers.image.vendor=${OWNER}" \
+            --annotation "index:org.opencontainers.image.authors=${{ github.actor }}" \
+            --annotation "index:maintainer=${{ github.actor }}" \
+            --annotation "index:build_version=Dispatcharr version: ${VERSION} Build date: ${TIMESTAMP}" \
+            --tag docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:latest \
+            --tag docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:${VERSION} \
             docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:${VERSION}-amd64 docker.io/${{ secrets.DOCKERHUB_ORGANIZATION }}/${REPO}:${VERSION}-arm64
 
   create-release:

.gitignore

@@ -18,4 +18,6 @@ dump.rdb
 debugpy*
 uwsgi.sock
 package-lock.json
-models
+models
+.idea
+uv.lock

.python-version

@@ -0,0 +1 @@
+3.13

CHANGELOG.md

@@ -7,20 +7,413 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- Updated Django 5.2.9 → 5.2.11, resolving the following CVEs:
+  - **CVE-2025-13473** (low): Username enumeration via timing difference in mod_wsgi authentication handler.
+  - **CVE-2025-14550** (moderate): Potential denial-of-service via repeated headers on ASGI requests.
+  - **CVE-2026-1207** (high): Potential SQL injection via raster lookups on PostGIS.
+  - **CVE-2026-1285** (moderate): Potential denial-of-service in `django.utils.text.Truncator` HTML methods via inputs with large numbers of unmatched HTML end tags.
+  - **CVE-2026-1287** (high): Potential SQL injection in column aliases via control characters in `FilteredRelation`.
+  - **CVE-2026-1312** (high): Potential SQL injection via `QuerySet.order_by()` and `FilteredRelation` when using column aliases containing periods.
+- Updated frontend npm dependencies to resolve 5 audit vulnerabilities (1 moderate, 4 high):
+  - Updated `ajv` 6.12.6 → 6.14.0, resolving a **moderate** ReDoS vulnerability when using the `$data` option ([GHSA-2g4f-4pwh-qvx6](https://github.com/advisories/GHSA-2g4f-4pwh-qvx6))
+  - Enforced `minimatch` ≥10.2.2 via npm overrides, resolving **high** ReDoS via repeated wildcards with non-matching literal patterns ([GHSA-3ppc-4f35-3m26](https://github.com/advisories/GHSA-3ppc-4f35-3m26)) affecting `minimatch`, `@eslint/config-array`, `@eslint/eslintrc`, and `eslint`
+
 ### Added
 
-- Sort buttons for 'Group' and 'M3U' columns in Streams table for improved stream organization and filtering - Thanks [@bobey6](https://github.com/bobey6)
+- API key authentication: Added support for API key-based authentication as an alternative to JWT tokens. Users can generate and revoke their own personal API key from their profile page, enabling programmatic access for scripts, automations, and third-party integrations without exposing account credentials. Keys authenticate via the `Authorization: ApiKey <key>` header or the `X-API-Key: <key>` header. Admin users can additionally generate and revoke keys on behalf of any user.
+- Lightweight channel summary API endpoint: Added a new `/api/channels/summary/` endpoint that returns only the minimal channel data needed for TV Guide and DVR scheduling (id, name, logo), avoiding the overhead of serializing full channel objects for high-frequency UI operations.
+- Custom Dummy EPG subtitle template support: Added optional subtitle template field to custom dummy EPG configuration. Users can now define subtitle patterns using extracted regex groups and time/date placeholders (e.g., `{starttime} - {endtime}`). (Closes #942)
+- Event-driven webhooks and script execution (Connect): Added new Connect feature that enables event-driven execution of custom scripts and webhooks in response to system events. Supports multiple event types including channel lifecycle (start, stop, reconnect, error, failover), stream operations (switch), recording events (start, end), data refreshes (EPG, M3U), and client activity (connect, disconnect). Event data is available as environment variables in scripts (prefixed with `DISPATCHARR_`), POST payloads for webhooks, and plugin execution payloads. Plugins can now subscribe to events by specifying an `events` array in their action definitions. Includes connection testing endpoint with dummy payloads for validation. (Closes #203)
+- Cron scheduling support for M3U and EPG refreshes: Added interactive cron expression builder with preset buttons and custom field editors, plus info popover with common cron examples. Refactored backup scheduling to use shared ScheduleInput component for consistency across all scheduling interfaces. (Closes #165)
+- Channel numbering modes for auto channel sync: Added three channel numbering modes when auto-syncing channels from M3U groups:
+  - **Fixed Start Number** (default): Start at a specified number and increment sequentially
+  - **Use Provider Number**: Use channel numbers from the M3U source (tvg-chno), with configurable fallback if provider number is missing
+  - **Next Available**: Auto-assign starting from 1, skipping all used channel numbers
+    Each mode includes its own configuration options accessible via the "Channel Numbering Mode" dropdown in auto sync settings. (Closes #956, #433)
+- Legacy NumPy for modular Docker: Added entrypoint detection and automatic installation for the Celery container (use `USE_LEGACY_NUMPY`) to support older CPUs. - Thanks [@patrickjmcd](https://github.com/patrickjmcd)
+- `series_relation` foreign key on `M3UEpisodeRelation`: episode relations now carry a direct FK to their parent `M3USeriesRelation`. This enables correct CASCADE deletion (removing a series relation automatically removes its episode relations), precise per-provider scoping during stale-stream cleanup.
+- Streamer accounts attempting to log into the web UI now receive a clear notification explaining they cannot access the UI but their stream URLs still work. Previously the login button would silently stop with no feedback.
 
 ### Changed
 
-- **Performance**: EPG program parsing optimized for sources with many channels but only a fraction mapped. Now parses XML file once per source instead of once per channel, dramatically reducing I/O and CPU overhead. For sources with 10,000 channels and 100 mapped, this results in ~99x fewer file opens and ~100x fewer full file scans. Orphaned programs for unmapped channels are also cleaned up during refresh to prevent database bloat. Database updates are now atomic to prevent clients from seeing empty/partial EPG data during refresh.
+- Dependency updates:
+  - `Django` 5.2.9 → 5.2.11 (security patch; see Security section)
+  - `celery` 5.6.0 → 5.6.2
+  - `psutil` 7.1.3 → 7.2.2
+  - `torch` 2.9.1+cpu → 2.10.0+cpu
+  - `sentence-transformers` 5.2.0 → 5.2.3
+  - `ajv` 6.12.6 → 6.14.0 (security patch; see Security section)
+  - `minimatch` enforced ≥10.2.2 via npm overrides (security patch; see Security section)
+  - `react` / `react-dom` 19.2.3 → 19.2.4
+  - `react-router-dom` / `react-router` 7.12.0 → 7.13.0
+  - `react-hook-form` 7.70.0 → 7.71.2
+  - `react-draggable` 4.4.6 → 4.5.0
+  - `@tanstack/react-table` 8.21.2 → 8.21.3
+  - `video.js` 8.23.4 → 8.23.7
+  - `vite` 7.3.0 → 7.3.1
+  - `zustand` 5.0.9 → 5.0.11
+  - `allotment` 1.20.4 → 1.20.5
+  - `prettier` 3.7.4 → 3.8.1
+  - `@swc/wasm` 1.15.7 → 1.15.11
+  - `@testing-library/react` 16.3.1 → 16.3.2
+  - `@types/react` 19.2.7 → 19.2.14
+  - `@vitejs/plugin-react-swc` 4.2.2 → 4.2.3
+- Channel store optimization: Refactored frontend channel loading to only fetch channel IDs on initial login (matching the streams store pattern), instead of loading full channel objects upfront. Full channel data is fetched lazily as needed. This dramatically reduces login time and initial page load when large channel libraries are present.
+- DVR scheduling: Channel selector now displays the channel number alongside the channel name when scheduling a recording.
+- TV Guide performance improvements: Optimized the TV Guide with horizontal culling for off-screen program rows (only rendering visible programs), throttled now-line position updates, and improved scroll performance. Reduces unnecessary DOM work and improves responsiveness with large EPG datasets.
+- Stream Profile form rework: Replaced the plain command text field with a dropdown listing built-in tools (FFmpeg, Streamlink, VLC, yt-dlp) plus a Custom option that reveals a free-text input. Each built-in now shows its default parameter string as a live example in the Parameters field description, updating as the command selection changes. Added descriptive help text to all fields to improve clarity.
+- Custom Dummy EPG form UI improvements: Reorganized the form into collapsible accordion sections (Pattern Configuration, Output Templates, Upcoming/Ended Templates, Fallback Templates, EPG Settings) for better organization. Field descriptions now appear in info icon popovers instead of taking up vertical space, making the form more compact and easier to navigate while keeping help text accessible.
+- XC API M3U stream URLs: M3U generation for Xtream Codes API endpoints now use proper XC-style stream URLs (`/live/username/password/channel_id`) instead of UUID-based stream endpoints, ensuring full compatibility with XC clients. (Fixes #839)
+- XC API `get_series` now includes `tmdb_id` and `imdb_id` fields, matching `get_vod_streams`. Clients that use TMDB enrichment (e.g. Chillio) can now resolve clean series titles and poster images. - Thanks [@firestaerter3](https://github.com/firestaerter3)
+
+### Fixed
+
+- Fixed admin permission checks inconsistently using `is_superuser`/`is_staff` instead of `user_level>=10`, causing API-created admin accounts to intermittently see the setup page, lose access to backup endpoints, and miss admin-only notifications. `manage.py createsuperuser` now also correctly sets `user_level=10`. (Fixes #954) - Thanks [@CodeBormen](https://github.com/CodeBormen)
+- Channel table group filter sort order: The group dropdown in the channel table is now sorted alphabetically.
+- DVR one-time recording scheduling: Fixed a bug where scheduling a one-time recording for a future program caused the recording to start immediately instead of at the scheduled time.
+- XC API `added` field type inconsistencies: `get_live_streams` and `get_vod_info` now return the `added` field as a string (e.g., `"1708300800"`) instead of an integer, fixing compatibility with XC clients that have strict JSON serializers (such as Jellyfin's Xtream Library plugin). (Closes #978)
+- Stream Profile form User-Agent not populating when editing: The User-Agent field was not correctly loaded from the existing profile when opening the edit modal. (Fixes #650)
+- VOD proxy connection counter leak on client disconnect: Fixed a connection leak in the VOD proxy where connection counters were not properly decremented when clients disconnected, causing the connection pool to lose track of available connections. The multi-worker connection manager now correctly handles client disconnection events across all proxy configurations. Includes three key fixes: (1) Replaced GET-check-INCR race condition with atomic INCR-first-then-check pattern in both connection managers to prevent concurrent requests exceeding max_streams; (2) Decrement profile counter directly in stream generator exit paths instead of deferring to daemon thread cleanup; (3) Decrement profile counter on create_connection() failure to release reserved slots. (Fixes #962, #971, #451, #533) - Thanks [@CodeBormen](https://github.com/CodeBormen)
+- XC profile refresh credential extraction with sub-paths: Fixed credential extraction in `get_transformed_credentials()` to use negative indices anchored to the known tail structure instead of hardcoded indices that broke when server URLs contained sub-paths (e.g., `http://server.com/portal/a/`). This ensures XC accounts with sub-paths in their server URLs work correctly for profile refreshes. (Fixes #945) - Thanks [@CodeBormen](https://github.com/CodeBormen)
+- XC EPG URL construction for accounts with sub-paths or trailing slashes: Fixed EPG URL construction in M3U forms to normalize server URL to origin before appending `xmltv.php` endpoint, preventing double slashes and incorrect path placement when server URLs include sub-paths or trailing slashes. (Fixes #800) - Thanks [@CodeBormen](https://github.com/CodeBormen)
+- Auto channel sync duplicate channel numbers across groups: Fixed issue where multiple auto-sync groups starting at the same number would create duplicate channel numbers. The used channel number tracking now persists across all groups in a single sync operation, ensuring each assigned channel number is globally unique.
+- Modular mode PostgreSQL/Redis connection checks: Replaced raw Python socket checks with native tools (`pg_isready` for PostgreSQL and `socket.create_connection` for Redis) in modular deployment mode to prevent indefinite hangs in Docker environments with non-standard networking or DNS configurations. Now properly supports IPv4 and IPv6 configurations. (Fixes #952) - Thanks [@CodeBormen](https://github.com/CodeBormen)
+- VOD episode UUID regeneration on every refresh: a pre-emptive `Episode.objects.delete()` in `refresh_series_episodes` ran before `batch_process_episodes`, defeating its update-in-place logic and forcing all episodes to be recreated with new UUIDs on every refresh. Clients (Jellyfin, Emby, Plex, etc.) with cached episode paths received 500 errors until a full library rescan. Removing the delete allows episodes to be updated in place with stable UUIDs. (Fixes #785, #985, #820) - Thanks [@znake-oil](https://github.com/znake-oil)
+- VOD stale episode stream cleanup scoped incorrectly per provider: when a provider removed a stream from a series, `batch_process_episodes` could delete episode relations belonging to a different provider version of the same series (e.g. EN vs ES) that had deduped to the same `Series` object via TMDB/IMDB ID. Cleanup is now scoped to the specific `M3USeriesRelation` that was queried.
+
+## [0.19.0] - 2026-02-10
+
+### Added
+
+- Add system notifications and update checks
+  -Real-time notifications for system events and alerts
+  -Per-user notification management and dismissal
+  -Update check on startup and every 24 hours to notify users of available versions
+  -Notification center UI component
+  -Automatic cleanup of expired notifications
+- Network Access "Reset to Defaults" button: Added a "Reset to Defaults" button to the Network Access settings form, matching the functionality in Proxy Settings. Users can now quickly restore recommended network access settings with one click.
+- Streams table column visibility toggle: Added column menu to Streams table header allowing users to show/hide optional columns (TVG-ID, Stats) based on preference, with optional columns hidden by default for cleaner default view.
+- Streams table TVG-ID column with search filter and sort: Added TVG-ID column to streams table with search filtering and sort capability for better stream organization. (Closes #866) - Thanks [@CodeBormen](https://github.com/CodeBormen)
+- Frontend now automatically refreshes streams and channels after a stream rehash completes, ensuring the UI is always up-to-date following backend merge operations.
+- Frontend Unit Tests: Added comprehensive unit tests for React hooks and Zustand stores, including:
+  - `useLocalStorage` hook tests with localStorage mocking and error handling
+  - `useSmartLogos` hook tests for logo loading and management
+  - `useTablePreferences` hook tests for table settings persistence
+  - `useAuthStore` tests for authentication flow and token management
+  - `useChannelsStore` tests for channel data management
+  - `useUserAgentsStore` tests for user agent CRUD operations
+  - `useUsersStore` tests for user management functionality
+  - `useVODLogosStore` tests for VOD logo operations
+  - `useVideoStore` tests for video player state management
+  - `useWarningsStore` tests for warning suppression functionality
+  - Code refactoring for improved readability and maintainability - Thanks [@nick4810](https://github.com/nick4810)
+- EPG auto-matching: Added advanced options to strip prefixes, suffixes, and custom text from channel names to assist matching; default matching behavior and settings remain unchanged (Closes #771) - Thanks [@CodeBormen](https://github.com/CodeBormen)
+- Redis authentication support for modular deployments: Added support for authentication when connecting to external Redis instances using either password-only authentication (Redis <6) or username + password authentication (Redis 6+ ACL). REDIS_PASSWORD and REDIS_USER environment variables with URL encoding for special characters. (Closes #937) - Thanks [@CodeBormen](https://github.com/CodeBormen)
+- Plugin logos: if a plugin ZIP includes `logo.png`, it is surfaced in the Plugins UI and shown next to the plugin name.
+- Plugin manifests (`plugin.json`) for safe metadata discovery, plus legacy warnings and folder-name fallbacks when a manifest is missing.
+- Plugin stop hooks: Dispatcharr now calls a plugin's optional `stop()` method (or `run("stop")` action) when disabling, deleting, or reloading plugins to allow graceful shutdown.
+- Plugin action buttons can define `button_label`, `button_variant`, and `button_color` (e.g., Stop in red), falling back to “Run” for older plugins.
+- Plugin card metadata: plugins can specify `author` and `help_url` in `plugin.json` to show author and docs link in the UI.
+- Plugin cards can now be expanded/collapsed by clicking the header or chevron to hide settings and actions.
+
+### Changed
+
+- XtreamCodes Authentication Optimization: Reduced API calls during XC refresh by 50% by eliminating redundant authentication step. This should help reduce rate-limiting errors.
+- App initialization efficiency: Refactored app initialization to prevent redundant execution across multiple worker processes. Created `dispatcharr.app_initialization` utility module with `should_skip_initialization()` function that prevents custom initialization tasks (backup scheduler sync, developer notifications sync) from running during management commands, in worker processes, or in development servers. This significantly reduces startup overhead in multi-worker deployments (e.g., uWSGI with 10 workers now syncs the scheduler once instead of 10 times). Applied to both `CoreConfig` and `BackupsConfig` apps.
+- M3U/EPG Network Access Defaults: Updated default network access settings for M3U and EPG endpoints to only allow local/private networks by default (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, ::1/128, fc00::/7, fe80::/10). This improves security by preventing public internet access to these endpoints unless explicitly configured. Other endpoints (Streams, XC API, UI) remain open by default.
+- Modular deployments: Bumped modular Postgres image to 17 and added compatibility checks (PostgreSQL version and UTF-8 database encoding) when using external databases to prevent migration/encoding issues.
+- Stream Identity Stability: Added `stream_id` (provider stream identifier) and `stream_chno` (provider channel number) fields to Stream model. For XC accounts, the stream hash now uses the stable `stream_id` instead of the URL when hashing, ensuring XC streams maintain their identity and channel associations even when account credentials or server URLs change. Supports both XC `num` and M3U `tvg-chno`/`channel-number` attributes.
+- Swagger/OpenAPI Migration: Migrated from `drf-yasg` (OpenAPI 2.0) to `drf-spectacular` (OpenAPI 3.0) for API documentation. This provides:
+  - Native Bearer token authentication support in Swagger UI - users can now enter just the JWT token and the "Bearer " prefix is automatically added
+  - Modern OpenAPI 3.0 specification compliance
+  - Better auto-generation of request/response schemas
+  - Improved documentation accuracy with serializer introspection
+- Switched to uv for package management: Migrated from pip to uv (Astral's fast Python package installer) for improved dependency resolution speed and reliability. This includes updates to Docker build processes, installation scripts (debian_install.sh), and project configuration (pyproject.toml) to leverage uv's features like virtual environment management and lockfile generation. - Thanks [@tobimichael96](https://github.com/tobimichael96) for getting it started!
+- Copy to Clipboard: Refactored `copyToClipboard` utility function to include notification handling internally, eliminating duplicate notification code across the frontend. The function now accepts optional parameters for customizing success/failure messages while providing consistent behavior across all copy operations.
+
+### Fixed
+
+- XC EPG Logic: Fixed EPG filtering issues where short EPG requests had no time-based filtering (returning expired programs) and regular EPG requests used `start_time__gte` (missing the currently playing program). Both now correctly use `end_time__gt` to show programs that haven't ended yet, with short EPG additionally limiting results. (Fixes #915)
+- Automatic backups not enabled by default on new installations: Added backups app to `INSTALLED_APPS` and implemented automatic scheduler initialization in `BackupsConfig.ready()`. The backup scheduler now properly syncs the periodic task on startup, ensuring automatic daily backups are enabled and scheduled immediately on fresh database creation without requiring manual user intervention.
+- Fixed modular Docker Compose deployment and entrypoint/init scripts to properly support `DISPATCHARR_ENV=modular`, use external PostgreSQL/Redis services, and handle port, version, and encoding validation (Closes #324, Fixes #61, #445, #731) - Thanks [@CodeBormen](https://github.com/CodeBormen)
+- Stream rehash/merge logic now guarantees unique stream_hash and always preserves the stream with the best channel ordering and relationships. This prevents duplicate key errors and ensures the correct stream is retained when merging. (Fixes #892)
+- Admin URL Conflict with XC Streams: Updated nginx configuration to only redirect exact `/admin` and `/admin/` paths to login in production, preventing interference with stream URLs that use "admin" as a username (e.g., `/admin/password/stream_id` now properly routes to stream handling instead of being redirected).
+- EPG Channel ID XML Escaping: Fixed XML parsing errors in EPG output when channel IDs contain special characters (&, <, >, \") by properly escaping them in XML attributes. (Fixes #765) - Thanks [@CodeBormen](https://github.com/CodeBormen)
+- Fixed NumPy baseline detection in Docker entrypoint. Now properly detects when NumPy crashes on import due to CPU baseline incompatibility and installs legacy NumPy version. Previously, if NumPy failed to import, the script would skip legacy installation assuming it was already compatible.
+- Backup Scheduler Test: Fixed test to correctly validate that automatic backups are enabled by default with a retention count of 3, matching the actual scheduler defaults. - Thanks [@jcasimir](https://github.com/jcasimir)
+- Hardened plugin loading to avoid executing plugin code unless the plugin is enabled.
+- Prevented plugin package names from shadowing standard library or installed modules by namespacing plugin imports with safe aliases.
+- Added safety limits to plugin ZIP imports (file count and size caps) and sanitized plugin keys derived from uploads.
+- Enforced strict boolean parsing for plugin enable/disable requests to avoid accidental enables from truthy strings.
+- Applied plugin field defaults server-side when running actions so plugins receive expected settings even before a user saves.
+- Plugin settings UI improvements: render `info`/`text` fields, support `input_type: password`, show descriptions/placeholders, surface save failures, and keep settings in sync after refresh.
+- Disabled plugins now collapse settings/actions to match the closed state before first enable.
+- Plugin card header controls (delete/version/toggle) now stay right-aligned even with long descriptions.
+- Improved plugin logo resolution (case-insensitive paths + absolute URLs), fixing dev UI logo loading without a Vite proxy.
+- Plugin reload now hits the backend, clears module caches across workers, and refreshes the UI so code changes apply without a full backend restart.
+- Plugin loader now supports `plugin.py` without `__init__.py`, including folders with non-identifier names, by loading modules directly from file paths.
+- Plugin action handling stabilized: avoids registry race conditions and only shows loading on the active action.
+- Plugin enable/disable toggles now update immediately without requiring a full page refresh.
+- M3U/EPG tasks downloading endlessly for large files: Fixed the root cause where the Redis task lock (300s TTL) expired during long downloads, allowing Celery Beat to start competing duplicate tasks that never completed. Added a `TaskLockRenewer` daemon thread that periodically extends the lock TTL while a task is actively working, applied to all long-running task paths (M3U refresh, M3U group refresh, EPG refresh, EPG program parsing). Also adds an HTTP timeout to M3U download requests, streams M3U downloads directly to a temp file on disk instead of accumulating the entire file in memory, and adds Celery task time limits as a safety net against runaway tasks. (Fixes #861) - Thanks [@CodeBormen](https://github.com/CodeBormen)
+
+## [0.18.1] - 2026-01-27
+
+### Fixed
+
+- Series Rules API Swagger Documentation: Fixed drf_yasg validation error where TYPE_ARRAY schemas were missing required items parameter, causing module import failure
+
+## [0.18.0] - 2026-01-27
+
+### Security
+
+- Updated react-router from 7.11.0 to 7.12.0 to address two security vulnerabilities:
+  - **High**: Open Redirect XSS vulnerability in Action/Server Action Request Processing ([GHSA-h5cw-625j-3rxh](https://github.com/advisories/GHSA-h5cw-625j-3rxh), [GHSA-2w69-qvjg-hvjx](https://github.com/advisories/GHSA-2w69-qvjg-hvjx))
+  - **Moderate**: SSR XSS vulnerability in ScrollRestoration component ([GHSA-8v8x-cx79-35w7](https://github.com/advisories/GHSA-8v8x-cx79-35w7))
+- Updated react-router-dom from 7.11.0 to 7.12.0 (dependency of react-router)
+- Fixed moderate severity Prototype Pollution vulnerability in Lodash (`_.unset` and `_.omit` functions) See [GHSA-xxjr-mmjv-4gpg](https://github.com/advisories/GHSA-xxjr-mmjv-4gpg) for details.
+
+### Added
+
+- Series Rules API Swagger Documentation: Added comprehensive Swagger/OpenAPI documentation for all series-rules endpoints (`GET /series-rules/`, `POST /series-rules/`, `DELETE /series-rules/{tvg_id}/`, `POST /series-rules/evaluate/`, `POST /series-rules/bulk-remove/`), including detailed descriptions, request/response schemas, and error handling information for improved API discoverability
+- Editable Channel Table Mode:
+  - Added a robust inline editing mode for the channels table, allowing users to quickly edit channel fields (name, number, group, EPG, logo) directly in the table without opening a modal.
+  - EPG and logo columns support searchable dropdowns with instant filtering and keyboard navigation for fast assignment.
+  - Drag-and-drop reordering of channels enabled when unlocked, with persistent order updates. (Closes #333)
+  - Group column uses a searchable dropdown for quick group assignment, matching the UX of EPG and logo selectors.
+  - All changes are saved via API with optimistic UI updates and error handling.
+- Stats page enhancements: Added "Now Playing" program information for active streams with smart polling that only fetches EPG data when programs are about to change (not on every stats refresh). Features include:
+  - Currently playing program title displayed with live broadcast indicator (green Radio icon)
+  - Expandable program descriptions via chevron button
+  - Progress bar showing elapsed and remaining time for currently playing programs
+  - Efficient POST-based API endpoint (`/api/epg/current-programs/`) supporting batch channel queries or fetching all channels
+  - Smart scheduling that fetches new program data 5 seconds after current program ends
+  - Only polls when active channel list changes, not on stats refresh
+- Channel preview button: Added preview functionality to active stream cards on stats page
+- Unassociated streams filter: Added "Only Unassociated" filter option to streams table for quickly finding streams not assigned to any channels - Thanks [@JeffreyBytes](https://github.com/JeffreyBytes) (Closes #667)
+- Streams table: Added "Hide Stale" filter to quickly hide streams marked as stale.
+- Client-side logo caching: Added `Cache-Control` and `Last-Modified` headers to logo responses, enabling browsers to cache logos locally for 4 hours (local files) and respecting upstream cache headers (remote logos). This reduces network traffic and nginx load while providing faster page loads through browser-level caching that complements the existing nginx server-side cache - Thanks [@DawtCom](https://github.com/DawtCom)
+- DVR recording remux fallback strategy: Implemented two-stage TS→MP4→MKV fallback when direct TS→MKV conversion fails due to timestamp issues. On remux failure, system now attempts TS→MP4 conversion (MP4 container handles broken timestamps better) followed by MP4→MKV conversion, automatically recovering from provider timestamp corruption. Failed conversions now properly clean up partial files and preserve source TS for manual recovery.
+- Mature content filtering support:
+  - Added `is_adult` boolean field to both Stream and Channel models with database indexing for efficient filtering and sorting
+  - Automatically populated during M3U/XC refresh operations by extracting `is_adult` value from provider data
+  - Type-safe conversion supporting both integer (0/1) and string ("0"/"1") formats from different providers
+  - UI controls in channel edit form (Switch with tooltip) and bulk edit form (Select dropdown) for easy management
+  - XtreamCodes API support with proper integer formatting (0/1) in live stream responses
+  - Automatic propagation from streams to channels during both single and bulk channel creation operations
+  - Included in serializers for full API support
+  - User-level content filtering: Non-admin users can opt to hide mature content channels across all interfaces (web UI, M3U playlists, EPG data, XtreamCodes API) via "Hide Mature Content" toggle in user settings (stored in custom_properties, admin users always see all content)
+- Table header pin toggle: Pin/unpin table headers to keep them visible while scrolling. Toggle available in channel table menu and UI Settings page. Setting persists across sessions and applies to all tables. (Closes #663)
+- Cascading filters for streams table: Improved filter usability with hierarchical M3U and Group dropdowns. M3U acts as the parent filter showing only active/enabled accounts, while Group options dynamically update to display only groups available in the selected M3U(s). Only enabled M3U's are displayed. (Closes #647)
+- Streams table UI: Added descriptive tooltips to top-toolbar buttons (Add to Channel, Create Channels, Filters, Create Stream, Delete) and to row action icons (Add to Channel, Create New Channel). Tooltips now use a 500ms open delay for consistent behavior with existing table header tooltips.
+
+### Changed
+
+- Data loading and initialization refactor: Major performance improvement reducing initial page load time by eliminating duplicate API requests caused by race conditions between authentication flow and route rendering:
+  - Fixed authentication race condition where `isAuthenticated` was set before data loading completed, causing routes to render and tables to mount prematurely
+  - Added `isInitialized` flag to delay route rendering until after all initialization data is loaded via `initData()`
+  - Consolidated version and environment settings fetching into centralized settings store with caching to prevent redundant calls
+  - Implemented stale fetch prevention in ChannelsTable and StreamsTable using fetch version tracking to ignore outdated responses
+  - Fixed filter handling in tables to use `debouncedFilters` consistently, preventing unnecessary refetches
+  - Added initialization guards using refs to prevent double-execution of auth and superuser checks during React StrictMode's intentional double-rendering in development
+  - Removed duplicate version/environment fetch calls from Sidebar, LoginForm, and SuperuserForm by using centralized store
+- Table preferences (header pin and table size) now managed together with centralized state management and localStorage persistence.
+- Streams table button labels: Renamed "Remove" to "Delete" and "Add Stream to Channel" to "Add to Channel" for clarity and consistency with other UI terminology.
+- Frontend tests GitHub workflow now uses Node.js 24 (matching Dockerfile) and runs on both `main` and `dev` branch pushes and pull requests for comprehensive CI coverage.
+- Table preferences architecture refactored: Migrated `table-size` preference from individual `useLocalStorage` calls to centralized `useTablePreferences` hook. All table components now read preferences from the table instance (`table.tableSize`, `.g maintainability and providing consistent API across all tables.
+- Optimized unassociated streams filter performance: Replaced inefficient reverse foreign key NULL check (`channels__isnull=True`) with Count annotation approach, reducing query time from 4-5 seconds to under 500ms for large datasets (75k+ streams)
+
+### Fixed
+
+- Channels table pagination error handling: Fixed "Invalid page" error notifications that appeared when filters reduced the result set while on a page beyond the new total. The API layer now automatically detects invalid page errors, resets pagination to page 1, and retries the request transparently. (Fixes #864)
+- Fixed long IP addresses overlapping adjacent columns in stream connection card by adding truncation with tooltips displaying the full address. (Fixes #712)
+- Fixed nginx startup failure due to group name mismatch in non-container deployments - Thanks [@s0len](https://github.com/s0len) (Fixes #877)
+- Updated streamlink from 8.1.0 to 8.1.2 to fix YouTube live stream playback issues and improve Pluto TV ad detection (Fixes #869)
+- Fixed date/time formatting across all tables to respect user's UI preferences (time format and date format) set in Settings page:
+  - Stream connection card "Connected" column
+  - VOD connection card "Connection Start Time" column
+  - M3U table "Updated" column
+  - EPG table "Updated" column
+  - Users table "Last Login" and "Date Joined" columns
+  - All components now use centralized `format()` helper from dateTimeUtils for consistency
+- Removed unused imports from table components for cleaner code
+- Fixed build-dev.sh script stability: Resolved Dockerfile and build context paths to be relative to script location for reliable execution from any working directory, added proper --platform argument handling with array-safe quoting, and corrected push behavior to honor -p flag with accurate messaging. Improved formatting and quoting throughout to prevent word-splitting issues - Thanks [@JeffreyBytes](https://github.com/JeffreyBytes)
+- Fixed TypeError on streams table load after container restart: Added robust data validation and type coercion to handle malformed filter options during container startup. The streams table MultiSelect components now safely convert group names to strings and filter out null/undefined values, preventing "right-hand side of 'in' should be an object, got number" errors when the backend hasn't fully initialized. API error handling returns safe defaults.
+- Fixed XtreamCodes API crash when channels have NULL channel_group: The `player_api.php` endpoint (`xc_get_live_streams`) now gracefully handles channels without an assigned channel_group by dynamically looking up and assigning them to "Default Group" instead of crashing with AttributeError. Additionally, the Channel serializer now auto-assigns new channels to "Default Group" when `channel_group_id` is omitted during creation, preventing future NULL channel_group issues.
+- Fixed streams table column header overflow: Implemented fixed-height column headers (30px max-height) with pill-style filter display showing first selection plus count (e.g., "Sport +3"). Prevents header expansion when multiple filters are selected, maintaining compact table layout. (Fixes #613)
+- Fixed VOD logo cleanup button count: The "Cleanup Unused" button now displays the total count of all unused logos across all pages instead of only counting unused logos on the current page.
+- Fixed VOD refresh failures when logos are deleted: Changed logo comparisons to use `logo_id` (raw FK integer) instead of `logo` (related object) to avoid Django's lazy loading, which triggers a database fetch that fails if the referenced logo no longer exists. Also improved orphaned logo detection to properly clear stale references when logo URLs exist but logos are missing from the database.
+- Fixed channel profile filtering to properly restrict content based on assigned channel profiles for all non-admin users (user_level < 10) instead of only streamers (user_level == 0). This corrects the XtreamCodes API endpoints (`get_live_categories` and `get_live_streams`) along with M3U and EPG generation, ensuring standard users (level 1) are properly restricted by their assigned channel profiles. Previously, "Standard" users with channel profiles assigned would see all channels instead of only those in their assigned profiles.
+- Fixed NumPy baseline detection in Docker entrypoint. Now calls `numpy.show_config()` directly with case-insensitive grep instead of incorrectly wrapping the output.
+- Fixed SettingsUtils frontend tests for new grouped settings architecture. Updated test suite to properly verify grouped JSON settings (stream_settings, dvr_settings, etc.) instead of individual CharField settings, including tests for type conversions, array-to-CSV transformations, and special handling of proxy_settings and network_access.
+
+## [0.17.0] - 2026-01-13
+
+### Added
+
+- Added tooltip on filter pills showing all selected items in a vertical list (up to 10 items, with "+N more" indicator)
+- Loading feedback for all confirmation dialogs: Extended visual loading indicators across all confirmation dialogs throughout the application. Delete, cleanup, and bulk operation dialogs now show an animated dots loader and disabled state during async operations, providing consistent user feedback for backups (restore/delete), channels, EPGs, logos, VOD logos, M3U accounts, streams, users, groups, filters, profiles, batch operations, and network access changes.
+- Channel profile edit and duplicate functionality: Users can now rename existing channel profiles and create duplicates with automatic channel membership cloning. Each profile action (edit, duplicate, delete) in the profile dropdown for quick access.
+- ProfileModal component extracted for improved code organization and maintainability of channel profile management operations.
+- Frontend unit tests for pages and utilities: Added comprehensive unit test coverage for frontend components within pages/ and JS files within utils/, along with a GitHub Actions workflow (`frontend-tests.yml`) to automatically run tests on commits and pull requests - Thanks [@nick4810](https://github.com/nick4810)
+- Channel Profile membership control for manual channel creation and bulk operations: Extended the existing `channel_profile_ids` parameter from `POST /api/channels/from-stream/` to also support `POST /api/channels/` (manual creation) and bulk creation tasks with the same flexible semantics:
+  - Omitted parameter (default): Channels are added to ALL profiles (preserves backward compatibility)
+  - Empty array `[]`: Channels are added to NO profiles
+  - Sentinel value `[0]`: Channels are added to ALL profiles (explicit)
+  - Specific IDs `[1, 2, ...]`: Channels are added only to the specified profiles
+    This allows API consumers to control profile membership across all channel creation methods without requiring all channels to be added to every profile by default.
+- Channel profile selection in creation modal: Users can now choose which profiles to add channels to when creating channels from streams (both single and bulk operations). Options include adding to all profiles, no profiles, or specific profiles with mutual exclusivity between special options ("All Profiles", "None") and specific profile selections. Profile selection defaults to the current table filter for intuitive workflow.
+- Group retention policy for M3U accounts: Groups now follow the same stale retention logic as streams, using the account's `stale_stream_days` setting. Groups that temporarily disappear from an M3U source are retained for the configured retention period instead of being immediately deleted, preserving user settings and preventing data loss when providers temporarily remove/re-add groups. (Closes #809)
+- Visual stale indicators for streams and groups: Added `is_stale` field to Stream and both `is_stale` and `last_seen` fields to ChannelGroupM3UAccount models to track items in their retention grace period. Stale groups display with orange buttons and a warning tooltip, while stale streams show with a red background color matching the visual treatment of empty channels.
+
+### Changed
+
+- Settings architecture refactored to use grouped JSON storage: Migrated from individual CharField settings to grouped JSONField settings for improved performance, maintainability, and type safety. Settings are now organized into logical groups (stream_settings, dvr_settings, backup_settings, system_settings, proxy_settings, network_access) with automatic migration handling. Backend provides helper methods (`get_stream_settings()`, `get_default_user_agent_id()`, etc.) for easy access. Frontend simplified by removing complex key mapping logic and standardizing on underscore-based field names throughout.
+- Docker setup enhanced for legacy CPU support: Added `USE_LEGACY_NUMPY` environment variable to enable custom-built NumPy with no CPU baseline, allowing Dispatcharr to run on older CPUs (circa 2009) that lack support for newer baseline CPU features. When set to `true`, the entrypoint script will install the legacy NumPy build instead of the standard distribution. (Fixes #805)
+- VOD upstream read timeout reduced from 30 seconds to 10 seconds to minimize lock hold time when clients disconnect during connection phase
+- Form management refactored across application: Migrated Channel, Stream, M3U Profile, Stream Profile, Logo, and User Agent forms from Formik to React Hook Form (RHF) with Yup validation for improved form handling, better validation feedback, and enhanced code maintainability
+- Stats and VOD pages refactored for clearer separation of concerns: extracted Stream/VOD connection cards (StreamConnectionCard, VodConnectionCard, VODCard, SeriesCard), moved page logic into dedicated utils, and lazy-loaded heavy components with ErrorBoundary fallbacks to improve readability and maintainability - Thanks [@nick4810](https://github.com/nick4810)
+- Channel creation modal refactored: Extracted and unified channel numbering dialogs from StreamsTable into a dedicated CreateChannelModal component that handles both single and bulk channel creation with cleaner, more maintainable implementation and integrated profile selection controls.
+
+### Fixed
+
+- Fixed bulk channel profile membership update endpoint silently ignoring channels without existing membership records. The endpoint now creates missing memberships automatically (matching single-channel endpoint behavior), validates that all channel IDs exist before processing, and provides detailed response feedback including counts of updated vs. created memberships. Added comprehensive Swagger documentation with request/response schemas.
+- Fixed bulk channel edit endpoint crashing with `ValueError: Field names must be given to bulk_update()` when the first channel in the update list had no actual field changes. The endpoint now collects all unique field names from all channels being updated instead of only looking at the first channel, properly handling cases where different channels update different fields or when some channels have no changes - Thanks [@mdellavo](https://github.com/mdellavo) (Fixes #804)
+- Fixed PostgreSQL backup restore not completely cleaning database before restoration. The restore process now drops and recreates the entire `public` schema before running `pg_restore`, ensuring a truly clean restore that removes all tables, functions, and other objects not present in the backup file. This prevents leftover database objects from persisting when restoring backups from older branches or versions. Added `--no-owner` flag to `pg_restore` to avoid role permission errors when the backup was created by a different PostgreSQL user.
+- Fixed TV Guide loading overlay not disappearing after navigating from DVR page. The `fetchRecordings()` function in the channels store was setting `isLoading: true` on start but never resetting it to `false` on successful completion, causing the Guide page's loading overlay to remain visible indefinitely when accessed after the DVR page.
+- Fixed stream profile parameters not properly handling quoted arguments. Switched from basic `.split()` to `shlex.split()` for parsing command-line parameters, allowing proper handling of multi-word arguments in quotes (e.g., OAuth tokens in HTTP headers like `"--twitch-api-header=Authorization=OAuth token123"`). This ensures external streaming tools like Streamlink and FFmpeg receive correctly formatted arguments when using stream profiles with complex parameters - Thanks [@justinforlenza](https://github.com/justinforlenza) (Fixes #833)
+- Fixed bulk and manual channel creation not refreshing channel profile memberships in the UI for all connected clients. WebSocket `channels_created` event now calls `fetchChannelProfiles()` to ensure profile membership updates are reflected in real-time for all users without requiring a page refresh.
+- Fixed Channel Profile filter incorrectly applying profile membership filtering even when "Show Disabled" was enabled, preventing all channels from being displayed. Profile filter now only applies when hiding disabled channels. (Fixes #825)
+- Fixed manual channel creation not adding channels to channel profiles. Manually created channels are now added to the selected profile if one is active, or to all profiles if "All" is selected, matching the behavior of channels created from streams.
+- Fixed VOD streams disappearing from stats page during playback by adding `socket-timeout = 600` to production uWSGI config. The missing directive caused uWSGI to use its default 4-second timeout, triggering premature cleanup when clients buffered content. Now matches the existing `http-timeout = 600` value and prevents timeout errors during normal client buffering - Thanks [@patchy8736](https://github.com/patchy8736)
+- Fixed Channels table EPG column showing "Not Assigned" on initial load for users with large EPG datasets. Added `tvgsLoaded` flag to EPG store to track when EPG data has finished loading, ensuring the table waits for EPG data before displaying. EPG cells now show animated skeleton placeholders while loading instead of incorrectly showing "Not Assigned". (Fixes #810)
+- Fixed VOD profile connection count not being decremented when stream connection fails (timeout, 404, etc.), preventing profiles from reaching capacity limits and rejecting valid stream requests
+- Fixed React warning in Channel form by removing invalid `removeTrailingZeros` prop from NumberInput component
+- Release workflow Docker tagging: Fixed issue where `latest` and version tags (e.g., `0.16.0`) were creating separate manifests instead of pointing to the same image digest, which caused old `latest` tags to become orphaned/untagged after new releases. Now creates a single multi-arch manifest with both tags, maintaining proper tag relationships and download statistics visibility on GitHub.
+- Fixed onboarding message appearing in the Channels Table when filtered results are empty. The onboarding message now only displays when there are no channels created at all, not when channels exist but are filtered out by current filters.
+- Fixed `M3UMovieRelation.get_stream_url()` and `M3UEpisodeRelation.get_stream_url()` to use XC client's `_normalize_url()` method instead of simple `rstrip('/')`. This properly handles malformed M3U account URLs (e.g., containing `/player_api.php` or query parameters) before constructing VOD stream endpoints, matching behavior of live channel URL building. (Closes #722)
+- Fixed bulk_create and bulk_update errors during VOD content refresh by pre-checking object existence with optimized bulk queries (3 queries total instead of N per batch) before creating new objects. This ensures all movie/series objects have primary keys before relation operations, preventing "prohibited to prevent data loss due to unsaved related object" errors. Additionally fixed duplicate key constraint violations by treating TMDB/IMDB ID values of `0` or `'0'` as invalid (some providers use this to indicate "no ID"), converting them to NULL to prevent multiple items from incorrectly sharing the same ID. (Fixes #813)
+
+## [0.16.0] - 2026-01-04
+
+### Added
+
+- Advanced filtering for Channels table: Filter menu now allows toggling disabled channels visibility (when a profile is selected) and filtering to show only empty channels without streams (Closes #182)
+- Network Access warning modal now displays the client's IP address for better transparency when network restrictions are being enforced - Thanks [@damien-alt-sudo](https://github.com/damien-alt-sudo) (Closes #778)
+- VLC streaming support - Thanks [@sethwv](https://github.com/sethwv)
+  - Added `cvlc` as an alternative streaming backend alongside FFmpeg and Streamlink
+  - Log parser refactoring: Introduced `LogParserFactory` and stream-specific parsers (`FFmpegLogParser`, `VLCLogParser`, `StreamlinkLogParser`) to enable codec and resolution detection from multiple streaming tools
+  - VLC log parsing for stream information: Detects video/audio codecs from TS demux output, supports both stream-copy and transcode modes with resolution/FPS extraction from transcode output
+  - Locked, read-only VLC stream profile configured for headless operation with intelligent audio/video codec detection
+  - VLC and required plugins installed in Docker environment with headless configuration
+- ErrorBoundary component for handling frontend errors gracefully with generic error message - Thanks [@nick4810](https://github.com/nick4810)
+
+### Changed
+
+- Fixed event viewer arrow direction (previously inverted) — UI behavior corrected. - Thanks [@drnikcuk](https://github.com/drnikcuk) (Closes #772)
+- Region code options now intentionally include both `GB` (ISO 3166-1 standard) and `UK` (commonly used by EPG/XMLTV providers) to accommodate real-world EPG data variations. Many providers use `UK` in channel identifiers (e.g., `BBCOne.uk`) despite `GB` being the official ISO country code. Users should select the region code that matches their specific EPG provider's convention for optimal region-based EPG matching bonuses - Thanks [@bigpandaaaa](https://github.com/bigpandaaaa)
+- Channel number inputs in stream-to-channel creation modals no longer have a maximum value restriction, allowing users to enter any valid channel number supported by the database
+- Stream log parsing refactored to use factory pattern: Simplified `ChannelService.parse_and_store_stream_info()` to route parsing through specialized log parsers instead of inline program-specific logic (~150 lines of code removed)
+- Stream profile names in fixtures updated to use proper capitalization (ffmpeg → FFmpeg, streamlink → Streamlink)
+- Frontend component refactoring for improved code organization and maintainability - Thanks [@nick4810](https://github.com/nick4810)
+  - Extracted large nested components into separate files (RecordingCard, RecordingDetailsModal, RecurringRuleModal, RecordingSynopsis, GuideRow, HourTimeline, PluginCard, ProgramRecordingModal, SeriesRecordingModal, Field)
+  - Moved business logic from components into dedicated utility files (dateTimeUtils, RecordingCardUtils, RecordingDetailsModalUtils, RecurringRuleModalUtils, DVRUtils, guideUtils, PluginsUtils, PluginCardUtils, notificationUtils)
+  - Lazy loaded heavy components (SuperuserForm, RecordingDetailsModal, ProgramRecordingModal, SeriesRecordingModal, PluginCard) with loading fallbacks
+  - Removed unused Dashboard and Home pages
+  - Guide page refactoring: Extracted GuideRow and HourTimeline components, moved grid calculations and utility functions to guideUtils.js, added loading states for initial data fetching, improved performance through better memoization
+  - Plugins page refactoring: Extracted PluginCard and Field components, added Zustand store for plugin state management, improved plugin action confirmation handling, better separation of concerns between UI and business logic
+- Logo loading optimization: Logos now load only after both Channels and Streams tables complete loading to prevent blocking initial page render, with rendering gated by table readiness to ensure data loads before visual elements
+- M3U stream URLs now use `build_absolute_uri_with_port()` for consistency with EPG and logo URLs, ensuring uniform port handling across all M3U file URLs
+- Settings and Logos page refactoring for improved readability and separation of concerns - Thanks [@nick4810](https://github.com/nick4810)
+  - Extracted individual settings forms (DVR, Network Access, Proxy, Stream, System, UI) into separate components with dedicated utility files
+  - Moved larger nested components into their own files
+  - Moved business logic into corresponding utils/ files
+  - Extracted larger in-line component logic into its own function
+  - Each panel in Settings now uses its own form state with the parent component handling active state management
+
+### Fixed
+
+- Auto Channel Sync Force EPG Source feature not properly forcing "No EPG" assignment - When selecting "Force EPG Source" > "No EPG (Disabled)", channels were still being auto-matched to EPG data instead of forcing dummy/no EPG. Now correctly sets `force_dummy_epg` flag to prevent unwanted EPG assignment. (Fixes #788)
+- VOD episode processing now properly handles season and episode numbers from APIs that return string values instead of integers, with comprehensive error logging to track data quality issues - Thanks [@patchy8736](https://github.com/patchy8736) (Fixes #770)
+- VOD episode-to-stream relations are now validated to ensure episodes have been saved to the database before creating relations, preventing integrity errors when bulk_create operations encounter conflicts - Thanks [@patchy8736](https://github.com/patchy8736)
+- VOD category filtering now correctly handles category names containing pipe "|" characters (e.g., "PL | BAJKI", "EN | MOVIES") by using `rsplit()` to split from the right instead of the left, ensuring the category type is correctly extracted as the last segment - Thanks [@Vitekant](https://github.com/Vitekant)
+- M3U and EPG URLs now correctly preserve non-standard HTTPS ports (e.g., `:8443`) when accessed behind reverse proxies that forward the port in headers — `get_host_and_port()` now properly checks `X-Forwarded-Port` header before falling back to other detection methods (Fixes #704)
+- M3U and EPG manager page no longer crashes when a playlist references a deleted channel group (Fixes screen blank on navigation)
+- Stream validation now returns original URL instead of redirected URL to prevent issues with temporary redirect URLs that expire before clients can connect
+- XtreamCodes EPG limit parameter now properly converted to integer to prevent type errors when accessing EPG listings (Fixes #781)
+- Docker container file permissions: Django management commands (`migrate`, `collectstatic`) now run as the non-root user to prevent root-owned `__pycache__` and static files from causing permission issues - Thanks [@sethwv](https://github.com/sethwv)
+- Stream validation now continues with GET request if HEAD request fails due to connection issues - Thanks [@kvnnap](https://github.com/kvnnap) (Fixes #782)
+- XtreamCodes M3U files now correctly set `x-tvg-url` and `url-tvg` headers to reference XC EPG URL (`xmltv.php`) instead of standard EPG endpoint when downloaded via XC API (Fixes #629)
+
+## [0.15.1] - 2025-12-22
+
+### Fixed
+
+- XtreamCodes EPG `has_archive` field now returns integer `0` instead of string `"0"` for proper JSON type consistency
+- nginx now gracefully handles hosts without IPv6 support by automatically disabling IPv6 binding at startup (Fixes #744)
+
+## [0.15.0] - 2025-12-20
+
+### Added
+
+- VOD client stop button in Stats page: Users can now disconnect individual VOD clients from the Stats view, similar to the existing channel client disconnect functionality.
+- Automated configuration backup/restore system with scheduled backups, retention policies, and async task processing - Thanks [@stlalpha](https://github.com/stlalpha) (Closes #153)
+- Stream group as available hash option: Users can now select 'Group' as a hash key option in Settings → Stream Settings → M3U Hash Key, allowing streams to be differentiated by their group membership in addition to name, URL, TVG-ID, and M3U ID
+
+### Changed
+
+- Initial super user creation page now matches the login page design with logo, welcome message, divider, and version display for a more consistent and polished first-time setup experience
+- Removed unreachable code path in m3u output - Thanks [@DawtCom](https://github.com/DawtCom)
+- GitHub Actions workflows now use `docker/metadata-action` for cleaner and more maintainable OCI-compliant image label generation across all build pipelines (ci.yml, base-image.yml, release.yml). Labels are applied to both platform-specific images and multi-arch manifests with proper annotation formatting. - Thanks [@mrdynamo]https://github.com/mrdynamo) (Closes #724)
+- Update docker/dev-build.sh to support private registries, multiple architectures and pushing. Now you can do things like `dev-build.sh  -p -r my.private.registry -a linux/arm64,linux/amd64` - Thanks [@jdblack](https://github.com/jblack)
+- Updated dependencies: Django (5.2.4 → 5.2.9) includes CVE security patch, psycopg2-binary (2.9.10 → 2.9.11), celery (5.5.3 → 5.6.0), djangorestframework (3.16.0 → 3.16.1), requests (2.32.4 → 2.32.5), psutil (7.0.0 → 7.1.3), gevent (25.5.1 → 25.9.1), rapidfuzz (3.13.0 → 3.14.3), torch (2.7.1 → 2.9.1), sentence-transformers (5.1.0 → 5.2.0), lxml (6.0.0 → 6.0.2) (Closes #662)
+- Frontend dependencies updated: Vite (6.2.0 → 7.1.7), ESLint (9.21.0 → 9.27.0), and related packages; added npm `overrides` to enforce js-yaml@^4.1.1 for transitive security fix. All 6 reported vulnerabilities resolved with `npm audit fix`.
+- Floating video player now supports resizing via a drag handles, with minimum size enforcement and viewport/page boundary constraints to keep it visible.
+- Redis connection settings now fully configurable via environment variables (`REDIS_HOST`, `REDIS_PORT`, `REDIS_DB`, `REDIS_URL`), replacing hardcoded `localhost:6379` values throughout the codebase. This enables use of external Redis services in production deployments. (Closes #762)
+- Celery broker and result backend URLs now respect `REDIS_HOST`/`REDIS_PORT`/`REDIS_DB` settings as defaults, with `CELERY_BROKER_URL` and `CELERY_RESULT_BACKEND` environment variables available for override.
+
+### Fixed
+
+- Docker init script now validates DISPATCHARR_PORT is an integer before using it, preventing sed errors when Kubernetes sets it to a service URL like `tcp://10.98.37.10:80`. Falls back to default port 9191 when invalid (Fixes #737)
+- M3U Profile form now properly resets local state for search and replace patterns after saving, preventing validation errors when adding multiple profiles in a row
+- DVR series rule deletion now properly handles TVG IDs that contain slashes by encoding them in the URL path (Fixes #697)
+- VOD episode processing now correctly handles duplicate episodes (same episode in multiple languages/qualities) by reusing Episode records across multiple M3UEpisodeRelation entries instead of attempting to create duplicates (Fixes #556)
+- XtreamCodes series streaming endpoint now correctly handles episodes with multiple streams (different languages/qualities) by selecting the best available stream based on account priority (Fixes #569)
+- XtreamCodes series info API now returns unique episodes instead of duplicate entries when multiple streams exist for the same episode (different languages/qualities)
+- nginx now gracefully handles hosts without IPv6 support by automatically disabling IPv6 binding at startup (Fixes #744)
+- XtreamCodes EPG API now returns correct date/time format for start/end fields and proper string types for timestamps and channel_id
+- XtreamCodes EPG API now handles None values for title and description fields to prevent AttributeError
+- XtreamCodes EPG `id` field now provides unique identifiers per program listing instead of always returning "0" for better client EPG handling
+- XtreamCodes EPG `epg_id` field now correctly returns the EPGData record ID (representing the EPG source/channel mapping) instead of a dummy value
+
+## [0.14.0] - 2025-12-09
+
+### Added
+
+- Sort buttons for 'Group' and 'M3U' columns in Streams table for improved stream organization and filtering - Thanks [@bobey6](https://github.com/bobey6)
+- EPG source priority field for controlling which EPG source is preferred when multiple sources have matching entries for a channel (higher numbers = higher priority) (Closes #603)
+
+### Changed
+
+- EPG program parsing optimized for sources with many channels but only a fraction mapped. Now parses XML file once per source instead of once per channel, dramatically reducing I/O and CPU overhead. For sources with 10,000 channels and 100 mapped, this results in ~99x fewer file opens and ~100x fewer full file scans. Orphaned programs for unmapped channels are also cleaned up during refresh to prevent database bloat. Database updates are now atomic to prevent clients from seeing empty/partial EPG data during refresh.
 - EPG table now displays detailed status messages including refresh progress, success messages, and last message for idle sources (matching M3U table behavior) (Closes #214)
 - IPv6 access now allowed by default with all IPv6 CIDRs accepted - Thanks [@adrianmace](https://github.com/adrianmace)
 - nginx.conf updated to bind to both IPv4 and IPv6 ports - Thanks [@jordandalley](https://github.com/jordandalley)
+- EPG matching now respects source priority and only uses active (enabled) EPG sources (Closes #672)
+- EPG form API Key field now only visible when Schedules Direct source type is selected
 
 ### Fixed
 
 - EPG table "Updated" column now updates in real-time via WebSocket using the actual backend timestamp instead of requiring a page refresh
+- Bulk channel editor confirmation dialog now displays the correct stream profile name that will be applied to the selected channels.
+- uWSGI not found and 502 bad gateway on first startup
+
+## [0.13.1] - 2025-12-06
+
+### Fixed
+
+- JWT token generated so is unique for each deployment
 
 ## [0.13.0] - 2025-12-02
 

Plugins.md

@@ -8,7 +8,43 @@ This document explains how to build, install, and use Python plugins in Dispatch
 
 1) Create a folder under `/app/data/plugins/my_plugin/` (host path `data/plugins/my_plugin/` in the repo).
 
-2) Add a `plugin.py` file exporting a `Plugin` class:
+2) Add a `plugin.json` manifest (new standard) and a `plugin.py` file:
+
+`/app/data/plugins/my_plugin/plugin.json`
+```json
+{
+  "name": "My Plugin",
+  "version": "0.1.0",
+  "description": "Does something useful",
+  "author": "Acme Labs",
+  "help_url": "https://example.com/docs/my-plugin",
+  "fields": [
+    { "id": "enabled", "label": "Enabled", "type": "boolean", "default": true },
+    { "id": "limit", "label": "Item limit", "type": "number", "default": 5 },
+    {
+      "id": "mode",
+      "label": "Mode",
+      "type": "select",
+      "default": "safe",
+      "options": [
+        { "value": "safe", "label": "Safe" },
+        { "value": "fast", "label": "Fast" }
+      ]
+    },
+    { "id": "note", "label": "Note", "type": "string", "default": "" }
+  ],
+  "actions": [
+    {
+      "id": "do_work",
+      "label": "Do Work",
+      "description": "Process items",
+      "button_label": "Run Job",
+      "button_variant": "filled",
+      "button_color": "blue"
+    }
+  ]
+}
+```
 
 ```
 # /app/data/plugins/my_plugin/plugin.py
@@ -16,6 +52,8 @@ class Plugin:
     name = "My Plugin"
     version = "0.1.0"
     description = "Does something useful"
+    author = "Acme Labs"
+    help_url = "https://example.com/docs/my-plugin"
 
     # Settings fields rendered by the UI and persisted by the backend
     fields = [
@@ -31,7 +69,14 @@ class Plugin:
 
     # Actions appear as buttons. Clicking one calls run(action, params, context)
     actions = [
-        {"id": "do_work", "label": "Do Work", "description": "Process items"},
+        {
+            "id": "do_work",
+            "label": "Do Work",
+            "description": "Process items",
+            "button_label": "Run Job",
+            "button_variant": "filled",
+            "button_color": "blue",
+        },
     ]
 
     def run(self, action: str, params: dict, context: dict):
@@ -59,8 +104,10 @@ class Plugin:
 - Each plugin is a directory containing either:
   - `plugin.py` exporting a `Plugin` class, or
   - a Python package (`__init__.py`) exporting a `Plugin` class.
+- New standard: include a `plugin.json` manifest alongside your code for safe metadata discovery.
+- Optional: include `logo.png` next to `plugin.py` to show a logo in the UI.
 
-The directory name (lowercased, spaces as `_`) is used as the registry key and module import path (e.g. `my_plugin.plugin`).
+The directory name (lowercased, spaces as `_`) is used as the registry key. Plugins are imported under a safe internal package name; if the folder name is a valid identifier (and not reserved), it is also registered as an alias for convenience.
 
 ---
 
@@ -69,7 +116,8 @@ The directory name (lowercased, spaces as `_`) is used as the registry key and m
 - Discovery runs at server startup and on-demand when:
   - Fetching the plugins list from the UI
   - Hitting `POST /api/plugins/plugins/reload/`
-- The loader imports each plugin module and instantiates `Plugin()`.
+- The loader reads `plugin.json` for metadata without executing plugin code.
+- Plugin code is only imported and instantiated when the plugin is enabled.
 - Metadata (name, version, description) and a per-plugin settings JSON are stored in the DB.
 
 Backend code:
@@ -80,6 +128,45 @@ Backend code:
 
 ---
 
+## Plugin Manifest (`plugin.json`)
+
+`plugin.json` lets Dispatcharr list your plugin safely without executing code. It should live next to `plugin.py`.
+
+Example:
+```
+{
+  "name": "My Plugin",
+  "version": "1.2.3",
+  "description": "Does something useful",
+  "author": "Acme Labs",
+  "help_url": "https://example.com/docs/my-plugin",
+  "fields": [
+    { "id": "limit", "label": "Item limit", "type": "number", "default": 5 }
+  ],
+  "actions": [
+    {
+      "id": "do_work",
+      "label": "Do Work",
+      "description": "Process items",
+      "button_label": "Run Job",
+      "button_variant": "filled",
+      "button_color": "blue"
+    }
+  ]
+}
+```
+
+Notes:
+- `author` and `help_url` are optional. If provided, the UI shows “By {author}” and a Docs link.
+- If your plugin includes a `logo.png` file next to `plugin.py`, it will be shown on the plugin card.
+
+If `plugin.json` is missing or invalid, the plugin is treated as **legacy**:
+- The name is inferred from the folder name.
+- `logo.png` still displays if present.
+- The UI shows a warning asking the developer to upgrade to the new standard.
+
+---
+
 ## Plugin Interface
 
 Export a `Plugin` class. Supported attributes and behavior:
@@ -87,34 +174,72 @@ Export a `Plugin` class. Supported attributes and behavior:
 - `name` (str): Human-readable name.
 - `version` (str): Semantic version string.
 - `description` (str): Short description.
+- `author` (str, optional): Author or team name shown on the card.
+- `help_url` (str, optional): Docs/support link shown on the card.
 - `fields` (list): Settings schema used by the UI to render controls.
-- `actions` (list): Available actions; the UI renders a Run button for each.
+- `actions` (list): Available actions; the UI renders a button for each (defaults to Run).
 - `run(action, params, context)` (callable): Invoked when a user clicks an action.
+- `stop(context)` (optional callable): Invoked when the plugin is disabled, deleted, or reloaded so you can gracefully shut down any processes you started. If `stop()` is not defined but you have an action with id `stop`, Dispatcharr will call `run("stop", {}, context)` as a fallback.
 
 ### Settings Schema
 Supported field `type`s:
 - `boolean`
 - `number`
-- `string`
+- `string` (single-line text)
+- `text` (multi-line textarea)
 - `select` (requires `options`: `[{"value": ..., "label": ...}, ...]`)
+- `info` (display-only text; useful for headings or notes)
 
 Common field keys:
 - `id` (str): Settings key.
 - `label` (str): Label shown in the UI.
 - `type` (str): One of above.
 - `default` (any): Default value used until saved.
-- `help_text` (str, optional): Shown under the control.
+- `help_text` / `description` (str, optional): Shown under the control.
+- `placeholder` (str, optional): Placeholder text for inputs.
+- `input_type` (str, optional): For `string` fields, set to `"password"` to mask input.
 - `options` (list, for select): List of `{value, label}`.
 
+Notes:
+- For `info` fields, you can use `description`/`help_text` (or `value`) to show the text.
+
 The UI automatically renders settings and persists them. The backend stores settings in `PluginConfig.settings`.
 
+### Example: stop() Hook
+```
+import signal
+
+class Plugin:
+    name = "Example Plugin"
+    version = "1.0.0"
+    description = "Shows how to shut down gracefully."
+
+    def run(self, action: str, params: dict, context: dict):
+        # Start a subprocess or background task here and store its PID.
+        # Example: save pid in /data or in your own module-level variable.
+        return {"status": "ok"}
+
+    def stop(self, context: dict):
+        logger = context.get("logger")
+        pid = self._read_pid()  # your helper
+        if pid:
+            try:
+                os.kill(pid, signal.SIGTERM)
+                logger.info("Stopped process %s", pid)
+            except Exception:
+                logger.exception("Failed to stop process %s", pid)
+```
+
 Read settings in `run` via `context["settings"]`.
 
 ### Actions
 Each action is a dict:
 - `id` (str): Unique action id.
-- `label` (str): Button label.
+- `label` (str): Action label.
 - `description` (str, optional): Helper text.
+- `button_label` (str, optional): Button text (defaults to “Run”).
+- `button_variant` (str, optional): Button style (Mantine variants like `filled`, `outline`, `subtle`).
+- `button_color` (str, optional): Button color (e.g., `red`, `blue`, `orange`).
 
 Clicking an action calls your plugin’s `run(action, params, context)` and shows a notification with the result or error.
 
@@ -182,6 +307,110 @@ Plugins are server-side Python code running within the Django application. You c
 
 Prefer Celery tasks (`.delay()`) to keep `run` fast and non-blocking.
 
+### Important: Don’t Ask Users for URL/User/Password
+Dispatcharr plugins run **inside** the Dispatcharr backend process. That means they already have direct access to the app’s models, tasks, and internal utilities.  
+Plugins **should not** ask users for “Dispatcharr URL”, “Admin Username”, or “Admin Password” just to call the API. That is unnecessary and unsafe because:
+
+- It encourages users to enter privileged credentials.
+- Malicious plugins could exfiltrate credentials.
+- It duplicates access that plugins already have internally.
+
+If you are writing a plugin, **use internal Python APIs** (models/tasks/utils) instead of making HTTP calls with user credentials.
+
+### When You Do Need HTTP
+In rare cases you may need to call a Dispatcharr HTTP endpoint (for example, to reuse an existing API response serializer). In that case:
+
+1. **Do not ask the user for credentials.**  
+   Use the backend’s internal access where possible.
+
+2. Prefer **local/internal URLs** (never user-provided):
+   - Docker: `http://web:9191` (service name inside the container network)
+   - Dev: `http://127.0.0.1:5656`
+
+3. Use Django helpers when building URLs:
+   ```
+   from django.urls import reverse
+   path = reverse("api:channels:list")  # example name
+   url = f"http://127.0.0.1:5656{path}"
+   ```
+
+4. Use a short timeout and robust error handling:
+   ```
+   import requests
+   resp = requests.get(url, timeout=10)
+   resp.raise_for_status()
+   data = resp.json()
+   ```
+
+### Examples: Preferred Internal Access (No HTTP, No Credentials)
+
+**Example 1: List channels directly from the DB**
+```
+from apps.channels.models import Channel
+
+channels = Channel.objects.all().values("id", "name", "number")[:50]
+return {"status": "ok", "channels": list(channels)}
+```
+
+**Example 2: Kick off an existing refresh task**
+```
+from apps.m3u.tasks import refresh_m3u_accounts
+from apps.epg.tasks import refresh_all_epg_data
+
+refresh_m3u_accounts.delay()
+refresh_all_epg_data.delay()
+return {"status": "queued"}
+```
+
+**Example 3: Send a WebSocket update to the UI**
+```
+from core.utils import send_websocket_update
+
+send_websocket_update(
+    "updates",
+    "update",
+    {"type": "plugin", "plugin": "my_plugin", "message": "Refresh queued"}
+)
+```
+
+### Example: HTTP Access (Only If You Must)
+
+**Find the endpoint**
+- Use `reverse()` with the named route when possible.
+- If you don’t know the route name, inspect `apps/*/api_urls.py` or Django’s URL config to find it.
+
+```
+from django.urls import reverse
+import requests
+
+path = reverse("api:channels:list")  # named route from apps/channels/api_urls.py
+url = f"http://127.0.0.1:5656{path}"
+
+resp = requests.get(url, timeout=10)
+resp.raise_for_status()
+data = resp.json()
+```
+
+### How Developers Find the API
+
+1. **Prefer internal models/tasks** (best and safest).
+2. **Check `apps/*/api_urls.py`** for named routes and endpoint patterns.
+   - Example: `apps/channels/api_urls.py` for channel endpoints.
+3. **Find the view** referenced in the URL config to see required params.
+   - Example: `apps/channels/api_views.py` or `apps/epg/api_views.py`.
+4. **Use `reverse()`** with the named route to build the path.
+   - This avoids hardcoding paths and keeps plugins compatible if URLs change.
+5. **Only use internal hostnames** (never user-provided URL).
+
+### What Plugins Can Access
+Because plugins run inside the server process, they can:
+- Read and write database models (same permissions as the app)
+- Invoke Celery tasks
+- Send websocket updates
+- Read configuration and settings
+
+Treat plugins as **trusted server code** and avoid exposing sensitive data in plugin settings or logs.
+
 ---
 
 ## REST Endpoints (for UI and tooling)
@@ -203,7 +432,9 @@ Notes:
 
 - In the UI, click the Import button on the Plugins page and upload a `.zip` containing a plugin folder.
 - The archive should contain either `plugin.py` or a Python package (`__init__.py`).
+- Include `plugin.json` in the plugin folder to provide metadata without executing code.
 - On success, the UI shows the plugin name/description and lets you enable it immediately (plugins are disabled by default).
+  - If `plugin.json` is missing, the plugin is marked as legacy and the UI will show a warning.
 
 ---
 
@@ -214,6 +445,7 @@ Notes:
 - The first time a plugin is enabled, the UI shows a trust warning modal explaining that plugins can run arbitrary server-side code.
 - The Plugins page shows a toggle in the card header. Turning it off dims the card and disables the Run button.
 - Backend enforcement: Attempts to run an action for a disabled plugin return HTTP 403.
+- Dispatcharr will not import or execute plugin code unless the plugin is enabled.
 
 ---
 
@@ -263,7 +495,7 @@ class Plugin:
 ## Troubleshooting
 
 - Plugin not listed: ensure the folder exists and contains `plugin.py` with a `Plugin` class.
-- Import errors: the folder name is the import name; avoid spaces or exotic characters.
+- Import errors: ensure the folder contains `plugin.py` or a package `__init__.py`. Folder names with spaces or dashes are supported; if you need to import by folder name inside your plugin, use a valid Python identifier.
 - No confirmation: include a boolean field with `id: "confirm"` and set it to true or default true.
 - HTTP 403 on run: the plugin is disabled; enable it from the toggle or via the `enabled/` endpoint.
 

README.md

@@ -1,61 +1,87 @@
 # 🎬 Dispatcharr — Your Ultimate IPTV & Stream Management Companion
+
 <p align="center">
-  <img src="https://raw.githubusercontent.com/Dispatcharr/Dispatcharr/refs/heads/main/frontend/src/images/logo.png" height="200" alt="Dispatcharr Logo" />
+  <img src="https://github.com/Dispatcharr/Dispatcharr/blob/main/frontend/src/images/logo.png?raw=true" height="200" alt="Dispatcharr Logo" />
 </p>
 
 ---
 
 ## 📖 What is Dispatcharr?
 
-Dispatcharr is an **open-source powerhouse** for managing IPTV streams and EPG data with elegance and control.\
+Dispatcharr is an **open-source powerhouse** for managing IPTV streams, EPG data, and VOD content with elegance and control.\
 Born from necessity and built with passion, it started as a personal project by **[OkinawaBoss](https://github.com/OkinawaBoss)** and evolved with contributions from legends like **[dekzter](https://github.com/dekzter)**, **[SergeantPanda](https://github.com/SergeantPanda)** and **Bucatini**.
 
-> Think of Dispatcharr as the \*arr family’s IPTV cousin — simple, smart, and designed for streamers who want reliability and flexibility.
+> Think of Dispatcharr as the \*arr family's IPTV cousin — simple, smart, and designed for streamers who want reliability and flexibility.
 
 ---
 
-## 🧪 What’s New in Beta
+## 🎯 What Can I Do With Dispatcharr?
 
-Dispatcharr has officially entered **BETA**, bringing powerful new features and improvements across the board:
+Dispatcharr empowers you with complete IPTV control. Here are some real-world scenarios:
 
-✨ **Proxy Streaming Engine** — Optimize bandwidth, reduce provider connections, and increase stream reliability\
-📊 **Real-Time Stats Dashboard** — Live insights into stream health and client activity\
-🧠 **EPG Auto-Match** — Match program data to channels automatically\
-⚙️ **Streamlink + FFmpeg Support** — Flexible backend options for streaming and recording\
-🎬 **VOD Management** — Full Video on Demand support with movies and TV series\
-🧼 **UI & UX Enhancements** — Smoother, faster, more responsive interface\
-🛁 **Output Compatibility** — HDHomeRun, M3U, and XMLTV EPG support for Plex, Jellyfin, and more
+💡 **Consolidate Multiple IPTV Sources**\
+Combine streams from multiple providers into a single interface. Manage, filter, and organize thousands of channels with ease.
+
+📺 **Integrate with Media Centers**\
+Use HDHomeRun emulation to add virtual tuners to **Plex**, **Emby**, or **Jellyfin**. They'll discover Dispatcharr as a live TV source and can record programs directly to their own DVR libraries.
+
+📡 **Create a Personal TV Ecosystem**\
+Merge live TV channels with custom EPG guides. Generate XMLTV schedules or use auto-matching to align channels with existing program data. Export as M3U, Xtream Codes API, or HDHomeRun device.
+
+🔧 **Transcode & Optimize Streams**\
+Configure output profiles with FFmpeg transcoding to optimize streams for different clients — reduce bandwidth, standardize formats, or add audio normalization.
+
+🔐 **Centralize VPN Access**\
+Run Dispatcharr through a VPN container (like Gluetun) so all streams route through a single VPN connection. Your clients access geo-blocked content without needing individual VPNs, reducing bandwidth overhead and simplifying network management.
+
+🚀 **Monitor & Manage in Real-Time**\
+Track active streams, client connections, and bandwidth usage with live statistics. Monitor buffering events and stream quality. Automatic failover keeps viewers connected when streams fail—seamlessly switching to backup sources without interruption.
+
+👥 **Share Access Safely**\
+Create multiple user accounts with granular permissions. Share streams via M3U playlists or Xtream Codes API while controlling which users access which channels, profiles, or features. Network-based access restrictions available for additional security.
+
+🔌 **Extend with Plugins**\
+Build custom integrations using Dispatcharr's robust plugin system. Automate tasks, connect to external services, or add entirely new workflows.
 
 ---
 
 ## ✨ Why You'll Love Dispatcharr
 
-✅ **Full IPTV Control** — Import, organize, proxy, and monitor IPTV streams on your own terms\
-✅ **Smart Playlist Handling** — M3U import, filtering, grouping, and failover support\
-✅ **VOD Content Management** — Organize movies and TV series with metadata and streaming\
-✅ **Reliable EPG Integration** — Match and manage TV guide data with ease\
-✅ **Clean & Responsive Interface** — Modern design that gets out of your way\
-✅ **Fully Self-Hosted** — Total control, zero reliance on third-party services
+✅ **Stream Proxy & Relay** — Intercept and proxy IPTV streams with real-time client management\
+✅ **M3U & Xtream Codes** — Import, filter, and organize playlists with multiple backend support\
+✅ **EPG Matching & Generation** — Auto-match EPG to channels or generate custom TV guides\
+✅ **Video on Demand** — Stream movies and TV series with rich metadata and IMDB/TMDB integration\
+✅ **Multi-Format Output** — Export as M3U, XMLTV EPG, Xtream Codes API, or HDHomeRun device\
+✅ **Real-Time Monitoring** — Live connection stats, bandwidth tracking, and automatic failover\
+✅ **Stream Profiles** — Configure different stream profiles for various clients and bandwidth requirements\
+✅ **Flexible Streaming Backends** — VLC, FFmpeg, Streamlink, or custom backends for transcoding and streaming\
+✅ **Multi-User & Access Control** — Granular permissions and network-based access restrictions\
+✅ **Plugin System** — Extend functionality with custom plugins for automation and integrations\
+✅ **Fully Self-Hosted** — Total control, no third-party dependencies
 
 ---
 
-
 # Screenshots
 
-![image](https://github.com/user-attachments/assets/bf7bc40a-d0e6-4f9f-8029-65b27d4205f9)
+<div align="center">
+  <img src="docs/images/channels.png" alt="Channels" width="750"/>
+  <img src="docs/images/guide.png" alt="TV Guide" width="750"/>
+  <img src="docs/images/stats.png" alt="Stats & Monitoring" width="750"/>
+  <img src="docs/images/m3u-epg-manager.png" alt="M3U & EPG Manager" width="750"/>
+  <img src="docs/images/vod-library.png" alt="VOD Library" width="750"/>
+  <img src="docs/images/settings.png" alt="Settings" width="750"/>
+</div>
 
-![image](https://github.com/user-attachments/assets/0835fd92-f7dc-4773-bdb7-7f88fd2f882d)
+---
 
-![image](https://github.com/user-attachments/assets/710f2bc4-250f-4161-a6ed-44d5082a30c4)
+## 🛠️ Troubleshooting & Help
 
-![image](https://github.com/user-attachments/assets/68a38d78-8f61-4c27-88f8-c52ba93d460d)
+- **General help?** Visit [Dispatcharr Docs](https://dispatcharr.github.io/Dispatcharr-Docs/)
+- **Community support?** Join our [Discord](https://discord.gg/Sp45V5BcxU)
 
-![image](https://github.com/user-attachments/assets/63686b9a-6faf-43a3-ae7a-c9e10a216b5b)
+---
 
-
-
-
-# 🚀 Get Started in Minutes
+## 🚀 Get Started in Minutes
 
 ### 🐳 Quick Start with Docker (Recommended)
 
@@ -72,42 +98,50 @@ docker run -d \
 
 ---
 
-### 🐳 Docker Compose Options
+### 🐋 Docker Compose Options
 
-| Use Case                    | File                                                    | Description                                                                                            |
-| --------------------------- | ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
-| **All-in-One Deployment**   | [docker-compose.aio.yml](docker/docker-compose.aio.yml) | ⭐ Recommended! A simple, all-in-one solution — everything runs in a single container for quick setup.  |
-| **Modular Deployment**      | [docker-compose.yml](docker/docker-compose.yml)         | Separate containers for Dispatcharr, Celery, and Postgres — perfect if you want more granular control. |
-| **Development Environment** | [docker-compose.dev.yml](docker/docker-compose.dev.yml) | Developer-friendly setup with pre-configured ports and settings for contributing and testing.          |
+| Use Case                    | File                                                    | Description                                                                                                   |
+| --------------------------- | ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
+| **All-in-One Deployment**   | [docker-compose.aio.yml](docker/docker-compose.aio.yml) | ⭐ Recommended! A simple, all-in-one solution — everything runs in a single container for quick setup.        |
+| **Modular Deployment**      | [docker-compose.yml](docker/docker-compose.yml)         | Separate containers for Dispatcharr, Celery, Redis, and Postgres — perfect if you want more granular control. |
+| **Development Environment** | [docker-compose.dev.yml](docker/docker-compose.dev.yml) | Developer-friendly setup with pre-configured ports and settings for contributing and testing.                 |
 
 ---
 
-### ⚒️ Building from Source (For the Adventurous)
+### 🛠️ Building from Source
 
 > ⚠️ **Warning**: Not officially supported — but if you're here, you know what you're doing!
 
-If you are running a Debian based operating system you can install using the `debian_install.sh` script. If you are on another operating system and come up with a script let us know! We would love to add it here!
+If you are running a Debian-based OS, use the `debian_install.sh` script. For other OS, contribute a script and we’ll add it!
 
 ---
 
 ## 🤝 Want to Contribute?
 
 We welcome **PRs, issues, ideas, and suggestions**!\
-Here’s how you can join the party:
+Here's how you can join the party:
 
 - Follow our coding style and best practices.
 - Be respectful, helpful, and open-minded.
 - Respect the **CC BY-NC-SA license**.
 
-> Whether it’s writing docs, squashing bugs, or building new features, your contribution matters! 🙌
+> Whether it's writing docs, squashing bugs, or building new features, your contribution matters! 🙋
 
 ---
 
-## 📚 Roadmap & Documentation
+## 📚 Documentation & Roadmap
 
-- 📚  **Roadmap:** Coming soon!
 - 📖 **Documentation:** [Dispatcharr Docs](https://dispatcharr.github.io/Dispatcharr-Docs/)
 
+**Upcoming Features (in no particular order):**
+
+- 🎬 **VOD Management Enhancements** — Granular metadata control and cleanup of unwanted VOD content
+- 📁 **Media Library** — Import local files and serve them over XC API
+- 👥 **Enhanced User Management** — Customizable XC API output per user account
+- 🔄 **Output Stream Profiles** — Different clients with different stream profiles (bandwidth control, quality tiers)
+- 🔌 **Fallback Videos** — Automatic fallback content when channels are unavailable
+- 📡 **Webhooks** — Event-driven integrations and automations
+
 ---
 
 ## ❤️ Shoutouts
@@ -120,7 +154,7 @@ A huge thank you to all the incredible open-source projects and libraries that p
 
 > Dispatcharr is licensed under **CC BY-NC-SA 4.0**:
 
-- **BY**: Give credit where credit’s due.
+- **BY**: Give credit where credit's due.
 - **NC**: No commercial use.
 - **SA**: Share alike if you remix.
 
@@ -131,8 +165,8 @@ For full license details, see [LICENSE](https://creativecommons.org/licenses/by-
 ## ✉️ Connect With Us
 
 Have a question? Want to suggest a feature? Just want to say hi?\
-➡️ **[Open an issue](https://github.com/Dispatcharr/Dispatcharr/issues)** or reach out on [Discord]( https://discord.gg/Sp45V5BcxU).
+➡️ **[Open an issue](https://github.com/Dispatcharr/Dispatcharr/issues)** or reach out on [Discord](https://discord.gg/Sp45V5BcxU).
 
 ---
 
-### 🚀 *Happy Streaming! The Dispatcharr Team*
+### 🚀 _Happy Streaming! The Dispatcharr Team_

apps/accounts/admin.py

@@ -7,7 +7,7 @@ from .models import User
 class CustomUserAdmin(UserAdmin):
     fieldsets = (
         (None, {'fields': ('username', 'password', 'avatar_config', 'groups')}),
-        ('Permissions', {'fields': ('is_active', 'is_staff', 'is_superuser', 'user_permissions')}),
+        ('Permissions', {'fields': ('is_staff', 'is_superuser', 'user_permissions')}),
         ('Important dates', {'fields': ('last_login', 'date_joined')}),
     )
 

apps/accounts/api_urls.py

@@ -4,6 +4,7 @@ from .api_views import (
     AuthViewSet,
     UserViewSet,
     GroupViewSet,
+    APIKeyViewSet,
     TokenObtainPairView,
     TokenRefreshView,
     list_permissions,
@@ -17,6 +18,7 @@ app_name = "accounts"
 router = DefaultRouter()
 router.register(r"users", UserViewSet, basename="user")
 router.register(r"groups", GroupViewSet, basename="group")
+router.register(r"api-keys", APIKeyViewSet, basename="api-key")
 
 # 🔹 Custom Authentication Endpoints
 auth_view = AuthViewSet.as_view({"post": "login"})

apps/accounts/api_views.py

@@ -1,13 +1,15 @@
 from django.contrib.auth import authenticate, login, logout
+import logging
 from django.contrib.auth.models import Group, Permission
 from django.http import JsonResponse, HttpResponse
 from django.views.decorators.csrf import csrf_exempt
 from rest_framework.decorators import api_view, permission_classes, action
 from rest_framework.response import Response
-from rest_framework import viewsets, status
-from drf_yasg.utils import swagger_auto_schema
-from drf_yasg import openapi
+from rest_framework import viewsets, status, serializers
+from drf_spectacular.utils import extend_schema, OpenApiParameter, inline_serializer
+from drf_spectacular.types import OpenApiTypes
 import json
+import secrets
 from .permissions import IsAdmin, Authenticated
 from dispatcharr.utils import network_access_allowed
 
@@ -15,6 +17,8 @@ from .models import User
 from .serializers import UserSerializer, GroupSerializer, PermissionSerializer
 from rest_framework_simplejwt.views import TokenObtainPairView, TokenRefreshView
 
+logger = logging.getLogger(__name__)
+
 
 class TokenObtainPairView(TokenObtainPairView):
     def post(self, request, *args, **kwargs):
@@ -25,6 +29,7 @@ class TokenObtainPairView(TokenObtainPairView):
             username = request.data.get("username", 'unknown')
             client_ip = request.META.get('REMOTE_ADDR', 'unknown')
             user_agent = request.META.get('HTTP_USER_AGENT', 'unknown')
+            logger.info(f"Login blocked by network policy: user={username} ip={client_ip} ua={user_agent}")
             log_system_event(
                 event_type='login_failed',
                 user=username,
@@ -43,6 +48,7 @@ class TokenObtainPairView(TokenObtainPairView):
         user_agent = request.META.get('HTTP_USER_AGENT', 'unknown')
 
         try:
+            logger.debug(f"Attempting JWT login for user={username}")
             response = super().post(request, *args, **kwargs)
 
             # If login was successful, update last_login and log success
@@ -61,6 +67,7 @@ class TokenObtainPairView(TokenObtainPairView):
                             client_ip=client_ip,
                             user_agent=user_agent,
                         )
+                        logger.info(f"Login success: user={username} ip={client_ip}")
                     except User.DoesNotExist:
                         pass  # User doesn't exist, but login somehow succeeded
             else:
@@ -72,6 +79,7 @@ class TokenObtainPairView(TokenObtainPairView):
                     user_agent=user_agent,
                     reason='Invalid credentials',
                 )
+                logger.info(f"Login failed: user={username} ip={client_ip}")
 
             return response
 
@@ -84,6 +92,7 @@ class TokenObtainPairView(TokenObtainPairView):
                 user_agent=user_agent,
                 reason=f'Authentication error: {str(e)[:100]}',
             )
+            logger.error(f"Login error for user={username}: {e}")
             raise  # Re-raise the exception to maintain normal error flow
 
 
@@ -95,6 +104,7 @@ class TokenRefreshView(TokenRefreshView):
             from core.utils import log_system_event
             client_ip = request.META.get('REMOTE_ADDR', 'unknown')
             user_agent = request.META.get('HTTP_USER_AGENT', 'unknown')
+            logger.info(f"Token refresh blocked by network policy: ip={client_ip} ua={user_agent}")
             log_system_event(
                 event_type='login_failed',
                 user='token_refresh',
@@ -109,8 +119,8 @@ class TokenRefreshView(TokenRefreshView):
 
 @csrf_exempt  # In production, consider CSRF protection strategies or ensure this endpoint is only accessible when no superuser exists.
 def initialize_superuser(request):
-    # If a superuser already exists, always indicate that
-    if User.objects.filter(is_superuser=True).exists():
+    # If an admin-level user already exists, the system is configured
+    if User.objects.filter(user_level__gte=10).exists():
         return JsonResponse({"superuser_exists": True})
 
     if request.method == "POST":
@@ -147,19 +157,15 @@ class AuthViewSet(viewsets.ViewSet):
             return [IsAuthenticated()]
         return []
 
-    @swagger_auto_schema(
-        operation_description="Authenticate and log in a user",
-        request_body=openapi.Schema(
-            type=openapi.TYPE_OBJECT,
-            required=["username", "password"],
-            properties={
-                "username": openapi.Schema(type=openapi.TYPE_STRING),
-                "password": openapi.Schema(
-                    type=openapi.TYPE_STRING, format=openapi.FORMAT_PASSWORD
-                ),
+    @extend_schema(
+        description="Authenticate and log in a user",
+        request=inline_serializer(
+            name="LoginRequest",
+            fields={
+                "username": serializers.CharField(),
+                "password": serializers.CharField(),
             },
         ),
-        responses={200: "Login successful", 400: "Invalid credentials"},
     )
     def login(self, request):
         """Logs in a user and returns user details"""
@@ -171,6 +177,7 @@ class AuthViewSet(viewsets.ViewSet):
         from core.utils import log_system_event
         client_ip = request.META.get('REMOTE_ADDR', 'unknown')
         user_agent = request.META.get('HTTP_USER_AGENT', 'unknown')
+        logger.debug(f"Login attempt via session: user={username} ip={client_ip}")
 
         if user:
             login(request, user)
@@ -186,6 +193,7 @@ class AuthViewSet(viewsets.ViewSet):
                 client_ip=client_ip,
                 user_agent=user_agent,
             )
+            logger.info(f"Login success via session: user={username} ip={client_ip}")
 
             return Response(
                 {
@@ -207,11 +215,11 @@ class AuthViewSet(viewsets.ViewSet):
             user_agent=user_agent,
             reason='Invalid credentials',
         )
+        logger.info(f"Login failed via session: user={username} ip={client_ip}")
         return Response({"error": "Invalid credentials"}, status=400)
 
-    @swagger_auto_schema(
-        operation_description="Log out the current user",
-        responses={200: "Logout successful"},
+    @extend_schema(
+        description="Log out the current user",
     )
     def logout(self, request):
         """Logs out the authenticated user"""
@@ -227,6 +235,7 @@ class AuthViewSet(viewsets.ViewSet):
             client_ip=client_ip,
             user_agent=user_agent,
         )
+        logger.info(f"Logout: user={username} ip={client_ip}")
 
         logout(request)
         return Response({"message": "Logout successful"})
@@ -245,32 +254,31 @@ class UserViewSet(viewsets.ModelViewSet):
 
         return [IsAdmin()]
 
-    @swagger_auto_schema(
-        operation_description="Retrieve a list of users",
+    @extend_schema(
+        description="Retrieve a list of users",
         responses={200: UserSerializer(many=True)},
     )
     def list(self, request, *args, **kwargs):
         return super().list(request, *args, **kwargs)
 
-    @swagger_auto_schema(operation_description="Retrieve a specific user by ID")
+    @extend_schema(description="Retrieve a specific user by ID")
     def retrieve(self, request, *args, **kwargs):
         return super().retrieve(request, *args, **kwargs)
 
-    @swagger_auto_schema(operation_description="Create a new user")
+    @extend_schema(description="Create a new user")
     def create(self, request, *args, **kwargs):
         return super().create(request, *args, **kwargs)
 
-    @swagger_auto_schema(operation_description="Update a user")
+    @extend_schema(description="Update a user")
     def update(self, request, *args, **kwargs):
         return super().update(request, *args, **kwargs)
 
-    @swagger_auto_schema(operation_description="Delete a user")
+    @extend_schema(description="Delete a user")
     def destroy(self, request, *args, **kwargs):
         return super().destroy(request, *args, **kwargs)
 
-    @swagger_auto_schema(
-        method="get",
-        operation_description="Get active user information",
+    @extend_schema(
+        description="Get active user information",
     )
     @action(detail=False, methods=["get"], url_path="me")
     def me(self, request):
@@ -287,34 +295,86 @@ class GroupViewSet(viewsets.ModelViewSet):
     serializer_class = GroupSerializer
     permission_classes = [Authenticated]
 
-    @swagger_auto_schema(
-        operation_description="Retrieve a list of groups",
+    @extend_schema(
+        description="Retrieve a list of groups",
         responses={200: GroupSerializer(many=True)},
     )
     def list(self, request, *args, **kwargs):
         return super().list(request, *args, **kwargs)
 
-    @swagger_auto_schema(operation_description="Retrieve a specific group by ID")
+    @extend_schema(description="Retrieve a specific group by ID")
     def retrieve(self, request, *args, **kwargs):
         return super().retrieve(request, *args, **kwargs)
 
-    @swagger_auto_schema(operation_description="Create a new group")
+    @extend_schema(description="Create a new group")
     def create(self, request, *args, **kwargs):
         return super().create(request, *args, **kwargs)
 
-    @swagger_auto_schema(operation_description="Update a group")
+    @extend_schema(description="Update a group")
     def update(self, request, *args, **kwargs):
         return super().update(request, *args, **kwargs)
 
-    @swagger_auto_schema(operation_description="Delete a group")
+    @extend_schema(description="Delete a group")
     def destroy(self, request, *args, **kwargs):
         return super().destroy(request, *args, **kwargs)
 
 
+# API Key management
+class APIKeyViewSet(viewsets.ViewSet):
+    permission_classes = [Authenticated]
+
+    def list(self, request):
+        user = request.user
+        return Response({"key": user.api_key})
+
+    @action(detail=False, methods=["post"], url_path="generate")
+    def generate(self, request):
+        target_user = request.user
+        user_id = request.data.get("user_id")
+
+        if user_id:
+            from .permissions import IsAdmin
+
+            if not IsAdmin().has_permission(request, self):
+                return Response({"detail": "Not allowed to create keys for other users."}, status=status.HTTP_403_FORBIDDEN)
+
+            try:
+                target_user = User.objects.get(id=int(user_id))
+            except Exception:
+                return Response({"detail": "User not found."}, status=status.HTTP_404_NOT_FOUND)
+
+        raw = secrets.token_urlsafe(40)
+        target_user.api_key = raw
+        target_user.save(update_fields=["api_key"])
+
+        user_data = UserSerializer(target_user).data
+        return Response({"key": raw, "user": user_data}, status=status.HTTP_201_CREATED)
+
+    @action(detail=False, methods=["post"], url_path="revoke")
+    def revoke(self, request):
+        target_user = request.user
+        user_id = request.data.get("user_id")
+
+        if user_id:
+            from .permissions import IsAdmin
+
+            if not IsAdmin().has_permission(request, self):
+                return Response({"detail": "Not allowed to revoke keys for other users."}, status=status.HTTP_403_FORBIDDEN)
+
+            try:
+                target_user = User.objects.get(id=int(user_id))
+            except Exception:
+                return Response({"detail": "User not found."}, status=status.HTTP_404_NOT_FOUND)
+
+        target_user.api_key = None
+        target_user.save(update_fields=["api_key"])
+
+        return Response({"success": True})
+
+
 # 🔹 4) Permissions List API
-@swagger_auto_schema(
-    method="get",
-    operation_description="Retrieve a list of all permissions",
+@extend_schema(
+    description="Retrieve a list of all permissions",
     responses={200: PermissionSerializer(many=True)},
 )
 @api_view(["GET"])

apps/accounts/authentication.py

@@ -0,0 +1,49 @@
+from rest_framework import authentication
+from rest_framework import exceptions
+from django.conf import settings
+from .models import User
+
+
+class ApiKeyAuthentication(authentication.BaseAuthentication):
+    """
+    Accepts header `Authorization: ApiKey <key>` or `X-API-Key: <key>`.
+    """
+
+    keyword = "ApiKey"
+
+    def authenticate(self, request):
+        # Check X-API-Key header first
+        raw_key = request.META.get("HTTP_X_API_KEY")
+
+        if not raw_key:
+            auth = authentication.get_authorization_header(request).split()
+            if not auth:
+                return None
+
+            if len(auth) != 2:
+                return None
+
+            scheme = auth[0].decode().lower()
+            if scheme != self.keyword.lower():
+                return None
+
+            raw_key = auth[1].decode()
+
+        if not raw_key:
+            return None
+
+        if not raw_key:
+            return None
+
+        try:
+            user = User.objects.get(api_key=raw_key)
+        except User.DoesNotExist:
+            raise exceptions.AuthenticationFailed("Invalid API key")
+
+        if not user.is_active:
+            raise exceptions.AuthenticationFailed("User inactive")
+
+        return (user, None)
+
+    def authenticate_header(self, request):
+        return self.keyword

apps/accounts/migrations/0004_user_api_key.py

@@ -0,0 +1,18 @@
+# Generated by Django 5.2.11 on 2026-02-21 18:14
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounts', '0003_alter_user_custom_properties'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='user',
+            name='api_key',
+            field=models.CharField(blank=True, db_index=True, max_length=200, null=True),
+        ),
+    ]

apps/accounts/models.py

@@ -1,9 +1,16 @@
 # apps/accounts/models.py
 from django.db import models
-from django.contrib.auth.models import AbstractUser, Permission
+from django.contrib.auth.models import AbstractUser, Permission, UserManager
+
+
+class CustomUserManager(UserManager):
+    def create_superuser(self, username, email=None, password=None, **extra_fields):
+        extra_fields.setdefault('user_level', 10)
+        return super().create_superuser(username, email, password, **extra_fields)
 
 
 class User(AbstractUser):
+    objects = CustomUserManager()
     """
     Custom user model for Dispatcharr.
     Inherits from Django's AbstractUser to add additional fields if needed.
@@ -22,6 +29,7 @@ class User(AbstractUser):
     )
     user_level = models.IntegerField(default=UserLevel.STREAMER)
     custom_properties = models.JSONField(default=dict, blank=True, null=True)
+    api_key = models.CharField(max_length=200, blank=True, null=True, db_index=True)
 
     def __str__(self):
         return self.username

apps/accounts/serializers.py

@@ -28,19 +28,20 @@ class UserSerializer(serializers.ModelSerializer):
     channel_profiles = serializers.PrimaryKeyRelatedField(
         queryset=ChannelProfile.objects.all(), many=True, required=False
     )
+    api_key = serializers.CharField(read_only=True, allow_null=True)
 
     class Meta:
         model = User
         fields = [
             "id",
             "username",
+            "api_key",
             "email",
             "user_level",
             "password",
             "channel_profiles",
             "custom_properties",
             "avatar_config",
-            "is_active",
             "is_staff",
             "is_superuser",
             "last_login",
@@ -54,7 +55,6 @@ class UserSerializer(serializers.ModelSerializer):
 
         user = User(**validated_data)
         user.set_password(validated_data["password"])
-        user.is_active = True
         user.save()
 
         user.channel_profiles.set(channel_profiles)

apps/accounts/tests.py

@@ -0,0 +1,72 @@
+from django.test import TestCase
+from django.contrib.auth import get_user_model
+from rest_framework.test import APIClient
+
+User = get_user_model()
+
+
+class InitializeSuperuserTests(TestCase):
+    """Tests for the initialize_superuser endpoint"""
+
+    def setUp(self):
+        self.client = APIClient()
+        self.url = "/api/accounts/initialize-superuser/"
+
+    def test_returns_true_when_superuser_exists(self):
+        """Superuser with is_superuser=True should be detected"""
+        User.objects.create_superuser(
+            username="admin", password="testpass123", user_level=10
+        )
+        response = self.client.get(self.url)
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(response.json()["superuser_exists"])
+
+    def test_returns_true_when_admin_level_user_exists(self):
+        """User with user_level=10 but is_superuser=False should be detected"""
+        user = User.objects.create_user(username="admin", password="testpass123")
+        user.user_level = 10
+        user.is_superuser = False
+        user.save()
+        response = self.client.get(self.url)
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(response.json()["superuser_exists"])
+
+    def test_returns_false_when_no_admin_exists(self):
+        """No admin or superuser should return false"""
+        # Create a non-admin user
+        User.objects.create_user(username="regular", password="testpass123")
+        response = self.client.get(self.url)
+        self.assertEqual(response.status_code, 200)
+        self.assertFalse(response.json()["superuser_exists"])
+
+    def test_returns_false_when_no_users_exist(self):
+        """Empty database should return false"""
+        response = self.client.get(self.url)
+        self.assertEqual(response.status_code, 200)
+        self.assertFalse(response.json()["superuser_exists"])
+
+    def test_create_superuser_when_none_exists(self):
+        """POST should create superuser when none exists"""
+        response = self.client.post(
+            self.url,
+            {"username": "newadmin", "password": "testpass123", "email": "admin@test.com"},
+            format="json",
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(response.json()["superuser_exists"])
+        self.assertTrue(User.objects.filter(username="newadmin", user_level=10).exists())
+
+    def test_cannot_create_superuser_when_admin_exists(self):
+        """POST should fail when an admin-level user already exists"""
+        user = User.objects.create_user(username="existing", password="testpass123")
+        user.user_level = 10
+        user.save()
+        response = self.client.post(
+            self.url,
+            {"username": "newadmin", "password": "testpass123"},
+            format="json",
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(response.json()["superuser_exists"])
+        # Should NOT have created a new user
+        self.assertFalse(User.objects.filter(username="newadmin").exists())

apps/api/urls.py

@@ -1,23 +1,8 @@
 from django.urls import path, include, re_path
-from drf_yasg.views import get_schema_view
-from drf_yasg import openapi
-from rest_framework.permissions import AllowAny
+from drf_spectacular.views import SpectacularAPIView, SpectacularSwaggerView, SpectacularRedocView
 
 app_name = 'api'
 
-schema_view = get_schema_view(
-    openapi.Info(
-        title="Dispatcharr API",
-        default_version='v1',
-        description="API documentation for Dispatcharr",
-        terms_of_service="https://www.google.com/policies/terms/",
-        contact=openapi.Contact(email="support@dispatcharr.local"),
-        license=openapi.License(name="Unlicense"),
-    ),
-    public=True,
-    permission_classes=(AllowAny,),
-)
-
 urlpatterns = [
     path('accounts/', include(('apps.accounts.api_urls', 'accounts'), namespace='accounts')),
     path('channels/', include(('apps.channels.api_urls', 'channels'), namespace='channels')),
@@ -27,6 +12,8 @@ urlpatterns = [
     path('core/', include(('core.api_urls', 'core'), namespace='core')),
     path('plugins/', include(('apps.plugins.api_urls', 'plugins'), namespace='plugins')),
     path('vod/', include(('apps.vod.api_urls', 'vod'), namespace='vod')),
+    path('backups/', include(('apps.backups.api_urls', 'backups'), namespace='backups')),
+    path('connect/', include(('apps.connect.api_urls', 'connect'), namespace='connect')),
     # path('output/', include(('apps.output.api_urls', 'output'), namespace='output')),
     #path('player/', include(('apps.player.api_urls', 'player'), namespace='player')),
     #path('settings/', include(('apps.settings.api_urls', 'settings'), namespace='settings')),
@@ -34,8 +21,9 @@ urlpatterns = [
 
 
 
-    # Swagger Documentation api_urls
-    re_path(r'^swagger/?$', schema_view.with_ui('swagger', cache_timeout=0), name='schema-swagger-ui'),
-    path('redoc/', schema_view.with_ui('redoc', cache_timeout=0), name='schema-redoc'),
-    path('swagger.json', schema_view.without_ui(cache_timeout=0), name='schema-json'),
+    # OpenAPI Schema and Documentation (drf-spectacular)
+    path('schema/', SpectacularAPIView.as_view(), name='schema'),
+    re_path(r'^swagger/?$', SpectacularSwaggerView.as_view(url_name='api:schema'), name='swagger-ui'),
+    path('redoc/', SpectacularRedocView.as_view(url_name='api:schema'), name='redoc'),
+    path('swagger.json', SpectacularAPIView.as_view(), name='schema-json'),
 ]

apps/backups/api_urls.py

@@ -0,0 +1,18 @@
+from django.urls import path
+
+from . import api_views
+
+app_name = "backups"
+
+urlpatterns = [
+    path("", api_views.list_backups, name="backup-list"),
+    path("create/", api_views.create_backup, name="backup-create"),
+    path("upload/", api_views.upload_backup, name="backup-upload"),
+    path("schedule/", api_views.get_schedule, name="backup-schedule-get"),
+    path("schedule/update/", api_views.update_schedule, name="backup-schedule-update"),
+    path("status/<str:task_id>/", api_views.backup_status, name="backup-status"),
+    path("<str:filename>/download-token/", api_views.get_download_token, name="backup-download-token"),
+    path("<str:filename>/download/", api_views.download_backup, name="backup-download"),
+    path("<str:filename>/delete/", api_views.delete_backup, name="backup-delete"),
+    path("<str:filename>/restore/", api_views.restore_backup, name="backup-restore"),
+]

apps/backups/api_views.py

@@ -0,0 +1,365 @@
+import hashlib
+import hmac
+import logging
+import os
+from pathlib import Path
+
+from celery.result import AsyncResult
+from django.conf import settings
+from django.http import HttpResponse, StreamingHttpResponse, Http404
+from rest_framework import status
+from rest_framework.decorators import api_view, permission_classes, parser_classes
+from rest_framework.permissions import AllowAny
+from apps.accounts.permissions import IsAdmin
+from rest_framework.parsers import MultiPartParser, FormParser
+from rest_framework.response import Response
+
+from . import services
+from .tasks import create_backup_task, restore_backup_task
+from .scheduler import get_schedule_settings, update_schedule_settings
+
+logger = logging.getLogger(__name__)
+
+
+def _generate_task_token(task_id: str) -> str:
+    """Generate a signed token for task status access without auth."""
+    secret = settings.SECRET_KEY.encode()
+    return hmac.new(secret, task_id.encode(), hashlib.sha256).hexdigest()[:32]
+
+
+def _verify_task_token(task_id: str, token: str) -> bool:
+    """Verify a task token is valid."""
+    expected = _generate_task_token(task_id)
+    return hmac.compare_digest(expected, token)
+
+
+@api_view(["GET"])
+@permission_classes([IsAdmin])
+def list_backups(request):
+    """List all available backup files."""
+    try:
+        backups = services.list_backups()
+        return Response(backups, status=status.HTTP_200_OK)
+    except Exception as e:
+        return Response(
+            {"detail": f"Failed to list backups: {str(e)}"},
+            status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+        )
+
+
+@api_view(["POST"])
+@permission_classes([IsAdmin])
+def create_backup(request):
+    """Create a new backup (async via Celery)."""
+    try:
+        task = create_backup_task.delay()
+        return Response(
+            {
+                "detail": "Backup started",
+                "task_id": task.id,
+                "task_token": _generate_task_token(task.id),
+            },
+            status=status.HTTP_202_ACCEPTED,
+        )
+    except Exception as e:
+        return Response(
+            {"detail": f"Failed to start backup: {str(e)}"},
+            status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+        )
+
+
+@api_view(["GET"])
+@permission_classes([AllowAny])
+def backup_status(request, task_id):
+    """Check the status of a backup/restore task.
+
+    Requires either:
+    - Valid admin authentication, OR
+    - Valid task_token query parameter
+    """
+    # Check for token-based auth (for restore when session is invalidated)
+    token = request.query_params.get("token")
+    if token:
+        if not _verify_task_token(task_id, token):
+            return Response(
+                {"detail": "Invalid task token"},
+                status=status.HTTP_403_FORBIDDEN,
+            )
+    else:
+        # Fall back to admin auth check
+        if not request.user.is_authenticated or getattr(request.user, 'user_level', 0) < 10:
+            return Response(
+                {"detail": "Authentication required"},
+                status=status.HTTP_401_UNAUTHORIZED,
+            )
+
+    try:
+        result = AsyncResult(task_id)
+
+        if result.ready():
+            task_result = result.get()
+            if task_result.get("status") == "completed":
+                return Response({
+                    "state": "completed",
+                    "result": task_result,
+                })
+            else:
+                return Response({
+                    "state": "failed",
+                    "error": task_result.get("error", "Unknown error"),
+                })
+        elif result.failed():
+            return Response({
+                "state": "failed",
+                "error": str(result.result),
+            })
+        else:
+            return Response({
+                "state": result.state.lower(),
+            })
+    except Exception as e:
+        return Response(
+            {"detail": f"Failed to get task status: {str(e)}"},
+            status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+        )
+
+
+@api_view(["GET"])
+@permission_classes([IsAdmin])
+def get_download_token(request, filename):
+    """Get a signed token for downloading a backup file."""
+    try:
+        # Security: prevent path traversal
+        if ".." in filename or "/" in filename or "\\" in filename:
+            raise Http404("Invalid filename")
+
+        backup_dir = services.get_backup_dir()
+        backup_file = backup_dir / filename
+
+        if not backup_file.exists():
+            raise Http404("Backup file not found")
+
+        token = _generate_task_token(filename)
+        return Response({"token": token})
+    except Http404:
+        raise
+    except Exception as e:
+        return Response(
+            {"detail": f"Failed to generate token: {str(e)}"},
+            status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+        )
+
+
+@api_view(["GET"])
+@permission_classes([AllowAny])
+def download_backup(request, filename):
+    """Download a backup file.
+
+    Requires either:
+    - Valid admin authentication, OR
+    - Valid download_token query parameter
+    """
+    # Check for token-based auth (avoids CORS preflight issues)
+    token = request.query_params.get("token")
+    if token:
+        if not _verify_task_token(filename, token):
+            return Response(
+                {"detail": "Invalid download token"},
+                status=status.HTTP_403_FORBIDDEN,
+            )
+    else:
+        # Fall back to admin auth check
+        if not request.user.is_authenticated or getattr(request.user, 'user_level', 0) < 10:
+            return Response(
+                {"detail": "Authentication required"},
+                status=status.HTTP_401_UNAUTHORIZED,
+            )
+
+    try:
+        # Security: prevent path traversal by checking for suspicious characters
+        if ".." in filename or "/" in filename or "\\" in filename:
+            raise Http404("Invalid filename")
+
+        backup_dir = services.get_backup_dir()
+        backup_file = (backup_dir / filename).resolve()
+
+        # Security: ensure the resolved path is still within backup_dir
+        if not str(backup_file).startswith(str(backup_dir.resolve())):
+            raise Http404("Invalid filename")
+
+        if not backup_file.exists() or not backup_file.is_file():
+            raise Http404("Backup file not found")
+
+        file_size = backup_file.stat().st_size
+
+        # Use X-Accel-Redirect for nginx (AIO container) - nginx serves file directly
+        # Fall back to streaming for non-nginx deployments
+        use_nginx_accel = os.environ.get("USE_NGINX_ACCEL", "").lower() == "true"
+        logger.info(f"[DOWNLOAD] File: {filename}, Size: {file_size}, USE_NGINX_ACCEL: {use_nginx_accel}")
+
+        if use_nginx_accel:
+            # X-Accel-Redirect: Django returns immediately, nginx serves file
+            logger.info(f"[DOWNLOAD] Using X-Accel-Redirect: /protected-backups/{filename}")
+            response = HttpResponse()
+            response["X-Accel-Redirect"] = f"/protected-backups/{filename}"
+            response["Content-Type"] = "application/zip"
+            response["Content-Length"] = file_size
+            response["Content-Disposition"] = f'attachment; filename="{filename}"'
+            return response
+        else:
+            # Streaming fallback for non-nginx deployments
+            logger.info(f"[DOWNLOAD] Using streaming fallback (no nginx)")
+            def file_iterator(file_path, chunk_size=2 * 1024 * 1024):
+                with open(file_path, "rb") as f:
+                    while chunk := f.read(chunk_size):
+                        yield chunk
+
+            response = StreamingHttpResponse(
+                file_iterator(backup_file),
+                content_type="application/zip",
+            )
+            response["Content-Length"] = file_size
+            response["Content-Disposition"] = f'attachment; filename="{filename}"'
+            return response
+    except Http404:
+        raise
+    except Exception as e:
+        return Response(
+            {"detail": f"Download failed: {str(e)}"},
+            status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+        )
+
+
+@api_view(["DELETE"])
+@permission_classes([IsAdmin])
+def delete_backup(request, filename):
+    """Delete a backup file."""
+    try:
+        # Security: prevent path traversal
+        if ".." in filename or "/" in filename or "\\" in filename:
+            raise Http404("Invalid filename")
+
+        services.delete_backup(filename)
+        return Response(
+            {"detail": "Backup deleted successfully"},
+            status=status.HTTP_204_NO_CONTENT,
+        )
+    except FileNotFoundError:
+        raise Http404("Backup file not found")
+    except Exception as e:
+        return Response(
+            {"detail": f"Delete failed: {str(e)}"},
+            status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+        )
+
+
+@api_view(["POST"])
+@permission_classes([IsAdmin])
+@parser_classes([MultiPartParser, FormParser])
+def upload_backup(request):
+    """Upload a backup file for restoration."""
+    uploaded = request.FILES.get("file")
+    if not uploaded:
+        return Response(
+            {"detail": "No file uploaded"},
+            status=status.HTTP_400_BAD_REQUEST,
+        )
+
+    try:
+        backup_dir = services.get_backup_dir()
+        filename = uploaded.name or "uploaded-backup.zip"
+
+        # Ensure unique filename
+        backup_file = backup_dir / filename
+        counter = 1
+        while backup_file.exists():
+            name_parts = filename.rsplit(".", 1)
+            if len(name_parts) == 2:
+                backup_file = backup_dir / f"{name_parts[0]}-{counter}.{name_parts[1]}"
+            else:
+                backup_file = backup_dir / f"{filename}-{counter}"
+            counter += 1
+
+        # Save uploaded file
+        with backup_file.open("wb") as f:
+            for chunk in uploaded.chunks():
+                f.write(chunk)
+
+        return Response(
+            {
+                "detail": "Backup uploaded successfully",
+                "filename": backup_file.name,
+            },
+            status=status.HTTP_201_CREATED,
+        )
+    except Exception as e:
+        return Response(
+            {"detail": f"Upload failed: {str(e)}"},
+            status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+        )
+
+
+@api_view(["POST"])
+@permission_classes([IsAdmin])
+def restore_backup(request, filename):
+    """Restore from a backup file (async via Celery). WARNING: This will flush the database!"""
+    try:
+        # Security: prevent path traversal
+        if ".." in filename or "/" in filename or "\\" in filename:
+            raise Http404("Invalid filename")
+
+        backup_dir = services.get_backup_dir()
+        backup_file = backup_dir / filename
+
+        if not backup_file.exists():
+            raise Http404("Backup file not found")
+
+        task = restore_backup_task.delay(filename)
+        return Response(
+            {
+                "detail": "Restore started",
+                "task_id": task.id,
+                "task_token": _generate_task_token(task.id),
+            },
+            status=status.HTTP_202_ACCEPTED,
+        )
+    except Http404:
+        raise
+    except Exception as e:
+        return Response(
+            {"detail": f"Failed to start restore: {str(e)}"},
+            status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+        )
+
+
+@api_view(["GET"])
+@permission_classes([IsAdmin])
+def get_schedule(request):
+    """Get backup schedule settings."""
+    try:
+        settings = get_schedule_settings()
+        return Response(settings)
+    except Exception as e:
+        return Response(
+            {"detail": f"Failed to get schedule: {str(e)}"},
+            status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+        )
+
+
+@api_view(["PUT"])
+@permission_classes([IsAdmin])
+def update_schedule(request):
+    """Update backup schedule settings."""
+    try:
+        settings = update_schedule_settings(request.data)
+        return Response(settings)
+    except ValueError as e:
+        return Response(
+            {"detail": str(e)},
+            status=status.HTTP_400_BAD_REQUEST,
+        )
+    except Exception as e:
+        return Response(
+            {"detail": f"Failed to update schedule: {str(e)}"},
+            status=status.HTTP_500_INTERNAL_SERVER_ERROR,
+        )

apps/backups/apps.py

@@ -0,0 +1,40 @@
+import logging
+
+from django.apps import AppConfig
+
+logger = logging.getLogger(__name__)
+
+
+class BackupsConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "apps.backups"
+    verbose_name = "Backups"
+
+    def ready(self):
+        """Initialize backup scheduler on app startup."""
+        from dispatcharr.app_initialization import should_skip_initialization
+
+        # Skip if this is a management command, worker process, or dev server
+        if should_skip_initialization():
+            return
+
+        logger.debug("Syncing backup scheduler on app startup")
+        self._sync_backup_scheduler()
+
+    def _sync_backup_scheduler(self):
+        """Sync backup scheduler task to database."""
+        from core.models import CoreSettings
+        from .scheduler import _sync_periodic_task, DEFAULTS
+        try:
+            # Ensure settings exist with defaults if this is a new install
+            CoreSettings.objects.get_or_create(
+                key="backup_settings",
+                defaults={"name": "Backup Settings", "value": DEFAULTS.copy()}
+            )
+
+            # Always sync the periodic task (handles new installs, updates, or missing tasks)
+            logger.debug("Syncing backup scheduler")
+            _sync_periodic_task()
+        except Exception as e:
+            # Log but don't fail startup if there's an issue
+            logger.warning(f"Failed to initialize backup scheduler: {e}")

apps/backups/scheduler.py

@@ -0,0 +1,133 @@
+import json
+import logging
+
+from django_celery_beat.models import PeriodicTask
+
+from core.models import CoreSettings
+from core.scheduling import (
+    create_or_update_periodic_task,
+    delete_periodic_task,
+)
+
+logger = logging.getLogger(__name__)
+
+BACKUP_SCHEDULE_TASK_NAME = "backup-scheduled-task"
+
+DEFAULTS = {
+    "schedule_enabled": True,
+    "schedule_frequency": "daily",
+    "schedule_time": "03:00",
+    "schedule_day_of_week": 0,  # Sunday
+    "retention_count": 3,
+    "schedule_cron_expression": "",
+}
+
+
+def _get_backup_settings():
+    """Get all backup settings from CoreSettings grouped JSON."""
+    try:
+        settings_obj = CoreSettings.objects.get(key="backup_settings")
+        return settings_obj.value if isinstance(settings_obj.value, dict) else DEFAULTS.copy()
+    except CoreSettings.DoesNotExist:
+        return DEFAULTS.copy()
+
+
+def _update_backup_settings(updates: dict) -> None:
+    """Update backup settings in the grouped JSON."""
+    obj, created = CoreSettings.objects.get_or_create(
+        key="backup_settings",
+        defaults={"name": "Backup Settings", "value": DEFAULTS.copy()}
+    )
+    current = obj.value if isinstance(obj.value, dict) else {}
+    current.update(updates)
+    obj.value = current
+    obj.save()
+
+
+def get_schedule_settings() -> dict:
+    """Get all backup schedule settings."""
+    settings = _get_backup_settings()
+    return {
+        "enabled": bool(settings.get("schedule_enabled", DEFAULTS["schedule_enabled"])),
+        "frequency": str(settings.get("schedule_frequency", DEFAULTS["schedule_frequency"])),
+        "time": str(settings.get("schedule_time", DEFAULTS["schedule_time"])),
+        "day_of_week": int(settings.get("schedule_day_of_week", DEFAULTS["schedule_day_of_week"])),
+        "retention_count": int(settings.get("retention_count", DEFAULTS["retention_count"])),
+        "cron_expression": str(settings.get("schedule_cron_expression", DEFAULTS["schedule_cron_expression"])),
+    }
+
+
+def update_schedule_settings(data: dict) -> dict:
+    """Update backup schedule settings and sync the PeriodicTask."""
+    # Validate
+    if "frequency" in data and data["frequency"] not in ("daily", "weekly"):
+        raise ValueError("frequency must be 'daily' or 'weekly'")
+
+    if "time" in data:
+        try:
+            hour, minute = data["time"].split(":")
+            int(hour)
+            int(minute)
+        except (ValueError, AttributeError):
+            raise ValueError("time must be in HH:MM format")
+
+    if "day_of_week" in data:
+        day = int(data["day_of_week"])
+        if day < 0 or day > 6:
+            raise ValueError("day_of_week must be 0-6 (Sunday-Saturday)")
+
+    if "retention_count" in data:
+        count = int(data["retention_count"])
+        if count < 0:
+            raise ValueError("retention_count must be >= 0")
+
+    # Update settings with proper key names
+    updates = {}
+    if "enabled" in data:
+        updates["schedule_enabled"] = bool(data["enabled"])
+    if "frequency" in data:
+        updates["schedule_frequency"] = str(data["frequency"])
+    if "time" in data:
+        updates["schedule_time"] = str(data["time"])
+    if "day_of_week" in data:
+        updates["schedule_day_of_week"] = int(data["day_of_week"])
+    if "retention_count" in data:
+        updates["retention_count"] = int(data["retention_count"])
+    if "cron_expression" in data:
+        updates["schedule_cron_expression"] = str(data["cron_expression"])
+
+    _update_backup_settings(updates)
+
+    # Sync the periodic task
+    _sync_periodic_task()
+
+    return get_schedule_settings()
+
+
+def _sync_periodic_task() -> None:
+    """Create, update, or delete the scheduled backup task based on settings."""
+    settings = get_schedule_settings()
+
+    if not settings["enabled"]:
+        delete_periodic_task(BACKUP_SCHEDULE_TASK_NAME)
+        logger.info("Backup schedule disabled, removed periodic task")
+        return
+
+    # Check if using cron expression (advanced mode)
+    if settings["cron_expression"]:
+        cron_expr = settings["cron_expression"]
+    else:
+        # Build a cron expression from simple frequency settings
+        hour, minute = settings["time"].split(":")
+        if settings["frequency"] == "daily":
+            cron_expr = f"{minute} {hour} * * *"
+        else:  # weekly
+            cron_expr = f"{minute} {hour} * * {settings['day_of_week']}"
+
+    create_or_update_periodic_task(
+        task_name=BACKUP_SCHEDULE_TASK_NAME,
+        celery_task_path="apps.backups.tasks.scheduled_backup_task",
+        kwargs={"retention_count": settings["retention_count"]},
+        cron_expression=cron_expr,
+        enabled=True,
+    )

apps/backups/services.py

@@ -0,0 +1,350 @@
+import datetime
+import json
+import os
+import shutil
+import subprocess
+import tempfile
+from pathlib import Path
+from zipfile import ZipFile, ZIP_DEFLATED
+import logging
+import pytz
+
+from django.conf import settings
+from core.models import CoreSettings
+
+logger = logging.getLogger(__name__)
+
+
+def get_backup_dir() -> Path:
+    """Get the backup directory, creating it if necessary."""
+    backup_dir = Path(settings.BACKUP_ROOT)
+    backup_dir.mkdir(parents=True, exist_ok=True)
+    return backup_dir
+
+
+def _is_postgresql() -> bool:
+    """Check if we're using PostgreSQL."""
+    return settings.DATABASES["default"]["ENGINE"] == "django.db.backends.postgresql"
+
+
+def _get_pg_env() -> dict:
+    """Get environment variables for PostgreSQL commands."""
+    db_config = settings.DATABASES["default"]
+    env = os.environ.copy()
+    env["PGPASSWORD"] = db_config.get("PASSWORD", "")
+    return env
+
+
+def _get_pg_args() -> list[str]:
+    """Get common PostgreSQL command arguments."""
+    db_config = settings.DATABASES["default"]
+    return [
+        "-h", db_config.get("HOST", "localhost"),
+        "-p", str(db_config.get("PORT", 5432)),
+        "-U", db_config.get("USER", "postgres"),
+        "-d", db_config.get("NAME", "dispatcharr"),
+    ]
+
+
+def _dump_postgresql(output_file: Path) -> None:
+    """Dump PostgreSQL database using pg_dump."""
+    logger.info("Dumping PostgreSQL database with pg_dump...")
+
+    cmd = [
+        "pg_dump",
+        *_get_pg_args(),
+        "-Fc",  # Custom format for pg_restore
+        "-v",   # Verbose
+        "-f", str(output_file),
+    ]
+
+    result = subprocess.run(
+        cmd,
+        env=_get_pg_env(),
+        capture_output=True,
+        text=True,
+    )
+
+    if result.returncode != 0:
+        logger.error(f"pg_dump failed: {result.stderr}")
+        raise RuntimeError(f"pg_dump failed: {result.stderr}")
+
+    logger.debug(f"pg_dump output: {result.stderr}")
+
+
+def _clean_postgresql_schema() -> None:
+    """Drop and recreate the public schema to ensure a completely clean restore."""
+    logger.info("[PG_CLEAN] Dropping and recreating public schema...")
+
+    # Commands to drop and recreate schema
+    sql_commands = "DROP SCHEMA IF EXISTS public CASCADE; CREATE SCHEMA public; GRANT ALL ON SCHEMA public TO public;"
+
+    cmd = [
+        "psql",
+        *_get_pg_args(),
+        "-c", sql_commands,
+    ]
+
+    result = subprocess.run(
+        cmd,
+        env=_get_pg_env(),
+        capture_output=True,
+        text=True,
+    )
+
+    if result.returncode != 0:
+        logger.error(f"[PG_CLEAN] Failed to clean schema: {result.stderr}")
+        raise RuntimeError(f"Failed to clean PostgreSQL schema: {result.stderr}")
+
+    logger.info("[PG_CLEAN] Schema cleaned successfully")
+
+
+def _restore_postgresql(dump_file: Path) -> None:
+    """Restore PostgreSQL database using pg_restore."""
+    logger.info("[PG_RESTORE] Starting pg_restore...")
+    logger.info(f"[PG_RESTORE] Dump file: {dump_file}")
+
+    # Drop and recreate schema to ensure a completely clean restore
+    _clean_postgresql_schema()
+
+    pg_args = _get_pg_args()
+    logger.info(f"[PG_RESTORE] Connection args: {pg_args}")
+
+    cmd = [
+        "pg_restore",
+        "--no-owner",  # Skip ownership commands (we already created schema)
+        *pg_args,
+        "-v",  # Verbose
+        str(dump_file),
+    ]
+
+    logger.info(f"[PG_RESTORE] Running command: {' '.join(cmd)}")
+
+    result = subprocess.run(
+        cmd,
+        env=_get_pg_env(),
+        capture_output=True,
+        text=True,
+    )
+
+    logger.info(f"[PG_RESTORE] Return code: {result.returncode}")
+
+    # pg_restore may return non-zero even on partial success
+    # Check for actual errors vs warnings
+    if result.returncode != 0:
+        # Some errors during restore are expected (e.g., "does not exist" when cleaning)
+        # Only fail on critical errors
+        stderr = result.stderr.lower()
+        if "fatal" in stderr or "could not connect" in stderr:
+            logger.error(f"[PG_RESTORE] Failed critically: {result.stderr}")
+            raise RuntimeError(f"pg_restore failed: {result.stderr}")
+        else:
+            logger.warning(f"[PG_RESTORE] Completed with warnings: {result.stderr[:500]}...")
+
+    logger.info("[PG_RESTORE] Completed successfully")
+
+
+def _dump_sqlite(output_file: Path) -> None:
+    """Dump SQLite database using sqlite3 .backup command."""
+    logger.info("Dumping SQLite database with sqlite3 .backup...")
+    db_path = Path(settings.DATABASES["default"]["NAME"])
+
+    if not db_path.exists():
+        raise FileNotFoundError(f"SQLite database not found: {db_path}")
+
+    # Use sqlite3 .backup command via stdin for reliable execution
+    result = subprocess.run(
+        ["sqlite3", str(db_path)],
+        input=f".backup '{output_file}'\n",
+        capture_output=True,
+        text=True,
+    )
+
+    if result.returncode != 0:
+        logger.error(f"sqlite3 backup failed: {result.stderr}")
+        raise RuntimeError(f"sqlite3 backup failed: {result.stderr}")
+
+    # Verify the backup file was created
+    if not output_file.exists():
+        raise RuntimeError("sqlite3 backup failed: output file not created")
+
+    logger.info(f"sqlite3 backup completed successfully: {output_file}")
+
+
+def _restore_sqlite(dump_file: Path) -> None:
+    """Restore SQLite database by replacing the database file."""
+    logger.info("Restoring SQLite database...")
+    db_path = Path(settings.DATABASES["default"]["NAME"])
+    backup_current = None
+
+    # Backup current database before overwriting
+    if db_path.exists():
+        backup_current = db_path.with_suffix(".db.bak")
+        shutil.copy2(db_path, backup_current)
+        logger.info(f"Backed up current database to {backup_current}")
+
+    # Ensure parent directory exists
+    db_path.parent.mkdir(parents=True, exist_ok=True)
+
+    # The backup file from _dump_sqlite is a complete SQLite database file
+    # We can simply copy it over the existing database
+    shutil.copy2(dump_file, db_path)
+
+    # Verify the restore worked by checking if sqlite3 can read it
+    result = subprocess.run(
+        ["sqlite3", str(db_path)],
+        input=".tables\n",
+        capture_output=True,
+        text=True,
+    )
+
+    if result.returncode != 0:
+        logger.error(f"sqlite3 verification failed: {result.stderr}")
+        # Try to restore from backup
+        if backup_current and backup_current.exists():
+            shutil.copy2(backup_current, db_path)
+            logger.info("Restored original database from backup")
+        raise RuntimeError(f"sqlite3 restore verification failed: {result.stderr}")
+
+    logger.info("sqlite3 restore completed successfully")
+
+
+def create_backup() -> Path:
+    """
+    Create a backup archive containing database dump and data directories.
+    Returns the path to the created backup file.
+    """
+    backup_dir = get_backup_dir()
+
+    # Use system timezone for filename (user-friendly), but keep internal timestamps as UTC
+    system_tz_name = CoreSettings.get_system_time_zone()
+    try:
+        system_tz = pytz.timezone(system_tz_name)
+        now_local = datetime.datetime.now(datetime.UTC).astimezone(system_tz)
+        timestamp = now_local.strftime("%Y.%m.%d.%H.%M.%S")
+    except Exception as e:
+        logger.warning(f"Failed to use system timezone {system_tz_name}: {e}, falling back to UTC")
+        timestamp = datetime.datetime.now(datetime.UTC).strftime("%Y.%m.%d.%H.%M.%S")
+
+    backup_name = f"dispatcharr-backup-{timestamp}.zip"
+    backup_file = backup_dir / backup_name
+
+    logger.info(f"Creating backup: {backup_name}")
+
+    with tempfile.TemporaryDirectory(prefix="dispatcharr-backup-") as temp_dir:
+        temp_path = Path(temp_dir)
+
+        # Determine database type and dump accordingly
+        if _is_postgresql():
+            db_dump_file = temp_path / "database.dump"
+            _dump_postgresql(db_dump_file)
+            db_type = "postgresql"
+        else:
+            db_dump_file = temp_path / "database.sqlite3"
+            _dump_sqlite(db_dump_file)
+            db_type = "sqlite"
+
+        # Create ZIP archive with compression and ZIP64 support for large files
+        with ZipFile(backup_file, "w", compression=ZIP_DEFLATED, allowZip64=True) as zip_file:
+            # Add database dump
+            zip_file.write(db_dump_file, db_dump_file.name)
+
+            # Add metadata
+            metadata = {
+                "format": "dispatcharr-backup",
+                "version": 2,
+                "database_type": db_type,
+                "database_file": db_dump_file.name,
+                "created_at": datetime.datetime.now(datetime.UTC).isoformat(),
+            }
+            zip_file.writestr("metadata.json", json.dumps(metadata, indent=2))
+
+    logger.info(f"Backup created successfully: {backup_file}")
+    return backup_file
+
+
+def restore_backup(backup_file: Path) -> None:
+    """
+    Restore from a backup archive.
+    WARNING: This will overwrite the database!
+    """
+    if not backup_file.exists():
+        raise FileNotFoundError(f"Backup file not found: {backup_file}")
+
+    logger.info(f"Restoring from backup: {backup_file}")
+
+    with tempfile.TemporaryDirectory(prefix="dispatcharr-restore-") as temp_dir:
+        temp_path = Path(temp_dir)
+
+        # Extract backup
+        logger.debug("Extracting backup archive...")
+        with ZipFile(backup_file, "r") as zip_file:
+            zip_file.extractall(temp_path)
+
+        # Read metadata
+        metadata_file = temp_path / "metadata.json"
+        if not metadata_file.exists():
+            raise ValueError("Invalid backup: missing metadata.json")
+
+        with open(metadata_file) as f:
+            metadata = json.load(f)
+
+        # Restore database
+        _restore_database(temp_path, metadata)
+
+    logger.info("Restore completed successfully")
+
+
+def _restore_database(temp_path: Path, metadata: dict) -> None:
+    """Restore database from backup."""
+    db_type = metadata.get("database_type", "postgresql")
+    db_file = metadata.get("database_file", "database.dump")
+    dump_file = temp_path / db_file
+
+    if not dump_file.exists():
+        raise ValueError(f"Invalid backup: missing {db_file}")
+
+    current_db_type = "postgresql" if _is_postgresql() else "sqlite"
+
+    if db_type != current_db_type:
+        raise ValueError(
+            f"Database type mismatch: backup is {db_type}, "
+            f"but current database is {current_db_type}"
+        )
+
+    if db_type == "postgresql":
+        _restore_postgresql(dump_file)
+    else:
+        _restore_sqlite(dump_file)
+
+
+def list_backups() -> list[dict]:
+    """List all available backup files with metadata."""
+    backup_dir = get_backup_dir()
+    backups = []
+
+    for backup_file in sorted(backup_dir.glob("dispatcharr-backup-*.zip"), reverse=True):
+        # Use UTC timezone so frontend can convert to user's local time
+        created_time = datetime.datetime.fromtimestamp(backup_file.stat().st_mtime, datetime.UTC)
+        backups.append({
+            "name": backup_file.name,
+            "size": backup_file.stat().st_size,
+            "created": created_time.isoformat(),
+        })
+
+    return backups
+
+
+def delete_backup(filename: str) -> None:
+    """Delete a backup file."""
+    backup_dir = get_backup_dir()
+    backup_file = backup_dir / filename
+
+    if not backup_file.exists():
+        raise FileNotFoundError(f"Backup file not found: {filename}")
+
+    if not backup_file.is_file():
+        raise ValueError(f"Invalid backup file: {filename}")
+
+    backup_file.unlink()
+    logger.info(f"Deleted backup: {filename}")

apps/backups/tasks.py

@@ -0,0 +1,106 @@
+import logging
+import traceback
+from celery import shared_task
+
+from . import services
+
+logger = logging.getLogger(__name__)
+
+
+def _cleanup_old_backups(retention_count: int) -> int:
+    """Delete old backups, keeping only the most recent N. Returns count deleted."""
+    if retention_count <= 0:
+        return 0
+
+    backups = services.list_backups()
+    if len(backups) <= retention_count:
+        return 0
+
+    # Backups are sorted newest first, so delete from the end
+    to_delete = backups[retention_count:]
+    deleted = 0
+
+    for backup in to_delete:
+        try:
+            services.delete_backup(backup["name"])
+            deleted += 1
+            logger.info(f"[CLEANUP] Deleted old backup: {backup['name']}")
+        except Exception as e:
+            logger.error(f"[CLEANUP] Failed to delete {backup['name']}: {e}")
+
+    return deleted
+
+
+@shared_task(bind=True)
+def create_backup_task(self):
+    """Celery task to create a backup asynchronously."""
+    try:
+        logger.info(f"[BACKUP] Starting backup task {self.request.id}")
+        backup_file = services.create_backup()
+        logger.info(f"[BACKUP] Task {self.request.id} completed: {backup_file.name}")
+        return {
+            "status": "completed",
+            "filename": backup_file.name,
+            "size": backup_file.stat().st_size,
+        }
+    except Exception as e:
+        logger.error(f"[BACKUP] Task {self.request.id} failed: {str(e)}")
+        logger.error(f"[BACKUP] Traceback: {traceback.format_exc()}")
+        return {
+            "status": "failed",
+            "error": str(e),
+        }
+
+
+@shared_task(bind=True)
+def restore_backup_task(self, filename: str):
+    """Celery task to restore a backup asynchronously."""
+    try:
+        logger.info(f"[RESTORE] Starting restore task {self.request.id} for {filename}")
+        backup_dir = services.get_backup_dir()
+        backup_file = backup_dir / filename
+        logger.info(f"[RESTORE] Backup file path: {backup_file}")
+        services.restore_backup(backup_file)
+        logger.info(f"[RESTORE] Task {self.request.id} completed successfully")
+        return {
+            "status": "completed",
+            "filename": filename,
+        }
+    except Exception as e:
+        logger.error(f"[RESTORE] Task {self.request.id} failed: {str(e)}")
+        logger.error(f"[RESTORE] Traceback: {traceback.format_exc()}")
+        return {
+            "status": "failed",
+            "error": str(e),
+        }
+
+
+@shared_task(bind=True)
+def scheduled_backup_task(self, retention_count: int = 0):
+    """Celery task for scheduled backups with optional retention cleanup."""
+    try:
+        logger.info(f"[SCHEDULED] Starting scheduled backup task {self.request.id}")
+
+        # Create backup
+        backup_file = services.create_backup()
+        logger.info(f"[SCHEDULED] Backup created: {backup_file.name}")
+
+        # Cleanup old backups if retention is set
+        deleted = 0
+        if retention_count > 0:
+            deleted = _cleanup_old_backups(retention_count)
+            logger.info(f"[SCHEDULED] Cleanup complete, deleted {deleted} old backup(s)")
+
+        return {
+            "status": "completed",
+            "filename": backup_file.name,
+            "size": backup_file.stat().st_size,
+            "deleted_count": deleted,
+        }
+    except Exception as e:
+        logger.error(f"[SCHEDULED] Task {self.request.id} failed: {str(e)}")
+        logger.error(f"[SCHEDULED] Traceback: {traceback.format_exc()}")
+        return {
+            "status": "failed",
+            "error": str(e),
+        }

apps/channels/api_urls.py

@@ -47,7 +47,7 @@ urlpatterns = [
     path('series-rules/', SeriesRulesAPIView.as_view(), name='series_rules'),
     path('series-rules/evaluate/', EvaluateSeriesRulesAPIView.as_view(), name='evaluate_series_rules'),
     path('series-rules/bulk-remove/', BulkRemoveSeriesRecordingsAPIView.as_view(), name='bulk_remove_series_recordings'),
-    path('series-rules/<str:tvg_id>/', DeleteSeriesRuleAPIView.as_view(), name='delete_series_rule'),
+    path('series-rules/<path:tvg_id>/', DeleteSeriesRuleAPIView.as_view(), name='delete_series_rule'),
     path('recordings/bulk-delete-upcoming/', BulkDeleteUpcomingRecordingsAPIView.as_view(), name='bulk_delete_upcoming_recordings'),
     path('dvr/comskip-config/', ComskipConfigAPIView.as_view(), name='comskip_config'),
 ]

apps/channels/migrations/0031_channelgroupm3uaccount_is_stale_and_more.py

@@ -0,0 +1,29 @@
+# Generated by Django 5.2.9 on 2026-01-09 18:19
+
+import datetime
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('dispatcharr_channels', '0030_alter_stream_url'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='channelgroupm3uaccount',
+            name='is_stale',
+            field=models.BooleanField(db_index=True, default=False, help_text='Whether this group relationship is stale (not seen in recent refresh, pending deletion)'),
+        ),
+        migrations.AddField(
+            model_name='channelgroupm3uaccount',
+            name='last_seen',
+            field=models.DateTimeField(db_index=True, default=datetime.datetime.now, help_text='Last time this group was seen in the M3U source during a refresh'),
+        ),
+        migrations.AddField(
+            model_name='stream',
+            name='is_stale',
+            field=models.BooleanField(db_index=True, default=False, help_text='Whether this stream is stale (not seen in recent refresh, pending deletion)'),
+        ),
+    ]

apps/channels/migrations/0032_channel_is_adult_stream_is_adult.py

@@ -0,0 +1,23 @@
+# Generated by Django 5.2.9 on 2026-01-17 16:56
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('dispatcharr_channels', '0031_channelgroupm3uaccount_is_stale_and_more'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='channel',
+            name='is_adult',
+            field=models.BooleanField(db_index=True, default=False, help_text='Whether this channel contains adult content'),
+        ),
+        migrations.AddField(
+            model_name='stream',
+            name='is_adult',
+            field=models.BooleanField(db_index=True, default=False, help_text='Whether this stream contains adult content'),
+        ),
+    ]

apps/channels/migrations/0033_stream_id_stream_chno.py

@@ -0,0 +1,205 @@
+# Generated by Django - Add stream_id and channel_number fields with data migration
+
+from django.db import migrations, models
+import hashlib
+import json
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+def populate_fields_and_rehash(apps, schema_editor):
+    """
+    Populate stream_id and stream_chno from custom_properties for XC account streams,
+    populate stream_chno from tvg-chno for standard M3U accounts,
+    then rehash XC streams using stable hash keys.
+    """
+    Stream = apps.get_model('dispatcharr_channels', 'Stream')
+    M3UAccount = apps.get_model('m3u', 'M3UAccount')
+    CoreSettings = apps.get_model('core', 'CoreSettings')
+
+    # Get hash keys from settings
+    try:
+        stream_settings = CoreSettings.objects.get(key='stream_settings')
+        hash_key_str = stream_settings.value.get('m3u_hash_key', '') if stream_settings.value else ''
+        keys = [k.strip() for k in hash_key_str.split(',') if k.strip()] if hash_key_str else []
+    except CoreSettings.DoesNotExist:
+        keys = []
+
+    logger.info(f"Using hash keys: {keys}")
+
+    # Get XC account IDs
+    xc_account_ids = set(
+        M3UAccount.objects.filter(account_type='XC').values_list('id', flat=True)
+    )
+
+    logger.info(f"Found {len(xc_account_ids)} XC accounts")
+
+    # Track hash collisions for XC streams
+    hash_map = {}  # new_hash -> stream_id
+    duplicates_to_delete = []
+
+    # Process all streams in batches
+    batch_size = 1000
+    processed = 0
+    updated = 0
+
+    total_count = Stream.objects.count()
+    logger.info(f"Processing {total_count} total streams")
+
+    streams_to_update = []
+
+    for stream in Stream.objects.select_related('channel_group', 'm3u_account').iterator(chunk_size=batch_size):
+        processed += 1
+        needs_update = False
+
+        custom_props = stream.custom_properties or {}
+        is_xc = stream.m3u_account_id in xc_account_ids if stream.m3u_account_id else False
+
+        # Extract stream_id (XC accounts only)
+        if is_xc and isinstance(custom_props, dict):
+            provider_stream_id = custom_props.get('stream_id')
+            if provider_stream_id:
+                try:
+                    stream.stream_id = int(provider_stream_id)
+                    needs_update = True
+                except (ValueError, TypeError):
+                    pass
+
+        # Extract stream_chno
+        channel_num = None
+        if isinstance(custom_props, dict):
+            if is_xc:
+                # XC accounts use 'num'
+                channel_num = custom_props.get('num')
+            else:
+                # Standard M3U accounts use 'tvg-chno' or 'channel-number' (case insensitive check)
+                for key in ['tvg-chno', 'TVG-CHNO', 'tvg-Chno', 'Tvg-Chno', 'channel-number', 'Channel-Number', 'CHANNEL-NUMBER']:
+                    if key in custom_props:
+                        channel_num = custom_props.get(key)
+                        break
+
+        if channel_num is not None:
+            try:
+                stream.stream_chno = float(channel_num)
+                needs_update = True
+            except (ValueError, TypeError):
+                pass
+
+        # Rehash XC streams only when 'url' is in hash keys (otherwise hash wouldn't change)
+        if is_xc and stream.stream_id and keys and 'url' in keys:
+            # For XC accounts, use stream_id instead of url when 'url' is in the hash keys
+            # This ensures credential/URL changes don't break stream identity
+            effective_url = stream.stream_id
+
+            # Get group name
+            group_name = stream.channel_group.name if stream.channel_group else None
+
+            # Build hash parts
+            stream_parts = {
+                "name": stream.name,
+                "url": effective_url,
+                "tvg_id": stream.tvg_id,
+                "m3u_id": stream.m3u_account_id,
+                "group": group_name
+            }
+            hash_parts = {key: stream_parts[key] for key in keys if key in stream_parts}
+
+            # When using stream_id instead of URL, we MUST include m3u_id to prevent
+            # collisions across different XC accounts (stream_id is only unique per account)
+            if 'm3u_id' not in hash_parts:
+                hash_parts['m3u_id'] = stream.m3u_account_id
+
+            # Generate hash
+            serialized_obj = json.dumps(hash_parts, sort_keys=True)
+            new_hash = hashlib.sha256(serialized_obj.encode()).hexdigest()
+
+            # Check for collisions
+            if new_hash in hash_map:
+                # Duplicate - mark for deletion (keep the first one)
+                duplicates_to_delete.append(stream.id)
+                continue
+
+            hash_map[new_hash] = stream.id
+            stream.stream_hash = new_hash
+            needs_update = True
+
+        if needs_update:
+            streams_to_update.append(stream)
+            updated += 1
+
+        # Bulk update in batches
+        if len(streams_to_update) >= batch_size:
+            Stream.objects.bulk_update(
+                streams_to_update,
+                ['stream_id', 'stream_chno', 'stream_hash'],
+                batch_size=500
+            )
+            logger.info(f"Updated batch: {processed}/{total_count} streams processed")
+            streams_to_update = []
+
+    # Final batch
+    if streams_to_update:
+        Stream.objects.bulk_update(
+            streams_to_update,
+            ['stream_id', 'stream_chno', 'stream_hash'],
+            batch_size=500
+        )
+
+    # Delete duplicates if any
+    if duplicates_to_delete:
+        logger.warning(f"Deleting {len(duplicates_to_delete)} duplicate streams due to hash collisions")
+        Stream.objects.filter(id__in=duplicates_to_delete).delete()
+
+    logger.info(f"Migration complete: {updated} streams updated, {len(duplicates_to_delete)} duplicates removed")
+
+
+def reverse_migration(apps, schema_editor):
+    """
+    Reverse migration - clear fields but don't attempt to reverse hash changes.
+    """
+    Stream = apps.get_model('dispatcharr_channels', 'Stream')
+    Stream.objects.all().update(stream_id=None, stream_chno=None)
+    logger.info("Cleared stream_id and stream_chno fields. Note: stream hashes were not reverted.")
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('dispatcharr_channels', '0032_channel_is_adult_stream_is_adult'),
+        ('m3u', '0018_add_profile_custom_properties'),
+        ('core', '0020_change_coresettings_value_to_jsonfield'),
+    ]
+
+    operations = [
+        # Schema changes - add fields WITHOUT indexes first
+        migrations.AddField(
+            model_name='stream',
+            name='stream_id',
+            field=models.IntegerField(
+                blank=True,
+                help_text='Provider stream ID (e.g., XC stream_id) for stable identity across credential changes',
+                null=True,
+            ),
+        ),
+        migrations.AddField(
+            model_name='stream',
+            name='stream_chno',
+            field=models.FloatField(
+                blank=True,
+                help_text='Provider channel number (XC num or M3U tvg-chno) for ordering - supports decimals like 2.1',
+                null=True,
+            ),
+        ),
+        # Data migration (may delete duplicates, which would conflict with pending index creation)
+        migrations.RunPython(populate_fields_and_rehash, reverse_migration),
+        # Add indexes AFTER data migration completes
+        migrations.AddIndex(
+            model_name='stream',
+            index=models.Index(fields=['stream_id'], name='dispatcharr_stream_id_idx'),
+        ),
+        migrations.AddIndex(
+            model_name='stream',
+            index=models.Index(fields=['stream_chno'], name='dispatcharr_stream_chno_idx'),
+        ),
+    ]

apps/channels/migrations/0034_remove_stream_dispatcharr_stream_id_idx_and_more.py

@@ -0,0 +1,31 @@
+# Generated by Django 5.2.9 on 2026-02-01 03:21
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('dispatcharr_channels', '0033_stream_id_stream_chno'),
+    ]
+
+    operations = [
+        migrations.RemoveIndex(
+            model_name='stream',
+            name='dispatcharr_stream_id_idx',
+        ),
+        migrations.RemoveIndex(
+            model_name='stream',
+            name='dispatcharr_stream_chno_idx',
+        ),
+        migrations.AlterField(
+            model_name='stream',
+            name='stream_chno',
+            field=models.FloatField(blank=True, db_index=True, help_text='Provider channel number (XC num or M3U tvg-chno) for ordering - supports decimals like 2.1', null=True),
+        ),
+        migrations.AlterField(
+            model_name='stream',
+            name='stream_id',
+            field=models.IntegerField(blank=True, db_index=True, help_text='Provider stream ID (e.g., XC stream_id) for stable identity across credential changes', null=True),
+        ),
+    ]

apps/channels/models.py

@@ -94,8 +94,31 @@ class Stream(models.Model):
         db_index=True,
     )
     last_seen = models.DateTimeField(db_index=True, default=datetime.now)
+    is_stale = models.BooleanField(
+        default=False,
+        db_index=True,
+        help_text="Whether this stream is stale (not seen in recent refresh, pending deletion)"
+    )
+    is_adult = models.BooleanField(
+        default=False,
+        db_index=True,
+        help_text="Whether this stream contains adult content"
+    )
     custom_properties = models.JSONField(default=dict, blank=True, null=True)
 
+    stream_id = models.IntegerField(
+        null=True,
+        blank=True,
+        db_index=True,
+        help_text="Provider stream ID (e.g., XC stream_id) for stable identity across credential changes"
+    )
+    stream_chno = models.FloatField(
+        null=True,
+        blank=True,
+        db_index=True,
+        help_text="Provider channel number (XC num or M3U tvg-chno) for ordering - supports decimals like 2.1"
+    )
+
     # Stream statistics fields
     stream_stats = models.JSONField(
         null=True,
@@ -119,14 +142,27 @@ class Stream(models.Model):
         return self.name or self.url or f"Stream ID {self.id}"
 
     @classmethod
-    def generate_hash_key(cls, name, url, tvg_id, keys=None, m3u_id=None):
+    def generate_hash_key(cls, name, url, tvg_id, keys=None, m3u_id=None, group=None,
+                          account_type=None, stream_id=None):
         if keys is None:
             keys = CoreSettings.get_m3u_hash_key().split(",")
 
-        stream_parts = {"name": name, "url": url, "tvg_id": tvg_id, "m3u_id": m3u_id}
+        # For XC accounts, use stream_id instead of url when 'url' is in the hash keys
+        # This ensures credential/URL changes don't break stream identity
+        effective_url = url
+        use_stream_id = account_type == 'XC' and stream_id and 'url' in keys
+        if use_stream_id:
+            effective_url = stream_id
+
+        stream_parts = {"name": name, "url": effective_url, "tvg_id": tvg_id, "m3u_id": m3u_id, "group": group}
 
         hash_parts = {key: stream_parts[key] for key in keys if key in stream_parts}
 
+        # When using stream_id instead of URL, we MUST include m3u_id to prevent
+        # collisions across different XC accounts (stream_id is only unique per account)
+        if use_stream_id and 'm3u_id' not in hash_parts:
+            hash_parts['m3u_id'] = m3u_id
+
         # Serialize and hash the dictionary
         serialized_obj = json.dumps(
             hash_parts, sort_keys=True
@@ -296,6 +332,12 @@ class Channel(models.Model):
 
     user_level = models.IntegerField(default=0)
 
+    is_adult = models.BooleanField(
+        default=False,
+        db_index=True,
+        help_text="Whether this channel contains adult content"
+    )
+
     auto_created = models.BooleanField(
         default=False,
         help_text="Whether this channel was automatically created via M3U auto channel sync"
@@ -738,6 +780,16 @@ class ChannelGroupM3UAccount(models.Model):
         blank=True,
         help_text='Starting channel number for auto-created channels in this group'
     )
+    last_seen = models.DateTimeField(
+        default=datetime.now,
+        db_index=True,
+        help_text='Last time this group was seen in the M3U source during a refresh'
+    )
+    is_stale = models.BooleanField(
+        default=False,
+        db_index=True,
+        help_text='Whether this group relationship is stale (not seen in recent refresh, pending deletion)'
+    )
 
     class Meta:
         unique_together = ("channel_group", "m3u_account")

apps/channels/serializers.py

@@ -104,7 +104,7 @@ class StreamSerializer(serializers.ModelSerializer):
         allow_null=True,
         required=False,
     )
-    read_only_fields = ["is_custom", "m3u_account", "stream_hash"]
+    read_only_fields = ["is_custom", "m3u_account", "stream_hash", "stream_id", "stream_chno"]
 
     class Meta:
         model = Stream
@@ -119,12 +119,16 @@ class StreamSerializer(serializers.ModelSerializer):
             "current_viewers",
             "updated_at",
             "last_seen",
+            "is_stale",
+            "is_adult",
             "stream_profile_id",
             "is_custom",
             "channel_group",
             "stream_hash",
             "stream_stats",
             "stream_stats_updated_at",
+            "stream_id",
+            "stream_chno",
         ]
 
     def get_fields(self):
@@ -155,7 +159,7 @@ class ChannelGroupM3UAccountSerializer(serializers.ModelSerializer):
 
     class Meta:
         model = ChannelGroupM3UAccount
-        fields = ["m3u_accounts", "channel_group", "enabled", "auto_channel_sync", "auto_sync_channel_start", "custom_properties"]
+        fields = ["m3u_accounts", "channel_group", "enabled", "auto_channel_sync", "auto_sync_channel_start", "custom_properties", "is_stale", "last_seen"]
 
     def to_representation(self, instance):
         data = super().to_representation(instance)
@@ -179,8 +183,8 @@ class ChannelGroupM3UAccountSerializer(serializers.ModelSerializer):
 # Channel Group
 #
 class ChannelGroupSerializer(serializers.ModelSerializer):
-    channel_count = serializers.IntegerField(read_only=True)
-    m3u_account_count = serializers.IntegerField(read_only=True)
+    channel_count = serializers.SerializerMethodField()
+    m3u_account_count = serializers.SerializerMethodField()
     m3u_accounts = ChannelGroupM3UAccountSerializer(
         many=True,
         read_only=True
@@ -190,6 +194,14 @@ class ChannelGroupSerializer(serializers.ModelSerializer):
         model = ChannelGroup
         fields = ["id", "name", "channel_count", "m3u_account_count", "m3u_accounts"]
 
+    def get_channel_count(self, obj):
+        """Get count of channels in this group"""
+        return obj.channels.count()
+
+    def get_m3u_account_count(self, obj):
+        """Get count of M3U accounts associated with this group"""
+        return obj.m3u_accounts.count()
+
 
 class ChannelProfileSerializer(serializers.ModelSerializer):
     channels = serializers.SerializerMethodField()
@@ -284,6 +296,7 @@ class ChannelSerializer(serializers.ModelSerializer):
             "uuid",
             "logo_id",
             "user_level",
+            "is_adult",
             "auto_created",
             "auto_created_by",
             "auto_created_by_name",
@@ -321,6 +334,13 @@ class ChannelSerializer(serializers.ModelSerializer):
             "channel_number", Channel.get_next_available_channel_number()
         )
         validated_data["channel_number"] = channel_number
+
+        # Auto-assign Default Group if no channel_group is specified
+        if "channel_group" not in validated_data or validated_data.get("channel_group") is None:
+            from apps.channels.models import ChannelGroup
+            default_group, _ = ChannelGroup.objects.get_or_create(name="Default Group")
+            validated_data["channel_group"] = default_group
+
         channel = Channel.objects.create(**validated_data)
 
         # Add streams in the specified order

apps/channels/signals.py

@@ -85,12 +85,23 @@ def create_profile_memberships(sender, instance, created, **kwargs):
             for channel in channels
         ])
 
-def schedule_recording_task(instance):
-    eta = instance.start_time
+def schedule_recording_task(instance, eta=None):
+    # Use the explicitly-passed (and timezone-aware) eta if provided;
+    # fall back to instance.start_time only as a last resort.
+    if eta is None:
+        eta = instance.start_time
+    # Ensure eta is timezone-aware before comparing against now()
+    if eta is not None and not is_aware(eta):
+        eta = make_aware(eta)
+    # countdown=0 fires immediately (in-progress programs whose start_time was
+    # clamped to now by the serializer), countdown>0 delays until start_time
+    # (future programs).  Using an integer countdown avoids any timezone
+    # serialization ambiguity that can occur with an absolute eta datetime.
+    countdown = max(0, int((eta - now()).total_seconds()))
     # Pass recording_id first so task can persist metadata to the correct row
     task = run_recording.apply_async(
         args=[instance.id, instance.channel_id, str(instance.start_time), str(instance.end_time)],
-        eta=eta
+        countdown=countdown,
     )
     return task.id
 
@@ -133,7 +144,10 @@ def schedule_task_on_save(sender, instance, created, **kwargs):
             # Optionally allow slight fudge factor (1 second) to ensure scheduling happens
             if start_time > current_time - timedelta(seconds=1):
                 print("Scheduling recording task!")
-                task_id = schedule_recording_task(instance)
+                # Pass the corrected, timezone-aware start_time explicitly so
+                # schedule_recording_task uses it as the Celery ETA rather than
+                # re-reading instance.start_time which may still be naive.
+                task_id = schedule_recording_task(instance, eta=start_time)
                 instance.task_id = task_id
                 instance.save(update_fields=['task_id'])
             else:

apps/channels/tasks.py

@@ -139,6 +139,7 @@ COMMON_EXTRANEOUS_WORDS = [
 def normalize_name(name: str) -> str:
     """
     A more aggressive normalization that:
+      - Removes user-configured prefixes/suffixes/custom strings (only if mode is 'advanced')
       - Lowercases
       - Removes bracketed/parenthesized text
       - Removes punctuation
@@ -148,7 +149,76 @@ def normalize_name(name: str) -> str:
     if not name:
         return ""
 
-    norm = name.lower()
+    # Load user-configured EPG matching rules (fail gracefully)
+    prefixes = []
+    suffixes = []
+    custom_strings = []
+
+    try:
+        from core.models import CoreSettings
+        settings = CoreSettings.get_epg_settings()
+
+        # Check if user has enabled advanced mode
+        mode = settings.get("epg_match_mode", "default")
+
+        # Only use custom settings if mode is 'advanced'
+        if mode == "advanced":
+            prefixes = settings.get("epg_match_ignore_prefixes", [])
+            suffixes = settings.get("epg_match_ignore_suffixes", [])
+            custom_strings = settings.get("epg_match_ignore_custom", [])
+
+            # Ensure we have lists
+            if not isinstance(prefixes, list):
+                prefixes = []
+            if not isinstance(suffixes, list):
+                suffixes = []
+            if not isinstance(custom_strings, list):
+                custom_strings = []
+
+    except Exception as e:
+        # Settings unavailable or error - continue with empty lists (graceful degradation)
+        logger.debug(f"Could not load EPG matching settings: {e}")
+        prefixes = []
+        suffixes = []
+        custom_strings = []
+
+    result = name
+
+    # Step 1: Remove prefixes (from START only - exact string match)
+    for prefix in prefixes:
+        # Skip empty or non-string entries
+        if not prefix or not isinstance(prefix, str):
+            continue
+        # Exact match at start
+        if result.startswith(prefix):
+            result = result[len(prefix):]
+            break  # Only remove first matching prefix
+
+    # Step 2: Remove suffixes (from END only - exact string match)
+    for suffix in suffixes:
+        # Skip empty or non-string entries
+        if not suffix or not isinstance(suffix, str):
+            continue
+        # Exact match at end
+        if result.endswith(suffix):
+            result = result[:-len(suffix)]
+            break  # Only remove first matching suffix
+
+    # Step 3: Remove custom strings (from ANYWHERE - exact string match)
+    for custom in custom_strings:
+        # Skip empty or non-string entries
+        if not custom or not isinstance(custom, str):
+            continue
+        try:
+            # Exact string removal (replace with empty string)
+            result = result.replace(custom, "")
+        except Exception as e:
+            # If removal fails for any reason, skip this entry
+            logger.debug(f"Failed to remove custom string '{custom}': {e}")
+            continue
+
+    # Step 4: Existing normalization logic (unchanged)
+    norm = result.lower()
     norm = re.sub(r"\[.*?\]", "", norm)
 
     # Extract and preserve important call signs from parentheses before removing them
@@ -295,7 +365,11 @@ def match_channels_to_epg(channels_data, epg_data, region_code=None, use_ml=True
             if score > 50:  # Only show decent matches
                 logger.debug(f"  EPG '{row['name']}' (norm: '{row['norm_name']}') => score: {score} (base: {base_score}, bonus: {bonus})")
 
-            if score > best_score:
+            # When scores are equal, prefer higher priority EPG source
+            row_priority = row.get('epg_source_priority', 0)
+            best_priority = best_epg.get('epg_source_priority', 0) if best_epg else -1
+
+            if score > best_score or (score == best_score and row_priority > best_priority):
                 best_score = score
                 best_epg = row
 
@@ -471,9 +545,9 @@ def match_epg_channels():
                 "norm_chan": normalize_name(channel.name)  # Always use channel name for fuzzy matching!
             })
 
-        # Get all EPG data
+        # Get all EPG data from active sources, ordered by source priority (highest first) so we prefer higher priority matches
         epg_data = []
-        for epg in EPGData.objects.all():
+        for epg in EPGData.objects.select_related('epg_source').filter(epg_source__is_active=True):
             normalized_tvg_id = epg.tvg_id.strip().lower() if epg.tvg_id else ""
             epg_data.append({
                 'id': epg.id,
@@ -482,9 +556,13 @@ def match_epg_channels():
                 'name': epg.name,
                 'norm_name': normalize_name(epg.name),
                 'epg_source_id': epg.epg_source.id if epg.epg_source else None,
+                'epg_source_priority': epg.epg_source.priority if epg.epg_source else 0,
             })
 
-        logger.info(f"Processing {len(channels_data)} channels against {len(epg_data)} EPG entries")
+        # Sort EPG data by source priority (highest first) so we prefer higher priority matches
+        epg_data.sort(key=lambda x: x['epg_source_priority'], reverse=True)
+
+        logger.info(f"Processing {len(channels_data)} channels against {len(epg_data)} EPG entries (from active sources only)")
 
         # Run EPG matching with progress updates - automatically uses conservative thresholds for bulk operations
         result = match_channels_to_epg(channels_data, epg_data, region_code, use_ml=True, send_progress=True)
@@ -618,9 +696,9 @@ def match_selected_channels_epg(channel_ids):
                 "norm_chan": normalize_name(channel.name)
             })
 
-        # Get all EPG data
+        # Get all EPG data from active sources, ordered by source priority (highest first) so we prefer higher priority matches
         epg_data = []
-        for epg in EPGData.objects.all():
+        for epg in EPGData.objects.select_related('epg_source').filter(epg_source__is_active=True):
             normalized_tvg_id = epg.tvg_id.strip().lower() if epg.tvg_id else ""
             epg_data.append({
                 'id': epg.id,
@@ -629,9 +707,13 @@ def match_selected_channels_epg(channel_ids):
                 'name': epg.name,
                 'norm_name': normalize_name(epg.name),
                 'epg_source_id': epg.epg_source.id if epg.epg_source else None,
+                'epg_source_priority': epg.epg_source.priority if epg.epg_source else 0,
             })
 
-        logger.info(f"Processing {len(channels_data)} selected channels against {len(epg_data)} EPG entries")
+        # Sort EPG data by source priority (highest first) so we prefer higher priority matches
+        epg_data.sort(key=lambda x: x['epg_source_priority'], reverse=True)
+
+        logger.info(f"Processing {len(channels_data)} selected channels against {len(epg_data)} EPG entries (from active sources only)")
 
         # Run EPG matching with progress updates - automatically uses appropriate thresholds
         result = match_channels_to_epg(channels_data, epg_data, region_code, use_ml=True, send_progress=True)
@@ -749,9 +831,10 @@ def match_single_channel_epg(channel_id):
         test_normalized = normalize_name(test_name)
         logger.debug(f"DEBUG normalization example: '{test_name}' → '{test_normalized}' (call sign preserved)")
 
-        # Get all EPG data for matching - must include norm_name field
+        # Get all EPG data for matching from active sources - must include norm_name field
+        # Ordered by source priority (highest first) so we prefer higher priority matches
         epg_data_list = []
-        for epg in EPGData.objects.filter(name__isnull=False).exclude(name=''):
+        for epg in EPGData.objects.select_related('epg_source').filter(epg_source__is_active=True, name__isnull=False).exclude(name=''):
             normalized_epg_tvg_id = epg.tvg_id.strip().lower() if epg.tvg_id else ""
             epg_data_list.append({
                 'id': epg.id,
@@ -760,10 +843,14 @@ def match_single_channel_epg(channel_id):
                 'name': epg.name,
                 'norm_name': normalize_name(epg.name),
                 'epg_source_id': epg.epg_source.id if epg.epg_source else None,
+                'epg_source_priority': epg.epg_source.priority if epg.epg_source else 0,
             })
 
+        # Sort EPG data by source priority (highest first) so we prefer higher priority matches
+        epg_data_list.sort(key=lambda x: x['epg_source_priority'], reverse=True)
+
         if not epg_data_list:
-            return {"matched": False, "message": "No EPG data available for matching"}
+            return {"matched": False, "message": "No EPG data available for matching (from active sources)"}
 
         logger.info(f"Matching single channel '{channel.name}' against {len(epg_data_list)} EPG entries")
 
@@ -1857,18 +1944,97 @@ def run_recording(recording_id, channel_id, start_time_str, end_time_str):
     remux_success = False
     try:
         if temp_ts_path and os.path.exists(temp_ts_path):
-            subprocess.run([
-                "ffmpeg", "-y", "-i", temp_ts_path, "-c", "copy", final_path
-            ], check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-            remux_success = os.path.exists(final_path)
-            # Clean up temp file on success
+            # First attempt: Direct TS to MKV remux
+            result = subprocess.run([
+                "ffmpeg", "-y",
+                "-fflags", "+genpts+igndts+discardcorrupt",  # Regenerate timestamps, ignore DTS
+                "-err_detect", "ignore_err",   # Ignore minor stream errors
+                "-i", temp_ts_path,
+                "-map", "0", # Map all streams
+                "-c", "copy",
+                final_path
+            ], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+
+            # Check if FFmpeg succeeded (return code 0) and output file is valid
+            if result.returncode == 0 and os.path.exists(final_path) and os.path.getsize(final_path) > 0:
+                remux_success = True
+                logger.info(f"Direct TS→MKV remux succeeded for {os.path.basename(final_path)}")
+            else:
+                # Direct remux failed - try fallback: TS → MP4 → MKV to fix timestamps
+                logger.warning(f"Direct TS→MKV remux failed (return code: {result.returncode}), trying fallback TS→MP4→MKV")
+
+                # Clean up partial/failed MKV
+                try:
+                    if os.path.exists(final_path):
+                        os.remove(final_path)
+                except Exception:
+                    pass
+
+                # Step 1: TS → MP4 (MP4 container handles broken timestamps better)
+                temp_mp4_path = os.path.splitext(temp_ts_path)[0] + ".mp4"
+                result_mp4 = subprocess.run([
+                    "ffmpeg", "-y",
+                    "-fflags", "+genpts+igndts+discardcorrupt",
+                    "-err_detect", "ignore_err",
+                    "-i", temp_ts_path,
+                    "-map", "0",
+                    "-c", "copy",
+                    temp_mp4_path
+                ], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+
+                if result_mp4.returncode == 0 and os.path.exists(temp_mp4_path) and os.path.getsize(temp_mp4_path) > 0:
+                    logger.info(f"TS→MP4 conversion succeeded, now converting MP4→MKV")
+
+                    # Step 2: MP4 → MKV (clean timestamps from MP4)
+                    result_mkv = subprocess.run([
+                        "ffmpeg", "-y",
+                        "-i", temp_mp4_path,
+                        "-map", "0",
+                        "-c", "copy",
+                        final_path
+                    ], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+
+                    if result_mkv.returncode == 0 and os.path.exists(final_path) and os.path.getsize(final_path) > 0:
+                        remux_success = True
+                        logger.info(f"Fallback TS→MP4→MKV remux succeeded for {os.path.basename(final_path)}")
+                    else:
+                        logger.error(f"MP4→MKV conversion failed (return code: {result_mkv.returncode})")
+
+                    # Clean up temp MP4
+                    try:
+                        if os.path.exists(temp_mp4_path):
+                            os.remove(temp_mp4_path)
+                    except Exception:
+                        pass
+                else:
+                    logger.error(f"TS→MP4 conversion failed (return code: {result_mp4.returncode})")
+
+            # Clean up temp TS file only on successful remux
             if remux_success:
                 try:
                     os.remove(temp_ts_path)
+                    logger.debug(f"Cleaned up temp TS file: {temp_ts_path}")
+                except Exception as e:
+                    logger.warning(f"Failed to remove temp TS file: {e}")
+            else:
+                # Keep TS file for debugging/manual recovery if remux failed
+                logger.warning(f"Remux failed - keeping temp TS file for recovery: {temp_ts_path}")
+                # Clean up any partial MKV
+                try:
+                    if os.path.exists(final_path):
+                        os.remove(final_path)
+                        logger.debug(f"Cleaned up partial MKV file: {final_path}")
                 except Exception:
                     pass
+
     except Exception as e:
-        logger.warning(f"MKV remux failed: {e}")
+        logger.warning(f"MKV remux failed with exception: {e}")
+        # Clean up any partial files on exception
+        try:
+            if os.path.exists(final_path):
+                os.remove(final_path)
+        except Exception:
+            pass
 
     # Persist final metadata to Recording (status, ended_at, and stream stats if available)
     try:
@@ -2530,13 +2696,9 @@ def bulk_create_channels_from_streams(self, stream_ids, channel_profile_ids=None
                     channel_number = None
 
                     if starting_channel_number is None:
-                        # Mode 1: Use provider numbers when available
-                        if "tvg-chno" in stream_custom_props:
-                            channel_number = float(stream_custom_props["tvg-chno"])
-                        elif "channel-number" in stream_custom_props:
-                            channel_number = float(stream_custom_props["channel-number"])
-                        elif "num" in stream_custom_props:
-                            channel_number = float(stream_custom_props["num"])
+                        # Mode 1: Use provider numbers when available (from stream_chno field)
+                        if stream.stream_chno is not None:
+                            channel_number = stream.stream_chno
 
                     # For modes 2 and 3 (starting_channel_number == 0 or specific number),
                     # ignore provider numbers and use sequential assignment
@@ -2565,6 +2727,7 @@ def bulk_create_channels_from_streams(self, stream_ids, channel_profile_ids=None
                         "name": name,
                         "tvc_guide_stationid": tvc_guide_stationid,
                         "tvg_id": stream.tvg_id,
+                        "is_adult": stream.is_adult,
                     }
 
                     # Only add channel_group_id if the stream has a channel group
@@ -2659,7 +2822,38 @@ def bulk_create_channels_from_streams(self, stream_ids, channel_profile_ids=None
                         )
 
                     # Handle channel profile membership
-                    if profile_ids:
+                    # Semantics:
+                    # - None: add to ALL profiles (backward compatible default)
+                    # - Empty array []: add to NO profiles
+                    # - Sentinel [0] or 0 in array: add to ALL profiles (explicit)
+                    # - [1,2,...]: add to specified profile IDs only
+                    if profile_ids is None:
+                        # Omitted -> add to all profiles (backward compatible)
+                        all_profiles = ChannelProfile.objects.all()
+                        channel_profile_memberships.extend([
+                            ChannelProfileMembership(
+                                channel_profile=profile,
+                                channel=channel,
+                                enabled=True
+                            )
+                            for profile in all_profiles
+                        ])
+                    elif isinstance(profile_ids, list) and len(profile_ids) == 0:
+                        # Empty array -> add to no profiles
+                        pass
+                    elif isinstance(profile_ids, list) and 0 in profile_ids:
+                        # Sentinel 0 -> add to all profiles (explicit)
+                        all_profiles = ChannelProfile.objects.all()
+                        channel_profile_memberships.extend([
+                            ChannelProfileMembership(
+                                channel_profile=profile,
+                                channel=channel,
+                                enabled=True
+                            )
+                            for profile in all_profiles
+                        ])
+                    else:
+                        # Specific profile IDs
                         try:
                             specific_profiles = ChannelProfile.objects.filter(id__in=profile_ids)
                             channel_profile_memberships.extend([
@@ -2675,17 +2869,6 @@ def bulk_create_channels_from_streams(self, stream_ids, channel_profile_ids=None
                                 'channel_id': channel.id,
                                 'error': f'Failed to add to profiles: {str(e)}'
                             })
-                    else:
-                        # Add to all profiles by default
-                        all_profiles = ChannelProfile.objects.all()
-                        channel_profile_memberships.extend([
-                            ChannelProfileMembership(
-                                channel_profile=profile,
-                                channel=channel,
-                                enabled=True
-                            )
-                            for profile in all_profiles
-                        ])
 
                 # Bulk update channels with logos
                 if update:

apps/channels/tests/test_channel_api.py

@@ -0,0 +1,211 @@
+from django.test import TestCase
+from django.contrib.auth import get_user_model
+from rest_framework.test import APIClient
+from rest_framework import status
+
+from apps.channels.models import Channel, ChannelGroup
+
+User = get_user_model()
+
+
+class ChannelBulkEditAPITests(TestCase):
+    def setUp(self):
+        # Create a test admin user (user_level >= 10) and authenticate
+        self.user = User.objects.create_user(username="testuser", password="testpass123")
+        self.user.user_level = 10  # Set admin level
+        self.user.save()
+        self.client = APIClient()
+        self.client.force_authenticate(user=self.user)
+        self.bulk_edit_url = "/api/channels/channels/edit/bulk/"
+
+        # Create test channel group
+        self.group1 = ChannelGroup.objects.create(name="Test Group 1")
+        self.group2 = ChannelGroup.objects.create(name="Test Group 2")
+
+        # Create test channels
+        self.channel1 = Channel.objects.create(
+            channel_number=1.0,
+            name="Channel 1",
+            tvg_id="channel1",
+            channel_group=self.group1
+        )
+        self.channel2 = Channel.objects.create(
+            channel_number=2.0,
+            name="Channel 2",
+            tvg_id="channel2",
+            channel_group=self.group1
+        )
+        self.channel3 = Channel.objects.create(
+            channel_number=3.0,
+            name="Channel 3",
+            tvg_id="channel3"
+        )
+
+    def test_bulk_edit_success(self):
+        """Test successful bulk update of multiple channels"""
+        data = [
+            {"id": self.channel1.id, "name": "Updated Channel 1"},
+            {"id": self.channel2.id, "name": "Updated Channel 2", "channel_number": 22.0},
+        ]
+
+        response = self.client.patch(self.bulk_edit_url, data, format="json")
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertEqual(response.data["message"], "Successfully updated 2 channels")
+        self.assertEqual(len(response.data["channels"]), 2)
+
+        # Verify database changes
+        self.channel1.refresh_from_db()
+        self.channel2.refresh_from_db()
+        self.assertEqual(self.channel1.name, "Updated Channel 1")
+        self.assertEqual(self.channel2.name, "Updated Channel 2")
+        self.assertEqual(self.channel2.channel_number, 22.0)
+
+    def test_bulk_edit_with_empty_validated_data_first(self):
+        """
+        Test the bug fix: when first channel has empty validated_data.
+        This was causing: ValueError: Field names must be given to bulk_update()
+        """
+        # Create a channel with data that will be "unchanged" (empty validated_data)
+        # We'll send the same data it already has
+        data = [
+            # First channel: no actual changes (this would create empty validated_data)
+            {"id": self.channel1.id},
+            # Second channel: has changes
+            {"id": self.channel2.id, "name": "Updated Channel 2"},
+        ]
+
+        response = self.client.patch(self.bulk_edit_url, data, format="json")
+
+        # Should not crash with ValueError
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertEqual(response.data["message"], "Successfully updated 2 channels")
+
+        # Verify the channel with changes was updated
+        self.channel2.refresh_from_db()
+        self.assertEqual(self.channel2.name, "Updated Channel 2")
+
+    def test_bulk_edit_all_empty_updates(self):
+        """Test when all channels have empty updates (no actual changes)"""
+        data = [
+            {"id": self.channel1.id},
+            {"id": self.channel2.id},
+        ]
+
+        response = self.client.patch(self.bulk_edit_url, data, format="json")
+
+        # Should succeed without calling bulk_update
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertEqual(response.data["message"], "Successfully updated 2 channels")
+
+    def test_bulk_edit_mixed_fields(self):
+        """Test bulk update where different channels update different fields"""
+        data = [
+            {"id": self.channel1.id, "name": "New Name 1"},
+            {"id": self.channel2.id, "channel_number": 99.0},
+            {"id": self.channel3.id, "tvg_id": "new_tvg_id", "name": "New Name 3"},
+        ]
+
+        response = self.client.patch(self.bulk_edit_url, data, format="json")
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertEqual(response.data["message"], "Successfully updated 3 channels")
+
+        # Verify all updates
+        self.channel1.refresh_from_db()
+        self.channel2.refresh_from_db()
+        self.channel3.refresh_from_db()
+
+        self.assertEqual(self.channel1.name, "New Name 1")
+        self.assertEqual(self.channel2.channel_number, 99.0)
+        self.assertEqual(self.channel3.tvg_id, "new_tvg_id")
+        self.assertEqual(self.channel3.name, "New Name 3")
+
+    def test_bulk_edit_with_channel_group(self):
+        """Test bulk update with channel_group_id changes"""
+        data = [
+            {"id": self.channel1.id, "channel_group_id": self.group2.id},
+            {"id": self.channel3.id, "channel_group_id": self.group1.id},
+        ]
+
+        response = self.client.patch(self.bulk_edit_url, data, format="json")
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+
+        # Verify group changes
+        self.channel1.refresh_from_db()
+        self.channel3.refresh_from_db()
+        self.assertEqual(self.channel1.channel_group, self.group2)
+        self.assertEqual(self.channel3.channel_group, self.group1)
+
+    def test_bulk_edit_nonexistent_channel(self):
+        """Test bulk update with a channel that doesn't exist"""
+        nonexistent_id = 99999
+        data = [
+            {"id": nonexistent_id, "name": "Should Fail"},
+            {"id": self.channel1.id, "name": "Should Still Update"},
+        ]
+
+        response = self.client.patch(self.bulk_edit_url, data, format="json")
+
+        # Should return 400 with errors
+        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+        self.assertIn("errors", response.data)
+        self.assertEqual(len(response.data["errors"]), 1)
+        self.assertEqual(response.data["errors"][0]["channel_id"], nonexistent_id)
+        self.assertEqual(response.data["errors"][0]["error"], "Channel not found")
+
+        # The valid channel should still be updated
+        self.assertEqual(response.data["updated_count"], 1)
+
+    def test_bulk_edit_validation_error(self):
+        """Test bulk update with invalid data (validation error)"""
+        data = [
+            {"id": self.channel1.id, "channel_number": "invalid_number"},
+        ]
+
+        response = self.client.patch(self.bulk_edit_url, data, format="json")
+
+        # Should return 400 with validation errors
+        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+        self.assertIn("errors", response.data)
+        self.assertEqual(len(response.data["errors"]), 1)
+        self.assertIn("channel_number", response.data["errors"][0]["errors"])
+
+    def test_bulk_edit_empty_channel_updates(self):
+        """Test bulk update with empty list"""
+        data = []
+
+        response = self.client.patch(self.bulk_edit_url, data, format="json")
+
+        # Empty list is accepted and returns success with 0 updates
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertEqual(response.data["message"], "Successfully updated 0 channels")
+
+    def test_bulk_edit_missing_channel_updates(self):
+        """Test bulk update without proper format (dict instead of list)"""
+        data = {"channel_updates": {}}
+
+        response = self.client.patch(self.bulk_edit_url, data, format="json")
+
+        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+        self.assertEqual(response.data["error"], "Expected a list of channel updates")
+
+    def test_bulk_edit_preserves_other_fields(self):
+        """Test that bulk update only changes specified fields"""
+        original_channel_number = self.channel1.channel_number
+        original_tvg_id = self.channel1.tvg_id
+
+        data = [
+            {"id": self.channel1.id, "name": "Only Name Changed"},
+        ]
+
+        response = self.client.patch(self.bulk_edit_url, data, format="json")
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+
+        # Verify only name changed, other fields preserved
+        self.channel1.refresh_from_db()
+        self.assertEqual(self.channel1.name, "Only Name Changed")
+        self.assertEqual(self.channel1.channel_number, original_channel_number)
+        self.assertEqual(self.channel1.tvg_id, original_tvg_id)

apps/connect/api_urls.py

@@ -0,0 +1,17 @@
+from django.urls import path
+from rest_framework.routers import DefaultRouter
+from .api_views import (
+    IntegrationViewSet,
+    EventSubscriptionViewSet,
+    DeliveryLogViewSet,
+)
+
+app_name = 'connect'
+
+router = DefaultRouter()
+router.register(r'integrations', IntegrationViewSet, basename='integration')
+router.register(r'subscriptions', EventSubscriptionViewSet, basename='subscription')
+router.register(r'logs', DeliveryLogViewSet, basename='delivery-log')
+
+urlpatterns = []
+urlpatterns += router.urls

apps/connect/api_views.py

@@ -0,0 +1,196 @@
+from rest_framework import viewsets, status
+from rest_framework.pagination import PageNumberPagination
+from django_filters.rest_framework import DjangoFilterBackend
+from rest_framework.response import Response
+from rest_framework.decorators import action
+from django.utils import timezone
+from .models import Integration, EventSubscription, DeliveryLog
+from .serializers import (
+    IntegrationSerializer,
+    EventSubscriptionSerializer,
+    DeliveryLogSerializer,
+)
+from apps.accounts.permissions import (
+    Authenticated,
+    permission_classes_by_action,
+    IsAdmin,
+)
+from .handlers.webhook import WebhookHandler
+from .handlers.script import ScriptHandler
+
+
+class IntegrationViewSet(viewsets.ModelViewSet):
+    queryset = Integration.objects.all()
+    serializer_class = IntegrationSerializer
+
+    def get_permissions(self):
+        try:
+            perms = permission_classes_by_action[self.action]
+        except KeyError:
+            # Respect view/action-specific permission_classes if provided; fallback to Authenticated
+            perms = getattr(self, "permission_classes", [Authenticated])
+        return [perm() for perm in perms]
+
+    @action(detail=True, methods=["get"], url_path="subscriptions")
+    def list_subscriptions(self, request, pk=None):
+        qs = EventSubscription.objects.filter(integration_id=pk)
+        serializer = EventSubscriptionSerializer(qs, many=True)
+        return Response(serializer.data)
+
+    @action(detail=True, methods=["put"], url_path=r"subscriptions/set")
+    def set_subscriptions(self, request, pk=None):
+        """
+        Replace the integration's subscriptions with the provided list.
+        Body format: [{"event": "channel_start", "enabled": true, "payload_template": "..."}, ...]
+        Any existing subscriptions not in the list will be deleted; missing ones will be created/updated.
+        """
+        try:
+            integration = Integration.objects.get(pk=pk)
+        except Integration.DoesNotExist:
+            return Response(
+                {"detail": "Integration not found"}, status=status.HTTP_404_NOT_FOUND
+            )
+
+        data = request.data
+        if not isinstance(data, list):
+            return Response(
+                {"detail": "Expected a list of subscriptions"},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        # Validate incoming items using serializer (without integration field)
+        # We'll attach the integration explicitly
+        valid_events = set(evt for evt, _ in EventSubscription.EVENT_CHOICES)
+        incoming = []
+        for item in data:
+            if not isinstance(item, dict):
+                return Response(
+                    {"detail": "Each subscription must be an object"},
+                    status=status.HTTP_400_BAD_REQUEST,
+                )
+            event = item.get("event")
+            if event not in valid_events:
+                return Response(
+                    {"detail": f"Invalid event: {event}"},
+                    status=status.HTTP_400_BAD_REQUEST,
+                )
+            incoming.append(
+                {
+                    "event": event,
+                    "enabled": bool(item.get("enabled", True)),
+                    "payload_template": item.get("payload_template"),
+                }
+            )
+
+        incoming_events = {s["event"] for s in incoming}
+
+        # Delete subscriptions that are no longer present
+        EventSubscription.objects.filter(integration=integration).exclude(
+            event__in=incoming_events
+        ).delete()
+
+        # Upsert incoming subscriptions
+        updated = []
+        for sub in incoming:
+            obj, _created = EventSubscription.objects.update_or_create(
+                integration=integration,
+                event=sub["event"],
+                defaults={
+                    "enabled": sub["enabled"],
+                    "payload_template": sub.get("payload_template"),
+                },
+            )
+            updated.append(obj)
+
+        serializer = EventSubscriptionSerializer(updated, many=True)
+        return Response(serializer.data, status=status.HTTP_200_OK)
+
+    @action(detail=True, methods=["post"], url_path="test", permission_classes=[IsAdmin])
+    def test(self, request, pk=None):
+        """
+        Execute a saved integration (connect) with a dummy payload to verify configuration.
+        """
+        try:
+            integration = Integration.objects.get(pk=pk)
+        except Integration.DoesNotExist:
+            return Response({"detail": "Integration not found"}, status=status.HTTP_404_NOT_FOUND)
+
+        # Build a dummy payload similar to system events
+        now = timezone.now().isoformat()
+        dummy_payload = {
+            "event": "test",
+            "timestamp": now,
+            "channel_name": "Test Channel",
+            "stream_name": "Test Stream",
+            "stream_url": "http://example.com/stream.m3u8",
+            "channel_url": "http://example.com/stream.m3u8",
+            "provider_name": "Test Provider",
+            "profile_used": "Default",
+            "test": True,
+        }
+
+        # Choose handler based on saved type
+        if integration.type == "webhook":
+            handler = WebhookHandler(integration, None, dummy_payload)
+        elif integration.type == "script":
+            handler = ScriptHandler(integration, None, dummy_payload)
+        else:
+            return Response(
+                {"success": False, "error": f"Unsupported integration type: {integration.type}"},
+                status=status.HTTP_400_BAD_REQUEST,
+            )
+
+        try:
+            result = handler.execute()
+            return Response(
+                {
+                    "success": bool(result.get("success")),
+                    "type": integration.type,
+                    "request_payload": dummy_payload,
+                    "result": result,
+                },
+                status=status.HTTP_200_OK,
+            )
+        except Exception as e:
+            return Response(
+                {
+                    "success": False,
+                    "type": integration.type,
+                    "request_payload": dummy_payload,
+                    "error": str(e),
+                },
+                status=status.HTTP_502_BAD_GATEWAY,
+            )
+
+
+class EventSubscriptionViewSet(viewsets.ModelViewSet):
+    queryset = EventSubscription.objects.all()
+    serializer_class = EventSubscriptionSerializer
+
+
+class DeliveryLogViewSet(viewsets.ReadOnlyModelViewSet):
+    queryset = DeliveryLog.objects.all().order_by("-created_at")
+    serializer_class = DeliveryLogSerializer
+    filter_backends = [DjangoFilterBackend]
+
+    # Support server-side pagination with page_size query param
+    class ConnectLogsPagination(PageNumberPagination):
+        page_size = 50
+        page_size_query_param = "page_size"
+        max_page_size = 250
+
+    pagination_class = ConnectLogsPagination
+
+    def get_queryset(self):
+        qs = super().get_queryset()
+
+        # Optional filters: integration id and type
+        integration_id = self.request.query_params.get("integration")
+        if integration_id:
+            qs = qs.filter(subscription__integration_id=integration_id)
+
+        integration_type = self.request.query_params.get("type")
+        if integration_type:
+            qs = qs.filter(subscription__integration__type=integration_type)
+
+        return qs

apps/connect/apps.py

@@ -0,0 +1,8 @@
+from django.apps import AppConfig
+
+
+class ConnectConfig(AppConfig):
+    default_auto_field = 'django.db.models.BigAutoField'
+    name = 'apps.connect'
+    verbose_name = "Connect Integrations"
+    label = 'dispatcharr_connect'

apps/connect/handlers/base.py

@@ -0,0 +1,12 @@
+# connect/handlers/base.py
+import abc
+
+class IntegrationHandler(abc.ABC):
+    def __init__(self, integration, subscription, payload):
+        self.integration = integration
+        self.subscription = subscription
+        self.payload = payload
+
+    @abc.abstractmethod
+    def execute(self):
+        pass

apps/connect/handlers/script.py

@@ -0,0 +1,81 @@
+# connect/handlers/script.py
+import os
+import stat
+import subprocess
+from django.conf import settings
+from .base import IntegrationHandler
+
+
+def _is_path_allowed(real_path: str) -> bool:
+    # Ensure path is within one of the allowed directories
+    for base in getattr(settings, "CONNECT_ALLOWED_SCRIPT_DIRS", []):
+        base_abs = os.path.abspath(base) + os.sep
+        if real_path.startswith(base_abs):
+            return True
+    return False
+
+
+class ScriptHandler(IntegrationHandler):
+    def execute(self):
+        raw_path = self.integration.config.get("path")
+        if not raw_path:
+            raise ValueError("Missing 'path' in integration config")
+
+        # Resolve and validate path
+        real_path = os.path.abspath(os.path.realpath(raw_path))
+
+        if not os.path.exists(real_path):
+            raise FileNotFoundError(f"Script not found: {real_path}")
+
+        if not _is_path_allowed(real_path):
+            raise PermissionError(
+                f"Script path '{real_path}' not within allowed directories: "
+                f"{getattr(settings, 'CONNECT_ALLOWED_SCRIPT_DIRS', [])}"
+            )
+
+        if getattr(settings, "CONNECT_SCRIPT_REQUIRE_EXECUTABLE", True):
+            if not os.access(real_path, os.X_OK):
+                raise PermissionError(f"Script is not executable: {real_path}")
+
+        if getattr(settings, "CONNECT_SCRIPT_DISALLOW_WORLD_WRITABLE", True):
+            st = os.stat(real_path)
+            if st.st_mode & stat.S_IWOTH:
+                raise PermissionError(
+                    f"Refusing to execute world-writable script: {real_path}"
+                )
+
+        # Build a sanitized minimal environment; avoid inheriting secrets
+        env = {
+            "PATH": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+        }
+        for key, value in (self.payload or {}).items():
+            env_key = f"DISPATCHARR_{str(key).upper()}"
+            env[env_key] = "" if value is None else str(value)
+
+        # Run with a timeout to prevent hanging scripts
+        timeout = getattr(settings, "CONNECT_SCRIPT_TIMEOUT", 10)
+        max_out = getattr(settings, "CONNECT_SCRIPT_MAX_OUTPUT", 65536)
+
+        result = subprocess.run(
+            [real_path],
+            capture_output=True,
+            text=True,
+            env=env,
+            timeout=timeout,
+            cwd=os.path.dirname(real_path) or None,
+        )
+
+        # Truncate outputs to avoid excessive memory/logging
+        stdout = result.stdout or ""
+        stderr = result.stderr or ""
+        if len(stdout) > max_out:
+            stdout = stdout[:max_out] + "... [truncated]"
+        if len(stderr) > max_out:
+            stderr = stderr[:max_out] + "... [truncated]"
+
+        return {
+            "exit_code": result.returncode,
+            "stdout": stdout,
+            "stderr": stderr,
+            "success": result.returncode == 0,
+        }

apps/connect/handlers/webhook.py

@@ -0,0 +1,10 @@
+# connect/handlers/webhook.py
+import requests
+from .base import IntegrationHandler
+
+class WebhookHandler(IntegrationHandler):
+    def execute(self):
+        url = self.integration.config.get("url")
+        headers = self.integration.config.get("headers", {})
+        response = requests.post(url, json=self.payload, headers=headers, timeout=10)
+        return {"status_code": response.status_code, "body": response.text, "success": response.ok}

apps/connect/migrations/0001_initial.py

@@ -0,0 +1,52 @@
+# Generated by Django 5.2.9 on 2026-01-27 21:05
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='EventSubscription',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('event', models.CharField(choices=[('channel_start', 'Channel Started'), ('channel_stop', 'Channel Stopped'), ('movie_added', 'Movie Added'), ('series_added', 'Series Added'), ('download_complete', 'Download Complete')], max_length=100)),
+                ('enabled', models.BooleanField(default=True)),
+                ('payload_template', models.TextField(blank=True, help_text='Optional Jinja2/Django template for customizing payload', null=True)),
+            ],
+        ),
+        migrations.CreateModel(
+            name='Integration',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('name', models.CharField(max_length=255)),
+                ('type', models.CharField(choices=[('webhook', 'Webhook'), ('api', 'API'), ('script', 'Custom Script')], max_length=50)),
+                ('config', models.JSONField(default=dict)),
+                ('enabled', models.BooleanField(default=True)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+            ],
+        ),
+        migrations.CreateModel(
+            name='DeliveryLog',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('status', models.CharField(choices=[('success', 'Success'), ('failed', 'Failed')], max_length=50)),
+                ('request_payload', models.JSONField(blank=True, default=dict)),
+                ('response_payload', models.JSONField(blank=True, default=dict)),
+                ('error_message', models.TextField(blank=True, null=True)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('subscription', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='logs', to='dispatcharr_connect.eventsubscription')),
+            ],
+        ),
+        migrations.AddField(
+            model_name='eventsubscription',
+            name='integration',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='subscriptions', to='dispatcharr_connect.integration'),
+        ),
+    ]

apps/connect/models.py

@@ -0,0 +1,47 @@
+from django.db import models
+
+SUPPORTED_EVENTS = {
+    "channel_start": "Channel Started",
+    "channel_stop": "Channel Stopped",
+    "channel_reconnect": "Channel Reconnected",
+    "channel_error": "Channel Error",
+    "channel_failover": "Channel Failover",
+    "stream_switch": "Stream Switch",
+    "recording_start": "Recording Started",
+    "recording_end": "Recording Ended",
+    "epg_refresh": "EPG Refreshed",
+    "m3u_refresh": "M3U Refreshed",
+    "client_connect": "Client Connected",
+    "client_disconnect": "Client Disconnected",
+    "login_failed": "Login Failed",
+    "epg_blocked": "EPG Blocked",
+    "m3u_blocked": "M3U Blocked",
+}
+
+class Integration(models.Model):
+    TYPE_CHOICES = [
+        ("webhook", "Webhook"),
+        ("api", "API"),
+        ("script", "Custom Script"),
+    ]
+    name = models.CharField(max_length=255)
+    type = models.CharField(max_length=50, choices=TYPE_CHOICES)
+    config = models.JSONField(default=dict)
+    enabled = models.BooleanField(default=True)
+    created_at = models.DateTimeField(auto_now_add=True)
+
+
+class EventSubscription(models.Model):
+    EVENT_CHOICES = list(SUPPORTED_EVENTS.items())
+    event = models.CharField(max_length=100, choices=EVENT_CHOICES)
+    integration = models.ForeignKey(Integration, on_delete=models.CASCADE, related_name="subscriptions")
+    enabled = models.BooleanField(default=True)
+    payload_template = models.TextField(blank=True, null=True, help_text="Optional Jinja2/Django template for customizing payload")
+
+class DeliveryLog(models.Model):
+    subscription = models.ForeignKey(EventSubscription, on_delete=models.CASCADE, related_name="logs")
+    status = models.CharField(max_length=50, choices=[("success", "Success"), ("failed", "Failed")])
+    request_payload = models.JSONField(default=dict, blank=True)
+    response_payload = models.JSONField(default=dict, blank=True)
+    error_message = models.TextField(blank=True, null=True)
+    created_at = models.DateTimeField(auto_now_add=True)

apps/connect/serializers.py

@@ -0,0 +1,68 @@
+from rest_framework import serializers
+from .models import Integration, EventSubscription, DeliveryLog
+import os
+
+
+class EventSubscriptionSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = EventSubscription
+        fields = [
+            "id",
+            "event",
+            "enabled",
+            "payload_template",
+            "integration",
+        ]
+
+
+class IntegrationSerializer(serializers.ModelSerializer):
+    subscriptions = EventSubscriptionSerializer(many=True, read_only=True)
+
+    class Meta:
+        model = Integration
+        fields = [
+            "id",
+            "name",
+            "type",
+            "config",
+            "enabled",
+            "created_at",
+            "subscriptions",
+        ]
+
+    def validate(self, attrs):
+        type = attrs.get("type") if "type" in attrs else getattr(self.instance, "type", None)
+        config = attrs.get("config") if "config" in attrs else getattr(self.instance, "config", {})
+
+        if type == "script":
+            path = (config or {}).get("path")
+            if not path or not isinstance(path, str):
+                raise serializers.ValidationError({"config": "Script config must include a 'path' string"})
+
+            real_path = os.path.abspath(os.path.realpath(path))
+            if not os.path.exists(real_path):
+                raise serializers.ValidationError({"config": f"Script path does not exist: {path}"})
+        elif type == "webhook":
+            url = (config or {}).get("url")
+            if not url or not isinstance(url, str):
+                raise serializers.ValidationError({"config": "Webhook config must include a 'url' string"})
+        else:
+            raise serializers.ValidationError({"type": "Unsupported integration type"})
+
+        return attrs
+
+
+class DeliveryLogSerializer(serializers.ModelSerializer):
+    subscription = EventSubscriptionSerializer(read_only=True)
+
+    class Meta:
+        model = DeliveryLog
+        fields = [
+            "id",
+            "subscription",
+            "status",
+            "request_payload",
+            "response_payload",
+            "error_message",
+            "created_at",
+        ]

apps/connect/utils.py

@@ -0,0 +1,115 @@
+# connect/utils.py
+import logging, json
+from django.template import Template, Context
+from .models import EventSubscription, DeliveryLog, SUPPORTED_EVENTS
+from .handlers.webhook import WebhookHandler
+from .handlers.script import ScriptHandler
+from apps.plugins.loader import PluginManager
+
+logger = logging.getLogger(__name__)
+
+HANDLERS = {
+    "webhook": WebhookHandler,
+    "script": ScriptHandler,
+}
+
+
+def trigger_event(event_name, payload):
+    if event_name not in SUPPORTED_EVENTS:
+        logger.debug(f"Unsupported event '{event_name}' - skipping")
+        return
+
+    logger.debug(
+        f"Triggering connect event: {event_name} payload_keys={list((payload or {}).keys())}"
+    )
+    subscriptions = EventSubscription.objects.filter(
+        event=event_name, enabled=True
+    ).select_related("integration")
+
+    count = subscriptions.count()
+    logger.info(f"Found {count} connect subscription(s) for event '{event_name}'")
+
+    # First, fetch all subscriptions and trigger
+    for sub in subscriptions:
+        integration = sub.integration
+        if not integration.enabled:
+            logger.debug(
+                f"Skipping disabled integration id={integration.id} name={integration.name}"
+            )
+            continue
+
+        # apply optional payload template
+        final_payload = payload
+        if sub.payload_template:
+            try:
+                template = Template(sub.payload_template)
+                rendered = template.render(Context(payload))
+                final_payload = {"message": rendered}
+            except Exception as e:
+                logger.error(
+                    f"Payload template render failed for subscription id={sub.id}: {e}"
+                )
+                final_payload = payload
+
+        handler_cls = HANDLERS.get(integration.type)
+        if not handler_cls:
+            DeliveryLog.objects.create(
+                subscription=sub,
+                status="failed",
+                request_payload=final_payload,
+                error_message=f"No handler for integration type '{integration.type}'",
+            )
+            logger.error(
+                f"No handler for integration type '{integration.type}' (integration id={integration.id})"
+            )
+            continue
+
+        handler = handler_cls(integration, sub, final_payload)
+        logger.debug(
+            f"Executing handler type={integration.type} integration_id={integration.id} subscription_id={sub.id}"
+        )
+
+        try:
+            result = handler.execute()
+            DeliveryLog.objects.create(
+                subscription=sub,
+                status="success" if result.get("success") else "failed",
+                request_payload=final_payload,
+                response_payload=result,
+            )
+            logger.info(
+                f"Connect delivery succeeded for subscription id={sub.id} integration '{integration.name}'"
+            )
+        except Exception as e:
+            DeliveryLog.objects.create(
+                subscription=sub,
+                status="failed",
+                request_payload=final_payload,
+                error_message=str(e),
+            )
+            logger.error(
+                f"Connect delivery failed for subscription id={sub.id} integration '{integration.name}': {e}"
+            )
+
+    pm = PluginManager.get()
+    pm.discover_plugins(sync_db=False, use_cache=True)
+    plugins = pm.list_plugins()
+
+    logger.debug(f"Checking {len(plugins)} plugins for event '{event_name}'")
+    for plugin in plugins:
+        if not plugin["enabled"]:
+            logger.debug(f"Skipping disabled plugin id={plugin.key} name={plugin.name}")
+            continue
+
+        logger.debug(json.dumps(plugin))
+        for action in plugin["actions"]:
+            if "events" in action and event_name in action["events"]:
+                key = plugin["key"]
+                params = {"event": event_name, "payload": payload}
+                action_name = action.get("label") or action.get("id")
+                action_id = action.get("id")
+                logger.debug(
+                    f"Triggering plugin action for event '{event_name}' on plugin id={key} action={action_name}"
+                )
+                if action_id:
+                    pm.run_action(key, action_id, params)

apps/epg/api_urls.py

@@ -1,6 +1,6 @@
 from django.urls import path, include
 from rest_framework.routers import DefaultRouter
-from .api_views import EPGSourceViewSet, ProgramViewSet, EPGGridAPIView, EPGImportAPIView, EPGDataViewSet
+from .api_views import EPGSourceViewSet, ProgramViewSet, EPGGridAPIView, EPGImportAPIView, EPGDataViewSet, CurrentProgramsAPIView
 
 app_name = 'epg'
 
@@ -12,6 +12,7 @@ router.register(r'epgdata', EPGDataViewSet, basename='epgdata')
 urlpatterns = [
     path('grid/', EPGGridAPIView.as_view(), name='epg_grid'),
     path('import/', EPGImportAPIView.as_view(), name='epg_import'),
+    path('current-programs/', CurrentProgramsAPIView.as_view(), name='current_programs'),
 ]
 
 urlpatterns += router.urls

apps/epg/api_views.py

@@ -1,10 +1,10 @@
 import logging, os
-from rest_framework import viewsets, status
+from rest_framework import viewsets, status, serializers
 from rest_framework.response import Response
 from rest_framework.views import APIView
 from rest_framework.decorators import action
-from drf_yasg.utils import swagger_auto_schema
-from drf_yasg import openapi
+from drf_spectacular.utils import extend_schema, OpenApiParameter, inline_serializer
+from drf_spectacular.types import OpenApiTypes
 from django.utils import timezone
 from datetime import timedelta
 from .models import EPGSource, ProgramData, EPGData  # Added ProgramData
@@ -31,7 +31,9 @@ class EPGSourceViewSet(viewsets.ModelViewSet):
     API endpoint that allows EPG sources to be viewed or edited.
     """
 
-    queryset = EPGSource.objects.all()
+    queryset = EPGSource.objects.select_related(
+        "refresh_task__crontab", "refresh_task__interval"
+    ).all()
     serializer_class = EPGSourceSerializer
 
     def get_permissions(self):
@@ -122,8 +124,8 @@ class EPGGridAPIView(APIView):
         except KeyError:
             return [Authenticated()]
 
-    @swagger_auto_schema(
-        operation_description="Retrieve programs from the previous hour, currently running and upcoming for the next 24 hours",
+    @extend_schema(
+        description="Retrieve programs from the previous hour, currently running and upcoming for the next 24 hours",
         responses={200: ProgramDataSerializer(many=True)},
     )
     def get(self, request, format=None):
@@ -371,9 +373,8 @@ class EPGImportAPIView(APIView):
         except KeyError:
             return [Authenticated()]
 
-    @swagger_auto_schema(
-        operation_description="Triggers an EPG data import",
-        responses={202: "EPG data import initiated"},
+    @extend_schema(
+        description="Triggers an EPG data import",
     )
     def post(self, request, format=None):
         logger.info("EPGImportAPIView: Received request to import EPG data.")
@@ -417,3 +418,89 @@ class EPGDataViewSet(viewsets.ReadOnlyModelViewSet):
         except KeyError:
             return [Authenticated()]
 
+
+# ─────────────────────────────
+# 6) Current Programs API
+# ─────────────────────────────
+class CurrentProgramsAPIView(APIView):
+    """
+    Lightweight endpoint that returns currently playing programs for specified channel IDs.
+    Accepts POST with JSON body containing channel_ids array, or null/empty to fetch all channels.
+    """
+
+    def get_permissions(self):
+        try:
+            return [
+                perm() for perm in permission_classes_by_method[self.request.method]
+            ]
+        except KeyError:
+            return [Authenticated()]
+
+    @extend_schema(
+        description="Get currently playing programs for specified channels or all channels",
+        request=inline_serializer(
+            name="CurrentProgramsRequest",
+            fields={
+                "channel_ids": serializers.ListField(
+                    child=serializers.IntegerField(),
+                    required=False,
+                    allow_null=True,
+                    help_text="Array of channel IDs. If null or omitted, returns all channels with current programs.",
+                ),
+            },
+        ),
+        responses={200: ProgramDataSerializer(many=True)},
+    )
+    def post(self, request, format=None):
+        # Get channel IDs from request body
+        channel_ids = request.data.get('channel_ids', None)
+
+        # Import Channel model
+        from apps.channels.models import Channel
+
+        # Build query for channels with EPG data
+        query = Channel.objects.filter(epg_data__isnull=False)
+
+        # Filter by specific channel IDs if provided
+        if channel_ids is not None:
+            if not isinstance(channel_ids, list):
+                return Response(
+                    {"error": "channel_ids must be an array of integers or null"},
+                    status=status.HTTP_400_BAD_REQUEST
+                )
+
+            try:
+                channel_ids = [int(id) for id in channel_ids]
+            except (ValueError, TypeError):
+                return Response(
+                    {"error": "channel_ids must contain valid integers"},
+                    status=status.HTTP_400_BAD_REQUEST
+                )
+
+            query = query.filter(id__in=channel_ids)
+
+        # Get channels with EPG data
+        channels = query.select_related('epg_data')
+
+        # Get current time
+        now = timezone.now()
+
+        # Build list of current programs
+        current_programs = []
+
+        for channel in channels:
+            # Query for current program
+            program = ProgramData.objects.filter(
+                epg=channel.epg_data,
+                start_time__lte=now,
+                end_time__gt=now
+            ).first()
+
+            if program:
+                # Serialize program and add channel_id for easy mapping
+                program_data = ProgramDataSerializer(program).data
+                program_data['channel_id'] = channel.id
+                current_programs.append(program_data)
+
+        return Response(current_programs, status=status.HTTP_200_OK)
+

apps/epg/migrations/0021_epgsource_priority.py

@@ -0,0 +1,18 @@
+# Generated by Django 5.2.4 on 2025-12-05 15:24
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('epg', '0020_migrate_time_to_starttime_placeholders'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='epgsource',
+            name='priority',
+            field=models.PositiveIntegerField(default=0, help_text='Priority for EPG matching (higher numbers = higher priority). Used when multiple EPG sources have matching entries for a channel.'),
+        ),
+    ]

apps/epg/models.py

@@ -45,6 +45,10 @@ class EPGSource(models.Model):
         null=True,
         help_text="Custom properties for dummy EPG configuration (regex patterns, timezone, duration, etc.)"
     )
+    priority = models.PositiveIntegerField(
+        default=0,
+        help_text="Priority for EPG matching (higher numbers = higher priority). Used when multiple EPG sources have matching entries for a channel."
+    )
     status = models.CharField(
         max_length=20,
         choices=STATUS_CHOICES,

apps/epg/serializers.py

@@ -12,6 +12,7 @@ class EPGSourceSerializer(serializers.ModelSerializer):
         allow_null=True,
         validators=[validate_flexible_url]
     )
+    cron_expression = serializers.CharField(required=False, allow_blank=True, default='')
 
     class Meta:
         model = EPGSource
@@ -24,6 +25,8 @@ class EPGSourceSerializer(serializers.ModelSerializer):
             'is_active',
             'file_path',
             'refresh_interval',
+            'cron_expression',
+            'priority',
             'status',
             'last_message',
             'created_at',
@@ -36,6 +39,42 @@ class EPGSourceSerializer(serializers.ModelSerializer):
         """Return the count of EPG data entries instead of all IDs to prevent large payloads"""
         return obj.epgs.count()
 
+    def to_representation(self, instance):
+        data = super().to_representation(instance)
+        # Derive cron_expression from the linked PeriodicTask's crontab (single source of truth)
+        # But first check if we have a transient _cron_expression (from create/update before signal runs)
+        cron_expr = ''
+        if hasattr(instance, '_cron_expression'):
+            cron_expr = instance._cron_expression
+        elif instance.refresh_task_id and instance.refresh_task and instance.refresh_task.crontab:
+            ct = instance.refresh_task.crontab
+            cron_expr = f'{ct.minute} {ct.hour} {ct.day_of_month} {ct.month_of_year} {ct.day_of_week}'
+        data['cron_expression'] = cron_expr
+        return data
+
+    def update(self, instance, validated_data):
+        # Pop cron_expression before it reaches model fields
+        # If not present (partial update), preserve the existing cron from the PeriodicTask
+        if 'cron_expression' in validated_data:
+            cron_expr = validated_data.pop('cron_expression')
+        else:
+            cron_expr = ''
+            if instance.refresh_task_id and instance.refresh_task and instance.refresh_task.crontab:
+                ct = instance.refresh_task.crontab
+                cron_expr = f'{ct.minute} {ct.hour} {ct.day_of_month} {ct.month_of_year} {ct.day_of_week}'
+        instance._cron_expression = cron_expr
+        for attr, value in validated_data.items():
+            setattr(instance, attr, value)
+        instance.save()
+        return instance
+
+    def create(self, validated_data):
+        cron_expr = validated_data.pop('cron_expression', '')
+        instance = EPGSource(**validated_data)
+        instance._cron_expression = cron_expr
+        instance.save()
+        return instance
+
 class ProgramDataSerializer(serializers.ModelSerializer):
     class Meta:
         model = ProgramData

apps/epg/signals.py

@@ -2,7 +2,7 @@ from django.db.models.signals import post_save, post_delete, pre_save
 from django.dispatch import receiver
 from .models import EPGSource, EPGData
 from .tasks import refresh_epg_data, delete_epg_refresh_task_by_id
-from django_celery_beat.models import PeriodicTask, IntervalSchedule
+from core.scheduling import create_or_update_periodic_task, delete_periodic_task
 from core.utils import is_protected_path, send_websocket_update
 import json
 import logging
@@ -70,10 +70,11 @@ def create_dummy_epg_data(sender, instance, created, **kwargs):
             logger.debug(f"EPGData already exists for dummy EPG source: {instance.name} (ID: {instance.id})")
 
 @receiver(post_save, sender=EPGSource)
-def create_or_update_refresh_task(sender, instance, **kwargs):
+def create_or_update_refresh_task(sender, instance, created, update_fields=None, **kwargs):
     """
     Create or update a Celery Beat periodic task when an EPGSource is created/updated.
     Skip creating tasks for dummy EPG sources as they don't need refreshing.
+    Supports both interval-based and cron-based scheduling via the shared utility.
     """
     # Skip task creation for dummy EPGs
     if instance.source_type == 'dummy':
@@ -83,39 +84,48 @@ def create_or_update_refresh_task(sender, instance, **kwargs):
             instance.refresh_task.save(update_fields=['enabled'])
         return
 
+    # Skip rescheduling when only non-schedule fields were saved (e.g. status/last_message
+    # updates from the refresh task itself). We only need to reschedule when schedule-relevant
+    # fields change or when _cron_expression was explicitly set by the serializer.
+    SCHEDULE_FIELDS = {'refresh_interval', 'is_active', 'refresh_task'}
+    if (
+        not created
+        and update_fields is not None
+        and not (set(update_fields) & SCHEDULE_FIELDS)
+        and not hasattr(instance, '_cron_expression')
+    ):
+        return
+
     task_name = f"epg_source-refresh-{instance.id}"
-    interval, _ = IntervalSchedule.objects.get_or_create(
-        every=int(instance.refresh_interval),
-        period=IntervalSchedule.HOURS
+    should_be_enabled = instance.is_active
+
+    # Read cron_expression from transient attribute set by the serializer.
+    # If not set (e.g. save came from a task updating status/last_message),
+    # preserve the existing crontab so we don't accidentally revert to interval.
+    if hasattr(instance, "_cron_expression"):
+        cron_expr = instance._cron_expression
+    else:
+        cron_expr = ""
+        try:
+            existing_task = instance.refresh_task
+            if existing_task and existing_task.crontab:
+                ct = existing_task.crontab
+                cron_expr = f"{ct.minute} {ct.hour} {ct.day_of_month} {ct.month_of_year} {ct.day_of_week}"
+        except Exception:
+            pass
+
+    task = create_or_update_periodic_task(
+        task_name=task_name,
+        celery_task_path="apps.epg.tasks.refresh_epg_data",
+        kwargs={"source_id": instance.id},
+        interval_hours=int(instance.refresh_interval),
+        cron_expression=cron_expr,
+        enabled=should_be_enabled,
     )
 
-    task, created = PeriodicTask.objects.get_or_create(name=task_name, defaults={
-        "interval": interval,
-        "task": "apps.epg.tasks.refresh_epg_data",
-        "kwargs": json.dumps({"source_id": instance.id}),
-        "enabled": instance.refresh_interval != 0 and instance.is_active,
-    })
-
-    update_fields = []
-    if created:
-        task.interval = interval
-
-    if task.interval != interval:
-        task.interval = interval
-        update_fields.append("interval")
-
-    # Check both refresh_interval and is_active to determine if task should be enabled
-    should_be_enabled = instance.refresh_interval != 0 and instance.is_active
-    if task.enabled != should_be_enabled:
-        task.enabled = should_be_enabled
-        update_fields.append("enabled")
-
-    if update_fields:
-        task.save(update_fields=update_fields)
-
     if instance.refresh_task != task:
         instance.refresh_task = task
-        instance.save(update_fields=["refresh_task"])  # Fixed field name
+        instance.save(update_fields=["refresh_task"])
 
 @receiver(post_delete, sender=EPGSource)
 def delete_refresh_task(sender, instance, **kwargs):

apps/epg/tasks.py

@@ -24,7 +24,7 @@ from asgiref.sync import async_to_sync
 from channels.layers import get_channel_layer
 
 from .models import EPGSource, EPGData, ProgramData
-from core.utils import acquire_task_lock, release_task_lock, send_websocket_update, cleanup_memory, log_system_event
+from core.utils import acquire_task_lock, release_task_lock, TaskLockRenewer, send_websocket_update, cleanup_memory, log_system_event
 
 logger = logging.getLogger(__name__)
 
@@ -146,12 +146,15 @@ def refresh_all_epg_data():
     return "EPG data refreshed."
 
 
-@shared_task
+@shared_task(time_limit=1800, soft_time_limit=1700)
 def refresh_epg_data(source_id):
     if not acquire_task_lock('refresh_epg_data', source_id):
         logger.debug(f"EPG refresh for {source_id} already running")
         return
 
+    lock_renewer = TaskLockRenewer('refresh_epg_data', source_id)
+    lock_renewer.start()
+
     source = None
     try:
         # Try to get the EPG source
@@ -168,6 +171,7 @@ def refresh_epg_data(source_id):
                 logger.info(f"No orphaned task found for EPG source {source_id}")
 
             # Release the lock and exit
+            lock_renewer.stop()
             release_task_lock('refresh_epg_data', source_id)
             # Force garbage collection before exit
             gc.collect()
@@ -176,6 +180,7 @@ def refresh_epg_data(source_id):
         # The source exists but is not active, just skip processing
         if not source.is_active:
             logger.info(f"EPG source {source_id} is not active. Skipping.")
+            lock_renewer.stop()
             release_task_lock('refresh_epg_data', source_id)
             # Force garbage collection before exit
             gc.collect()
@@ -184,6 +189,7 @@ def refresh_epg_data(source_id):
         # Skip refresh for dummy EPG sources - they don't need refreshing
         if source.source_type == 'dummy':
             logger.info(f"Skipping refresh for dummy EPG source {source.name} (ID: {source_id})")
+            lock_renewer.stop()
             release_task_lock('refresh_epg_data', source_id)
             gc.collect()
             return
@@ -194,6 +200,7 @@ def refresh_epg_data(source_id):
             fetch_success = fetch_xmltv(source)
             if not fetch_success:
                 logger.error(f"Failed to fetch XMLTV for source {source.name}")
+                lock_renewer.stop()
                 release_task_lock('refresh_epg_data', source_id)
                 # Force garbage collection before exit
                 gc.collect()
@@ -202,6 +209,7 @@ def refresh_epg_data(source_id):
             parse_channels_success = parse_channels_only(source)
             if not parse_channels_success:
                 logger.error(f"Failed to parse channels for source {source.name}")
+                lock_renewer.stop()
                 release_task_lock('refresh_epg_data', source_id)
                 # Force garbage collection before exit
                 gc.collect()
@@ -234,6 +242,7 @@ def refresh_epg_data(source_id):
         source = None
         # Force garbage collection before releasing the lock
         gc.collect()
+        lock_renewer.stop()
         release_task_lock('refresh_epg_data', source_id)
 
 
@@ -286,11 +295,12 @@ def fetch_xmltv(source):
     logger.info(f"Fetching XMLTV data from source: {source.name}")
     try:
         # Get default user agent from settings
-        default_user_agent_setting = CoreSettings.objects.filter(key='default-user-agent').first()
+        stream_settings = CoreSettings.get_stream_settings()
         user_agent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0"  # Fallback default
-        if default_user_agent_setting and default_user_agent_setting.value:
+        default_user_agent_id = stream_settings.get('default_user_agent')
+        if default_user_agent_id:
             try:
-                user_agent_obj = UserAgent.objects.filter(id=int(default_user_agent_setting.value)).first()
+                user_agent_obj = UserAgent.objects.filter(id=int(default_user_agent_id)).first()
                 if user_agent_obj and user_agent_obj.user_agent:
                     user_agent = user_agent_obj.user_agent
                     logger.debug(f"Using default user agent: {user_agent}")
@@ -1125,12 +1135,15 @@ def parse_channels_only(source):
 
 
 
-@shared_task
+@shared_task(time_limit=3600, soft_time_limit=3500)
 def parse_programs_for_tvg_id(epg_id):
     if not acquire_task_lock('parse_epg_programs', epg_id):
         logger.info(f"Program parse for {epg_id} already in progress, skipping duplicate task")
         return "Task already running"
 
+    lock_renewer = TaskLockRenewer('parse_epg_programs', epg_id)
+    lock_renewer.start()
+
     source_file = None
     program_parser = None
     programs_to_create = []
@@ -1160,11 +1173,13 @@ def parse_programs_for_tvg_id(epg_id):
         # Skip program parsing for dummy EPG sources - they don't have program data files
         if epg_source.source_type == 'dummy':
             logger.info(f"Skipping program parsing for dummy EPG source {epg_source.name} (ID: {epg_id})")
+            lock_renewer.stop()
             release_task_lock('parse_epg_programs', epg_id)
             return
 
         if not Channel.objects.filter(epg_data=epg).exists():
             logger.info(f"No channels matched to EPG {epg.tvg_id}")
+            lock_renewer.stop()
             release_task_lock('parse_epg_programs', epg_id)
             return
 
@@ -1206,6 +1221,7 @@ def parse_programs_for_tvg_id(epg_id):
                     epg_source.last_message = f"Failed to download EPG data, cannot parse programs"
                     epg_source.save(update_fields=['status', 'last_message'])
                     send_epg_update(epg_source.id, "parsing_programs", 100, status="error", error="Failed to download EPG file")
+                    lock_renewer.stop()
                     release_task_lock('parse_epg_programs', epg_id)
                     return
 
@@ -1216,6 +1232,7 @@ def parse_programs_for_tvg_id(epg_id):
                     epg_source.last_message = f"Failed to download EPG data, file missing after download"
                     epg_source.save(update_fields=['status', 'last_message'])
                     send_epg_update(epg_source.id, "parsing_programs", 100, status="error", error="File not found after download")
+                    lock_renewer.stop()
                     release_task_lock('parse_epg_programs', epg_id)
                     return
 
@@ -1231,6 +1248,7 @@ def parse_programs_for_tvg_id(epg_id):
                 epg_source.last_message = f"No URL provided, cannot fetch EPG data"
                 epg_source.save(update_fields=['status', 'last_message'])
                 send_epg_update(epg_source.id, "parsing_programs", 100, status="error", error="No URL provided")
+                lock_renewer.stop()
                 release_task_lock('parse_epg_programs', epg_id)
                 return
 
@@ -1378,7 +1396,7 @@ def parse_programs_for_tvg_id(epg_id):
         epg_source = None
         # Add comprehensive cleanup before releasing lock
         cleanup_memory(log_usage=should_log_memory, force_collection=True)
-         # Memory tracking after processing
+        # Memory tracking after processing
         if process:
             try:
                 mem_after = process.memory_info().rss / 1024 / 1024
@@ -1388,6 +1406,7 @@ def parse_programs_for_tvg_id(epg_id):
             process = None
         epg = None
         programs_processed = None
+        lock_renewer.stop()
         release_task_lock('parse_epg_programs', epg_id)
 
 
@@ -1650,7 +1669,7 @@ def parse_programs_for_source(epg_source, tvg_id=None):
         epg_source.status = EPGSource.STATUS_SUCCESS
         epg_source.last_message = (
             f"Parsed {total_programs:,} programs for {channels_with_programs} channels "
-            f"(skipped {skipped_programs:,} programmes for {total_epg_count - mapped_count} unmapped channels)"
+            f"(skipped {skipped_programs:,} programs for {total_epg_count - mapped_count} unmapped channels)"
         )
         epg_source.updated_at = timezone.now()
         epg_source.save(update_fields=['status', 'last_message', 'updated_at'])
@@ -1672,8 +1691,8 @@ def parse_programs_for_source(epg_source, tvg_id=None):
                       updated_at=epg_source.updated_at.isoformat())
 
         logger.info(f"Completed parsing programs for source: {epg_source.name} - "
-                   f"{total_programs:,} programs for {channels_with_programs} channels, "
-                   f"skipped {skipped_programs:,} programmes for unmapped channels")
+               f"{total_programs:,} programs for {channels_with_programs} channels, "
+               f"skipped {skipped_programs:,} programs for unmapped channels")
         return True
 
     except Exception as e:
@@ -1714,12 +1733,13 @@ def fetch_schedules_direct(source):
     logger.info(f"Fetching Schedules Direct data from source: {source.name}")
     try:
         # Get default user agent from settings
-        default_user_agent_setting = CoreSettings.objects.filter(key='default-user-agent').first()
+        stream_settings = CoreSettings.get_stream_settings()
         user_agent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0"  # Fallback default
+        default_user_agent_id = stream_settings.get('default_user_agent')
 
-        if default_user_agent_setting and default_user_agent_setting.value:
+        if default_user_agent_id:
             try:
-                user_agent_obj = UserAgent.objects.filter(id=int(default_user_agent_setting.value)).first()
+                user_agent_obj = UserAgent.objects.filter(id=int(default_user_agent_id)).first()
                 if user_agent_obj and user_agent_obj.user_agent:
                     user_agent = user_agent_obj.user_agent
                     logger.debug(f"Using default user agent: {user_agent}")

apps/hdhr/api_views.py

@@ -4,8 +4,8 @@ from rest_framework.views import APIView
 from apps.accounts.permissions import Authenticated, permission_classes_by_action
 from django.http import JsonResponse, HttpResponseForbidden, HttpResponse
 import logging
-from drf_yasg.utils import swagger_auto_schema
-from drf_yasg import openapi
+from drf_spectacular.utils import extend_schema, OpenApiParameter
+from drf_spectacular.types import OpenApiTypes
 from django.shortcuts import get_object_or_404
 from django.db import models
 from apps.channels.models import Channel, ChannelProfile, Stream
@@ -47,9 +47,8 @@ class HDHRDeviceViewSet(viewsets.ModelViewSet):
 class DiscoverAPIView(APIView):
     """Returns device discovery information"""
 
-    @swagger_auto_schema(
-        operation_description="Retrieve HDHomeRun device discovery information",
-        responses={200: openapi.Response("HDHR Discovery JSON")},
+    @extend_schema(
+        description="Retrieve HDHomeRun device discovery information",
     )
     def get(self, request, profile=None):
         uri_parts = ["hdhr"]
@@ -100,9 +99,8 @@ class DiscoverAPIView(APIView):
 class LineupAPIView(APIView):
     """Returns available channel lineup"""
 
-    @swagger_auto_schema(
-        operation_description="Retrieve the available channel lineup",
-        responses={200: openapi.Response("Channel Lineup JSON")},
+    @extend_schema(
+        description="Retrieve the available channel lineup",
     )
     def get(self, request, profile=None):
         if profile is not None:
@@ -141,9 +139,8 @@ class LineupAPIView(APIView):
 class LineupStatusAPIView(APIView):
     """Returns the current status of the HDHR lineup"""
 
-    @swagger_auto_schema(
-        operation_description="Retrieve the HDHomeRun lineup status",
-        responses={200: openapi.Response("Lineup Status JSON")},
+    @extend_schema(
+        description="Retrieve the HDHomeRun lineup status",
     )
     def get(self, request, profile=None):
         data = {
@@ -159,9 +156,8 @@ class LineupStatusAPIView(APIView):
 class HDHRDeviceXMLAPIView(APIView):
     """Returns HDHomeRun device configuration in XML"""
 
-    @swagger_auto_schema(
-        operation_description="Retrieve the HDHomeRun device XML configuration",
-        responses={200: openapi.Response("HDHR Device XML")},
+    @extend_schema(
+        description="Retrieve the HDHomeRun device XML configuration",
     )
     def get(self, request):
         base_url = request.build_absolute_uri("/hdhr/").rstrip("/")

apps/hdhr/views.py

@@ -3,8 +3,8 @@ from rest_framework.response import Response
 from rest_framework.views import APIView
 from apps.accounts.permissions import Authenticated, permission_classes_by_action
 from django.http import JsonResponse, HttpResponseForbidden, HttpResponse
-from drf_yasg.utils import swagger_auto_schema
-from drf_yasg import openapi
+from drf_spectacular.utils import extend_schema, OpenApiParameter
+from drf_spectacular.types import OpenApiTypes
 from django.shortcuts import get_object_or_404
 from apps.channels.models import Channel
 from .models import HDHRDevice
@@ -42,9 +42,8 @@ class HDHRDeviceViewSet(viewsets.ModelViewSet):
 class DiscoverAPIView(APIView):
     """Returns device discovery information"""
 
-    @swagger_auto_schema(
-        operation_description="Retrieve HDHomeRun device discovery information",
-        responses={200: openapi.Response("HDHR Discovery JSON")},
+    @extend_schema(
+        description="Retrieve HDHomeRun device discovery information",
     )
     def get(self, request):
         base_url = request.build_absolute_uri("/hdhr/").rstrip("/")
@@ -81,9 +80,8 @@ class DiscoverAPIView(APIView):
 class LineupAPIView(APIView):
     """Returns available channel lineup"""
 
-    @swagger_auto_schema(
-        operation_description="Retrieve the available channel lineup",
-        responses={200: openapi.Response("Channel Lineup JSON")},
+    @extend_schema(
+        description="Retrieve the available channel lineup",
     )
     def get(self, request):
         channels = Channel.objects.all().order_by("channel_number")
@@ -102,9 +100,8 @@ class LineupAPIView(APIView):
 class LineupStatusAPIView(APIView):
     """Returns the current status of the HDHR lineup"""
 
-    @swagger_auto_schema(
-        operation_description="Retrieve the HDHomeRun lineup status",
-        responses={200: openapi.Response("Lineup Status JSON")},
+    @extend_schema(
+        description="Retrieve the HDHomeRun lineup status",
     )
     def get(self, request):
         data = {
@@ -120,9 +117,8 @@ class LineupStatusAPIView(APIView):
 class HDHRDeviceXMLAPIView(APIView):
     """Returns HDHomeRun device configuration in XML"""
 
-    @swagger_auto_schema(
-        operation_description="Retrieve the HDHomeRun device XML configuration",
-        responses={200: openapi.Response("HDHR Device XML")},
+    @extend_schema(
+        description="Retrieve the HDHomeRun device XML configuration",
     )
     def get(self, request):
         base_url = request.build_absolute_uri("/hdhr/").rstrip("/")

apps/m3u/api_views.py

@@ -6,8 +6,8 @@ from apps.accounts.permissions import (
     permission_classes_by_action,
     permission_classes_by_method,
 )
-from drf_yasg.utils import swagger_auto_schema
-from drf_yasg import openapi
+from drf_spectacular.utils import extend_schema, OpenApiParameter
+from drf_spectacular.types import OpenApiTypes
 from django.shortcuts import get_object_or_404
 from django.http import JsonResponse
 from django.core.cache import cache
@@ -37,7 +37,9 @@ import json
 class M3UAccountViewSet(viewsets.ModelViewSet):
     """Handles CRUD operations for M3U accounts"""
 
-    queryset = M3UAccount.objects.prefetch_related("channel_group")
+    queryset = M3UAccount.objects.select_related(
+        "refresh_task__crontab", "refresh_task__interval"
+    ).prefetch_related("channel_group")
     serializer_class = M3UAccountSerializer
 
     def get_permissions(self):
@@ -357,9 +359,8 @@ class RefreshM3UAPIView(APIView):
         except KeyError:
             return [Authenticated()]
 
-    @swagger_auto_schema(
-        operation_description="Triggers a refresh of all active M3U accounts",
-        responses={202: "M3U refresh initiated"},
+    @extend_schema(
+        description="Triggers a refresh of all active M3U accounts",
     )
     def post(self, request, format=None):
         refresh_m3u_accounts.delay()
@@ -380,9 +381,8 @@ class RefreshSingleM3UAPIView(APIView):
         except KeyError:
             return [Authenticated()]
 
-    @swagger_auto_schema(
-        operation_description="Triggers a refresh of a single M3U account",
-        responses={202: "M3U account refresh initiated"},
+    @extend_schema(
+        description="Triggers a refresh of a single M3U account",
     )
     def post(self, request, account_id, format=None):
         refresh_single_m3u_account.delay(account_id)
@@ -406,9 +406,8 @@ class RefreshAccountInfoAPIView(APIView):
         except KeyError:
             return [Authenticated()]
 
-    @swagger_auto_schema(
-        operation_description="Triggers a refresh of account information for a specific M3U profile",
-        responses={202: "Account info refresh initiated", 400: "Profile not found or not XtreamCodes"},
+    @extend_schema(
+        description="Triggers a refresh of account information for a specific M3U profile",
     )
     def post(self, request, profile_id, format=None):
         try:

apps/m3u/serializers.py

@@ -139,6 +139,7 @@ class M3UAccountSerializer(serializers.ModelSerializer):
     auto_enable_new_groups_live = serializers.BooleanField(required=False, write_only=True)
     auto_enable_new_groups_vod = serializers.BooleanField(required=False, write_only=True)
     auto_enable_new_groups_series = serializers.BooleanField(required=False, write_only=True)
+    cron_expression = serializers.CharField(required=False, allow_blank=True, default="")
 
     class Meta:
         model = M3UAccount
@@ -158,6 +159,7 @@ class M3UAccountSerializer(serializers.ModelSerializer):
             "locked",
             "channel_groups",
             "refresh_interval",
+            "cron_expression",
             "custom_properties",
             "account_type",
             "username",
@@ -188,9 +190,30 @@ class M3UAccountSerializer(serializers.ModelSerializer):
         data["auto_enable_new_groups_live"] = custom_props.get("auto_enable_new_groups_live", True)
         data["auto_enable_new_groups_vod"] = custom_props.get("auto_enable_new_groups_vod", True)
         data["auto_enable_new_groups_series"] = custom_props.get("auto_enable_new_groups_series", True)
+
+        # Derive cron_expression from the linked PeriodicTask's crontab (single source of truth)
+        # But first check if we have a transient _cron_expression (from create/update before signal runs)
+        cron_expr = ""
+        if hasattr(instance, '_cron_expression'):
+            cron_expr = instance._cron_expression
+        elif instance.refresh_task_id and instance.refresh_task and instance.refresh_task.crontab:
+            ct = instance.refresh_task.crontab
+            cron_expr = f"{ct.minute} {ct.hour} {ct.day_of_month} {ct.month_of_year} {ct.day_of_week}"
+        data["cron_expression"] = cron_expr
         return data
 
     def update(self, instance, validated_data):
+        # Pop cron_expression before it reaches model fields
+        # If not present (partial update), preserve the existing cron from the PeriodicTask
+        if "cron_expression" in validated_data:
+            cron_expr = validated_data.pop("cron_expression")
+        else:
+            cron_expr = ""
+            if instance.refresh_task_id and instance.refresh_task and instance.refresh_task.crontab:
+                ct = instance.refresh_task.crontab
+                cron_expr = f"{ct.minute} {ct.hour} {ct.day_of_month} {ct.month_of_year} {ct.day_of_week}"
+        instance._cron_expression = cron_expr
+
         # Handle enable_vod preference and auto_enable_new_groups settings
         enable_vod = validated_data.pop("enable_vod", None)
         auto_enable_new_groups_live = validated_data.pop("auto_enable_new_groups_live", None)
@@ -244,6 +267,9 @@ class M3UAccountSerializer(serializers.ModelSerializer):
         return instance
 
     def create(self, validated_data):
+        # Pop cron_expression — it's not a model field
+        cron_expr = validated_data.pop("cron_expression", "")
+
         # Handle enable_vod preference and auto_enable_new_groups settings during creation
         enable_vod = validated_data.pop("enable_vod", False)
         auto_enable_new_groups_live = validated_data.pop("auto_enable_new_groups_live", True)
@@ -260,7 +286,11 @@ class M3UAccountSerializer(serializers.ModelSerializer):
         custom_props["auto_enable_new_groups_series"] = auto_enable_new_groups_series
         validated_data["custom_properties"] = custom_props
 
-        return super().create(validated_data)
+        # Build instance manually so we can attach transient attr before save triggers signal
+        instance = M3UAccount(**validated_data)
+        instance._cron_expression = cron_expr
+        instance.save()
+        return instance
 
     def get_filters(self, obj):
         filters = obj.filters.order_by("order")

apps/m3u/signals.py

@@ -3,7 +3,7 @@ from django.db.models.signals import post_save, post_delete, pre_save
 from django.dispatch import receiver
 from .models import M3UAccount
 from .tasks import refresh_single_m3u_account, refresh_m3u_groups, delete_m3u_refresh_task_by_id
-from django_celery_beat.models import PeriodicTask, IntervalSchedule
+from core.scheduling import create_or_update_periodic_task, delete_periodic_task
 import json
 import logging
 
@@ -20,51 +20,53 @@ def refresh_account_on_save(sender, instance, created, **kwargs):
         refresh_m3u_groups.delay(instance.id)
 
 @receiver(post_save, sender=M3UAccount)
-def create_or_update_refresh_task(sender, instance, **kwargs):
+def create_or_update_refresh_task(sender, instance, created, update_fields=None, **kwargs):
     """
     Create or update a Celery Beat periodic task when an M3UAccount is created/updated.
+    Supports both interval-based and cron-based scheduling via the shared utility.
     """
-    task_name = f"m3u_account-refresh-{instance.id}"
+    # Skip rescheduling when only non-schedule fields were saved (e.g. status/last_message
+    # updates from the refresh task itself). We only need to reschedule when schedule-relevant
+    # fields change or when _cron_expression was explicitly set by the serializer.
+    SCHEDULE_FIELDS = {'refresh_interval', 'is_active', 'refresh_task'}
+    if (
+        not created
+        and update_fields is not None
+        and not (set(update_fields) & SCHEDULE_FIELDS)
+        and not hasattr(instance, '_cron_expression')
+    ):
+        return
 
-    interval, _ = IntervalSchedule.objects.get_or_create(
-        every=int(instance.refresh_interval),
-        period=IntervalSchedule.HOURS
+    task_name = f"m3u_account-refresh-{instance.id}"
+    should_be_enabled = instance.is_active
+
+    # Read cron_expression from transient attribute set by the serializer.
+    # If not set (e.g. save came from a task updating status/last_message),
+    # preserve the existing crontab so we don't accidentally revert to interval.
+    if hasattr(instance, "_cron_expression"):
+        cron_expr = instance._cron_expression
+    else:
+        cron_expr = ""
+        try:
+            existing_task = instance.refresh_task
+            if existing_task and existing_task.crontab:
+                ct = existing_task.crontab
+                cron_expr = f"{ct.minute} {ct.hour} {ct.day_of_month} {ct.month_of_year} {ct.day_of_week}"
+        except Exception:
+            pass
+
+    task = create_or_update_periodic_task(
+        task_name=task_name,
+        celery_task_path="apps.m3u.tasks.refresh_single_m3u_account",
+        kwargs={"account_id": instance.id},
+        interval_hours=int(instance.refresh_interval),
+        cron_expression=cron_expr,
+        enabled=should_be_enabled,
     )
 
-    # Task should be enabled only if refresh_interval != 0 AND account is active
-    should_be_enabled = (instance.refresh_interval != 0) and instance.is_active
-
-    # First check if the task already exists to avoid validation errors
-    try:
-        task = PeriodicTask.objects.get(name=task_name)
-        # Task exists, just update it
-        updated_fields = []
-
-        if task.enabled != should_be_enabled:
-            task.enabled = should_be_enabled
-            updated_fields.append("enabled")
-
-        if task.interval != interval:
-            task.interval = interval
-            updated_fields.append("interval")
-
-        if updated_fields:
-            task.save(update_fields=updated_fields)
-
-        # Ensure instance has the task
-        if instance.refresh_task_id != task.id:
-            M3UAccount.objects.filter(id=instance.id).update(refresh_task=task)
-
-    except PeriodicTask.DoesNotExist:
-        # Create new task if it doesn't exist
-        refresh_task = PeriodicTask.objects.create(
-            name=task_name,
-            interval=interval,
-            task="apps.m3u.tasks.refresh_single_m3u_account",
-            kwargs=json.dumps({"account_id": instance.id}),
-            enabled=should_be_enabled,
-        )
-        M3UAccount.objects.filter(id=instance.id).update(refresh_task=refresh_task)
+    # Ensure instance has the task linked
+    if instance.refresh_task_id != task.id:
+        M3UAccount.objects.filter(id=instance.id).update(refresh_task=task)
 
 @receiver(post_delete, sender=M3UAccount)
 def delete_refresh_task(sender, instance, **kwargs):

apps/output/tests.py

@@ -1,5 +1,8 @@
 from django.test import TestCase, Client
 from django.urls import reverse
+from apps.channels.models import Channel, ChannelGroup
+from apps.epg.models import EPGData, EPGSource
+import xml.etree.ElementTree as ET
 
 class OutputM3UTest(TestCase):
     def setUp(self):
@@ -37,3 +40,106 @@ class OutputM3UTest(TestCase):
 
         self.assertEqual(response.status_code, 403, "POST with body should return 403 Forbidden")
         self.assertIn("POST requests with body are not allowed, body is:", response.content.decode())
+
+
+class OutputEPGXMLEscapingTest(TestCase):
+    """Test XML escaping of channel_id attributes in EPG generation"""
+
+    def setUp(self):
+        self.client = Client()
+        self.group = ChannelGroup.objects.create(name="Test Group")
+
+    def test_channel_id_with_ampersand(self):
+        """Test channel ID with ampersand is properly escaped"""
+        channel = Channel.objects.create(
+            channel_number=1.0,
+            name="Test Channel",
+            tvg_id="News & Sports",
+            channel_group=self.group
+        )
+
+        url = reverse('output:generate_epg') + '?tvg_id_source=tvg_id'
+        response = self.client.get(url)
+
+        self.assertEqual(response.status_code, 200)
+        content = response.content.decode()
+
+        # Should contain escaped ampersand
+        self.assertIn('id="News & Sports"', content)
+        self.assertNotIn('id="News & Sports"', content)
+
+        # Verify XML is parseable
+        try:
+            ET.fromstring(content)
+        except ET.ParseError as e:
+            self.fail(f"Generated EPG is not valid XML: {e}")
+
+    def test_channel_id_with_angle_brackets(self):
+        """Test channel ID with < and > characters"""
+        channel = Channel.objects.create(
+            channel_number=2.0,
+            name="HD Channel",
+            tvg_id="Channel <HD>",
+            channel_group=self.group
+        )
+
+        url = reverse('output:generate_epg') + '?tvg_id_source=tvg_id'
+        response = self.client.get(url)
+
+        content = response.content.decode()
+        self.assertIn('id="Channel &lt;HD&gt;"', content)
+
+        try:
+            ET.fromstring(content)
+        except ET.ParseError as e:
+            self.fail(f"Generated EPG with < > is not valid XML: {e}")
+
+    def test_channel_id_with_all_special_chars(self):
+        """Test channel ID with all XML special characters"""
+        channel = Channel.objects.create(
+            channel_number=3.0,
+            name="Complex Channel",
+            tvg_id='Test & "Special" <Chars>',
+            channel_group=self.group
+        )
+
+        url = reverse('output:generate_epg') + '?tvg_id_source=tvg_id'
+        response = self.client.get(url)
+
+        content = response.content.decode()
+        self.assertIn('id="Test &amp; &quot;Special&quot; &lt;Chars&gt;"', content)
+
+        try:
+            tree = ET.fromstring(content)
+            # Verify we can find the channel with correct ID in parsed tree
+            channel_elem = tree.find('.//channel[@id="Test & \\"Special\\" <Chars>"]')
+            self.assertIsNotNone(channel_elem)
+        except ET.ParseError as e:
+            self.fail(f"Generated EPG with all special chars is not valid XML: {e}")
+
+    def test_program_channel_attribute_escaping(self):
+        """Test that programme elements also have escaped channel attributes"""
+        epg_source = EPGSource.objects.create(name="Test EPG", source_type="dummy")
+        epg_data = EPGData.objects.create(name="Test EPG Data", epg_source=epg_source)
+        channel = Channel.objects.create(
+            channel_number=4.0,
+            name="Program Test",
+            tvg_id="News & Sports",
+            epg_data=epg_data,
+            channel_group=self.group
+        )
+
+        url = reverse('output:generate_epg') + '?tvg_id_source=tvg_id'
+        response = self.client.get(url)
+
+        content = response.content.decode()
+
+        # Check programme elements have escaped channel attributes
+        self.assertIn('channel="News &amp; Sports"', content)
+
+        try:
+            tree = ET.fromstring(content)
+            programmes = tree.findall('.//programme[@channel="News & Sports"]')
+            self.assertGreater(len(programmes), 0)
+        except ET.ParseError as e:
+            self.fail(f"Generated EPG with programme elements is not valid XML: {e}")

apps/output/views.py

@@ -7,7 +7,6 @@ from django.views.decorators.csrf import csrf_exempt
 from django.views.decorators.http import require_http_methods
 from apps.epg.models import ProgramData
 from apps.accounts.models import User
-from core.models import CoreSettings, NETWORK_ACCESS
 from dispatcharr.utils import network_access_allowed
 from django.utils import timezone as django_timezone
 from django.shortcuts import get_object_or_404
@@ -129,13 +128,17 @@ def generate_m3u(request, profile_name=None, user=None):
             return HttpResponseForbidden("POST requests with body are not allowed, body is: {}".format(request.body.decode()))
 
     if user is not None:
-        if user.user_level == 0:
+        if user.user_level < 10:
             user_profile_count = user.channel_profiles.count()
 
             # If user has ALL profiles or NO profiles, give unrestricted access
             if user_profile_count == 0:
                 # No profile filtering - user sees all channels based on user_level
-                channels = Channel.objects.filter(user_level__lte=user.user_level).order_by("channel_number")
+                filters = {"user_level__lte": user.user_level}
+                # Hide adult content if user preference is set
+                if (user.custom_properties or {}).get('hide_adult_content', False):
+                    filters["is_adult"] = False
+                channels = Channel.objects.filter(**filters).order_by("channel_number")
             else:
                 # User has specific limited profiles assigned
                 filters = {
@@ -143,6 +146,9 @@ def generate_m3u(request, profile_name=None, user=None):
                     "user_level__lte": user.user_level,
                     "channelprofilemembership__channel_profile__in": user.channel_profiles.all()
                 }
+                # Hide adult content if user preference is set
+                if (user.custom_properties or {}).get('hide_adult_content', False):
+                    filters["is_adult"] = False
                 channels = Channel.objects.filter(**filters).distinct().order_by("channel_number")
         else:
             channels = Channel.objects.filter(user_level__lte=user.user_level).order_by(
@@ -161,18 +167,7 @@ def generate_m3u(request, profile_name=None, user=None):
                 channelprofilemembership__enabled=True
             ).order_by('channel_number')
         else:
-            if profile_name is not None:
-                try:
-                    channel_profile = ChannelProfile.objects.get(name=profile_name)
-                except ChannelProfile.DoesNotExist:
-                    logger.warning("Requested channel profile (%s) during m3u generation does not exist", profile_name)
-                    raise Http404(f"Channel profile '{profile_name}' not found")
-                channels = Channel.objects.filter(
-                    channelprofilemembership__channel_profile=channel_profile,
-                    channelprofilemembership__enabled=True,
-                ).order_by("channel_number")
-            else:
-                channels = Channel.objects.order_by("channel_number")
+            channels = Channel.objects.order_by("channel_number")
 
     # Check if the request wants to use direct logo URLs instead of cache
     use_cached_logos = request.GET.get('cachedlogos', 'true').lower() != 'false'
@@ -185,16 +180,27 @@ def generate_m3u(request, profile_name=None, user=None):
     tvg_id_source = request.GET.get('tvg_id_source', 'channel_number').lower()
 
     # Build EPG URL with query parameters if needed
-    epg_base_url = build_absolute_uri_with_port(request, reverse('output:epg_endpoint', args=[profile_name]) if profile_name else reverse('output:epg_endpoint'))
+    # Check if this is an XC API request (has username/password in GET params and user is authenticated)
+    xc_username = request.GET.get('username')
+    xc_password = request.GET.get('password')
+    is_xc_request = user is not None and xc_username and xc_password
 
-    # Optionally preserve certain query parameters
-    preserved_params = ['tvg_id_source', 'cachedlogos', 'days']
-    query_params = {k: v for k, v in request.GET.items() if k in preserved_params}
-    if query_params:
-        from urllib.parse import urlencode
-        epg_url = f"{epg_base_url}?{urlencode(query_params)}"
+    if is_xc_request:
+        # This is an XC API request - use XC-style EPG URL
+        base_url = build_absolute_uri_with_port(request, '')
+        epg_url = f"{base_url}/xmltv.php?username={xc_username}&password={xc_password}"
     else:
-        epg_url = epg_base_url
+        # Regular request - use standard EPG endpoint
+        epg_base_url = build_absolute_uri_with_port(request, reverse('output:epg_endpoint', args=[profile_name]) if profile_name else reverse('output:epg_endpoint'))
+
+        # Optionally preserve certain query parameters
+        preserved_params = ['tvg_id_source', 'cachedlogos', 'days']
+        query_params = {k: v for k, v in request.GET.items() if k in preserved_params}
+        if query_params:
+            from urllib.parse import urlencode
+            epg_url = f"{epg_base_url}?{urlencode(query_params)}"
+        else:
+            epg_url = epg_base_url
 
     # Add x-tvg-url and url-tvg attribute for EPG URL
     m3u_content = f'#EXTM3U x-tvg-url="{epg_url}" url-tvg="{epg_url}"\n'
@@ -249,8 +255,12 @@ def generate_m3u(request, profile_name=None, user=None):
             f'tvg-chno="{formatted_channel_number}" {tvc_guide_stationid}group-title="{group_title}",{channel.name}\n'
         )
 
-        # Determine the stream URL based on the direct parameter
-        if use_direct_urls:
+        # Determine the stream URL based on request type
+        if is_xc_request:
+            # XC API request - use XC-style stream URL format
+            base_url = build_absolute_uri_with_port(request, '')
+            stream_url = f"{base_url}/live/{xc_username}/{xc_password}/{channel.id}"
+        elif use_direct_urls:
             # Try to get the first stream's direct URL
             first_stream = channel.streams.order_by('channelstream__order').first()
             if first_stream and first_stream.url:
@@ -258,12 +268,10 @@ def generate_m3u(request, profile_name=None, user=None):
                 stream_url = first_stream.url
             else:
                 # Fall back to proxy URL if no direct URL available
-                base_url = request.build_absolute_uri('/')[:-1]
-                stream_url = f"{base_url}/proxy/ts/stream/{channel.uuid}"
+                stream_url = build_absolute_uri_with_port(request, f"/proxy/ts/stream/{channel.uuid}")
         else:
             # Standard behavior - use proxy URL
-            base_url = request.build_absolute_uri('/')[:-1]
-            stream_url = f"{base_url}/proxy/ts/stream/{channel.uuid}"
+            stream_url = build_absolute_uri_with_port(request, f"/proxy/ts/stream/{channel.uuid}")
 
         m3u_content += extinf_line + stream_url + "\n"
 
@@ -503,6 +511,7 @@ def generate_custom_dummy_programs(channel_id, channel_name, now, num_days, cust
     output_timezone_value = custom_properties.get('output_timezone', '')  # Optional: display times in different timezone
     program_duration = custom_properties.get('program_duration', 180)  # Minutes
     title_template = custom_properties.get('title_template', '')
+    subtitle_template = custom_properties.get('subtitle_template', '')
     description_template = custom_properties.get('description_template', '')
 
     # Templates for upcoming/ended programs
@@ -908,6 +917,11 @@ def generate_custom_dummy_programs(channel_id, channel_name, now, num_days, cust
                     title_parts.append(all_groups['title'])
                 main_event_title = ' - '.join(title_parts) if title_parts else channel_name
 
+            if subtitle_template:
+                main_event_subtitle = format_template(subtitle_template, all_groups)
+            else:
+                main_event_subtitle = None
+
             if description_template:
                 main_event_description = format_template(description_template, all_groups)
             else:
@@ -958,6 +972,7 @@ def generate_custom_dummy_programs(channel_id, channel_name, now, num_days, cust
                         "start_time": program_start_utc,
                         "end_time": program_end_utc,
                         "title": upcoming_title,
+                        "sub_title": None,  # No subtitle for filler programs
                         "description": upcoming_description,
                         "custom_properties": program_custom_properties,
                         "channel_logo_url": channel_logo_url,  # Pass channel logo for EPG generation
@@ -997,6 +1012,7 @@ def generate_custom_dummy_programs(channel_id, channel_name, now, num_days, cust
                     "start_time": event_start_utc,
                     "end_time": event_end_utc,
                     "title": main_event_title,
+                    "sub_title": main_event_subtitle,
                     "description": main_event_description,
                     "custom_properties": main_event_custom_properties,
                     "channel_logo_url": channel_logo_url,  # Pass channel logo for EPG generation
@@ -1041,6 +1057,7 @@ def generate_custom_dummy_programs(channel_id, channel_name, now, num_days, cust
                         "start_time": program_start_utc,
                         "end_time": program_end_utc,
                         "title": ended_title,
+                        "sub_title": None,  # No subtitle for filler programs
                         "description": ended_description,
                         "custom_properties": program_custom_properties,
                         "channel_logo_url": channel_logo_url,  # Pass channel logo for EPG generation
@@ -1101,6 +1118,7 @@ def generate_custom_dummy_programs(channel_id, channel_name, now, num_days, cust
                         "start_time": program_start_utc,
                         "end_time": program_end_utc,
                         "title": program_title,
+                        "sub_title": None,  # No subtitle for filler programs
                         "description": program_description,
                         "custom_properties": program_custom_properties,
                         "channel_logo_url": channel_logo_url,
@@ -1128,6 +1146,11 @@ def generate_custom_dummy_programs(channel_id, channel_name, now, num_days, cust
                         title_parts.append(all_groups['title'])
                     title = ' - '.join(title_parts) if title_parts else channel_name
 
+                if subtitle_template:
+                    subtitle = format_template(subtitle_template, all_groups)
+                else:
+                    subtitle = None
+
                 if description_template:
                     description = format_template(description_template, all_groups)
                 else:
@@ -1164,6 +1187,7 @@ def generate_custom_dummy_programs(channel_id, channel_name, now, num_days, cust
                     "start_time": program_start_utc,
                     "end_time": program_end_utc,
                     "title": title,
+                    "sub_title": subtitle,
                     "description": description,
                     "custom_properties": program_custom_properties,
                     "channel_logo_url": channel_logo_url,  # Pass channel logo for EPG generation
@@ -1200,9 +1224,14 @@ def generate_dummy_epg(
 
         # Create program entry with escaped channel name
         xml_lines.append(
-            f'  <programme start="{start_str}" stop="{stop_str}" channel="{program["channel_id"]}">'
+            f'  <programme start="{start_str}" stop="{stop_str}" channel="{html.escape(program["channel_id"])}">'
         )
         xml_lines.append(f"    <title>{html.escape(program['title'])}</title>")
+
+        # Add subtitle if available
+        if program.get('sub_title'):
+            xml_lines.append(f"    <sub-title>{html.escape(program['sub_title'])}</sub-title>")
+
         xml_lines.append(f"    <desc>{html.escape(program['description'])}</desc>")
 
         # Add custom_properties if present
@@ -1262,13 +1291,17 @@ def generate_epg(request, profile_name=None, user=None):
 
         # Get channels based on user/profile
         if user is not None:
-            if user.user_level == 0:
+            if user.user_level < 10:
                 user_profile_count = user.channel_profiles.count()
 
                 # If user has ALL profiles or NO profiles, give unrestricted access
                 if user_profile_count == 0:
                     # No profile filtering - user sees all channels based on user_level
-                    channels = Channel.objects.filter(user_level__lte=user.user_level).order_by("channel_number")
+                    filters = {"user_level__lte": user.user_level}
+                    # Hide adult content if user preference is set
+                    if (user.custom_properties or {}).get('hide_adult_content', False):
+                        filters["is_adult"] = False
+                    channels = Channel.objects.filter(**filters).order_by("channel_number")
                 else:
                     # User has specific limited profiles assigned
                     filters = {
@@ -1276,6 +1309,9 @@ def generate_epg(request, profile_name=None, user=None):
                         "user_level__lte": user.user_level,
                         "channelprofilemembership__channel_profile__in": user.channel_profiles.all()
                     }
+                    # Hide adult content if user preference is set
+                    if (user.custom_properties or {}).get('hide_adult_content', False):
+                        filters["is_adult"] = False
                     channels = Channel.objects.filter(**filters).distinct().order_by("channel_number")
             else:
                 channels = Channel.objects.filter(user_level__lte=user.user_level).order_by(
@@ -1438,7 +1474,7 @@ def generate_epg(request, profile_name=None, user=None):
                     else:
                         tvg_logo = build_absolute_uri_with_port(request, reverse('api:channels:logo-cache', args=[channel.logo.id]))
             display_name = channel.name
-            xml_lines.append(f'  <channel id="{channel_id}">')
+            xml_lines.append(f'  <channel id="{html.escape(channel_id)}">')
             xml_lines.append(f'    <display-name>{html.escape(display_name)}</display-name>')
             xml_lines.append(f'    <icon src="{html.escape(tvg_logo)}" />')
             xml_lines.append("  </channel>")
@@ -1513,8 +1549,13 @@ def generate_epg(request, profile_name=None, user=None):
                     stop_str = program['end_time'].strftime("%Y%m%d%H%M%S %z")
 
                     # Create program entry with escaped channel name
-                    yield f'  <programme start="{start_str}" stop="{stop_str}" channel="{channel_id}">\n'
+                    yield f'  <programme start="{start_str}" stop="{stop_str}" channel="{html.escape(channel_id)}">\n'
                     yield f"    <title>{html.escape(program['title'])}</title>\n"
+
+                    # Add subtitle if available
+                    if program.get('sub_title'):
+                        yield f"    <sub-title>{html.escape(program['sub_title'])}</sub-title>\n"
+
                     yield f"    <desc>{html.escape(program['description'])}</desc>\n"
 
                     # Add custom_properties if present
@@ -1562,8 +1603,13 @@ def generate_epg(request, profile_name=None, user=None):
                             start_str = program['start_time'].strftime("%Y%m%d%H%M%S %z")
                             stop_str = program['end_time'].strftime("%Y%m%d%H%M%S %z")
 
-                            yield f'  <programme start="{start_str}" stop="{stop_str}" channel="{channel_id}">\n'
+                            yield f'  <programme start="{start_str}" stop="{stop_str}" channel="{html.escape(channel_id)}">\n'
                             yield f"    <title>{html.escape(program['title'])}</title>\n"
+
+                            # Add subtitle if available
+                            if program.get('sub_title'):
+                                yield f"    <sub-title>{html.escape(program['sub_title'])}</sub-title>\n"
+
                             yield f"    <desc>{html.escape(program['description'])}</desc>\n"
 
                             # Add custom_properties if present
@@ -1624,7 +1670,7 @@ def generate_epg(request, profile_name=None, user=None):
                         start_str = prog.start_time.strftime("%Y%m%d%H%M%S %z")
                         stop_str = prog.end_time.strftime("%Y%m%d%H%M%S %z")
 
-                        program_xml = [f'  <programme start="{start_str}" stop="{stop_str}" channel="{channel_id}">']
+                        program_xml = [f'  <programme start="{start_str}" stop="{stop_str}" channel="{html.escape(channel_id)}">']
                         program_xml.append(f'    <title>{html.escape(prog.title)}</title>')
 
                         # Add subtitle if available
@@ -1899,6 +1945,7 @@ def xc_get_user(request):
         return None
 
     user = get_object_or_404(User, username=username)
+
     custom_properties = user.custom_properties or {}
 
     if "xc_password" not in custom_properties:
@@ -2083,7 +2130,7 @@ def xc_get_live_categories(user):
     from django.db.models import Min
     response = []
 
-    if user.user_level == 0:
+    if user.user_level < 10:
         user_profile_count = user.channel_profiles.count()
 
         # If user has ALL profiles or NO profiles, give unrestricted access
@@ -2120,7 +2167,7 @@ def xc_get_live_categories(user):
 def xc_get_live_streams(request, user, category_id=None):
     streams = []
 
-    if user.user_level == 0:
+    if user.user_level < 10:
         user_profile_count = user.channel_profiles.count()
 
         # If user has ALL profiles or NO profiles, give unrestricted access
@@ -2129,6 +2176,9 @@ def xc_get_live_streams(request, user, category_id=None):
             filters = {"user_level__lte": user.user_level}
             if category_id is not None:
                 filters["channel_group__id"] = category_id
+            # Hide adult content if user preference is set
+            if (user.custom_properties or {}).get('hide_adult_content', False):
+                filters["is_adult"] = False
             channels = Channel.objects.filter(**filters).order_by("channel_number")
         else:
             # User has specific limited profiles assigned
@@ -2139,6 +2189,9 @@ def xc_get_live_streams(request, user, category_id=None):
             }
             if category_id is not None:
                 filters["channel_group__id"] = category_id
+            # Hide adult content if user preference is set
+            if (user.custom_properties or {}).get('hide_adult_content', False):
+                filters["is_adult"] = False
             channels = Channel.objects.filter(**filters).distinct().order_by("channel_number")
     else:
         if not category_id:
@@ -2192,10 +2245,10 @@ def xc_get_live_streams(request, user, category_id=None):
                     )
                 ),
                 "epg_channel_id": str(channel_num_int),
-                "added": int(channel.created_at.timestamp()),
-                "is_adult": 0,
-                "category_id": str(channel.channel_group.id),
-                "category_ids": [channel.channel_group.id],
+                "added": str(int(channel.created_at.timestamp())),
+                "is_adult": int(channel.is_adult),
+                "category_id": str(channel.channel_group.id if channel.channel_group else ChannelGroup.objects.get_or_create(name="Default Group")[0].id),
+                "category_ids": [channel.channel_group.id if channel.channel_group else ChannelGroup.objects.get_or_create(name="Default Group")[0].id],
                 "custom_sid": None,
                 "tv_archive": 0,
                 "direct_source": "",
@@ -2218,10 +2271,14 @@ def xc_get_epg(request, user, short=False):
         # If user has ALL profiles or NO profiles, give unrestricted access
         if user_profile_count == 0:
             # No profile filtering - user sees all channels based on user_level
-            channel = Channel.objects.filter(
-                id=channel_id,
-                user_level__lte=user.user_level
-            ).first()
+            filters = {
+                "id": channel_id,
+                "user_level__lte": user.user_level
+            }
+            # Hide adult content if user preference is set
+            if (user.custom_properties or {}).get('hide_adult_content', False):
+                filters["is_adult"] = False
+            channel = Channel.objects.filter(**filters).first()
         else:
             # User has specific limited profiles assigned
             filters = {
@@ -2230,6 +2287,9 @@ def xc_get_epg(request, user, short=False):
                 "user_level__lte": user.user_level,
                 "channelprofilemembership__channel_profile__in": user.channel_profiles.all()
             }
+            # Hide adult content if user preference is set
+            if (user.custom_properties or {}).get('hide_adult_content', False):
+                filters["is_adult"] = False
             channel = Channel.objects.filter(**filters).distinct().first()
 
         if not channel:
@@ -2269,7 +2329,7 @@ def xc_get_epg(request, user, short=False):
     # Get the mapped integer for this specific channel
     channel_num_int = channel_num_map.get(channel.id, int(channel.channel_number))
 
-    limit = request.GET.get('limit', 4)
+    limit = int(request.GET.get('limit', 4))
     if channel.epg_data:
         # Check if this is a dummy EPG that generates on-demand
         if channel.epg_data.epg_source and channel.epg_data.epg_source.source_type == 'dummy':
@@ -2284,18 +2344,22 @@ def xc_get_epg(request, user, short=False):
                 # Has stored programs, use them
                 if short == False:
                     programs = channel.epg_data.programs.filter(
-                        start_time__gte=django_timezone.now()
+                        end_time__gt=django_timezone.now()
                     ).order_by('start_time')
                 else:
-                    programs = channel.epg_data.programs.all().order_by('start_time')[:limit]
+                    programs = channel.epg_data.programs.filter(
+                        end_time__gt=django_timezone.now()
+                    ).order_by('start_time')[:limit]
         else:
             # Regular EPG with stored programs
             if short == False:
                 programs = channel.epg_data.programs.filter(
-                    start_time__gte=django_timezone.now()
+                    end_time__gt=django_timezone.now()
                 ).order_by('start_time')
             else:
-                programs = channel.epg_data.programs.all().order_by('start_time')[:limit]
+                programs = channel.epg_data.programs.filter(
+                        end_time__gt=django_timezone.now()
+                    ).order_by('start_time')[:limit]
     else:
         # No EPG data assigned, generate default dummy
         programs = generate_dummy_programs(channel_id=channel_id, channel_name=channel.name, epg_source=None)
@@ -2303,31 +2367,41 @@ def xc_get_epg(request, user, short=False):
     output = {"epg_listings": []}
 
     for program in programs:
-        id = "0"
-        epg_id = "0"
         title = program['title'] if isinstance(program, dict) else program.title
         description = program['description'] if isinstance(program, dict) else program.description
 
         start = program["start_time"] if isinstance(program, dict) else program.start_time
         end = program["end_time"] if isinstance(program, dict) else program.end_time
 
+        # For database programs, use actual ID; for generated dummy programs, create synthetic ID
+        if isinstance(program, dict):
+            # Generated dummy program - create unique ID from channel + timestamp
+            program_id = str(abs(hash(f"{channel_id}_{int(start.timestamp())}")))
+        else:
+            # Database program - use actual ID
+            program_id = str(program.id)
+
+        # epg_id refers to the EPG source/channel mapping in XC panels
+        # Use the actual EPGData ID when available, otherwise fall back to 0
+        epg_id = str(channel.epg_data.id) if channel.epg_data else "0"
+
         program_output = {
-            "id": f"{id}",
-            "epg_id": f"{epg_id}",
-            "title": base64.b64encode(title.encode()).decode(),
+            "id": program_id,
+            "epg_id": epg_id,
+            "title": base64.b64encode((title or "").encode()).decode(),
             "lang": "",
-            "start": start.strftime("%Y%m%d%H%M%S"),
-            "end": end.strftime("%Y%m%d%H%M%S"),
-            "description": base64.b64encode(description.encode()).decode(),
-            "channel_id": channel_num_int,
-            "start_timestamp": int(start.timestamp()),
-            "stop_timestamp": int(end.timestamp()),
+            "start": start.strftime("%Y-%m-%d %H:%M:%S"),
+            "end": end.strftime("%Y-%m-%d %H:%M:%S"),
+            "description": base64.b64encode((description or "").encode()).decode(),
+            "channel_id": str(channel_num_int),
+            "start_timestamp": str(int(start.timestamp())),
+            "stop_timestamp": str(int(end.timestamp())),
             "stream_id": f"{channel_id}",
         }
 
         if short == False:
             program_output["now_playing"] = 1 if start <= django_timezone.now() <= end else 0
-            program_output["has_archive"] = "0"
+            program_output["has_archive"] = 0
 
         output['epg_listings'].append(program_output)
 
@@ -2486,6 +2560,8 @@ def xc_get_series(request, user, category_id=None):
             "episode_run_time": series.custom_properties.get('episode_run_time', '') if series.custom_properties else "",
             "category_id": str(relation.category.id) if relation.category else "0",
             "category_ids": [int(relation.category.id)] if relation.category else [],
+            "tmdb_id": series.tmdb_id or "",
+            "imdb_id": series.imdb_id or "",
         })
 
     return series_list
@@ -2532,34 +2608,45 @@ def xc_get_series_info(request, user, series_id):
     except Exception as e:
         logger.error(f"Error refreshing series data for relation {series_relation.id}: {str(e)}")
 
-    # Get episodes for this series from the same M3U account
-    episode_relations = M3UEpisodeRelation.objects.filter(
-        episode__series=series,
-        m3u_account=series_relation.m3u_account
-    ).select_related('episode').order_by('episode__season_number', 'episode__episode_number')
+    # Get unique episodes for this series that have relations from any active M3U account
+    # We query episodes directly to avoid duplicates when multiple relations exist
+    # (e.g., same episode in different languages/qualities)
+    from apps.vod.models import Episode
+    episodes = Episode.objects.filter(
+        series=series,
+        m3u_relations__m3u_account__is_active=True
+    ).distinct().order_by('season_number', 'episode_number')
 
     # Group episodes by season
     seasons = {}
-    for relation in episode_relations:
-        episode = relation.episode
+    for episode in episodes:
         season_num = episode.season_number or 1
         if season_num not in seasons:
             seasons[season_num] = []
 
-        # Try to get the highest priority related M3UEpisodeRelation for this episode (for video/audio/bitrate)
+        # Get the highest priority relation for this episode (for container_extension, video/audio/bitrate)
         from apps.vod.models import M3UEpisodeRelation
-        first_relation = M3UEpisodeRelation.objects.filter(
-            episode=episode
+        best_relation = M3UEpisodeRelation.objects.filter(
+            episode=episode,
+            m3u_account__is_active=True
         ).select_related('m3u_account').order_by('-m3u_account__priority', 'id').first()
+
         video = audio = bitrate = None
-        if first_relation and first_relation.custom_properties:
-            info = first_relation.custom_properties.get('info')
-            if info and isinstance(info, dict):
-                info_info = info.get('info')
-                if info_info and isinstance(info_info, dict):
-                    video = info_info.get('video', {})
-                    audio = info_info.get('audio', {})
-                    bitrate = info_info.get('bitrate', 0)
+        container_extension = "mp4"
+        added_timestamp = str(int(episode.created_at.timestamp()))
+
+        if best_relation:
+            container_extension = best_relation.container_extension or "mp4"
+            added_timestamp = str(int(best_relation.created_at.timestamp()))
+            if best_relation.custom_properties:
+                info = best_relation.custom_properties.get('info')
+                if info and isinstance(info, dict):
+                    info_info = info.get('info')
+                    if info_info and isinstance(info_info, dict):
+                        video = info_info.get('video', {})
+                        audio = info_info.get('audio', {})
+                        bitrate = info_info.get('bitrate', 0)
+
         if video is None:
             video = episode.custom_properties.get('video', {}) if episode.custom_properties else {}
         if audio is None:
@@ -2572,8 +2659,8 @@ def xc_get_series_info(request, user, series_id):
             "season": season_num,
             "episode_num": episode.episode_number or 0,
             "title": episode.name,
-            "container_extension": relation.container_extension or "mp4",
-            "added": str(int(relation.created_at.timestamp())),
+            "container_extension": container_extension,
+            "added": added_timestamp,
             "custom_sid": None,
             "direct_source": "",
             "info": {
@@ -2822,7 +2909,7 @@ def xc_get_vod_info(request, user, vod_id):
         "movie_data": {
             "stream_id": movie.id,
             "name": movie.name,
-            "added": int(movie_relation.created_at.timestamp()),
+            "added": str(int(movie_relation.created_at.timestamp())),
             "category_id": str(movie_relation.category.id) if movie_relation.category else "0",
             "category_ids": [int(movie_relation.category.id)] if movie_relation.category else [],
             "container_extension": movie_relation.container_extension or "mp4",
@@ -2889,7 +2976,7 @@ def xc_series_stream(request, username, password, stream_id, extension):
     filters = {"episode_id": stream_id, "m3u_account__is_active": True}
 
     try:
-        episode_relation = M3UEpisodeRelation.objects.select_related('episode').get(**filters)
+        episode_relation = M3UEpisodeRelation.objects.select_related('episode').filter(**filters).order_by('-m3u_account__priority', 'id').first()
     except M3UEpisodeRelation.DoesNotExist:
         return JsonResponse({"error": "Episode not found"}, status=404)
 
@@ -2922,19 +3009,16 @@ def get_host_and_port(request):
     if xfh:
         if ":" in xfh:
             host, port = xfh.split(":", 1)
-            # Omit standard ports from URLs, or omit if port doesn't match standard for scheme
-            # (e.g., HTTPS but port is 9191 = behind external reverse proxy)
+            # Omit standard ports from URLs
             if port == standard_port:
                 return host, None
-            # If port doesn't match standard and X-Forwarded-Proto is set, likely behind external RP
-            if request.META.get("HTTP_X_FORWARDED_PROTO"):
-                host = xfh.split(":")[0]  # Strip port, will check for proper port below
-            else:
-                return host, port
+            # Non-standard port in X-Forwarded-Host - return it
+            # This handles reverse proxies on non-standard ports (e.g., https://example.com:8443)
+            return host, port
         else:
             host = xfh
 
-        # Check for X-Forwarded-Port header (if we didn't already find a valid port)
+        # Check for X-Forwarded-Port header (if we didn't find a port in X-Forwarded-Host)
         port = request.META.get("HTTP_X_FORWARDED_PORT")
         if port:
             # Omit standard ports from URLs
@@ -2952,22 +3036,28 @@ def get_host_and_port(request):
     else:
         host = raw_host
 
-    # 3. Check if we're behind a reverse proxy (X-Forwarded-Proto or X-Forwarded-For present)
+    # 3. Check for X-Forwarded-Port (when Host header has no port but we're behind a reverse proxy)
+    port = request.META.get("HTTP_X_FORWARDED_PORT")
+    if port:
+        # Omit standard ports from URLs
+        return host, None if port == standard_port else port
+
+    # 4. Check if we're behind a reverse proxy (X-Forwarded-Proto or X-Forwarded-For present)
     # If so, assume standard port for the scheme (don't trust SERVER_PORT in this case)
     if request.META.get("HTTP_X_FORWARDED_PROTO") or request.META.get("HTTP_X_FORWARDED_FOR"):
         return host, None
 
-    # 4. Try SERVER_PORT from META (only if NOT behind reverse proxy)
+    # 5. Try SERVER_PORT from META (only if NOT behind reverse proxy)
     port = request.META.get("SERVER_PORT")
     if port:
         # Omit standard ports from URLs
         return host, None if port == standard_port else port
 
-    # 5. Dev fallback: guess port 5656
+    # 6. Dev fallback: guess port 5656
     if os.environ.get("DISPATCHARR_ENV") == "dev" or host in ("localhost", "127.0.0.1"):
         return host, "5656"
 
-    # 6. Final fallback: assume standard port for scheme (omit from URL)
+    # 7. Final fallback: assume standard port for scheme (omit from URL)
     return host, None
 
 def build_absolute_uri_with_port(request, path):

apps/plugins/api_urls.py

@@ -7,6 +7,7 @@ from .api_views import (
     PluginEnabledAPIView,
     PluginImportAPIView,
     PluginDeleteAPIView,
+    PluginLogoAPIView,
 )
 
 app_name = "plugins"
@@ -19,4 +20,5 @@ urlpatterns = [
     path("plugins/<str:key>/settings/", PluginSettingsAPIView.as_view(), name="settings"),
     path("plugins/<str:key>/run/", PluginRunAPIView.as_view(), name="run"),
     path("plugins/<str:key>/enabled/", PluginEnabledAPIView.as_view(), name="enabled"),
+    path("plugins/<str:key>/logo/", PluginLogoAPIView.as_view(), name="logo"),
 ]

apps/plugins/api_views.py

@@ -1,19 +1,21 @@
 import logging
+import re
 from rest_framework.views import APIView
 from rest_framework.response import Response
 from rest_framework import status
-from rest_framework.decorators import api_view
 from django.conf import settings
 from django.core.files.uploadedfile import UploadedFile
-import io
+from django.http import FileResponse
 import os
 import zipfile
 import shutil
 import tempfile
+from urllib.parse import urlparse
 from apps.accounts.permissions import (
     Authenticated,
     permission_classes_by_method,
 )
+from dispatcharr.utils import network_access_allowed
 
 from .loader import PluginManager
 from .models import PluginConfig
@@ -21,6 +23,42 @@ from .models import PluginConfig
 logger = logging.getLogger(__name__)
 
 
+MAX_PLUGIN_IMPORT_FILES = getattr(settings, "DISPATCHARR_PLUGIN_IMPORT_MAX_FILES", 2000)
+MAX_PLUGIN_IMPORT_BYTES = getattr(settings, "DISPATCHARR_PLUGIN_IMPORT_MAX_BYTES", 200 * 1024 * 1024)
+MAX_PLUGIN_IMPORT_FILE_BYTES = getattr(settings, "DISPATCHARR_PLUGIN_IMPORT_MAX_FILE_BYTES", 200 * 1024 * 1024)
+
+
+def _parse_bool(value):
+    if isinstance(value, bool):
+        return value
+    if isinstance(value, int) and value in (0, 1):
+        return bool(value)
+    if isinstance(value, str):
+        normalized = value.strip().lower()
+        if normalized in ("true", "1", "yes", "y", "on"):
+            return True
+        if normalized in ("false", "0", "no", "n", "off"):
+            return False
+    return None
+
+
+def _sanitize_plugin_key(value: str) -> str:
+    base = os.path.basename(value or "")
+    base = base.replace(" ", "_").lower()
+    base = re.sub(r"[^a-z0-9_-]", "_", base)
+    base = base.strip("._-")
+    return base or "plugin"
+
+
+def _absolutize_logo_url(request, url: str | None) -> str | None:
+    if not url or not request:
+        return url
+    parsed = urlparse(url)
+    if parsed.scheme:
+        return url
+    return request.build_absolute_uri(url)
+
+
 class PluginsListAPIView(APIView):
     def get_permissions(self):
         try:
@@ -32,9 +70,12 @@ class PluginsListAPIView(APIView):
 
     def get(self, request):
         pm = PluginManager.get()
-        # Ensure registry is up-to-date on each request
-        pm.discover_plugins()
-        return Response({"plugins": pm.list_plugins()})
+        # Prefer cached registry; reload explicitly via the reload endpoint
+        pm.discover_plugins(sync_db=False, use_cache=True)
+        plugins = pm.list_plugins()
+        for plugin in plugins:
+            plugin["logo_url"] = _absolutize_logo_url(request, plugin.get("logo_url"))
+        return Response({"plugins": plugins})
 
 
 class PluginReloadAPIView(APIView):
@@ -48,7 +89,8 @@ class PluginReloadAPIView(APIView):
 
     def post(self, request):
         pm = PluginManager.get()
-        pm.discover_plugins()
+        pm.stop_all_plugins(reason="reload")
+        pm.discover_plugins(force_reload=True)
         return Response({"success": True, "count": len(pm._registry)})
 
 
@@ -81,6 +123,19 @@ class PluginImportAPIView(APIView):
             if not file_members:
                 shutil.rmtree(tmp_root, ignore_errors=True)
                 return Response({"success": False, "error": "Archive is empty"}, status=status.HTTP_400_BAD_REQUEST)
+            if len(file_members) > MAX_PLUGIN_IMPORT_FILES:
+                shutil.rmtree(tmp_root, ignore_errors=True)
+                return Response({"success": False, "error": "Archive has too many files"}, status=status.HTTP_400_BAD_REQUEST)
+
+            total_size = 0
+            for member in file_members:
+                total_size += member.file_size
+                if member.file_size > MAX_PLUGIN_IMPORT_FILE_BYTES:
+                    shutil.rmtree(tmp_root, ignore_errors=True)
+                    return Response({"success": False, "error": "Archive contains a file that is too large"}, status=status.HTTP_400_BAD_REQUEST)
+            if total_size > MAX_PLUGIN_IMPORT_BYTES:
+                shutil.rmtree(tmp_root, ignore_errors=True)
+                return Response({"success": False, "error": "Archive is too large"}, status=status.HTTP_400_BAD_REQUEST)
 
             for member in file_members:
                 name = member.filename
@@ -115,7 +170,31 @@ class PluginImportAPIView(APIView):
             plugin_key = os.path.basename(chosen.rstrip(os.sep))
             if chosen.rstrip(os.sep) == tmp_root.rstrip(os.sep):
                 plugin_key = base_name
-            plugin_key = plugin_key.replace(" ", "_").lower()
+            plugin_key = _sanitize_plugin_key(plugin_key)
+            if len(plugin_key) > 128:
+                plugin_key = plugin_key[:128]
+            logo_bytes = None
+            try:
+                logo_candidates = []
+                chosen_abs = os.path.abspath(chosen)
+                for dirpath, _, filenames in os.walk(tmp_root):
+                    for filename in filenames:
+                        if filename.lower() != "logo.png":
+                            continue
+                        full_path = os.path.join(dirpath, filename)
+                        full_abs = os.path.abspath(full_path)
+                        try:
+                            in_chosen = os.path.commonpath([chosen_abs, full_abs]) == chosen_abs
+                        except Exception:
+                            in_chosen = False
+                        depth = len(os.path.relpath(dirpath, tmp_root).split(os.sep))
+                        logo_candidates.append((0 if in_chosen else 1, depth, full_path))
+                if logo_candidates:
+                    logo_candidates.sort()
+                    with open(logo_candidates[0][2], "rb") as fh:
+                        logo_bytes = fh.read()
+            except Exception:
+                logo_bytes = None
 
             final_dir = os.path.join(plugins_dir, plugin_key)
             if os.path.exists(final_dir):
@@ -136,6 +215,12 @@ class PluginImportAPIView(APIView):
                     shutil.move(os.path.join(tmp_root, item), os.path.join(final_dir, item))
             else:
                 shutil.move(chosen, final_dir)
+            if logo_bytes:
+                try:
+                    with open(os.path.join(final_dir, "logo.png"), "wb") as fh:
+                        fh.write(logo_bytes)
+                except Exception:
+                    pass
             # Cleanup temp
             shutil.rmtree(tmp_root, ignore_errors=True)
             target_dir = final_dir
@@ -145,49 +230,50 @@ class PluginImportAPIView(APIView):
             except Exception:
                 pass
 
-        # Reload discovery and validate plugin entry
-        pm.discover_plugins()
-        plugin = pm._registry.get(plugin_key)
-        if not plugin:
-            # Cleanup the copied folder to avoid leaving invalid plugin behind
-            try:
-                shutil.rmtree(target_dir, ignore_errors=True)
-            except Exception:
-                pass
-            return Response({"success": False, "error": "Invalid plugin: missing Plugin class in plugin.py or __init__.py"}, status=status.HTTP_400_BAD_REQUEST)
-
-        # Extra validation: ensure Plugin.run exists
-        instance = getattr(plugin, "instance", None)
-        run_method = getattr(instance, "run", None)
-        if not callable(run_method):
-            try:
-                shutil.rmtree(target_dir, ignore_errors=True)
-            except Exception:
-                pass
-            return Response({"success": False, "error": "Invalid plugin: Plugin class must define a callable run(action, params, context)"}, status=status.HTTP_400_BAD_REQUEST)
-
-        # Find DB config to return enabled/ever_enabled
+        # Ensure DB config exists (untrusted plugins are registered without loading)
         try:
-            cfg = PluginConfig.objects.get(key=plugin_key)
-            enabled = cfg.enabled
-            ever_enabled = getattr(cfg, "ever_enabled", False)
-        except PluginConfig.DoesNotExist:
-            enabled = False
-            ever_enabled = False
+            cfg, _ = PluginConfig.objects.get_or_create(
+                key=plugin_key,
+                defaults={
+                    "name": plugin_key,
+                    "version": "",
+                    "description": "",
+                    "settings": {},
+                },
+            )
+        except Exception:
+            cfg = None
 
-        return Response({
-            "success": True,
-            "plugin": {
-                "key": plugin.key,
-                "name": plugin.name,
-                "version": plugin.version,
-                "description": plugin.description,
-                "enabled": enabled,
-                "ever_enabled": ever_enabled,
-                "fields": plugin.fields or [],
-                "actions": plugin.actions or [],
+        # Reload discovery to register the plugin (trusted plugins will load)
+        pm.discover_plugins(force_reload=True)
+        plugin_entry = None
+        try:
+            plugin_entry = next((p for p in pm.list_plugins() if p.get("key") == plugin_key), None)
+        except Exception:
+            plugin_entry = None
+
+        if not plugin_entry:
+            logo_path = os.path.join(plugins_dir, plugin_key, "logo.png")
+            logo_url = f"/api/plugins/plugins/{plugin_key}/logo/" if os.path.isfile(logo_path) else None
+            legacy = not os.path.isfile(os.path.join(plugins_dir, plugin_key, "plugin.json"))
+            plugin_entry = {
+                "key": plugin_key,
+                "name": cfg.name if cfg else plugin_key,
+                "version": cfg.version if cfg else "",
+                "description": cfg.description if cfg else "",
+                "enabled": cfg.enabled if cfg else False,
+                "ever_enabled": getattr(cfg, "ever_enabled", False) if cfg else False,
+                "fields": [],
+                "actions": [],
+                "trusted": bool(cfg and (cfg.ever_enabled or cfg.enabled)),
+                "loaded": False,
+                "missing": False,
+                "legacy": legacy,
+                "logo_url": logo_url,
             }
-        })
+
+        plugin_entry["logo_url"] = _absolutize_logo_url(request, plugin_entry.get("logo_url"))
+        return Response({"success": True, "plugin": plugin_entry})
 
 
 class PluginSettingsAPIView(APIView):
@@ -254,21 +340,63 @@ class PluginEnabledAPIView(APIView):
             return [Authenticated()]
 
     def post(self, request, key):
-        enabled = request.data.get("enabled")
-        if enabled is None:
+        enabled_raw = request.data.get("enabled")
+        if enabled_raw is None:
             return Response({"success": False, "error": "Missing 'enabled' boolean"}, status=status.HTTP_400_BAD_REQUEST)
+        enabled = _parse_bool(enabled_raw)
+        if enabled is None:
+            return Response({"success": False, "error": "Invalid 'enabled' boolean"}, status=status.HTTP_400_BAD_REQUEST)
         try:
             cfg = PluginConfig.objects.get(key=key)
-            cfg.enabled = bool(enabled)
+            pm = PluginManager.get()
+            if not enabled and cfg.enabled:
+                try:
+                    pm.stop_plugin(key, reason="disable")
+                except Exception:
+                    logger.exception("Failed to stop plugin '%s' on disable", key)
+            cfg.enabled = enabled
             # Mark that this plugin has been enabled at least once
             if cfg.enabled and not cfg.ever_enabled:
                 cfg.ever_enabled = True
             cfg.save(update_fields=["enabled", "ever_enabled", "updated_at"])
-            return Response({"success": True, "enabled": cfg.enabled, "ever_enabled": cfg.ever_enabled})
+            pm.discover_plugins(force_reload=True)
+            plugin_entry = None
+            try:
+                plugin_entry = next((p for p in pm.list_plugins() if p.get("key") == key), None)
+            except Exception:
+                plugin_entry = None
+            response = {"success": True, "enabled": cfg.enabled, "ever_enabled": cfg.ever_enabled}
+            if plugin_entry:
+                plugin_entry["logo_url"] = _absolutize_logo_url(request, plugin_entry.get("logo_url"))
+                response["plugin"] = plugin_entry
+            return Response(response)
         except PluginConfig.DoesNotExist:
             return Response({"success": False, "error": "Plugin not found"}, status=status.HTTP_404_NOT_FOUND)
 
 
+class PluginLogoAPIView(APIView):
+    def get_permissions(self):
+        return []
+
+    def get(self, request, key):
+        if not network_access_allowed(request, "UI"):
+            return Response({"success": False, "error": "Network access denied"}, status=status.HTTP_403_FORBIDDEN)
+        pm = PluginManager.get()
+        pm.discover_plugins(use_cache=True)
+        plugins_dir = pm.plugins_dir
+        logo_path = os.path.join(plugins_dir, key, "logo.png")
+        lp = pm.get_plugin(key)
+        if lp and getattr(lp, "path", None):
+            logo_path = os.path.join(lp.path, "logo.png")
+        abs_plugins = os.path.abspath(plugins_dir) + os.sep
+        abs_target = os.path.abspath(logo_path)
+        if not abs_target.startswith(abs_plugins):
+            return Response({"success": False, "error": "Invalid plugin path"}, status=status.HTTP_400_BAD_REQUEST)
+        if not os.path.isfile(logo_path):
+            return Response({"success": False, "error": "Logo not found"}, status=status.HTTP_404_NOT_FOUND)
+        return FileResponse(open(logo_path, "rb"), content_type="image/png")
+
+
 class PluginDeleteAPIView(APIView):
     def get_permissions(self):
         try:
@@ -280,6 +408,10 @@ class PluginDeleteAPIView(APIView):
 
     def delete(self, request, key):
         pm = PluginManager.get()
+        try:
+            pm.stop_plugin(key, reason="delete")
+        except Exception:
+            logger.exception("Failed to stop plugin '%s' before delete", key)
         plugins_dir = pm.plugins_dir
         target_dir = os.path.join(plugins_dir, key)
         # Safety: ensure path inside plugins_dir
@@ -302,5 +434,5 @@ class PluginDeleteAPIView(APIView):
             pass
 
         # Reload registry
-        pm.discover_plugins()
+        pm.discover_plugins(force_reload=True)
         return Response({"success": True})

apps/plugins/loader.py

@@ -1,8 +1,12 @@
 import importlib
+import importlib.util
 import json
 import logging
 import os
+import re
 import sys
+import threading
+import types
 from dataclasses import dataclass, field
 from typing import Any, Dict, List, Optional
 
@@ -19,10 +23,17 @@ class LoadedPlugin:
     name: str
     version: str = ""
     description: str = ""
+    author: str = ""
+    help_url: str = ""
     module: Any = None
     instance: Any = None
     fields: List[Dict[str, Any]] = field(default_factory=list)
     actions: List[Dict[str, Any]] = field(default_factory=list)
+    trusted: bool = False
+    loaded: bool = False
+    path: Optional[str] = None
+    folder_name: Optional[str] = None
+    legacy: bool = False
 
 
 class PluginManager:
@@ -39,70 +50,254 @@ class PluginManager:
     def __init__(self) -> None:
         self.plugins_dir = os.environ.get("DISPATCHARR_PLUGINS_DIR", "/data/plugins")
         self._registry: Dict[str, LoadedPlugin] = {}
+        self._package_names: Dict[str, str] = {}
+        self._alias_names: Dict[str, str] = {}
+        self._reload_token_path = os.path.join(self.plugins_dir, ".reload_token")
+        self._last_reload_token = 0.0
+        self._lock = threading.RLock()
 
         # Ensure plugins directory exists
         os.makedirs(self.plugins_dir, exist_ok=True)
         if self.plugins_dir not in sys.path:
             sys.path.append(self.plugins_dir)
 
-    def discover_plugins(self, *, sync_db: bool = True) -> Dict[str, LoadedPlugin]:
+    def discover_plugins(
+        self,
+        *,
+        sync_db: bool = True,
+        force_reload: bool = False,
+        use_cache: bool = False,
+    ) -> Dict[str, LoadedPlugin]:
+        token = self._get_reload_token()
+        if use_cache and not force_reload:
+            with self._lock:
+                if self._registry and token <= self._last_reload_token:
+                    return self._registry
+        if token > self._last_reload_token:
+            force_reload = True
+        if force_reload:
+            self._touch_reload_token()
+            token = self._get_reload_token()
+
         if sync_db:
             logger.info(f"Discovering plugins in {self.plugins_dir}")
         else:
             logger.debug(f"Discovering plugins (no DB sync) in {self.plugins_dir}")
-        self._registry.clear()
+
+        with self._lock:
+            previous_packages = dict(self._package_names)
+            previous_aliases = dict(self._alias_names)
+            previous_paths = {
+                key: lp.path for key, lp in self._registry.items() if lp and lp.path
+            }
 
         try:
+            configs: Optional[Dict[str, PluginConfig]] = None
+            try:
+                configs = {c.key: c for c in PluginConfig.objects.all()}
+            except Exception:
+                # DB might not be ready; treat all plugins as untrusted
+                configs = None
+
+            new_registry: Dict[str, LoadedPlugin] = {}
+            new_packages: Dict[str, str] = {}
+            new_aliases: Dict[str, str] = {}
             for entry in sorted(os.listdir(self.plugins_dir)):
                 path = os.path.join(self.plugins_dir, entry)
                 if not os.path.isdir(path):
                     continue
 
+                has_pkg = os.path.exists(os.path.join(path, "__init__.py"))
+                has_pluginpy = os.path.exists(os.path.join(path, "plugin.py"))
+                if not (has_pkg or has_pluginpy):
+                    continue
+
                 plugin_key = entry.replace(" ", "_").lower()
+                alias_name = self._resolve_alias_name(entry, path)
+
+                if force_reload:
+                    prev_alias = previous_aliases.get(plugin_key)
+                    if prev_alias:
+                        self._unload_alias(prev_alias)
+                    prev_path = previous_paths.get(plugin_key)
+                    if prev_path:
+                        self._unload_path_modules(prev_path)
+
+                cfg = configs.get(plugin_key) if configs else None
+                enabled = bool(cfg and cfg.enabled)
+                trusted = bool(cfg and (cfg.ever_enabled or cfg.enabled))
+
+                manifest, has_manifest = self._read_manifest(path)
+                legacy = not has_manifest
+                manifest_name = None
+                manifest_version = None
+                manifest_description = None
+                manifest_author = None
+                manifest_help_url = None
+                manifest_fields: List[Dict[str, Any]] = []
+                manifest_actions: List[Dict[str, Any]] = []
+                if has_manifest and isinstance(manifest, dict):
+                    manifest_name = manifest.get("name") if isinstance(manifest.get("name"), str) else None
+                    manifest_version = manifest.get("version") if isinstance(manifest.get("version"), str) else None
+                    manifest_description = manifest.get("description") if isinstance(manifest.get("description"), str) else None
+                    manifest_author = manifest.get("author") if isinstance(manifest.get("author"), str) else None
+                    manifest_help_url = manifest.get("help_url") if isinstance(manifest.get("help_url"), str) else None
+                    manifest_fields = self._normalize_fields(manifest.get("fields", []))
+                    manifest_actions = self._normalize_actions(manifest.get("actions", []))
+
+                display_name = manifest_name or entry
+                display_version = (
+                    manifest_version if manifest_version is not None else (cfg.version if cfg else "")
+                )
+                display_description = (
+                    manifest_description if manifest_description is not None else (cfg.description if cfg else "")
+                )
+
+                def _make_placeholder() -> LoadedPlugin:
+                    return LoadedPlugin(
+                        key=plugin_key,
+                        name=display_name,
+                        version=display_version,
+                        description=display_description,
+                        author=manifest_author or "",
+                        help_url=manifest_help_url or "",
+                        fields=manifest_fields if has_manifest else [],
+                        actions=manifest_actions if has_manifest else [],
+                        trusted=trusted,
+                        loaded=False,
+                        path=path,
+                        folder_name=entry,
+                        legacy=legacy,
+                    )
+
+                if not enabled:
+                    new_registry[plugin_key] = _make_placeholder()
+                    continue
 
                 try:
-                    self._load_plugin(plugin_key, path)
+                    lp, package_name = self._load_plugin(
+                        plugin_key,
+                        path,
+                        folder_name=entry,
+                        force_reload=force_reload,
+                        previous_package=previous_packages.get(plugin_key),
+                    )
+                    if lp:
+                        if manifest_name and (not lp.name or lp.name == plugin_key):
+                            lp.name = manifest_name
+                        if manifest_version is not None and not lp.version:
+                            lp.version = manifest_version
+                        if manifest_description is not None and not lp.description:
+                            lp.description = manifest_description
+                        if manifest_author is not None and not lp.author:
+                            lp.author = manifest_author
+                        if manifest_help_url is not None and not lp.help_url:
+                            lp.help_url = manifest_help_url
+                        if manifest_fields and not lp.fields:
+                            lp.fields = manifest_fields
+                        if manifest_actions and not lp.actions:
+                            lp.actions = manifest_actions
+                        lp.trusted = trusted
+                        lp.loaded = True
+                        lp.path = path
+                        lp.folder_name = entry
+                        lp.legacy = legacy
+                        new_registry[plugin_key] = lp
+                        if package_name:
+                            new_packages[plugin_key] = package_name
+                        if alias_name:
+                            new_aliases[plugin_key] = alias_name
+                    else:
+                        new_registry[plugin_key] = _make_placeholder()
                 except Exception:
                     logger.exception(f"Failed to load plugin '{plugin_key}' from {path}")
+                    new_registry[plugin_key] = _make_placeholder()
 
-            logger.info(f"Discovered {len(self._registry)} plugin(s)")
+            if force_reload:
+                # Remove stale modules for plugins that no longer exist
+                removed_keys = set(previous_packages.keys()) - set(new_packages.keys())
+                for key in removed_keys:
+                    self._unload_package(previous_packages[key])
+                    prev_alias = previous_aliases.get(key)
+                    if prev_alias:
+                        self._unload_alias(prev_alias)
+                    prev_path = previous_paths.get(key)
+                    if prev_path:
+                        self._unload_path_modules(prev_path)
+
+            with self._lock:
+                self._registry = new_registry
+                self._package_names = new_packages
+                self._alias_names = new_aliases
+                if token > self._last_reload_token:
+                    self._last_reload_token = token
+
+            logger.info(f"Discovered {len(new_registry)} plugin(s)")
         except FileNotFoundError:
             logger.warning(f"Plugins directory not found: {self.plugins_dir}")
 
         # Sync DB records (optional)
         if sync_db:
             try:
-                self._sync_db_with_registry()
+                self._sync_db_with_registry(new_registry if 'new_registry' in locals() else None)
             except Exception:
                 # Defer sync if database is not ready (e.g., first startup before migrate)
                 logger.exception("Deferring plugin DB sync; database not ready yet")
         return self._registry
 
-    def _load_plugin(self, key: str, path: str):
+    def _load_plugin(
+        self,
+        key: str,
+        path: str,
+        *,
+        folder_name: str,
+        force_reload: bool,
+        previous_package: Optional[str],
+    ) -> tuple[Optional[LoadedPlugin], Optional[str]]:
         # Plugin can be a package and/or contain plugin.py. Prefer plugin.py when present.
         has_pkg = os.path.exists(os.path.join(path, "__init__.py"))
         has_pluginpy = os.path.exists(os.path.join(path, "plugin.py"))
         if not (has_pkg or has_pluginpy):
             logger.debug(f"Skipping {path}: no plugin.py or package")
-            return
+            return None, None
 
-        candidate_modules = []
-        if has_pluginpy:
-            candidate_modules.append(f"{key}.plugin")
-        if has_pkg:
-            candidate_modules.append(key)
+        package_name = self._resolve_package_name(key)
+        alias_name = self._resolve_alias_name(folder_name, path)
+
+        if force_reload and previous_package:
+            self._unload_package(previous_package)
 
         module = None
         plugin_cls = None
         last_error = None
-        for module_name in candidate_modules:
+
+        # Ensure a package context exists for plugin.py (even without __init__.py)
+        if has_pluginpy:
+            self._ensure_namespace_package(package_name, path, alias=alias_name)
+
+            module_name = f"{package_name}.plugin"
+            plugin_path = os.path.join(path, "plugin.py")
             try:
-                logger.debug(f"Importing plugin module {module_name}")
-                module = importlib.import_module(module_name)
+                logger.debug(f"Importing plugin module {module_name} from {plugin_path}")
+                module = self._load_module_from_path(module_name, plugin_path, is_package=False)
+                if alias_name:
+                    self._register_alias_module(f"{alias_name}.plugin", module, path)
                 plugin_cls = getattr(module, "Plugin", None)
-                if plugin_cls is not None:
-                    break
-                else:
+                if plugin_cls is None:
+                    logger.warning(f"Module {module_name} has no Plugin class")
+            except Exception as e:
+                last_error = e
+                logger.exception(f"Error importing module {module_name}")
+
+        if plugin_cls is None and has_pkg:
+            module_name = package_name
+            init_path = os.path.join(path, "__init__.py")
+            try:
+                logger.debug(f"Importing plugin package {module_name} from {init_path}")
+                module = self._load_module_from_path(module_name, init_path, is_package=True)
+                self._register_alias_module(alias_name, module, path)
+                plugin_cls = getattr(module, "Plugin", None)
+                if plugin_cls is None:
                     logger.warning(f"Module {module_name} has no Plugin class")
             except Exception as e:
                 last_error = e
@@ -111,32 +306,43 @@ class PluginManager:
         if plugin_cls is None:
             if last_error:
                 raise last_error
-            else:
-                logger.warning(f"No Plugin class found for {key}; skipping")
-                return
+            logger.warning(f"No Plugin class found for {key}; skipping")
+            return None, package_name
 
         instance = plugin_cls()
 
         name = getattr(instance, "name", key)
         version = getattr(instance, "version", "")
         description = getattr(instance, "description", "")
+        author = getattr(instance, "author", "")
+        help_url = getattr(instance, "help_url", "")
         fields = getattr(instance, "fields", [])
         actions = getattr(instance, "actions", [])
+        fields = self._normalize_fields(fields)
+        actions = self._normalize_actions(actions)
 
-        self._registry[key] = LoadedPlugin(
+        lp = LoadedPlugin(
             key=key,
             name=name,
             version=version,
             description=description,
+            author=author or "",
+            help_url=help_url or "",
             module=module,
             instance=instance,
             fields=fields,
             actions=actions,
+            path=path,
+            folder_name=folder_name,
         )
+        return lp, package_name
 
-    def _sync_db_with_registry(self):
+    def _sync_db_with_registry(self, registry: Optional[Dict[str, LoadedPlugin]] = None):
+        if registry is None:
+            with self._lock:
+                registry = dict(self._registry)
         with transaction.atomic():
-            for key, lp in self._registry.items():
+            for key, lp in registry.items():
                 obj, _ = PluginConfig.objects.get_or_create(
                     key=key,
                     defaults={
@@ -164,6 +370,8 @@ class PluginManager:
         from .models import PluginConfig
 
         plugins: List[Dict[str, Any]] = []
+        with self._lock:
+            registry_snapshot = dict(self._registry)
         try:
             configs = {c.key: c for c in PluginConfig.objects.all()}
         except Exception as e:
@@ -172,25 +380,33 @@ class PluginManager:
             configs = {}
 
         # First, include all discovered plugins
-        for key, lp in self._registry.items():
+        for key, lp in registry_snapshot.items():
             conf = configs.get(key)
+            trusted = bool(conf and (conf.ever_enabled or conf.enabled))
+            logo_url = self._get_logo_url(key, path=lp.path)
             plugins.append(
                 {
                     "key": key,
                     "name": lp.name,
                     "version": lp.version,
                     "description": lp.description,
+                    "author": getattr(lp, "author", "") or "",
+                    "help_url": getattr(lp, "help_url", "") or "",
                     "enabled": conf.enabled if conf else False,
                     "ever_enabled": getattr(conf, "ever_enabled", False) if conf else False,
                     "fields": lp.fields or [],
                     "settings": (conf.settings if conf else {}),
                     "actions": lp.actions or [],
                     "missing": False,
+                    "trusted": trusted,
+                    "loaded": bool(lp.loaded),
+                    "legacy": bool(getattr(lp, "legacy", False)),
+                    "logo_url": logo_url,
                 }
             )
 
         # Then, include any DB-only configs (files missing or failed to load)
-        discovered_keys = set(self._registry.keys())
+        discovered_keys = set(registry_snapshot.keys())
         for key, conf in configs.items():
             if key in discovered_keys:
                 continue
@@ -200,19 +416,26 @@ class PluginManager:
                     "name": conf.name,
                     "version": conf.version,
                     "description": conf.description,
+                    "author": "",
+                    "help_url": "",
                     "enabled": conf.enabled,
                     "ever_enabled": getattr(conf, "ever_enabled", False),
                     "fields": [],
                     "settings": conf.settings or {},
                     "actions": [],
                     "missing": True,
+                    "trusted": bool(conf.ever_enabled or conf.enabled),
+                    "loaded": False,
+                    "legacy": False,
+                    "logo_url": self._get_logo_url(key),
                 }
             )
 
         return plugins
 
     def get_plugin(self, key: str) -> Optional[LoadedPlugin]:
-        return self._registry.get(key)
+        with self._lock:
+            return self._registry.get(key)
 
     def update_settings(self, key: str, settings: Dict[str, Any]) -> Dict[str, Any]:
         cfg = PluginConfig.objects.get(key=key)
@@ -223,19 +446,18 @@ class PluginManager:
     def run_action(self, key: str, action_id: str, params: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
         lp = self.get_plugin(key)
         if not lp or not lp.instance:
-            raise ValueError(f"Plugin '{key}' not found")
+            # Attempt a lightweight re-discovery in case the registry was rebuilt
+            self.discover_plugins(sync_db=False, force_reload=False, use_cache=False)
+            lp = self.get_plugin(key)
+            if not lp or not lp.instance:
+                raise ValueError(f"Plugin '{key}' not found")
 
         cfg = PluginConfig.objects.get(key=key)
         if not cfg.enabled:
             raise PermissionError(f"Plugin '{key}' is disabled")
         params = params or {}
 
-        # Provide a context object to the plugin
-        context = {
-            "settings": cfg.settings or {},
-            "logger": logger,
-            "actions": {a.get("id"): a for a in (lp.actions or [])},
-        }
+        context = self._build_context(lp, cfg)
 
         # Run either via Celery if plugin provides a delayed method, or inline
         run_method = getattr(lp.instance, "run", None)
@@ -252,3 +474,286 @@ class PluginManager:
         if isinstance(result, dict):
             return result
         return {"status": "ok", "result": result}
+
+    def stop_plugin(self, key: str, reason: Optional[str] = None) -> bool:
+        lp = self.get_plugin(key)
+        if not lp or not lp.instance:
+            return False
+        try:
+            cfg = PluginConfig.objects.get(key=key)
+        except PluginConfig.DoesNotExist:
+            return False
+        if not cfg.enabled:
+            return False
+
+        context = self._build_context(lp, cfg)
+        if reason:
+            context["reason"] = reason
+
+        stop_method = getattr(lp.instance, "stop", None)
+        if callable(stop_method):
+            try:
+                stop_method(context)
+                return True
+            except TypeError:
+                try:
+                    stop_method()
+                    return True
+                except Exception:
+                    logger.exception("Plugin '%s' stop() failed", key)
+                    return False
+            except Exception:
+                logger.exception("Plugin '%s' stop() failed", key)
+                return False
+
+        run_method = getattr(lp.instance, "run", None)
+        if callable(run_method):
+            actions = {a.get("id") for a in (lp.actions or []) if isinstance(a, dict)}
+            if "stop" in actions:
+                try:
+                    run_method("stop", {}, context)
+                    return True
+                except Exception:
+                    logger.exception("Plugin '%s' stop action failed", key)
+                    return False
+        return False
+
+    def stop_all_plugins(self, reason: Optional[str] = None) -> int:
+        stopped = 0
+        with self._lock:
+            registry_snapshot = dict(self._registry)
+        for key in registry_snapshot.keys():
+            if self.stop_plugin(key, reason=reason):
+                stopped += 1
+        return stopped
+
+    def _resolve_package_name(self, key: str) -> str:
+        safe_key = self._safe_module_name(key)
+        return f"_dispatcharr_plugin_{safe_key}"
+
+    def _resolve_alias_name(self, folder_name: str, path: str) -> Optional[str]:
+        if not self._is_valid_identifier(folder_name):
+            return None
+        if self._is_reserved_module_name(folder_name, path):
+            return None
+        return folder_name
+
+    def _is_valid_identifier(self, name: str) -> bool:
+        return re.match(r"^[A-Za-z_][A-Za-z0-9_]*$", name) is not None
+
+    def _safe_module_name(self, value: str) -> str:
+        safe = re.sub(r"[^0-9A-Za-z_]", "_", value)
+        if not safe or safe[0].isdigit():
+            safe = f"p_{safe}"
+        return safe
+
+    def _normalize_fields(self, fields: Any) -> List[Dict[str, Any]]:
+        try:
+            from .serializers import PluginFieldSerializer
+        except Exception:
+            return fields if isinstance(fields, list) else []
+        if not isinstance(fields, list):
+            return []
+        serializer = PluginFieldSerializer(data=fields, many=True)
+        if serializer.is_valid():
+            return serializer.validated_data
+        normalized: List[Dict[str, Any]] = []
+        for item in fields:
+            item_ser = PluginFieldSerializer(data=item)
+            if item_ser.is_valid():
+                normalized.append(item_ser.validated_data)
+            else:
+                logger.warning("Invalid plugin field entry ignored: %s", item_ser.errors)
+        return normalized
+
+    def _normalize_actions(self, actions: Any) -> List[Dict[str, Any]]:
+        try:
+            from .serializers import PluginActionSerializer
+        except Exception:
+            return actions if isinstance(actions, list) else []
+        if not isinstance(actions, list):
+            return []
+        serializer = PluginActionSerializer(data=actions, many=True)
+        if serializer.is_valid():
+            return serializer.validated_data
+        normalized: List[Dict[str, Any]] = []
+        for item in actions:
+            item_ser = PluginActionSerializer(data=item)
+            if item_ser.is_valid():
+                normalized.append(item_ser.validated_data)
+            else:
+                logger.warning("Invalid plugin action entry ignored: %s", item_ser.errors)
+        return normalized
+
+    def _merge_settings_with_defaults(self, settings: Dict[str, Any], fields: List[Dict[str, Any]]) -> Dict[str, Any]:
+        merged = dict(settings or {})
+        for field_def in fields or []:
+            field_id = field_def.get("id")
+            if not field_id:
+                continue
+            if field_id not in merged and "default" in field_def:
+                merged[field_id] = field_def.get("default")
+        return merged
+
+    def _build_context(self, lp: LoadedPlugin, cfg: PluginConfig) -> Dict[str, Any]:
+        settings = self._merge_settings_with_defaults(cfg.settings or {}, lp.fields or [])
+        return {
+            "settings": settings,
+            "logger": logger,
+            "actions": {a.get("id"): a for a in (lp.actions or [])},
+        }
+
+    def _read_manifest(self, path: str) -> tuple[Optional[Dict[str, Any]], bool]:
+        manifest_path = os.path.join(path, "plugin.json")
+        if not os.path.isfile(manifest_path):
+            return None, False
+        try:
+            with open(manifest_path, "r", encoding="utf-8") as fh:
+                data = json.load(fh)
+        except Exception:
+            logger.warning("Invalid plugin.json for plugin at %s", path)
+            return None, False
+        if not isinstance(data, dict):
+            logger.warning("plugin.json must be an object for plugin at %s", path)
+            return None, False
+        return data, True
+
+    def _get_logo_url(self, key: str, *, path: Optional[str] = None) -> Optional[str]:
+        logo_path = os.path.join(self.plugins_dir, key, "logo.png")
+        if path:
+            logo_path = os.path.join(path, "logo.png")
+        try:
+            if os.path.isfile(logo_path):
+                return f"/api/plugins/plugins/{key}/logo/"
+        except Exception:
+            return None
+        return None
+
+    def _ensure_namespace_package(self, package_name: str, path: str, *, alias: Optional[str] = None) -> None:
+        existing = sys.modules.get(package_name)
+        if existing and getattr(existing, "__path__", None):
+            return
+        pkg = types.ModuleType(package_name)
+        pkg.__path__ = [path]
+        pkg.__package__ = package_name
+        sys.modules[package_name] = pkg
+        self._register_alias_module(alias, pkg, path)
+
+    def _register_alias_module(
+        self,
+        alias_name: Optional[str],
+        module: Any,
+        path: str,
+        *,
+        force: bool = False,
+    ) -> None:
+        if not alias_name:
+            return
+        if self._is_reserved_module_name(alias_name, path):
+            return
+        if alias_name in sys.modules:
+            if not force:
+                return
+            self._unload_alias(alias_name)
+        sys.modules[alias_name] = module
+
+    def _is_reserved_module_name(self, name: str, path: str) -> bool:
+        if name in sys.builtin_module_names:
+            return True
+        if hasattr(sys, "stdlib_module_names") and name in sys.stdlib_module_names:
+            return True
+        existing = sys.modules.get(name)
+        if existing:
+            origin = getattr(existing, "__file__", None)
+            if origin is None:
+                return True
+            try:
+                if not os.path.abspath(origin).startswith(os.path.abspath(path)):
+                    return True
+            except Exception:
+                return True
+        try:
+            spec = importlib.util.find_spec(name)
+        except Exception:
+            spec = None
+        if spec:
+            if spec.origin is None:
+                return True
+            try:
+                if not os.path.abspath(spec.origin).startswith(os.path.abspath(path)):
+                    return True
+            except Exception:
+                return True
+        return False
+
+    def _load_module_from_path(self, module_name: str, path: str, *, is_package: bool) -> Any:
+        importlib.invalidate_caches()
+        spec = importlib.util.spec_from_file_location(
+            module_name,
+            path,
+            submodule_search_locations=[os.path.dirname(path)] if is_package else None,
+        )
+        if spec is None or spec.loader is None:
+            raise ImportError(f"Could not load spec for {module_name} from {path}")
+        module = importlib.util.module_from_spec(spec)
+        sys.modules[module_name] = module
+        spec.loader.exec_module(module)
+        return module
+
+    def _get_reload_token(self) -> float:
+        try:
+            return os.path.getmtime(self._reload_token_path)
+        except FileNotFoundError:
+            return 0.0
+        except Exception:
+            return 0.0
+
+    def _touch_reload_token(self) -> None:
+        try:
+            os.makedirs(self.plugins_dir, exist_ok=True)
+            with open(self._reload_token_path, "a", encoding="utf-8"):
+                pass
+            os.utime(self._reload_token_path, None)
+        except Exception:
+            logger.debug("Failed to update plugin reload token", exc_info=True)
+
+    def _unload_package(self, package_name: str) -> None:
+        if not package_name:
+            return
+        for name in list(sys.modules.keys()):
+            if name == package_name or name.startswith(f"{package_name}."):
+                sys.modules.pop(name, None)
+
+    def _unload_alias(self, alias_name: str) -> None:
+        if not alias_name:
+            return
+        for name in list(sys.modules.keys()):
+            if name == alias_name or name.startswith(f"{alias_name}."):
+                sys.modules.pop(name, None)
+
+    def _unload_path_modules(self, path: str) -> None:
+        if not path:
+            return
+        root = os.path.abspath(path)
+        for name, module in list(sys.modules.items()):
+            if not module:
+                continue
+            mod_path = getattr(module, "__file__", None)
+            if mod_path:
+                try:
+                    abs_path = os.path.abspath(mod_path)
+                    if abs_path == root or abs_path.startswith(f"{root}{os.sep}"):
+                        sys.modules.pop(name, None)
+                        continue
+                except Exception:
+                    pass
+            mod_paths = getattr(module, "__path__", None)
+            if mod_paths:
+                try:
+                    for pkg_path in mod_paths:
+                        abs_pkg = os.path.abspath(pkg_path)
+                        if abs_pkg == root or abs_pkg.startswith(f"{root}{os.sep}"):
+                            sys.modules.pop(name, None)
+                            break
+                except Exception:
+                    continue

apps/plugins/serializers.py

@@ -5,15 +5,34 @@ class PluginActionSerializer(serializers.Serializer):
     id = serializers.CharField()
     label = serializers.CharField()
     description = serializers.CharField(required=False, allow_blank=True)
+    confirm = serializers.JSONField(required=False)
+    button_label = serializers.CharField(required=False, allow_blank=True)
+    button_variant = serializers.CharField(required=False, allow_blank=True)
+    button_color = serializers.CharField(required=False, allow_blank=True)
+    events = serializers.ListField(
+        child=serializers.CharField(), required=False, allow_empty=True
+    )
+
+
+class PluginFieldOptionSerializer(serializers.Serializer):
+    value = serializers.CharField()
+    label = serializers.CharField()
 
 
 class PluginFieldSerializer(serializers.Serializer):
     id = serializers.CharField()
-    label = serializers.CharField()
-    type = serializers.ChoiceField(choices=["string", "number", "boolean", "select"])  # simple types
+    label = serializers.CharField(required=False, allow_blank=True)
+    type = serializers.ChoiceField(choices=["string", "number", "boolean", "select", "text", "info"])
     default = serializers.JSONField(required=False)
     help_text = serializers.CharField(required=False, allow_blank=True)
-    options = serializers.ListField(child=serializers.DictField(), required=False)
+    description = serializers.CharField(required=False, allow_blank=True)
+    placeholder = serializers.CharField(required=False, allow_blank=True)
+    input_type = serializers.CharField(required=False, allow_blank=True)
+    min = serializers.FloatField(required=False)
+    max = serializers.FloatField(required=False)
+    step = serializers.FloatField(required=False)
+    value = serializers.CharField(required=False, allow_blank=True)
+    options = PluginFieldOptionSerializer(many=True, required=False)
 
 
 class PluginSerializer(serializers.Serializer):
@@ -21,8 +40,9 @@ class PluginSerializer(serializers.Serializer):
     name = serializers.CharField()
     version = serializers.CharField(allow_blank=True)
     description = serializers.CharField(allow_blank=True)
+    author = serializers.CharField(required=False, allow_blank=True)
+    help_url = serializers.CharField(required=False, allow_blank=True)
     enabled = serializers.BooleanField()
     fields = PluginFieldSerializer(many=True)
     settings = serializers.JSONField()
     actions = PluginActionSerializer(many=True)
-

apps/proxy/ts_proxy/client_manager.py

@@ -46,9 +46,11 @@ class ClientManager:
             # Import here to avoid potential import issues
             from apps.proxy.ts_proxy.channel_status import ChannelStatus
             import redis
+            from django.conf import settings
 
-            # Get all channels from Redis
-            redis_client = redis.Redis.from_url('redis://localhost:6379', decode_responses=True)
+            # Get all channels from Redis using settings
+            redis_url = getattr(settings, 'REDIS_URL', 'redis://localhost:6379/0')
+            redis_client = redis.Redis.from_url(redis_url, decode_responses=True)
             all_channels = []
             cursor = 0
 

apps/proxy/ts_proxy/server.py

@@ -149,11 +149,15 @@ class ProxyServer:
                         redis_host = os.environ.get("REDIS_HOST", getattr(settings, 'REDIS_HOST', 'localhost'))
                         redis_port = int(os.environ.get("REDIS_PORT", getattr(settings, 'REDIS_PORT', 6379)))
                         redis_db = int(os.environ.get("REDIS_DB", getattr(settings, 'REDIS_DB', 0)))
+                        redis_password = os.environ.get("REDIS_PASSWORD", getattr(settings, 'REDIS_PASSWORD', ''))
+                        redis_user = os.environ.get("REDIS_USER", getattr(settings, 'REDIS_USER', ''))
 
                         pubsub_client = redis.Redis(
                             host=redis_host,
                             port=redis_port,
                             db=redis_db,
+                            password=redis_password if redis_password else None,
+                            username=redis_user if redis_user else None,
                             socket_timeout=60,
                             socket_connect_timeout=10,
                             socket_keepalive=True,

apps/proxy/ts_proxy/services/channel_service.py

@@ -15,6 +15,7 @@ from ..redis_keys import RedisKeys
 from ..constants import EventType, ChannelState, ChannelMetadataField
 from ..url_utils import get_stream_info_for_switch
 from core.utils import log_system_event
+from .log_parsers import LogParserFactory
 
 logger = logging.getLogger("ts_proxy")
 
@@ -419,124 +420,51 @@ class ChannelService:
 
     @staticmethod
     def parse_and_store_stream_info(channel_id, stream_info_line, stream_type="video", stream_id=None):
-        """Parse FFmpeg stream info line and store in Redis metadata and database"""
+        """
+        Parse stream info from FFmpeg/VLC/Streamlink logs and store in Redis/DB.
+        Uses specialized parsers for each streaming tool.
+        """
         try:
-            if stream_type == "input":
-                # Example lines:
-                # Input #0, mpegts, from 'http://example.com/stream.ts':
-                # Input #0, hls, from 'http://example.com/stream.m3u8':
+            # Use factory to parse the line based on stream type
+            parsed_data = LogParserFactory.parse(stream_type, stream_info_line)
+            
+            if not parsed_data:
+                return
 
-                # Extract input format (e.g., "mpegts", "hls", "flv", etc.)
-                input_match = re.search(r'Input #\d+,\s*([^,]+)', stream_info_line)
-                input_format = input_match.group(1).strip() if input_match else None
+            # Update Redis and database with parsed data
+            ChannelService._update_stream_info_in_redis(
+                channel_id, 
+                parsed_data.get('video_codec'),
+                parsed_data.get('resolution'),
+                parsed_data.get('width'),
+                parsed_data.get('height'),
+                parsed_data.get('source_fps'),
+                parsed_data.get('pixel_format'),
+                parsed_data.get('video_bitrate'),
+                parsed_data.get('audio_codec'),
+                parsed_data.get('sample_rate'),
+                parsed_data.get('audio_channels'),
+                parsed_data.get('audio_bitrate'),
+                parsed_data.get('stream_type')
+            )
 
-                # Store in Redis if we have valid data
-                if input_format:
-                    ChannelService._update_stream_info_in_redis(channel_id, None, None, None, None, None, None, None, None, None, None, None, input_format)
-                    # Save to database if stream_id is provided
-                    if stream_id:
-                        ChannelService._update_stream_stats_in_db(stream_id, stream_type=input_format)
-
-                logger.debug(f"Input format info - Format: {input_format} for channel {channel_id}")
-
-            elif stream_type == "video":
-                # Example line:
-                # Stream #0:0: Video: h264 (Main), yuv420p(tv, progressive), 1280x720 [SAR 1:1 DAR 16:9], q=2-31, 2000 kb/s, 29.97 fps, 90k tbn
-
-                # Extract video codec (e.g., "h264", "mpeg2video", etc.)
-                codec_match = re.search(r'Video:\s*([a-zA-Z0-9_]+)', stream_info_line)
-                video_codec = codec_match.group(1) if codec_match else None
-
-                # Extract resolution (e.g., "1280x720") - be more specific to avoid hex values
-                # Look for resolution patterns that are realistic video dimensions
-                resolution_match = re.search(r'\b(\d{3,5})x(\d{3,5})\b', stream_info_line)
-                if resolution_match:
-                    width = int(resolution_match.group(1))
-                    height = int(resolution_match.group(2))
-                    # Validate that these look like reasonable video dimensions
-                    if 100 <= width <= 10000 and 100 <= height <= 10000:
-                        resolution = f"{width}x{height}"
-                    else:
-                        width = height = resolution = None
-                else:
-                    width = height = resolution = None
-
-                # Extract source FPS (e.g., "29.97 fps")
-                fps_match = re.search(r'(\d+(?:\.\d+)?)\s*fps', stream_info_line)
-                source_fps = float(fps_match.group(1)) if fps_match else None
-
-                # Extract pixel format (e.g., "yuv420p")
-                pixel_format_match = re.search(r'Video:\s*[^,]+,\s*([^,(]+)', stream_info_line)
-                pixel_format = None
-                if pixel_format_match:
-                    pf = pixel_format_match.group(1).strip()
-                    # Clean up pixel format (remove extra info in parentheses)
-                    if '(' in pf:
-                        pf = pf.split('(')[0].strip()
-                    pixel_format = pf
-
-                # Extract bitrate if present (e.g., "2000 kb/s")
-                video_bitrate = None
-                bitrate_match = re.search(r'(\d+(?:\.\d+)?)\s*kb/s', stream_info_line)
-                if bitrate_match:
-                    video_bitrate = float(bitrate_match.group(1))
-
-                # Store in Redis if we have valid data
-                if any(x is not None for x in [video_codec, resolution, source_fps, pixel_format, video_bitrate]):
-                    ChannelService._update_stream_info_in_redis(channel_id, video_codec, resolution, width, height, source_fps, pixel_format, video_bitrate, None, None, None, None, None)
-                    # Save to database if stream_id is provided
-                    if stream_id:
-                        ChannelService._update_stream_stats_in_db(
-                            stream_id,
-                            video_codec=video_codec,
-                            resolution=resolution,
-                            source_fps=source_fps,
-                            pixel_format=pixel_format,
-                            video_bitrate=video_bitrate
-                        )
-
-                logger.info(f"Video stream info - Codec: {video_codec}, Resolution: {resolution}, "
-                           f"Source FPS: {source_fps}, Pixel Format: {pixel_format}, "
-                           f"Video Bitrate: {video_bitrate} kb/s")
-
-            elif stream_type == "audio":
-                # Example line:
-                # Stream #0:1[0x101]: Audio: aac (LC) ([15][0][0][0] / 0x000F), 48000 Hz, stereo, fltp, 64 kb/s
-
-                # Extract audio codec (e.g., "aac", "mp3", etc.)
-                codec_match = re.search(r'Audio:\s*([a-zA-Z0-9_]+)', stream_info_line)
-                audio_codec = codec_match.group(1) if codec_match else None
-
-                # Extract sample rate (e.g., "48000 Hz")
-                sample_rate_match = re.search(r'(\d+)\s*Hz', stream_info_line)
-                sample_rate = int(sample_rate_match.group(1)) if sample_rate_match else None
-
-                # Extract channel layout (e.g., "stereo", "5.1", "mono")
-                # Look for common channel layouts
-                channel_match = re.search(r'\b(mono|stereo|5\.1|7\.1|quad|2\.1)\b', stream_info_line, re.IGNORECASE)
-                channels = channel_match.group(1) if channel_match else None
-
-                # Extract audio bitrate if present (e.g., "64 kb/s")
-                audio_bitrate = None
-                bitrate_match = re.search(r'(\d+(?:\.\d+)?)\s*kb/s', stream_info_line)
-                if bitrate_match:
-                    audio_bitrate = float(bitrate_match.group(1))
-
-                # Store in Redis if we have valid data
-                if any(x is not None for x in [audio_codec, sample_rate, channels, audio_bitrate]):
-                    ChannelService._update_stream_info_in_redis(channel_id, None, None, None, None, None, None, None, audio_codec, sample_rate, channels, audio_bitrate, None)
-                    # Save to database if stream_id is provided
-                    if stream_id:
-                        ChannelService._update_stream_stats_in_db(
-                            stream_id,
-                            audio_codec=audio_codec,
-                            sample_rate=sample_rate,
-                            audio_channels=channels,
-                            audio_bitrate=audio_bitrate
-                        )
+            if stream_id:
+                ChannelService._update_stream_stats_in_db(
+                    stream_id,
+                    video_codec=parsed_data.get('video_codec'),
+                    resolution=parsed_data.get('resolution'),
+                    source_fps=parsed_data.get('source_fps'),
+                    pixel_format=parsed_data.get('pixel_format'),
+                    video_bitrate=parsed_data.get('video_bitrate'),
+                    audio_codec=parsed_data.get('audio_codec'),
+                    sample_rate=parsed_data.get('sample_rate'),
+                    audio_channels=parsed_data.get('audio_channels'),
+                    audio_bitrate=parsed_data.get('audio_bitrate'),
+                    stream_type=parsed_data.get('stream_type')
+                )
 
         except Exception as e:
-            logger.debug(f"Error parsing FFmpeg {stream_type} stream info: {e}")
+            logger.debug(f"Error parsing {stream_type} stream info: {e}")
 
     @staticmethod
     def _update_stream_info_in_redis(channel_id, codec, resolution, width, height, fps, pixel_format, video_bitrate, audio_codec=None, sample_rate=None, channels=None, audio_bitrate=None, input_format=None):

apps/proxy/ts_proxy/services/log_parsers.py

@@ -0,0 +1,410 @@
+"""Log parsers for FFmpeg, Streamlink, and VLC output."""
+import re
+import logging
+from abc import ABC, abstractmethod
+from typing import Optional, Dict, Any
+
+logger = logging.getLogger(__name__)
+
+
+class BaseLogParser(ABC):
+    """Base class for log parsers"""
+    
+    # Map of stream_type -> method_name that this parser handles
+    STREAM_TYPE_METHODS: Dict[str, str] = {}
+
+    @abstractmethod
+    def can_parse(self, line: str) -> Optional[str]:
+        """
+        Check if this parser can handle the line.
+        Returns the stream_type if it can parse, None otherwise.
+        e.g., 'video', 'audio', 'vlc_video', 'vlc_audio', 'streamlink'
+        """
+        pass
+
+    @abstractmethod
+    def parse_input_format(self, line: str) -> Optional[Dict[str, Any]]:
+        pass
+
+    @abstractmethod
+    def parse_video_stream(self, line: str) -> Optional[Dict[str, Any]]:
+        pass
+
+    @abstractmethod
+    def parse_audio_stream(self, line: str) -> Optional[Dict[str, Any]]:
+        pass
+
+
+class FFmpegLogParser(BaseLogParser):
+    """Parser for FFmpeg log output"""
+    
+    STREAM_TYPE_METHODS = {
+        'input': 'parse_input_format',
+        'video': 'parse_video_stream',
+        'audio': 'parse_audio_stream'
+    }
+
+    def can_parse(self, line: str) -> Optional[str]:
+        """Check if this is an FFmpeg line we can parse"""
+        lower = line.lower()
+        
+        # Input format detection
+        if lower.startswith('input #'):
+            return 'input'
+        
+        # Stream info (only during input phase, but we'll let stream_manager handle phase tracking)
+        if 'stream #' in lower:
+            if 'video:' in lower:
+                return 'video'
+            elif 'audio:' in lower:
+                return 'audio'
+        
+        return None
+
+    def parse_input_format(self, line: str) -> Optional[Dict[str, Any]]:
+        """Parse FFmpeg input format (e.g., mpegts, hls)"""
+        try:
+            input_match = re.search(r'Input #\d+,\s*([^,]+)', line)
+            input_format = input_match.group(1).strip() if input_match else None
+
+            if input_format:
+                logger.debug(f"Input format info - Format: {input_format}")
+                return {'stream_type': input_format}
+        except Exception as e:
+            logger.debug(f"Error parsing FFmpeg input format: {e}")
+        
+        return None
+
+    def parse_video_stream(self, line: str) -> Optional[Dict[str, Any]]:
+        """Parse FFmpeg video stream info"""
+        try:
+            result = {}
+
+            # Extract codec, resolution, fps, pixel format, bitrate
+            codec_match = re.search(r'Video:\s*([a-zA-Z0-9_]+)', line)
+            if codec_match:
+                result['video_codec'] = codec_match.group(1)
+
+            resolution_match = re.search(r'\b(\d{3,5})x(\d{3,5})\b', line)
+            if resolution_match:
+                width = int(resolution_match.group(1))
+                height = int(resolution_match.group(2))
+                if 100 <= width <= 10000 and 100 <= height <= 10000:
+                    result['resolution'] = f"{width}x{height}"
+                    result['width'] = width
+                    result['height'] = height
+
+            fps_match = re.search(r'(\d+(?:\.\d+)?)\s*fps', line)
+            if fps_match:
+                result['source_fps'] = float(fps_match.group(1))
+
+            pixel_format_match = re.search(r'Video:\s*[^,]+,\s*([^,(]+)', line)
+            if pixel_format_match:
+                pf = pixel_format_match.group(1).strip()
+                if '(' in pf:
+                    pf = pf.split('(')[0].strip()
+                result['pixel_format'] = pf
+
+            bitrate_match = re.search(r'(\d+(?:\.\d+)?)\s*kb/s', line)
+            if bitrate_match:
+                result['video_bitrate'] = float(bitrate_match.group(1))
+
+            if result:
+                logger.info(f"Video stream info - Codec: {result.get('video_codec')}, "
+                           f"Resolution: {result.get('resolution')}, "
+                           f"Source FPS: {result.get('source_fps')}, "
+                           f"Pixel Format: {result.get('pixel_format')}, "
+                           f"Video Bitrate: {result.get('video_bitrate')} kb/s")
+                return result
+
+        except Exception as e:
+            logger.debug(f"Error parsing FFmpeg video stream info: {e}")
+
+        return None
+
+    def parse_audio_stream(self, line: str) -> Optional[Dict[str, Any]]:
+        """Parse FFmpeg audio stream info"""
+        try:
+            result = {}
+
+            codec_match = re.search(r'Audio:\s*([a-zA-Z0-9_]+)', line)
+            if codec_match:
+                result['audio_codec'] = codec_match.group(1)
+
+            sample_rate_match = re.search(r'(\d+)\s*Hz', line)
+            if sample_rate_match:
+                result['sample_rate'] = int(sample_rate_match.group(1))
+
+            channel_match = re.search(r'\b(mono|stereo|5\.1|7\.1|quad|2\.1)\b', line, re.IGNORECASE)
+            if channel_match:
+                result['audio_channels'] = channel_match.group(1)
+
+            bitrate_match = re.search(r'(\d+(?:\.\d+)?)\s*kb/s', line)
+            if bitrate_match:
+                result['audio_bitrate'] = float(bitrate_match.group(1))
+
+            if result:
+                return result
+
+        except Exception as e:
+            logger.debug(f"Error parsing FFmpeg audio stream info: {e}")
+
+        return None
+
+
+class VLCLogParser(BaseLogParser):
+    """Parser for VLC log output"""
+    
+    STREAM_TYPE_METHODS = {
+        'vlc_video': 'parse_video_stream',
+        'vlc_audio': 'parse_audio_stream'
+    }
+
+    def can_parse(self, line: str) -> Optional[str]:
+        """Check if this is a VLC line we can parse"""
+        lower = line.lower()
+        
+        # VLC TS demux codec detection
+        if 'ts demux debug' in lower and 'type=' in lower:
+            if 'video' in lower:
+                return 'vlc_video'
+            elif 'audio' in lower:
+                return 'vlc_audio'
+        
+        # VLC decoder output
+        if 'decoder' in lower and ('channels:' in lower or 'samplerate:' in lower or 'x' in line or 'fps' in lower):
+            if 'audio' in lower or 'channels:' in lower or 'samplerate:' in lower:
+                return 'vlc_audio'
+            else:
+                return 'vlc_video'
+        
+        # VLC transcode output for resolution/FPS
+        if 'stream_out_transcode' in lower and ('source fps' in lower or ('source ' in lower and 'x' in line)):
+            return 'vlc_video'
+        
+        return None
+
+    def parse_input_format(self, line: str) -> Optional[Dict[str, Any]]:
+        return None
+
+    def parse_video_stream(self, line: str) -> Optional[Dict[str, Any]]:
+        """Parse VLC TS demux output and decoder info for video"""
+        try:
+            lower = line.lower()
+            result = {}
+            
+            # Codec detection from TS demux
+            video_codec_map = {
+                ('avc', 'h.264', 'type=0x1b'): "h264",
+                ('hevc', 'h.265', 'type=0x24'): "hevc",
+                ('mpeg-2', 'type=0x02'): "mpeg2video",
+                ('mpeg-4', 'type=0x10'): "mpeg4"
+            }
+            
+            for patterns, codec in video_codec_map.items():
+                if any(p in lower for p in patterns):
+                    result['video_codec'] = codec
+                    break
+            
+            # Extract FPS from transcode output: "source fps 30/1"
+            fps_fraction_match = re.search(r'source fps\s+(\d+)/(\d+)', lower)
+            if fps_fraction_match:
+                numerator = int(fps_fraction_match.group(1))
+                denominator = int(fps_fraction_match.group(2))
+                if denominator > 0:
+                    result['source_fps'] = numerator / denominator
+            
+            # Extract resolution from transcode output: "source 1280x720"
+            source_res_match = re.search(r'source\s+(\d{3,4})x(\d{3,4})', lower)
+            if source_res_match:
+                width = int(source_res_match.group(1))
+                height = int(source_res_match.group(2))
+                if 100 <= width <= 10000 and 100 <= height <= 10000:
+                    result['resolution'] = f"{width}x{height}"
+                    result['width'] = width
+                    result['height'] = height
+            else:
+                # Fallback: generic resolution pattern
+                resolution_match = re.search(r'(\d{3,4})x(\d{3,4})', line)
+                if resolution_match:
+                    width = int(resolution_match.group(1))
+                    height = int(resolution_match.group(2))
+                    if 100 <= width <= 10000 and 100 <= height <= 10000:
+                        result['resolution'] = f"{width}x{height}"
+                        result['width'] = width
+                        result['height'] = height
+            
+            # Fallback: try to extract FPS from generic format
+            if 'source_fps' not in result:
+                fps_match = re.search(r'(\d+\.?\d*)\s*fps', lower)
+                if fps_match:
+                    result['source_fps'] = float(fps_match.group(1))
+            
+            return result if result else None
+
+        except Exception as e:
+            logger.debug(f"Error parsing VLC video stream info: {e}")
+
+        return None
+
+    def parse_audio_stream(self, line: str) -> Optional[Dict[str, Any]]:
+        """Parse VLC TS demux output and decoder info for audio"""
+        try:
+            lower = line.lower()
+            result = {}
+            
+            # Codec detection from TS demux
+            audio_codec_map = {
+                ('type=0xf', 'adts'): "aac",
+                ('type=0x03', 'type=0x04'): "mp3",
+                ('type=0x06', 'type=0x81'): "ac3",
+                ('type=0x0b', 'lpcm'): "pcm"
+            }
+            
+            for patterns, codec in audio_codec_map.items():
+                if any(p in lower for p in patterns):
+                    result['audio_codec'] = codec
+                    break
+            
+            # VLC decoder format: "AAC channels: 2 samplerate: 48000"
+            if 'channels:' in lower:
+                channels_match = re.search(r'channels:\s*(\d+)', lower)
+                if channels_match:
+                    num_channels = int(channels_match.group(1))
+                    # Convert number to name
+                    channel_names = {1: 'mono', 2: 'stereo', 6: '5.1', 8: '7.1'}
+                    result['audio_channels'] = channel_names.get(num_channels, str(num_channels))
+            
+            if 'samplerate:' in lower:
+                samplerate_match = re.search(r'samplerate:\s*(\d+)', lower)
+                if samplerate_match:
+                    result['sample_rate'] = int(samplerate_match.group(1))
+            
+            # Try to extract sample rate (Hz format)
+            sample_rate_match = re.search(r'(\d+)\s*hz', lower)
+            if sample_rate_match and 'sample_rate' not in result:
+                result['sample_rate'] = int(sample_rate_match.group(1))
+            
+            # Try to extract channels (word format)
+            if 'audio_channels' not in result:
+                channel_match = re.search(r'\b(mono|stereo|5\.1|7\.1|quad|2\.1)\b', lower)
+                if channel_match:
+                    result['audio_channels'] = channel_match.group(1)
+            
+            return result if result else None
+
+        except Exception as e:
+            logger.error(f"[VLC AUDIO PARSER] Error parsing VLC audio stream info: {e}")
+
+        return None
+
+
+class StreamlinkLogParser(BaseLogParser):
+    """Parser for Streamlink log output"""
+    
+    STREAM_TYPE_METHODS = {
+        'streamlink': 'parse_video_stream'
+    }
+
+    def can_parse(self, line: str) -> Optional[str]:
+        """Check if this is a Streamlink line we can parse"""
+        lower = line.lower()
+        
+        if 'opening stream:' in lower or 'available streams:' in lower:
+            return 'streamlink'
+        
+        return None
+
+    def parse_input_format(self, line: str) -> Optional[Dict[str, Any]]:
+        return None
+
+    def parse_video_stream(self, line: str) -> Optional[Dict[str, Any]]:
+        """Parse Streamlink quality/resolution"""
+        try:
+            quality_match = re.search(r'(\d+p|\d+x\d+)', line)
+            if quality_match:
+                quality = quality_match.group(1)
+                
+                if 'x' in quality:
+                    resolution = quality
+                    width, height = map(int, quality.split('x'))
+                else:
+                    resolutions = {
+                        '2160p': ('3840x2160', 3840, 2160),
+                        '1080p': ('1920x1080', 1920, 1080),
+                        '720p': ('1280x720', 1280, 720),
+                        '480p': ('854x480', 854, 480),
+                        '360p': ('640x360', 640, 360)
+                    }
+                    resolution, width, height = resolutions.get(quality, ('1920x1080', 1920, 1080))
+                
+                return {
+                    'video_codec': 'h264',
+                    'resolution': resolution,
+                    'width': width,
+                    'height': height,
+                    'pixel_format': 'yuv420p'
+                }
+
+        except Exception as e:
+            logger.debug(f"Error parsing Streamlink video info: {e}")
+
+        return None
+
+    def parse_audio_stream(self, line: str) -> Optional[Dict[str, Any]]:
+        return None
+
+
+class LogParserFactory:
+    """Factory to get the appropriate log parser"""
+
+    _parsers = {
+        'ffmpeg': FFmpegLogParser(),
+        'vlc': VLCLogParser(),
+        'streamlink': StreamlinkLogParser()
+    }
+
+    @classmethod
+    def _get_parser_and_method(cls, stream_type: str) -> Optional[tuple[BaseLogParser, str]]:
+        """Determine parser and method from stream_type"""
+        # Check each parser to see if it handles this stream_type
+        for parser in cls._parsers.values():
+            method_name = parser.STREAM_TYPE_METHODS.get(stream_type)
+            if method_name:
+                return (parser, method_name)
+        
+        return None
+
+    @classmethod
+    def parse(cls, stream_type: str, line: str) -> Optional[Dict[str, Any]]:
+        """
+        Parse a log line based on stream type.
+        Returns parsed data or None if parsing fails.
+        """
+        result = cls._get_parser_and_method(stream_type)
+        if not result:
+            return None
+        
+        parser, method_name = result
+        method = getattr(parser, method_name, None)
+        if method:
+            return method(line)
+        
+        return None
+
+    @classmethod
+    def auto_parse(cls, line: str) -> Optional[tuple[str, Dict[str, Any]]]:
+        """
+        Automatically detect which parser can handle this line and parse it.
+        Returns (stream_type, parsed_data) or None if no parser can handle it.
+        """
+        # Try each parser to see if it can handle this line
+        for parser in cls._parsers.values():
+            stream_type = parser.can_parse(line)
+            if stream_type:
+                # Parser can handle this line, now parse it
+                parsed_data = cls.parse(stream_type, line)
+                if parsed_data:
+                    return (stream_type, parsed_data)
+        
+        return None

apps/proxy/ts_proxy/stream_manager.py

@@ -107,6 +107,10 @@ class StreamManager:
         # Add this flag for tracking transcoding process status
         self.transcode_process_active = False
 
+        # Track stream command for efficient log parser routing
+        self.stream_command = None
+        self.parser_type = None  # Will be set when transcode process starts
+
         # Add tracking for data throughput
         self.bytes_processed = 0
         self.last_bytes_update = time.time()
@@ -476,6 +480,21 @@ class StreamManager:
             # Build and start transcode command
             self.transcode_cmd = stream_profile.build_command(self.url, self.user_agent)
 
+            # Store stream command for efficient log parser routing
+            self.stream_command = stream_profile.command
+            # Map actual commands to parser types for direct routing
+            command_to_parser = {
+                'ffmpeg': 'ffmpeg',
+                'cvlc': 'vlc',
+                'vlc': 'vlc',
+                'streamlink': 'streamlink'
+            }
+            self.parser_type = command_to_parser.get(self.stream_command.lower())
+            if self.parser_type:
+                logger.debug(f"Using {self.parser_type} parser for log parsing (command: {self.stream_command})")
+            else:
+                logger.debug(f"Unknown stream command '{self.stream_command}', will use auto-detection for log parsing")
+
             # For UDP streams, remove any user_agent parameters from the command
             if hasattr(self, 'stream_type') and self.stream_type == StreamType.UDP:
                 # Filter out any arguments that contain the user_agent value or related headers
@@ -645,35 +664,51 @@ class StreamManager:
             if content_lower.startswith('output #') or 'encoder' in content_lower:
                 self.ffmpeg_input_phase = False
 
-            # Only parse stream info if we're still in the input phase
-            if ("stream #" in content_lower and
-                ("video:" in content_lower or "audio:" in content_lower) and
-                self.ffmpeg_input_phase):
+            # Route to appropriate parser based on known command type
+            from .services.log_parsers import LogParserFactory
+            from .services.channel_service import ChannelService
 
-                from .services.channel_service import ChannelService
-                if "video:" in content_lower:
-                    ChannelService.parse_and_store_stream_info(self.channel_id, content, "video", self.current_stream_id)
-                elif "audio:" in content_lower:
-                    ChannelService.parse_and_store_stream_info(self.channel_id, content, "audio", self.current_stream_id)
+            parse_result = None
+
+            # If we know the parser type, use direct routing for efficiency
+            if self.parser_type:
+                # Get the appropriate parser and check what it can parse
+                parser = LogParserFactory._parsers.get(self.parser_type)
+                if parser:
+                    stream_type = parser.can_parse(content)
+                    if stream_type:
+                        # Parser can handle this line, parse it directly
+                        parsed_data = LogParserFactory.parse(stream_type, content)
+                        if parsed_data:
+                            parse_result = (stream_type, parsed_data)
+            else:
+                # Unknown command type - use auto-detection as fallback
+                parse_result = LogParserFactory.auto_parse(content)
+
+            if parse_result:
+                stream_type, parsed_data = parse_result
+                # For FFmpeg, only parse during input phase
+                if stream_type in ['video', 'audio', 'input']:
+                    if self.ffmpeg_input_phase:
+                        ChannelService.parse_and_store_stream_info(self.channel_id, content, stream_type, self.current_stream_id)
+                else:
+                    # VLC and Streamlink can be parsed anytime
+                    ChannelService.parse_and_store_stream_info(self.channel_id, content, stream_type, self.current_stream_id)
 
             # Determine log level based on content
             if any(keyword in content_lower for keyword in ['error', 'failed', 'cannot', 'invalid', 'corrupt']):
-                logger.error(f"FFmpeg stderr for channel {self.channel_id}: {content}")
+                logger.error(f"Stream process error for channel {self.channel_id}: {content}")
             elif any(keyword in content_lower for keyword in ['warning', 'deprecated', 'ignoring']):
-                logger.warning(f"FFmpeg stderr for channel {self.channel_id}: {content}")
+                logger.warning(f"Stream process warning for channel {self.channel_id}: {content}")
             elif content.startswith('frame=') or 'fps=' in content or 'speed=' in content:
                 # Stats lines - log at trace level to avoid spam
-                logger.trace(f"FFmpeg stats for channel {self.channel_id}: {content}")
+                logger.trace(f"Stream stats for channel {self.channel_id}: {content}")
             elif any(keyword in content_lower for keyword in ['input', 'output', 'stream', 'video', 'audio']):
                 # Stream info - log at info level
-                logger.info(f"FFmpeg info for channel {self.channel_id}: {content}")
-                if content.startswith('Input #0'):
-                    # If it's input 0, parse stream info
-                    from .services.channel_service import ChannelService
-                    ChannelService.parse_and_store_stream_info(self.channel_id, content, "input", self.current_stream_id)
+                logger.info(f"Stream info for channel {self.channel_id}: {content}")
             else:
                 # Everything else at debug level
-                logger.debug(f"FFmpeg stderr for channel {self.channel_id}: {content}")
+                logger.debug(f"Stream process output for channel {self.channel_id}: {content}")
 
         except Exception as e:
             logger.error(f"Error logging stderr content for channel {self.channel_id}: {e}")

apps/proxy/ts_proxy/url_utils.py

@@ -462,16 +462,21 @@ def validate_stream_url(url, user_agent=None, timeout=(5, 5)):
         session.headers.update(headers)
 
         # Make HEAD request first as it's faster and doesn't download content
-        head_response = session.head(
-            url,
-            timeout=timeout,
-            allow_redirects=True
-        )
+        head_request_success = True
+        try:
+            head_response = session.head(
+                url,
+                timeout=timeout,
+                allow_redirects=True
+            )
+        except requests.exceptions.RequestException as e:
+            head_request_success = False
+            logger.warning(f"Request error (HEAD), assuming HEAD not supported: {str(e)}")
 
         # If HEAD not supported, server will return 405 or other error
-        if 200 <= head_response.status_code < 300:
+        if head_request_success and (200 <= head_response.status_code < 300):
             # HEAD request successful
-            return True, head_response.url, head_response.status_code, "Valid (HEAD request)"
+            return True, url, head_response.status_code, "Valid (HEAD request)"
 
         # Try a GET request with stream=True to avoid downloading all content
         get_response = session.get(
@@ -484,7 +489,7 @@ def validate_stream_url(url, user_agent=None, timeout=(5, 5)):
         # IMPORTANT: Check status code first before checking content
         if not (200 <= get_response.status_code < 300):
             logger.warning(f"Stream validation failed with HTTP status {get_response.status_code}")
-            return False, get_response.url, get_response.status_code, f"Invalid HTTP status: {get_response.status_code}"
+            return False, url, get_response.status_code, f"Invalid HTTP status: {get_response.status_code}"
 
         # Only check content if status code is valid
         try:
@@ -538,7 +543,7 @@ def validate_stream_url(url, user_agent=None, timeout=(5, 5)):
         get_response.close()
 
         # If we have content, consider it valid even with unrecognized content type
-        return is_valid, get_response.url, get_response.status_code, message
+        return is_valid, url, get_response.status_code, message
 
     except requests.exceptions.Timeout:
         return False, url, 0, "Timeout connecting to stream"

apps/proxy/vod_proxy/connection_manager.py

@@ -97,7 +97,20 @@ class PersistentVODConnection:
                 # First check if we have a pre-stored content length from HEAD request
                 try:
                     import redis
-                    r = redis.StrictRedis(host='localhost', port=6379, db=0, decode_responses=True)
+                    from django.conf import settings
+                    redis_host = getattr(settings, 'REDIS_HOST', 'localhost')
+                    redis_port = int(getattr(settings, 'REDIS_PORT', 6379))
+                    redis_db = int(getattr(settings, 'REDIS_DB', 0))
+                    redis_password = getattr(settings, 'REDIS_PASSWORD', '')
+                    redis_user = getattr(settings, 'REDIS_USER', '')
+                    r = redis.StrictRedis(
+                        host=redis_host,
+                        port=redis_port,
+                        db=redis_db,
+                        password=redis_password if redis_password else None,
+                        username=redis_user if redis_user else None,
+                        decode_responses=True
+                    )
                     content_length_key = f"vod_content_length:{self.session_id}"
                     stored_length = r.get(content_length_key)
                     if stored_length:
@@ -446,13 +459,12 @@ class VODConnectionManager:
             return False
 
         try:
-            # Check profile connection limits using standardized key
-            if not self._check_profile_limits(m3u_profile):
+            # Atomically check and reserve a profile connection slot (INCR-first)
+            if not self._check_and_reserve_profile_slot(m3u_profile):
                 logger.warning(f"Profile {m3u_profile.name} connection limit exceeded")
                 return False
 
             connection_key = self._get_connection_key(content_type, content_uuid, client_id)
-            profile_connections_key = self._get_profile_connections_key(m3u_profile.id)
             content_connections_key = self._get_content_connections_key(content_type, content_uuid)
 
             # Check if connection already exists to prevent duplicate counting
@@ -460,6 +472,9 @@ class VODConnectionManager:
                 logger.info(f"Connection already exists for {client_id} - {content_type} {content_name}")
                 # Update activity but don't increment profile counter
                 self.redis_client.hset(connection_key, "last_activity", str(time.time()))
+                # Roll back the reservation — connection already counted
+                if m3u_profile.max_streams > 0:
+                    self.redis_client.decr(self._get_profile_connections_key(m3u_profile.id))
                 return True
 
             # Connection data
@@ -486,8 +501,7 @@ class VODConnectionManager:
             pipe.hset(connection_key, mapping=connection_data)
             pipe.expire(connection_key, self.connection_ttl)
 
-            # Increment profile connections using standardized method
-            pipe.incr(profile_connections_key)
+            # Profile counter already incremented atomically above — no pipe.incr needed
 
             # Add to content connections set
             pipe.sadd(content_connections_key, client_id)
@@ -500,6 +514,9 @@ class VODConnectionManager:
             return True
 
         except Exception as e:
+            # Roll back the profile reservation on failure
+            if m3u_profile.max_streams > 0:
+                self.redis_client.decr(self._get_profile_connections_key(m3u_profile.id))
             logger.error(f"Error creating VOD connection: {e}")
             return False
 
@@ -518,6 +535,41 @@ class VODConnectionManager:
             logger.error(f"Error checking profile limits: {e}")
             return False
 
+    def _check_and_reserve_profile_slot(self, m3u_profile: M3UAccountProfile) -> bool:
+        """
+        Atomically check and reserve a connection slot for the given profile.
+
+        Uses an INCR-first-then-check pattern to eliminate the TOCTOU race
+        condition where separate GET > check > INCR operations could allow
+        concurrent requests to both pass the capacity check.
+
+        For profiles with max_streams=0 (unlimited), no reservation is needed.
+
+        Returns:
+            bool: True if slot was reserved (or unlimited), False if at capacity
+        """
+        if m3u_profile.max_streams == 0:  # Unlimited
+            return True
+
+        try:
+            profile_connections_key = self._get_profile_connections_key(m3u_profile.id)
+
+            # Atomically increment first — single Redis command eliminates race window
+            new_count = self.redis_client.incr(profile_connections_key)
+
+            if new_count <= m3u_profile.max_streams:
+                logger.info(f"[PROFILE-RESERVE] Profile {m3u_profile.id} slot reserved: {new_count}/{m3u_profile.max_streams}")
+                return True
+
+            # Over capacity — roll back the increment
+            self.redis_client.decr(profile_connections_key)
+            logger.info(f"[PROFILE-RESERVE] Profile {m3u_profile.id} at capacity: {new_count - 1}/{m3u_profile.max_streams}")
+            return False
+
+        except Exception as e:
+            logger.error(f"Error reserving profile slot: {e}")
+            return False
+
     def update_connection_activity(self, content_type: str, content_uuid: str,
                                  client_id: str, bytes_sent: int = 0,
                                  position_seconds: int = 0) -> bool:

apps/proxy/vod_proxy/multi_worker_connection_manager.py

@@ -24,6 +24,11 @@ from apps.m3u.models import M3UAccountProfile
 logger = logging.getLogger("vod_proxy")
 
 
+def get_vod_client_stop_key(client_id):
+    """Get the Redis key for signaling a VOD client to stop"""
+    return f"vod_proxy:client:{client_id}:stop"
+
+
 def infer_content_type_from_url(url: str) -> Optional[str]:
     """
     Infer MIME type from file extension in URL
@@ -352,12 +357,12 @@ class RedisBackedVODConnection:
 
             logger.info(f"[{self.session_id}] Making request #{state.request_count} to {'final' if state.final_url else 'original'} URL")
 
-            # Make request
+            # Make request (10s connect, 10s read timeout - keeps lock time reasonable if client disconnects)
             response = self.local_session.get(
                 target_url,
                 headers=headers,
                 stream=True,
-                timeout=(10, 30),
+                timeout=(10, 10),
                 allow_redirects=allow_redirects
             )
             response.raise_for_status()
@@ -411,8 +416,22 @@ class RedisBackedVODConnection:
 
                 logger.info(f"[{self.session_id}] Updated connection state: length={state.content_length}, type={state.content_type}")
 
-            # Save updated state
-            self._save_connection_state(state)
+            # Save updated state under lock to avoid overwriting concurrent
+            # active_streams changes (e.g., another stream's GeneratorExit decrement)
+            if self._acquire_lock():
+                try:
+                    current = self._get_connection_state()
+                    if current:
+                        # Preserve the current active_streams value — it may have been
+                        # modified by concurrent increment/decrement operations while
+                        # waiting for the upstream HTTP response.
+                        state.active_streams = current.active_streams
+                    self._save_connection_state(state)
+                finally:
+                    self._release_lock()
+            else:
+                # Fallback: save without lock but skip active_streams to avoid overwrite
+                logger.warning(f"[{self.session_id}] Could not acquire lock for get_stream state save")
 
             self.local_response = response
             return response
@@ -461,35 +480,44 @@ class RedisBackedVODConnection:
             return range_header
 
     def increment_active_streams(self):
-        """Increment active streams count in Redis"""
+        """Increment active streams count in Redis. Returns new active_streams count, or 0 on failure."""
         if not self._acquire_lock():
-            return False
+            logger.warning(f"[{self.session_id}] INCR-AS failed: could not acquire lock")
+            return 0
 
         try:
             state = self._get_connection_state()
             if state:
+                old = state.active_streams
                 state.active_streams += 1
                 state.last_activity = time.time()
                 self._save_connection_state(state)
-                logger.debug(f"[{self.session_id}] Active streams incremented to {state.active_streams}")
-                return True
-            return False
+                logger.debug(f"[{self.session_id}] INCR-AS {old} -> {state.active_streams}")
+                return state.active_streams
+            logger.warning(f"[{self.session_id}] INCR-AS failed: no state")
+            return 0
         finally:
             self._release_lock()
 
     def decrement_active_streams(self):
         """Decrement active streams count in Redis"""
         if not self._acquire_lock():
+            logger.warning(f"[{self.session_id}] DECR-AS failed: could not acquire lock")
             return False
 
         try:
             state = self._get_connection_state()
             if state and state.active_streams > 0:
+                old = state.active_streams
                 state.active_streams -= 1
                 state.last_activity = time.time()
                 self._save_connection_state(state)
-                logger.debug(f"[{self.session_id}] Active streams decremented to {state.active_streams}")
+                logger.debug(f"[{self.session_id}] DECR-AS {old} -> {state.active_streams}")
                 return True
+            if not state:
+                logger.warning(f"[{self.session_id}] DECR-AS failed: no state")
+            else:
+                logger.warning(f"[{self.session_id}] DECR-AS failed: active_streams already {state.active_streams}")
             return False
         finally:
             self._release_lock()
@@ -669,6 +697,41 @@ class MultiWorkerVODConnectionManager:
             logger.error(f"Error checking profile limits: {e}")
             return False
 
+    def _check_and_reserve_profile_slot(self, m3u_profile) -> bool:
+        """
+        Atomically check and reserve a connection slot for the given profile.
+
+        Uses an INCR-first-then-check pattern to eliminate the TOCTOU race
+        condition where separate GET > check > INCR operations could allow
+        concurrent requests to both pass the capacity check.
+
+        For profiles with max_streams=0 (unlimited), no reservation is needed.
+
+        Returns:
+            bool: True if slot was reserved (or unlimited), False if at capacity
+        """
+        if m3u_profile.max_streams == 0:  # Unlimited
+            return True
+
+        try:
+            profile_connections_key = self._get_profile_connections_key(m3u_profile.id)
+
+            # Atomically increment first — single Redis command eliminates race window
+            new_count = self.redis_client.incr(profile_connections_key)
+
+            if new_count <= m3u_profile.max_streams:
+                logger.info(f"[PROFILE-RESERVE] Profile {m3u_profile.id} slot reserved: {new_count}/{m3u_profile.max_streams}")
+                return True
+
+            # Over capacity — roll back the increment
+            self.redis_client.decr(profile_connections_key)
+            logger.info(f"[PROFILE-RESERVE] Profile {m3u_profile.id} at capacity: {new_count - 1}/{m3u_profile.max_streams}")
+            return False
+
+        except Exception as e:
+            logger.error(f"Error reserving profile slot: {e}")
+            return False
+
     def _increment_profile_connections(self, m3u_profile):
         """Increment profile connection count"""
         try:
@@ -707,6 +770,10 @@ class MultiWorkerVODConnectionManager:
         content_name = content_obj.name if hasattr(content_obj, 'name') else str(content_obj)
         client_id = session_id
 
+        # Track whether we incremented profile connections (for cleanup on error)
+        profile_connections_incremented = False
+        redis_connection = None
+
         logger.info(f"[{client_id}] Worker {self.worker_id} - Redis-backed streaming request for {content_type} {content_name}")
 
         try:
@@ -747,10 +814,11 @@ class MultiWorkerVODConnectionManager:
             if not existing_state:
                 logger.info(f"[{client_id}] Worker {self.worker_id} - Creating new Redis-backed connection")
 
-                # Check profile limits before creating new connection
-                if not self._check_profile_limits(m3u_profile):
+                # Atomically check and reserve a profile connection slot (INCR-first)
+                if not self._check_and_reserve_profile_slot(m3u_profile):
                     logger.warning(f"[{client_id}] Profile {m3u_profile.name} connection limit exceeded")
                     return HttpResponse("Connection limit exceeded for profile", status=429)
+                profile_connections_incremented = True
 
                 # Apply timeshift parameters
                 modified_stream_url = self._apply_timeshift_parameters(stream_url, utc_start, utc_end, offset)
@@ -793,15 +861,43 @@ class MultiWorkerVODConnectionManager:
                     worker_id=self.worker_id
                 ):
                     logger.error(f"[{client_id}] Worker {self.worker_id} - Failed to create Redis connection")
+                    # Roll back the profile slot reservation since connection failed
+                    self._decrement_profile_connections(m3u_profile.id)
+                    profile_connections_incremented = False
                     return HttpResponse("Failed to create connection", status=500)
 
-                # Increment profile connections after successful connection creation
-                self._increment_profile_connections(m3u_profile)
-
                 logger.info(f"[{client_id}] Worker {self.worker_id} - Created consolidated connection with session metadata")
             else:
                 logger.info(f"[{client_id}] Worker {self.worker_id} - Using existing Redis-backed connection")
 
+                # Immediately increment active_streams to prevent cleanup race condition.
+                # Without this, stream's GeneratorExit can see active_streams=0
+                # and DECR the profile counter before the new generator starts.
+                if matching_session_id:
+                    # Idle session reuse: active_streams already incremented at line 776
+                    # Always need to re-reserve profile slot (GeneratorExit DECRed it)
+                    if not self._check_and_reserve_profile_slot(m3u_profile):
+                        logger.warning(f"[{client_id}] Profile {m3u_profile.name} connection limit exceeded on session reuse")
+                        redis_connection.decrement_active_streams()
+                        return HttpResponse("Connection limit exceeded for profile", status=429)
+                    profile_connections_incremented = True
+                else:
+                    # Concurrent/reconnect: increment active_streams now (not in generator)
+                    new_count = redis_connection.increment_active_streams()
+                    if new_count == 1:
+                        # 0→1 transition: previous stream's GeneratorExit already DECRed
+                        # the profile counter, need to re-reserve the slot
+                        if not self._check_and_reserve_profile_slot(m3u_profile):
+                            logger.warning(f"[{client_id}] Profile {m3u_profile.name} connection limit exceeded on reconnect")
+                            redis_connection.decrement_active_streams()
+                            return HttpResponse("Connection limit exceeded for profile", status=429)
+                        profile_connections_incremented = True
+                    elif new_count == 0:
+                        logger.error(f"[{client_id}] Failed to increment active streams")
+                        return HttpResponse("Failed to reserve stream", status=500)
+                    # else: new_count > 1, another stream is already active and profile
+                    # counter already reflects it — no INCR needed
+
                 # Transfer ownership to current worker and update session activity
                 if redis_connection._acquire_lock():
                     try:
@@ -824,6 +920,12 @@ class MultiWorkerVODConnectionManager:
 
             if upstream_response is None:
                 logger.warning(f"[{client_id}] Worker {self.worker_id} - Range not satisfiable")
+                if existing_state:
+                    # Roll back the active_streams increment from the else branch
+                    redis_connection.decrement_active_streams()
+                if profile_connections_incremented:
+                    self._decrement_profile_connections(m3u_profile.id)
+                    profile_connections_incremented = False
                 return HttpResponse("Requested Range Not Satisfiable", status=416)
 
             # Get connection headers
@@ -832,28 +934,41 @@ class MultiWorkerVODConnectionManager:
             # Create streaming generator
             def stream_generator():
                 decremented = False
+                stop_signal_detected = False
                 try:
                     logger.info(f"[{client_id}] Worker {self.worker_id} - Starting Redis-backed stream")
 
-                    # Increment active streams (unless we already did it for session reuse)
-                    if not matching_session_id:
-                        # New session - increment active streams
+                    # Increment active streams only for brand-new connections.
+                    # For existing connections (session reuse or concurrent requests),
+                    # active_streams was already incremented in the else branch above
+                    # to prevent cleanup race conditions with GeneratorExit.
+                    if not existing_state:
                         redis_connection.increment_active_streams()
                     else:
-                        # Reused session - we already incremented when reserving the session
-                        logger.debug(f"[{client_id}] Using pre-reserved session - active streams already incremented")
+                        logger.debug(f"[{client_id}] Active streams already incremented in connection reuse path")
 
                     bytes_sent = 0
                     chunk_count = 0
 
+                    # Get the stop signal key for this client
+                    stop_key = get_vod_client_stop_key(client_id)
+
                     for chunk in upstream_response.iter_content(chunk_size=8192):
                         if chunk:
                             yield chunk
                             bytes_sent += len(chunk)
                             chunk_count += 1
 
-                            # Update activity every 100 chunks in consolidated connection state
+                            # Check for stop signal every 100 chunks
                             if chunk_count % 100 == 0:
+                                # Check if stop signal has been set
+                                if self.redis_client and self.redis_client.exists(stop_key):
+                                    logger.info(f"[{client_id}] Worker {self.worker_id} - Stop signal detected, terminating stream")
+                                    # Delete the stop key
+                                    self.redis_client.delete(stop_key)
+                                    stop_signal_detected = True
+                                    break
+
                                 # Update the connection state
                                 logger.debug(f"Client: [{client_id}] Worker: {self.worker_id} sent {chunk_count} chunks for VOD: {content_name}")
                                 if redis_connection._acquire_lock():
@@ -867,17 +982,28 @@ class MultiWorkerVODConnectionManager:
                                     finally:
                                         redis_connection._release_lock()
 
-                    logger.info(f"[{client_id}] Worker {self.worker_id} - Redis-backed stream completed: {bytes_sent} bytes sent")
+                    if stop_signal_detected:
+                        logger.info(f"[{client_id}] Worker {self.worker_id} - Stream stopped by signal: {bytes_sent} bytes sent")
+                    else:
+                        logger.info(f"[{client_id}] Worker {self.worker_id} - Redis-backed stream completed: {bytes_sent} bytes sent")
                     redis_connection.decrement_active_streams()
                     decremented = True
 
                     # Schedule smart cleanup if no active streams after normal completion
                     if not redis_connection.has_active_streams():
+                        # Decrement profile counter immediately — don't defer to daemon thread
+                        state = redis_connection._get_connection_state()
+                        profile_id = state.m3u_profile_id if state else m3u_profile.id
+                        if profile_id:
+                            self._decrement_profile_connections(profile_id)
+                            logger.info(f"[{client_id}] Profile counter decremented for profile {profile_id} on normal completion")
+
                         def delayed_cleanup():
                             time.sleep(1)  # Wait 1 second
                             # Smart cleanup: check active streams and ownership
                             logger.info(f"[{client_id}] Worker {self.worker_id} - Checking for smart cleanup after normal completion")
-                            redis_connection.cleanup(connection_manager=self, current_worker_id=self.worker_id)
+                            # No connection_manager — profile already decremented above
+                            redis_connection.cleanup(current_worker_id=self.worker_id)
 
                         import threading
                         cleanup_thread = threading.Thread(target=delayed_cleanup)
@@ -892,11 +1018,19 @@ class MultiWorkerVODConnectionManager:
 
                     # Schedule smart cleanup if no active streams
                     if not redis_connection.has_active_streams():
+                        # Decrement profile counter immediately — don't defer to daemon thread
+                        state = redis_connection._get_connection_state()
+                        profile_id = state.m3u_profile_id if state else m3u_profile.id
+                        if profile_id:
+                            self._decrement_profile_connections(profile_id)
+                            logger.info(f"[{client_id}] Profile counter decremented for profile {profile_id} on client disconnect")
+
                         def delayed_cleanup():
                             time.sleep(1)  # Wait 1 second
                             # Smart cleanup: check active streams and ownership
                             logger.info(f"[{client_id}] Worker {self.worker_id} - Checking for smart cleanup after client disconnect")
-                            redis_connection.cleanup(connection_manager=self, current_worker_id=self.worker_id)
+                            # No connection_manager — profile already decremented above
+                            redis_connection.cleanup(current_worker_id=self.worker_id)
 
                         import threading
                         cleanup_thread = threading.Thread(target=delayed_cleanup)
@@ -908,8 +1042,17 @@ class MultiWorkerVODConnectionManager:
                     if not decremented:
                         redis_connection.decrement_active_streams()
                         decremented = True
-                    # Smart cleanup on error - immediate cleanup since we're in error state
-                    redis_connection.cleanup(connection_manager=self, current_worker_id=self.worker_id)
+
+                    # Decrement profile counter immediately if no other active streams
+                    if not redis_connection.has_active_streams():
+                        state = redis_connection._get_connection_state()
+                        profile_id = state.m3u_profile_id if state else m3u_profile.id
+                        if profile_id:
+                            self._decrement_profile_connections(profile_id)
+                            logger.info(f"[{client_id}] Profile counter decremented for profile {profile_id} on stream error")
+                        # Smart cleanup on error - immediate cleanup since we're in error state
+                        # No connection_manager — profile already decremented above
+                        redis_connection.cleanup(current_worker_id=self.worker_id)
                     yield b"Error: Stream interrupted"
 
                 finally:
@@ -1004,6 +1147,19 @@ class MultiWorkerVODConnectionManager:
 
         except Exception as e:
             logger.error(f"[{client_id}] Worker {self.worker_id} - Error in Redis-backed stream_content_with_session: {e}", exc_info=True)
+
+            # Decrement profile connections if we incremented them but failed before streaming started
+            if profile_connections_incremented:
+                logger.info(f"[{client_id}] Connection error occurred after profile increment - decrementing profile connections")
+                self._decrement_profile_connections(m3u_profile.id)
+
+                # Also clean up the Redis connection state since we won't be using it
+                if redis_connection:
+                    try:
+                        redis_connection.cleanup(connection_manager=self, current_worker_id=self.worker_id)
+                    except Exception as cleanup_error:
+                        logger.error(f"[{client_id}] Error during cleanup after connection failure: {cleanup_error}")
+
             return HttpResponse(f"Streaming error: {str(e)}", status=500)
 
     def _apply_timeshift_parameters(self, original_url, utc_start=None, utc_end=None, offset=None):

apps/proxy/vod_proxy/urls.py

@@ -21,4 +21,7 @@ urlpatterns = [
 
     # VOD Stats
     path('stats/', views.VODStatsView.as_view(), name='vod_stats'),
+
+    # Stop VOD client connection
+    path('stop_client/', views.stop_vod_client, name='stop_vod_client'),
 ]

apps/proxy/vod_proxy/views.py

@@ -15,7 +15,7 @@ from django.views import View
 from apps.vod.models import Movie, Series, Episode
 from apps.m3u.models import M3UAccount, M3UAccountProfile
 from apps.proxy.vod_proxy.connection_manager import VODConnectionManager
-from apps.proxy.vod_proxy.multi_worker_connection_manager import MultiWorkerVODConnectionManager, infer_content_type_from_url
+from apps.proxy.vod_proxy.multi_worker_connection_manager import MultiWorkerVODConnectionManager, infer_content_type_from_url, get_vod_client_stop_key
 from .utils import get_client_info, create_vod_response
 
 logger = logging.getLogger(__name__)
@@ -329,7 +329,20 @@ class VODStreamView(View):
             # Store the total content length in Redis for the persistent connection to use
             try:
                 import redis
-                r = redis.StrictRedis(host='localhost', port=6379, db=0, decode_responses=True)
+                from django.conf import settings
+                redis_host = getattr(settings, 'REDIS_HOST', 'localhost')
+                redis_port = int(getattr(settings, 'REDIS_PORT', 6379))
+                redis_db = int(getattr(settings, 'REDIS_DB', 0))
+                redis_password = getattr(settings, 'REDIS_PASSWORD', '')
+                redis_user = getattr(settings, 'REDIS_USER', '')
+                r = redis.StrictRedis(
+                    host=redis_host,
+                    port=redis_port,
+                    db=redis_db,
+                    password=redis_password if redis_password else None,
+                    username=redis_user if redis_user else None,
+                    decode_responses=True
+                )
                 content_length_key = f"vod_content_length:{session_id}"
                 r.set(content_length_key, total_size, ex=1800)  # Store for 30 minutes
                 logger.info(f"[VOD-HEAD] Stored total content length {total_size} for session {session_id}")
@@ -1001,3 +1014,59 @@ class VODStatsView(View):
         except Exception as e:
             logger.error(f"Error getting VOD stats: {e}")
             return JsonResponse({'error': str(e)}, status=500)
+
+
+from rest_framework.decorators import api_view, permission_classes
+from apps.accounts.permissions import IsAdmin
+
+
+@csrf_exempt
+@api_view(["POST"])
+@permission_classes([IsAdmin])
+def stop_vod_client(request):
+    """Stop a specific VOD client connection using stop signal mechanism"""
+    try:
+        # Parse request body
+        import json
+        try:
+            data = json.loads(request.body)
+        except json.JSONDecodeError:
+            return JsonResponse({'error': 'Invalid JSON'}, status=400)
+
+        client_id = data.get('client_id')
+        if not client_id:
+            return JsonResponse({'error': 'No client_id provided'}, status=400)
+
+        logger.info(f"Request to stop VOD client: {client_id}")
+
+        # Get Redis client
+        connection_manager = MultiWorkerVODConnectionManager.get_instance()
+        redis_client = connection_manager.redis_client
+
+        if not redis_client:
+            return JsonResponse({'error': 'Redis not available'}, status=500)
+
+        # Check if connection exists
+        connection_key = f"vod_persistent_connection:{client_id}"
+        connection_data = redis_client.hgetall(connection_key)
+        if not connection_data:
+            logger.warning(f"VOD connection not found: {client_id}")
+            return JsonResponse({'error': 'Connection not found'}, status=404)
+
+        # Set a stop signal key that the worker will check
+        stop_key = get_vod_client_stop_key(client_id)
+        redis_client.setex(stop_key, 60, "true")  # 60 second TTL
+
+        logger.info(f"Set stop signal for VOD client: {client_id}")
+
+        return JsonResponse({
+            'message': 'VOD client stop signal sent',
+            'client_id': client_id,
+            'stop_key': stop_key
+        })
+
+    except Exception as e:
+        logger.error(f"Error stopping VOD client: {e}", exc_info=True)
+        return JsonResponse({'error': str(e)}, status=500)
+
+

apps/vod/admin.py

@@ -60,7 +60,7 @@ class M3USeriesRelationAdmin(admin.ModelAdmin):
 
 @admin.register(M3UEpisodeRelation)
 class M3UEpisodeRelationAdmin(admin.ModelAdmin):
-    list_display = ['episode', 'm3u_account', 'stream_id', 'created_at']
+    list_display = ['episode', 'm3u_account', 'series_relation', 'stream_id', 'created_at']
     list_filter = ['m3u_account', 'created_at']
     search_fields = ['episode__name', 'episode__series__name', 'm3u_account__name', 'stream_id']
     readonly_fields = ['created_at', 'updated_at']

apps/vod/api_views.py

@@ -62,7 +62,7 @@ class MovieFilter(django_filters.FilterSet):
 
         # Handle the format 'category_name|category_type'
         if '|' in value:
-            category_name, category_type = value.split('|', 1)
+            category_name, category_type = value.rsplit('|', 1)
             return queryset.filter(
                 m3u_relations__category__name=category_name,
                 m3u_relations__category__category_type=category_type
@@ -219,7 +219,7 @@ class SeriesFilter(django_filters.FilterSet):
 
         # Handle the format 'category_name|category_type'
         if '|' in value:
-            category_name, category_type = value.split('|', 1)
+            category_name, category_type = value.rsplit('|', 1)
             return queryset.filter(
                 m3u_relations__category__name=category_name,
                 m3u_relations__category__category_type=category_type
@@ -588,7 +588,7 @@ class UnifiedContentViewSet(viewsets.ReadOnlyModelViewSet):
 
             if category:
                 if '|' in category:
-                    cat_name, cat_type = category.split('|', 1)
+                    cat_name, cat_type = category.rsplit('|', 1)
                     if cat_type == 'movie':
                         where_conditions[0] += " AND movies.id IN (SELECT movie_id FROM vod_m3umovierelation mmr JOIN vod_vodcategory c ON mmr.category_id = c.id WHERE c.name = %s)"
                         where_conditions[1] = "1=0"  # Exclude series

apps/vod/migrations/0004_m3uepisoderelation_series_relation.py

@@ -0,0 +1,19 @@
+# Generated by Django 5.2.11 on 2026-02-24 23:53
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('vod', '0003_vodlogo_alter_movie_logo_alter_series_logo'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='m3uepisoderelation',
+            name='series_relation',
+            field=models.ForeignKey(blank=True, help_text='The series relation this episode relation belongs to. CASCADE ensures cleanup when the series relation is removed.', null=True, on_delete=django.db.models.deletion.CASCADE, related_name='episode_relations', to='vod.m3useriesrelation'),
+        ),
+    ]

apps/vod/models.py

@@ -245,10 +245,13 @@ class M3UMovieRelation(models.Model):
         """Get the full stream URL for this movie from this provider"""
         # Build URL dynamically for XtreamCodes accounts
         if self.m3u_account.account_type == 'XC':
-            server_url = self.m3u_account.server_url.rstrip('/')
+            from core.xtream_codes import Client as XCClient
+            # Use XC client's URL normalization to handle malformed URLs
+            # (e.g., URLs with /player_api.php or query parameters)
+            normalized_url = XCClient(self.m3u_account.server_url, '', '')._normalize_url(self.m3u_account.server_url)
             username = self.m3u_account.username
             password = self.m3u_account.password
-            return f"{server_url}/movie/{username}/{password}/{self.stream_id}.{self.container_extension or 'mp4'}"
+            return f"{normalized_url}/movie/{username}/{password}/{self.stream_id}.{self.container_extension or 'mp4'}"
         else:
             # For other account types, we would need another way to build URLs
             return None
@@ -258,6 +261,14 @@ class M3UEpisodeRelation(models.Model):
     """Links M3U accounts to Episodes with provider-specific information"""
     m3u_account = models.ForeignKey(M3UAccount, on_delete=models.CASCADE, related_name='episode_relations')
     episode = models.ForeignKey(Episode, on_delete=models.CASCADE, related_name='m3u_relations')
+    series_relation = models.ForeignKey(
+        'M3USeriesRelation',
+        on_delete=models.CASCADE,
+        related_name='episode_relations',
+        null=True,
+        blank=True,
+        help_text="The series relation this episode relation belongs to. CASCADE ensures cleanup when the series relation is removed."
+    )
 
     # Streaming information (provider-specific)
     stream_id = models.CharField(max_length=255, help_text="External stream ID from M3U provider")
@@ -285,10 +296,12 @@ class M3UEpisodeRelation(models.Model):
 
         if self.m3u_account.account_type == 'XC':
             # For XtreamCodes accounts, build the URL dynamically
-            server_url = self.m3u_account.server_url.rstrip('/')
+            # Use XC client's URL normalization to handle malformed URLs
+            # (e.g., URLs with /player_api.php or query parameters)
+            normalized_url = XtreamCodesClient(self.m3u_account.server_url, '', '')._normalize_url(self.m3u_account.server_url)
             username = self.m3u_account.username
             password = self.m3u_account.password
-            return f"{server_url}/series/{username}/{password}/{self.stream_id}.{self.container_extension or 'mp4'}"
+            return f"{normalized_url}/series/{username}/{password}/{self.stream_id}.{self.container_extension or 'mp4'}"
         else:
             # We might support non XC accounts in the future
             # For now, return None

apps/vod/tasks.py

@@ -73,7 +73,9 @@ def refresh_vod_content(account_id):
         return f"Batch VOD refresh completed for account {account.name} in {duration:.2f} seconds"
 
     except Exception as e:
+        import traceback
         logger.error(f"Error refreshing VOD for account {account_id}: {str(e)}")
+        logger.error(f"Full traceback:\n{traceback.format_exc()}")
 
         # Send error notification
         send_m3u_update(account_id, "vod_refresh", 100, status="error",
@@ -410,10 +412,10 @@ def process_movie_batch(account, batch, categories, relations, scan_start_time=N
             tmdb_id = movie_data.get('tmdb_id') or movie_data.get('tmdb')
             imdb_id = movie_data.get('imdb_id') or movie_data.get('imdb')
 
-            # Clean empty string IDs
-            if tmdb_id == '':
+            # Clean empty string IDs and zero values (some providers use 0 to indicate no ID)
+            if tmdb_id == '' or tmdb_id == 0 or tmdb_id == '0':
                 tmdb_id = None
-            if imdb_id == '':
+            if imdb_id == '' or imdb_id == 0 or imdb_id == '0':
                 imdb_id = None
 
             # Create a unique key for this movie (priority: TMDB > IMDB > name+year)
@@ -555,12 +557,19 @@ def process_movie_batch(account, batch, categories, relations, scan_start_time=N
 
             # Handle logo assignment for existing movies
             logo_updated = False
-            if logo_url and len(logo_url) <= 500 and logo_url in existing_logos:
-                new_logo = existing_logos[logo_url]
-                if movie.logo != new_logo:
-                    movie._logo_to_update = new_logo
+            if logo_url and len(logo_url) <= 500:
+                if logo_url in existing_logos:
+                    new_logo = existing_logos[logo_url]
+                    if movie.logo_id != new_logo.id:
+                        movie._logo_to_update = new_logo
+                        logo_updated = True
+                elif movie.logo_id:
+                    # Logo URL exists but logo creation failed or logo not found
+                    # Clear the orphaned logo reference
+                    logger.warning(f"Logo URL provided but logo not found in database for movie '{movie.name}', clearing logo reference")
+                    movie._logo_to_update = None
                     logo_updated = True
-            elif (not logo_url or len(logo_url) > 500) and movie.logo:
+            elif (not logo_url or len(logo_url) > 500) and movie.logo_id:
                 # Clear logo if no logo URL provided or URL is too long
                 movie._logo_to_update = None
                 logo_updated = True
@@ -614,26 +623,41 @@ def process_movie_batch(account, batch, categories, relations, scan_start_time=N
             # First, create new movies and get their IDs
             created_movies = {}
             if movies_to_create:
-                Movie.objects.bulk_create(movies_to_create, ignore_conflicts=True)
+                # Bulk query to check which movies already exist
+                tmdb_ids = [m.tmdb_id for m in movies_to_create if m.tmdb_id]
+                imdb_ids = [m.imdb_id for m in movies_to_create if m.imdb_id]
+                name_year_pairs = [(m.name, m.year) for m in movies_to_create if not m.tmdb_id and not m.imdb_id]
 
-                # Get the newly created movies with their IDs
-                # We need to re-fetch them to get the primary keys
+                existing_by_tmdb = {m.tmdb_id: m for m in Movie.objects.filter(tmdb_id__in=tmdb_ids)} if tmdb_ids else {}
+                existing_by_imdb = {m.imdb_id: m for m in Movie.objects.filter(imdb_id__in=imdb_ids)} if imdb_ids else {}
+
+                existing_by_name_year = {}
+                if name_year_pairs:
+                    for movie in Movie.objects.filter(tmdb_id__isnull=True, imdb_id__isnull=True):
+                        key = (movie.name, movie.year)
+                        if key in name_year_pairs:
+                            existing_by_name_year[key] = movie
+
+                # Check each movie against the bulk query results
+                movies_actually_created = []
                 for movie in movies_to_create:
-                    # Find the movie by its unique identifiers
-                    if movie.tmdb_id:
-                        db_movie = Movie.objects.filter(tmdb_id=movie.tmdb_id).first()
-                    elif movie.imdb_id:
-                        db_movie = Movie.objects.filter(imdb_id=movie.imdb_id).first()
-                    else:
-                        db_movie = Movie.objects.filter(
-                            name=movie.name,
-                            year=movie.year,
-                            tmdb_id__isnull=True,
-                            imdb_id__isnull=True
-                        ).first()
+                    existing = None
+                    if movie.tmdb_id and movie.tmdb_id in existing_by_tmdb:
+                        existing = existing_by_tmdb[movie.tmdb_id]
+                    elif movie.imdb_id and movie.imdb_id in existing_by_imdb:
+                        existing = existing_by_imdb[movie.imdb_id]
+                    elif not movie.tmdb_id and not movie.imdb_id:
+                        existing = existing_by_name_year.get((movie.name, movie.year))
 
-                    if db_movie:
-                        created_movies[id(movie)] = db_movie
+                    if existing:
+                        created_movies[id(movie)] = existing
+                    else:
+                        movies_actually_created.append(movie)
+                        created_movies[id(movie)] = movie
+
+                # Bulk create only movies that don't exist
+                if movies_actually_created:
+                    Movie.objects.bulk_create(movies_actually_created)
 
             # Update existing movies
             if movies_to_update:
@@ -649,12 +673,16 @@ def process_movie_batch(account, batch, categories, relations, scan_start_time=N
                         movie.logo = movie._logo_to_update
                         movie.save(update_fields=['logo'])
 
-            # Update relations to reference the correct movie objects
+            # Update relations to reference the correct movie objects (with PKs)
             for relation in relations_to_create:
                 if id(relation.movie) in created_movies:
                     relation.movie = created_movies[id(relation.movie)]
 
-            # Handle relations
+            for relation in relations_to_update:
+                if id(relation.movie) in created_movies:
+                    relation.movie = created_movies[id(relation.movie)]
+
+            # All movies now have PKs, safe to bulk create/update relations
             if relations_to_create:
                 M3UMovieRelation.objects.bulk_create(relations_to_create, ignore_conflicts=True)
 
@@ -724,10 +752,10 @@ def process_series_batch(account, batch, categories, relations, scan_start_time=
             tmdb_id = series_data.get('tmdb') or series_data.get('tmdb_id')
             imdb_id = series_data.get('imdb') or series_data.get('imdb_id')
 
-            # Clean empty string IDs
-            if tmdb_id == '':
+            # Clean empty string IDs and zero values (some providers use 0 to indicate no ID)
+            if tmdb_id == '' or tmdb_id == 0 or tmdb_id == '0':
                 tmdb_id = None
-            if imdb_id == '':
+            if imdb_id == '' or imdb_id == 0 or imdb_id == '0':
                 imdb_id = None
 
             # Create a unique key for this series (priority: TMDB > IMDB > name+year)
@@ -886,12 +914,19 @@ def process_series_batch(account, batch, categories, relations, scan_start_time=
 
             # Handle logo assignment for existing series
             logo_updated = False
-            if logo_url and len(logo_url) <= 500 and logo_url in existing_logos:
-                new_logo = existing_logos[logo_url]
-                if series.logo != new_logo:
-                    series._logo_to_update = new_logo
+            if logo_url and len(logo_url) <= 500:
+                if logo_url in existing_logos:
+                    new_logo = existing_logos[logo_url]
+                    if series.logo_id != new_logo.id:
+                        series._logo_to_update = new_logo
+                        logo_updated = True
+                elif series.logo_id:
+                    # Logo URL exists but logo creation failed or logo not found
+                    # Clear the orphaned logo reference
+                    logger.warning(f"Logo URL provided but logo not found in database for series '{series.name}', clearing logo reference")
+                    series._logo_to_update = None
                     logo_updated = True
-            elif (not logo_url or len(logo_url) > 500) and series.logo:
+            elif (not logo_url or len(logo_url) > 500) and series.logo_id:
                 # Clear logo if no logo URL provided or URL is too long
                 series._logo_to_update = None
                 logo_updated = True
@@ -945,26 +980,41 @@ def process_series_batch(account, batch, categories, relations, scan_start_time=
             # First, create new series and get their IDs
             created_series = {}
             if series_to_create:
-                Series.objects.bulk_create(series_to_create, ignore_conflicts=True)
+                # Bulk query to check which series already exist
+                tmdb_ids = [s.tmdb_id for s in series_to_create if s.tmdb_id]
+                imdb_ids = [s.imdb_id for s in series_to_create if s.imdb_id]
+                name_year_pairs = [(s.name, s.year) for s in series_to_create if not s.tmdb_id and not s.imdb_id]
 
-                # Get the newly created series with their IDs
-                # We need to re-fetch them to get the primary keys
+                existing_by_tmdb = {s.tmdb_id: s for s in Series.objects.filter(tmdb_id__in=tmdb_ids)} if tmdb_ids else {}
+                existing_by_imdb = {s.imdb_id: s for s in Series.objects.filter(imdb_id__in=imdb_ids)} if imdb_ids else {}
+
+                existing_by_name_year = {}
+                if name_year_pairs:
+                    for series in Series.objects.filter(tmdb_id__isnull=True, imdb_id__isnull=True):
+                        key = (series.name, series.year)
+                        if key in name_year_pairs:
+                            existing_by_name_year[key] = series
+
+                # Check each series against the bulk query results
+                series_actually_created = []
                 for series in series_to_create:
-                    # Find the series by its unique identifiers
-                    if series.tmdb_id:
-                        db_series = Series.objects.filter(tmdb_id=series.tmdb_id).first()
-                    elif series.imdb_id:
-                        db_series = Series.objects.filter(imdb_id=series.imdb_id).first()
-                    else:
-                        db_series = Series.objects.filter(
-                            name=series.name,
-                            year=series.year,
-                            tmdb_id__isnull=True,
-                            imdb_id__isnull=True
-                        ).first()
+                    existing = None
+                    if series.tmdb_id and series.tmdb_id in existing_by_tmdb:
+                        existing = existing_by_tmdb[series.tmdb_id]
+                    elif series.imdb_id and series.imdb_id in existing_by_imdb:
+                        existing = existing_by_imdb[series.imdb_id]
+                    elif not series.tmdb_id and not series.imdb_id:
+                        existing = existing_by_name_year.get((series.name, series.year))
 
-                    if db_series:
-                        created_series[id(series)] = db_series
+                    if existing:
+                        created_series[id(series)] = existing
+                    else:
+                        series_actually_created.append(series)
+                        created_series[id(series)] = series
+
+                # Bulk create only series that don't exist
+                if series_actually_created:
+                    Series.objects.bulk_create(series_actually_created)
 
             # Update existing series
             if series_to_update:
@@ -980,12 +1030,16 @@ def process_series_batch(account, batch, categories, relations, scan_start_time=
                         series.logo = series._logo_to_update
                         series.save(update_fields=['logo'])
 
-            # Update relations to reference the correct series objects
+            # Update relations to reference the correct series objects (with PKs)
             for relation in relations_to_create:
                 if id(relation.series) in created_series:
                     relation.series = created_series[id(relation.series)]
 
-            # Handle relations
+            for relation in relations_to_update:
+                if id(relation.series) in created_series:
+                    relation.series = created_series[id(relation.series)]
+
+            # All series now have PKs, safe to bulk create/update relations
             if relations_to_create:
                 M3USeriesRelation.objects.bulk_create(relations_to_create, ignore_conflicts=True)
 
@@ -1204,20 +1258,15 @@ def refresh_series_episodes(account, series, external_series_id, episodes_data=N
                 else:
                     episodes_data = {}
 
-        # Clear existing episodes for this account to handle deletions
-        Episode.objects.filter(
-            series=series,
-            m3u_relations__m3u_account=account
-        ).delete()
+        # Fetch the series relation once — used both to pass into batch_process_episodes
+        # (so episode relations get the FK set) and to update metadata afterwards.
+        series_relation = M3USeriesRelation.objects.filter(
+            m3u_account=account,
+            external_series_id=external_series_id
+        ).first()
 
         # Process all episodes in batch
-        batch_process_episodes(account, series, episodes_data)
-
-        # Update the series relation to mark episodes as fetched
-        series_relation = M3USeriesRelation.objects.filter(
-            series=series,
-            m3u_account=account
-        ).first()
+        batch_process_episodes(account, series, episodes_data, series_relation=series_relation)
 
         if series_relation:
             custom_props = series_relation.custom_properties or {}
@@ -1231,8 +1280,19 @@ def refresh_series_episodes(account, series, external_series_id, episodes_data=N
         logger.error(f"Error refreshing episodes for series {series.name}: {str(e)}")
 
 
-def batch_process_episodes(account, series, episodes_data, scan_start_time=None):
-    """Process episodes in batches for better performance"""
+def batch_process_episodes(account, series, episodes_data, scan_start_time=None, series_relation=None):
+    """Process episodes in batches for better performance.
+
+    Note: Multiple streams can represent the same episode (e.g., different languages
+    or qualities). Each stream has a unique stream_id, but they share the same
+    season/episode number. We create one Episode record per (series, season, episode)
+    and multiple M3UEpisodeRelation records pointing to it.
+
+    series_relation, when provided, is stored as a FK on each M3UEpisodeRelation so
+    that CASCADE correctly removes episode relations when their parent series relation
+    is deleted, and so that stale-stream cleanup is scoped precisely to relations that
+    came from this specific provider query.
+    """
     if not episodes_data:
         return
 
@@ -1249,12 +1309,13 @@ def batch_process_episodes(account, series, episodes_data, scan_start_time=None)
     logger.info(f"Batch processing {len(all_episodes_data)} episodes for series {series.name}")
 
     # Extract episode identifiers
-    episode_keys = []
+    # Note: episode_keys may have duplicates when multiple streams represent same episode
+    episode_keys = set()  # Use set to track unique episode keys
     episode_ids = []
     for episode_data in all_episodes_data:
         season_num = episode_data['_season_number']
         episode_num = episode_data.get('episode_num', 0)
-        episode_keys.append((series.id, season_num, episode_num))
+        episode_keys.add((series.id, season_num, episode_num))
         episode_ids.append(str(episode_data.get('id')))
 
     # Pre-fetch existing episodes
@@ -1277,12 +1338,25 @@ def batch_process_episodes(account, series, episodes_data, scan_start_time=None)
     relations_to_create = []
     relations_to_update = []
 
+    # Track episodes we're creating in this batch to avoid duplicates
+    # Key: (series_id, season_number, episode_number) -> Episode object
+    episodes_pending_creation = {}
+
     for episode_data in all_episodes_data:
         try:
             episode_id = str(episode_data.get('id'))
             episode_name = episode_data.get('title', 'Unknown Episode')
-            season_number = episode_data['_season_number']
-            episode_number = episode_data.get('episode_num', 0)
+            # Ensure season and episode numbers are integers (API may return strings)
+            try:
+                season_number = int(episode_data['_season_number'])
+            except (ValueError, TypeError) as e:
+                logger.warning(f"Invalid season_number '{episode_data.get('_season_number')}' for episode '{episode_name}': {e}")
+                season_number = 0
+            try:
+                episode_number = int(episode_data.get('episode_num', 0))
+            except (ValueError, TypeError) as e:
+                logger.warning(f"Invalid episode_num '{episode_data.get('episode_num')}' for episode '{episode_name}': {e}")
+                episode_number = 0
             info = episode_data.get('info', {})
 
             # Extract episode metadata
@@ -1306,10 +1380,15 @@ def batch_process_episodes(account, series, episodes_data, scan_start_time=None)
                 if backdrop:
                     custom_props['backdrop_path'] = [backdrop]
 
-            # Find existing episode
+            # Find existing episode - check DB first, then pending creations
             episode_key = (series.id, season_number, episode_number)
             episode = existing_episodes.get(episode_key)
 
+            # Check if we already have this episode pending creation (multiple streams for same episode)
+            if not episode and episode_key in episodes_pending_creation:
+                episode = episodes_pending_creation[episode_key]
+                logger.debug(f"Reusing pending episode for S{season_number}E{episode_number} (stream_id: {episode_id})")
+
             if episode:
                 # Update existing episode
                 updated = False
@@ -1338,7 +1417,9 @@ def batch_process_episodes(account, series, episodes_data, scan_start_time=None)
                     episode.custom_properties = custom_props if custom_props else None
                     updated = True
 
-                if updated:
+                # Only add to update list if episode has a PK (exists in DB) and isn't already in list
+                # Episodes pending creation don't have PKs yet and will be created via bulk_create
+                if updated and episode.pk and episode not in episodes_to_update:
                     episodes_to_update.append(episode)
             else:
                 # Create new episode
@@ -1356,16 +1437,19 @@ def batch_process_episodes(account, series, episodes_data, scan_start_time=None)
                     custom_properties=custom_props if custom_props else None
                 )
                 episodes_to_create.append(episode)
+                # Track this episode so subsequent streams with same season/episode can reuse it
+                episodes_pending_creation[episode_key] = episode
 
             # Handle episode relation
             if episode_id in existing_relations:
                 # Update existing relation
                 relation = existing_relations[episode_id]
                 relation.episode = episode
+                relation.series_relation = series_relation
                 relation.container_extension = episode_data.get('container_extension', 'mp4')
                 relation.custom_properties = {
                     'info': episode_data,
-                    'season_number': season_number
+                    'season_number': season_number,
                 }
                 relation.last_seen = scan_start_time or timezone.now()  # Mark as seen during this scan
                 relations_to_update.append(relation)
@@ -1374,11 +1458,12 @@ def batch_process_episodes(account, series, episodes_data, scan_start_time=None)
                 relation = M3UEpisodeRelation(
                     m3u_account=account,
                     episode=episode,
+                    series_relation=series_relation,
                     stream_id=episode_id,
                     container_extension=episode_data.get('container_extension', 'mp4'),
                     custom_properties={
                         'info': episode_data,
-                        'season_number': season_number
+                        'season_number': season_number,
                     },
                     last_seen=scan_start_time or timezone.now()  # Mark as seen during this scan
                 )
@@ -1389,9 +1474,43 @@ def batch_process_episodes(account, series, episodes_data, scan_start_time=None)
 
     # Execute batch operations
     with transaction.atomic():
-        # Create new episodes
+        # Create new episodes - use ignore_conflicts in case of race conditions
         if episodes_to_create:
-            Episode.objects.bulk_create(episodes_to_create)
+            Episode.objects.bulk_create(episodes_to_create, ignore_conflicts=True)
+
+            # Re-fetch the created episodes to get their PKs
+            # We need to do this because bulk_create with ignore_conflicts doesn't set PKs
+            created_episode_keys = [
+                (ep.series_id, ep.season_number, ep.episode_number)
+                for ep in episodes_to_create
+            ]
+            db_episodes = Episode.objects.filter(series=series)
+            episode_pk_map = {
+                (ep.series_id, ep.season_number, ep.episode_number): ep
+                for ep in db_episodes
+            }
+
+            # Update relations to point to the actual DB episodes with PKs
+            for relation in relations_to_create:
+                ep = relation.episode
+                key = (ep.series_id, ep.season_number, ep.episode_number)
+                if key in episode_pk_map:
+                    relation.episode = episode_pk_map[key]
+
+        # Filter out relations with unsaved episodes (no PK)
+        # This can happen if bulk_create had a conflict and ignore_conflicts=True didn't save the episode
+        valid_relations_to_create = []
+        for relation in relations_to_create:
+            if relation.episode.pk is not None:
+                valid_relations_to_create.append(relation)
+            else:
+                season_num = relation.episode.season_number
+                episode_num = relation.episode.episode_number
+                logger.warning(
+                    f"Skipping relation for episode S{season_num}E{episode_num} "
+                    f"- episode not saved to database"
+                )
+        relations_to_create = valid_relations_to_create
 
         # Update existing episodes
         if episodes_to_update:
@@ -1400,16 +1519,35 @@ def batch_process_episodes(account, series, episodes_data, scan_start_time=None)
                 'tmdb_id', 'imdb_id', 'custom_properties'
             ])
 
-        # Create new episode relations
+        # Create new episode relations - use ignore_conflicts for stream_id duplicates
         if relations_to_create:
-            M3UEpisodeRelation.objects.bulk_create(relations_to_create)
+            M3UEpisodeRelation.objects.bulk_create(relations_to_create, ignore_conflicts=True)
 
         # Update existing episode relations
         if relations_to_update:
             M3UEpisodeRelation.objects.bulk_update(relations_to_update, [
-                'episode', 'container_extension', 'custom_properties', 'last_seen'
+                'episode', 'series_relation', 'container_extension', 'custom_properties', 'last_seen'
             ])
 
+        # Delete relations for streams no longer returned by the provider.
+        # Scope to this series_relation FK (post-migration rows) plus any legacy NULL rows
+        # for the same account+series (pre-migration rows whose stream is now gone — the
+        # update path only backfills the FK for streams still present in the response).
+        # Falls back to account+series scope when series_relation is None (shouldn't occur).
+        if series_relation is not None:
+            stale_qs = M3UEpisodeRelation.objects.filter(
+                Q(series_relation=series_relation) |
+                Q(series_relation__isnull=True, m3u_account=account, episode__series=series)
+            )
+        else:
+            stale_qs = M3UEpisodeRelation.objects.filter(
+                m3u_account=account,
+                episode__series=series
+            )
+        removed_count = stale_qs.exclude(stream_id__in=episode_ids).delete()[0]
+        if removed_count:
+            logger.info(f"Removed {removed_count} episode relations no longer present in provider for series {series.name}")
+
     logger.info(f"Batch processed episodes: {len(episodes_to_create)} new, {len(episodes_to_update)} updated, "
                 f"{len(relations_to_create)} new relations, {len(relations_to_update)} updated relations")
 
@@ -1494,16 +1632,12 @@ def cleanup_orphaned_vod_content(stale_days=0, scan_start_time=None, account_id=
     stale_movie_count = stale_movie_relations.count()
     stale_movie_relations.delete()
 
-    # Clean up stale series relations
+    # Clean up stale series relations.
+    # Episode relations are removed via CASCADE on the series_relation FK.
     stale_series_relations = M3USeriesRelation.objects.filter(**base_filters)
     stale_series_count = stale_series_relations.count()
     stale_series_relations.delete()
 
-    # Clean up stale episode relations
-    stale_episode_relations = M3UEpisodeRelation.objects.filter(**base_filters)
-    stale_episode_count = stale_episode_relations.count()
-    stale_episode_relations.delete()
-
     # Clean up movies with no relations (orphaned)
     # Safe to delete even during account-specific cleanup because if ANY account
     # has a relation, m3u_relations will not be null
@@ -1520,11 +1654,8 @@ def cleanup_orphaned_vod_content(stale_days=0, scan_start_time=None, account_id=
         logger.info(f"Deleting {orphaned_series_count} orphaned series with no M3U relations")
         orphaned_series.delete()
 
-    # Episodes will be cleaned up via CASCADE when series are deleted
-
     result = (f"Cleaned up {stale_movie_count} stale movie relations, "
               f"{stale_series_count} stale series relations, "
-              f"{stale_episode_count} stale episode relations, "
               f"{orphaned_movie_count} orphaned movies, and "
               f"{orphaned_series_count} orphaned series")
 
@@ -2075,33 +2206,3 @@ def refresh_movie_advanced_data(m3u_movie_relation_id, force_refresh=False):
     except Exception as e:
         logger.error(f"Error refreshing advanced movie data for relation {m3u_movie_relation_id}: {str(e)}")
         return f"Error: {str(e)}"
-
-
-def validate_logo_reference(obj, obj_type="object"):
-    """
-    Validate that a VOD logo reference exists in the database.
-    If not, set it to None to prevent foreign key constraint violations.
-
-    Args:
-        obj: Object with a logo attribute
-        obj_type: String description of the object type for logging
-
-    Returns:
-        bool: True if logo was valid or None, False if logo was invalid and cleared
-    """
-    if not hasattr(obj, 'logo') or not obj.logo:
-        return True
-
-    if not obj.logo.pk:
-        # Logo doesn't have a primary key, so it's not saved
-        obj.logo = None
-        return False
-
-    try:
-        # Verify the logo exists in the database
-        VODLogo.objects.get(pk=obj.logo.pk)
-        return True
-    except VODLogo.DoesNotExist:
-        logger.warning(f"VOD Logo with ID {obj.logo.pk} does not exist in database for {obj_type} '{getattr(obj, 'name', 'Unknown')}', setting to None")
-        obj.logo = None
-        return False

core/api_urls.py

@@ -6,6 +6,7 @@ from .api_views import (
     UserAgentViewSet,
     StreamProfileViewSet,
     CoreSettingsViewSet,
+    SystemNotificationViewSet,
     environment,
     version,
     rehash_streams_endpoint,
@@ -17,6 +18,7 @@ router = DefaultRouter()
 router.register(r'useragents', UserAgentViewSet, basename='useragent')
 router.register(r'streamprofiles', StreamProfileViewSet, basename='streamprofile')
 router.register(r'settings', CoreSettingsViewSet, basename='coresettings')
+router.register(r'notifications', SystemNotificationViewSet, basename='systemnotification')
 urlpatterns = [
     path('settings/env/', environment, name='token_refresh'),
     path('version/', version, name='version'),

core/api_views.py

@@ -3,20 +3,22 @@
 import json
 import ipaddress
 import logging
+from django.db import models
 from rest_framework import viewsets, status
 from rest_framework.response import Response
 from rest_framework.views import APIView
 from django.shortcuts import get_object_or_404
 from rest_framework.permissions import IsAuthenticated
 from rest_framework.decorators import api_view, permission_classes, action
-from drf_yasg.utils import swagger_auto_schema
-from drf_yasg import openapi
+from drf_spectacular.utils import extend_schema, OpenApiParameter
+from drf_spectacular.types import OpenApiTypes
 from .models import (
     UserAgent,
     StreamProfile,
     CoreSettings,
-    STREAM_HASH_KEY,
-    NETWORK_ACCESS,
+    STREAM_SETTINGS_KEY,
+    DVR_SETTINGS_KEY,
+    NETWORK_ACCESS_KEY,
     PROXY_SETTINGS_KEY,
 )
 from .serializers import (
@@ -68,16 +70,28 @@ class CoreSettingsViewSet(viewsets.ModelViewSet):
 
     def update(self, request, *args, **kwargs):
         instance = self.get_object()
+        old_value = instance.value
         response = super().update(request, *args, **kwargs)
-        if instance.key == STREAM_HASH_KEY:
-            if instance.value != request.data["value"]:
-                rehash_streams.delay(request.data["value"].split(","))
 
-        # If DVR pre/post offsets changed, reschedule upcoming recordings
-        try:
-            from core.models import DVR_PRE_OFFSET_MINUTES_KEY, DVR_POST_OFFSET_MINUTES_KEY
-            if instance.key in (DVR_PRE_OFFSET_MINUTES_KEY, DVR_POST_OFFSET_MINUTES_KEY):
-                if instance.value != request.data.get("value"):
+        # If stream settings changed and m3u_hash_key is different, rehash streams
+        if instance.key == STREAM_SETTINGS_KEY:
+            new_value = request.data.get("value", {})
+            if isinstance(new_value, dict) and isinstance(old_value, dict):
+                old_hash = old_value.get("m3u_hash_key", "")
+                new_hash = new_value.get("m3u_hash_key", "")
+                if old_hash != new_hash:
+                    hash_keys = new_hash.split(",") if isinstance(new_hash, str) else new_hash
+                    rehash_streams.delay(hash_keys)
+
+        # If DVR settings changed and pre/post offsets are different, reschedule upcoming recordings
+        if instance.key == DVR_SETTINGS_KEY:
+            new_value = request.data.get("value", {})
+            if isinstance(new_value, dict) and isinstance(old_value, dict):
+                old_pre = old_value.get("pre_offset_minutes")
+                new_pre = new_value.get("pre_offset_minutes")
+                old_post = old_value.get("post_offset_minutes")
+                new_post = new_value.get("post_offset_minutes")
+                if old_pre != new_pre or old_post != new_post:
                     try:
                         # Prefer async task if Celery is available
                         from apps.channels.tasks import reschedule_upcoming_recordings_for_offset_change
@@ -86,24 +100,23 @@ class CoreSettingsViewSet(viewsets.ModelViewSet):
                         # Fallback to synchronous implementation
                         from apps.channels.tasks import reschedule_upcoming_recordings_for_offset_change_impl
                         reschedule_upcoming_recordings_for_offset_change_impl()
-        except Exception:
-            pass
 
         return response
 
     def create(self, request, *args, **kwargs):
         response = super().create(request, *args, **kwargs)
-        # If creating DVR pre/post offset settings, also reschedule upcoming recordings
+        # If creating DVR settings with offset values, reschedule upcoming recordings
         try:
             key = request.data.get("key")
-            from core.models import DVR_PRE_OFFSET_MINUTES_KEY, DVR_POST_OFFSET_MINUTES_KEY
-            if key in (DVR_PRE_OFFSET_MINUTES_KEY, DVR_POST_OFFSET_MINUTES_KEY):
-                try:
-                    from apps.channels.tasks import reschedule_upcoming_recordings_for_offset_change
-                    reschedule_upcoming_recordings_for_offset_change.delay()
-                except Exception:
-                    from apps.channels.tasks import reschedule_upcoming_recordings_for_offset_change_impl
-                    reschedule_upcoming_recordings_for_offset_change_impl()
+            if key == DVR_SETTINGS_KEY:
+                value = request.data.get("value", {})
+                if isinstance(value, dict) and ("pre_offset_minutes" in value or "post_offset_minutes" in value):
+                    try:
+                        from apps.channels.tasks import reschedule_upcoming_recordings_for_offset_change
+                        reschedule_upcoming_recordings_for_offset_change.delay()
+                    except Exception:
+                        from apps.channels.tasks import reschedule_upcoming_recordings_for_offset_change_impl
+                        reschedule_upcoming_recordings_for_offset_change_impl()
         except Exception:
             pass
         return response
@@ -111,13 +124,13 @@ class CoreSettingsViewSet(viewsets.ModelViewSet):
     def check(self, request, *args, **kwargs):
         data = request.data
 
-        if data.get("key") == NETWORK_ACCESS:
+        if data.get("key") == NETWORK_ACCESS_KEY:
             client_ip = ipaddress.ip_address(get_client_ip(request))
 
             in_network = {}
             invalid = []
 
-            value = json.loads(data.get("value", "{}"))
+            value = data.get("value", {})
             for key, val in value.items():
                 in_network[key] = []
                 cidrs = val.split(",")
@@ -143,7 +156,11 @@ class CoreSettingsViewSet(viewsets.ModelViewSet):
                     status=status.HTTP_200_OK,
                 )
 
-            return Response(in_network, status=status.HTTP_200_OK)
+            response_data = {
+                **in_network,
+                "client_ip": str(client_ip)
+            }
+            return Response(response_data, status=status.HTTP_200_OK)
 
         return Response({}, status=status.HTTP_200_OK)
 
@@ -157,8 +174,8 @@ class ProxySettingsViewSet(viewsets.ViewSet):
         """Get or create the proxy settings CoreSettings entry"""
         try:
             settings_obj = CoreSettings.objects.get(key=PROXY_SETTINGS_KEY)
-            settings_data = json.loads(settings_obj.value)
-        except (CoreSettings.DoesNotExist, json.JSONDecodeError):
+            settings_data = settings_obj.value
+        except CoreSettings.DoesNotExist:
             # Create default settings
             settings_data = {
                 "buffering_timeout": 15,
@@ -171,7 +188,7 @@ class ProxySettingsViewSet(viewsets.ViewSet):
                 key=PROXY_SETTINGS_KEY,
                 defaults={
                     "name": "Proxy Settings",
-                    "value": json.dumps(settings_data)
+                    "value": settings_data
                 }
             )
         return settings_obj, settings_data
@@ -193,8 +210,8 @@ class ProxySettingsViewSet(viewsets.ViewSet):
         serializer = ProxySettingsSerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
 
-        # Update the JSON data
-        settings_obj.value = json.dumps(serializer.validated_data)
+        # Update the JSON data - store as dict directly
+        settings_obj.value = serializer.validated_data
         settings_obj.save()
 
         return Response(serializer.validated_data)
@@ -209,8 +226,8 @@ class ProxySettingsViewSet(viewsets.ViewSet):
         serializer = ProxySettingsSerializer(data=updated_data)
         serializer.is_valid(raise_exception=True)
 
-        # Update the JSON data
-        settings_obj.value = json.dumps(serializer.validated_data)
+        # Update the JSON data - store as dict directly
+        settings_obj.value = serializer.validated_data
         settings_obj.save()
 
         return Response(serializer.validated_data)
@@ -225,10 +242,8 @@ class ProxySettingsViewSet(viewsets.ViewSet):
 
 
 
-@swagger_auto_schema(
-    method="get",
-    operation_description="Endpoint for environment details",
-    responses={200: "Environment variables"},
+@extend_schema(
+    description="Endpoint for environment details",
 )
 @api_view(["GET"])
 @permission_classes([Authenticated])
@@ -298,10 +313,8 @@ def environment(request):
     )
 
 
-@swagger_auto_schema(
-    method="get",
-    operation_description="Get application version information",
-    responses={200: "Version information"},
+@extend_schema(
+    description="Get application version information",
 )
 
 @api_view(["GET"])
@@ -317,10 +330,8 @@ def version(request):
     )
 
 
-@swagger_auto_schema(
-    method="post",
-    operation_description="Trigger rehashing of all streams",
-    responses={200: "Rehash task started"},
+@extend_schema(
+    description="Trigger rehashing of all streams",
 )
 @api_view(["POST"])
 @permission_classes([Authenticated])
@@ -328,8 +339,8 @@ def rehash_streams_endpoint(request):
     """Trigger the rehash streams task"""
     try:
         # Get the current hash keys from settings
-        hash_key_setting = CoreSettings.objects.get(key=STREAM_HASH_KEY)
-        hash_keys = hash_key_setting.value.split(",")
+        hash_key = CoreSettings.get_m3u_hash_key()
+        hash_keys = hash_key.split(",") if isinstance(hash_key, str) else hash_key
 
         # Queue the rehash task
         task = rehash_streams.delay(hash_keys)
@@ -340,10 +351,10 @@ def rehash_streams_endpoint(request):
             "task_id": task.id
         }, status=status.HTTP_200_OK)
 
-    except CoreSettings.DoesNotExist:
+    except Exception as e:
         return Response({
             "success": False,
-            "message": "Hash key settings not found"
+            "message": f"Error triggering rehash: {str(e)}"
         }, status=status.HTTP_400_BAD_REQUEST)
 
     except Exception as e:
@@ -367,9 +378,8 @@ class TimezoneListView(APIView):
     def get_permissions(self):
         return [Authenticated()]
 
-    @swagger_auto_schema(
-        operation_description="Get list of all supported timezones",
-        responses={200: openapi.Response('List of timezones with grouping by region')}
+    @extend_schema(
+        description="Get list of all supported timezones",
     )
     def get(self, request):
         import pytz
@@ -457,3 +467,159 @@ def get_system_events(request):
         return Response({
             'error': 'Failed to fetch system events'
         }, status=status.HTTP_500_INTERNAL_SERVER_ERROR)
+
+
+# ─────────────────────────────
+# System Notifications API
+# ─────────────────────────────
+from .models import SystemNotification, NotificationDismissal
+from .serializers import SystemNotificationSerializer, NotificationDismissalSerializer
+from django.utils import timezone as dj_timezone
+
+
+class SystemNotificationViewSet(viewsets.ModelViewSet):
+    """
+    API endpoint for system notifications.
+    Users can view active notifications and dismiss them.
+    Admins can create and manage notifications.
+    """
+    serializer_class = SystemNotificationSerializer
+    permission_classes = [IsAuthenticated]
+
+    def get_queryset(self):
+        """
+        Return notifications based on user permissions.
+        Filter out expired and dismissed notifications for regular users.
+        Evaluate conditions for developer notifications.
+        """
+        from core.developer_notifications import evaluate_conditions
+        from django.core.cache import cache
+
+        user = self.request.user
+        now = dj_timezone.now()
+
+        queryset = SystemNotification.objects.filter(is_active=True)
+
+        # Filter out expired notifications
+        queryset = queryset.filter(
+            models.Q(expires_at__isnull=True) | models.Q(expires_at__gt=now)
+        )
+
+        # Filter admin-only notifications for non-admins
+        if getattr(user, 'user_level', 0) < 10:
+            queryset = queryset.filter(admin_only=False)
+
+        # For developer notifications, evaluate conditions
+        # Cache the evaluation per notification to avoid repeated condition checks
+        notifications_to_exclude = []
+        developer_notifications = queryset.filter(source=SystemNotification.Source.DEVELOPER)
+
+        for notification in developer_notifications:
+            action_data = notification.action_data or {}
+            conditions = action_data.get('condition', [])
+
+            if not conditions:
+                continue
+
+            # Cache key based on notification ID and current settings
+            # Cache for 5 minutes to balance freshness with performance
+            cache_key = f'dev_notif_condition_{notification.id}_{user.id}'
+            should_show = cache.get(cache_key)
+
+            if should_show is None:
+                should_show = evaluate_conditions(conditions, user)
+                cache.set(cache_key, should_show, timeout=300)  # 5 minutes
+
+            if not should_show:
+                notifications_to_exclude.append(notification.id)
+
+        if notifications_to_exclude:
+            queryset = queryset.exclude(id__in=notifications_to_exclude)
+
+        return queryset
+
+    def get_serializer_context(self):
+        context = super().get_serializer_context()
+        context['request'] = self.request
+        return context
+
+    def list(self, request):
+        """
+        List all active notifications for the current user.
+        Optionally filter by dismissed status.
+        """
+        queryset = self.get_queryset()
+
+        # Optional: filter out already dismissed notifications
+        include_dismissed = request.query_params.get('include_dismissed', 'false').lower() == 'true'
+        if not include_dismissed:
+            dismissed_ids = NotificationDismissal.objects.filter(
+                user=request.user
+            ).values_list('notification_id', flat=True)
+            queryset = queryset.exclude(id__in=dismissed_ids)
+
+        serializer = self.get_serializer(queryset, many=True)
+        return Response({
+            'notifications': serializer.data,
+            'count': len(serializer.data),
+            'unread_count': queryset.count()
+        })
+
+    @action(detail=True, methods=['post'], url_path='dismiss')
+    def dismiss(self, request, pk=None):
+        """Dismiss a notification for the current user."""
+        notification = self.get_object()
+        action_taken = request.data.get('action_taken', None)
+
+        dismissal, created = NotificationDismissal.objects.get_or_create(
+            user=request.user,
+            notification=notification,
+            defaults={'action_taken': action_taken}
+        )
+
+        if not created and action_taken:
+            dismissal.action_taken = action_taken
+            dismissal.save()
+
+        return Response({
+            'success': True,
+            'message': 'Notification dismissed',
+            'notification_key': notification.notification_key
+        })
+
+    @action(detail=False, methods=['post'], url_path='dismiss-all')
+    def dismiss_all(self, request):
+        """Dismiss all notifications for the current user."""
+        notifications = self.get_queryset()
+
+        # Get notifications not yet dismissed
+        dismissed_ids = NotificationDismissal.objects.filter(
+            user=request.user
+        ).values_list('notification_id', flat=True)
+        to_dismiss = notifications.exclude(id__in=dismissed_ids)
+
+        # Create dismissals for all
+        dismissals = [
+            NotificationDismissal(user=request.user, notification=n)
+            for n in to_dismiss
+        ]
+        NotificationDismissal.objects.bulk_create(dismissals, ignore_conflicts=True)
+
+        return Response({
+            'success': True,
+            'dismissed_count': len(dismissals)
+        })
+
+    @action(detail=False, methods=['get'], url_path='count')
+    def unread_count(self, request):
+        """Get count of unread notifications."""
+        queryset = self.get_queryset()
+        dismissed_ids = NotificationDismissal.objects.filter(
+            user=request.user
+        ).values_list('notification_id', flat=True)
+        unread_count = queryset.exclude(id__in=dismissed_ids).count()
+
+        return Response({
+            'unread_count': unread_count
+        })
+

core/apps.py

@@ -1,6 +1,6 @@
 from django.apps import AppConfig
 from django.conf import settings
-import os, logging
+import logging
 
 # Define TRACE level (5 is below DEBUG which is 10)
 TRACE = 5
@@ -15,6 +15,7 @@ def trace(self, message, *args, **kwargs):
 # Add the trace method to the Logger class
 logging.Logger.trace = trace
 
+
 class CoreConfig(AppConfig):
     default_auto_field = 'django.db.models.BigAutoField'
     name = 'core'
@@ -22,3 +23,38 @@ class CoreConfig(AppConfig):
     def ready(self):
         # Import signals to ensure they get registered
         import core.signals
+        from dispatcharr.app_initialization import should_skip_initialization
+
+        # Sync developer notifications and check for version updates on startup
+        # Only run in the main process (not in management commands, migrations, or workers)
+        if should_skip_initialization():
+            return
+
+        self._sync_developer_notifications()
+        self._check_version_update()
+
+    def _sync_developer_notifications(self):
+        """Sync developer notifications from JSON file to database."""
+        from django.db import connection
+        import logging
+
+        logger = logging.getLogger(__name__)
+
+
+        try:
+            from core.developer_notifications import sync_developer_notifications
+            sync_developer_notifications()
+        except Exception as e:
+            logger.warning(f"Failed to sync developer notifications on startup: {e}")
+
+    def _check_version_update(self):
+        """Check for version updates on startup."""
+        import logging
+
+        logger = logging.getLogger(__name__)
+
+        try:
+            from core.tasks import check_for_version_update
+            check_for_version_update.delay()
+        except Exception as e:
+            logger.warning(f"Failed to check for version updates on startup: {e}")

core/developer_notifications.py

@@ -0,0 +1,412 @@
+"""
+Developer Notification Sync Service
+
+Handles syncing developer-defined notifications from the JSON file to the database.
+This ensures users receive important notifications from the development team
+about recommended settings, security updates, and other announcements.
+
+JSON Schema (see fixtures/developer_notifications.json):
+    {
+        "id": str,                      # REQUIRED - Unique identifier (notification_key)
+        "title": str,                   # REQUIRED - Notification heading
+        "message": str,                 # REQUIRED - Notification body text
+
+        "notification_type": str,       # OPTIONAL - 'version_update', 'setting_recommendation', 'announcement', 'warning', 'info' (default: 'info')
+        "priority": str,                # OPTIONAL - 'low', 'normal', 'high', 'critical' (default: 'normal')
+        "min_version": str | null,      # OPTIONAL - Minimum version (inclusive), e.g., "0.17.0" (default: null)
+        "max_version": str | null,      # OPTIONAL - Maximum version (inclusive), e.g., "0.18.1" (default: null)
+        "created_at": str,              # OPTIONAL - ISO timestamp for tracking
+        "expires_at": str | null,       # OPTIONAL - ISO timestamp when notification expires (default: null)
+        "condition": list[str],         # OPTIONAL - List of condition check names, AND logic (default: [])
+        "user_level": str,              # OPTIONAL - 'all' or 'admin' (default: 'all')
+        "action_url": str | null,       # OPTIONAL - Internal navigation URL (e.g., "/settings#network-access")
+        "action_text": str | null,      # OPTIONAL - Text for action button (required if action_url is set)
+    }
+
+Condition Checks:
+    Conditions are function names from CONDITION_CHECKS registry that evaluate
+    whether a notification should be shown. All conditions must pass (AND logic).
+
+    Available conditions:
+        - 'm3u_epg_network_insecure': M3U/EPG endpoint allows access from anywhere
+
+    To add new conditions:
+        1. Define a function: check_your_condition(user) -> bool
+        2. Add to CONDITION_CHECKS registry
+        3. Reference in JSON: "condition": ["your_condition"]
+
+Sync Behavior:
+    - Runs on startup (see apps.py)
+    - Runs when relevant settings change (see signals.py)
+    - Adds new notifications if in version range and not expired
+    - Updates existing notifications with latest data
+    - Removes notifications that are:
+        * No longer in JSON file
+        * Out of current version range
+        * Past expiration date
+    - Sends websocket event to refresh frontend
+    - Cache invalidated when triggering settings change
+"""
+import json
+import logging
+from datetime import datetime
+from pathlib import Path
+from typing import Any, Callable
+
+from django.conf import settings
+from django.db import models
+from django.utils import timezone
+from packaging import version
+
+from version import __version__
+
+logger = logging.getLogger(__name__)
+
+# Path to developer notifications JSON file
+NOTIFICATIONS_FILE = Path(__file__).parent / 'fixtures' / 'developer_notifications.json'
+
+
+# ─────────────────────────────
+# Condition Checks
+# ─────────────────────────────
+# Each condition function receives (user) and returns True if the notification should show
+
+def check_network_access_is_default(user, endpoint: str = 'M3U_EPG') -> bool:
+    """
+    Check if network access settings for a specific endpoint are insecure (allow all).
+
+    Args:
+        user: The user object (unused but required for condition check signature)
+        endpoint: The endpoint to check (e.g., 'M3U_EPG', 'XC_API')
+
+    Returns:
+        True if the notification should show (insecure settings detected)
+    """
+    from core.models import CoreSettings, NETWORK_ACCESS_KEY
+
+    try:
+        network_settings = CoreSettings._get_group(NETWORK_ACCESS_KEY, {})
+
+        # Empty settings are secure (defaults to local network only)
+        if not network_settings:
+            return False
+
+        # Get the specific endpoint's allowed networks (stored as comma-separated string)
+        allowed_networks_str = network_settings.get(endpoint, '')
+        if not allowed_networks_str:
+            return False
+
+        # Parse comma-separated network addresses
+        allowed_networks = [net.strip() for net in allowed_networks_str.split(',')]
+
+        # Check if settings allow access from anywhere (insecure)
+        if '0.0.0.0/0' in allowed_networks or '::/0' in allowed_networks:
+            return True
+
+        return False
+    except Exception as e:
+        logger.warning(f"Error checking network_access_is_default condition for {endpoint}: {e}")
+        return False
+
+
+# Registry of all available condition checks
+CONDITION_CHECKS: dict[str, Callable] = {
+    'm3u_epg_network_insecure': lambda user: check_network_access_is_default(user, 'M3U_EPG'),
+    # Add more conditions here as needed
+    # 'transcode_not_configured': check_transcode_not_configured,
+    # 'no_backup_configured': check_no_backup_configured,
+}
+
+
+# ─────────────────────────────
+# Version Utilities
+# ─────────────────────────────
+
+def parse_version(version_str: str | None) -> version.Version | None:
+    """Parse a version string, returning None if invalid or empty."""
+    if not version_str:
+        return None
+    try:
+        return version.parse(version_str)
+    except Exception:
+        return None
+
+
+def is_version_in_range(
+    current_version: str,
+    min_version: str | None,
+    max_version: str | None
+) -> bool:
+    """Check if current version is within the specified range."""
+    current = parse_version(current_version)
+    if not current:
+        return True  # If we can't parse version, show notification
+
+    min_ver = parse_version(min_version)
+    max_ver = parse_version(max_version)
+
+    if min_ver and current < min_ver:
+        return False
+    if max_ver and current > max_ver:
+        return False
+
+    return True
+
+
+# ─────────────────────────────
+# Notification Evaluation
+# ─────────────────────────────
+
+def evaluate_conditions(conditions: list[str] | str | None, user) -> bool:
+    """
+    Evaluate notification conditions for a user.
+    All conditions must pass (AND logic).
+    """
+    if not conditions:
+        return True
+
+    # Normalize to list
+    if isinstance(conditions, str):
+        conditions = [conditions]
+
+    for condition in conditions:
+        if condition not in CONDITION_CHECKS:
+            logger.warning(f"Unknown condition: {condition}")
+            continue
+
+        try:
+            if not CONDITION_CHECKS[condition](user):
+                return False
+        except Exception as e:
+            logger.error(f"Error evaluating condition {condition}: {e}")
+            # On error, skip this condition (fail open)
+            continue
+
+    return True
+
+
+def should_show_notification(notification_data: dict, user) -> bool:
+    """
+    Determine if a notification should be shown to a specific user.
+    Checks version range, user level, and conditions.
+    """
+    # Check version range
+    if not is_version_in_range(
+        __version__,
+        notification_data.get('min_version'),
+        notification_data.get('max_version')
+    ):
+        return False
+
+    # Check user level
+    user_level = notification_data.get('user_level', 'all')
+    if user_level == 'admin' and getattr(user, 'user_level', 0) < 10:
+        return False
+
+    # Check conditions
+    conditions = notification_data.get('condition', [])
+    if not evaluate_conditions(conditions, user):
+        return False
+
+    return True
+
+
+# ─────────────────────────────
+# Sync Service
+# ─────────────────────────────
+
+def load_developer_notifications() -> list[dict]:
+    """Load notifications from the JSON file."""
+    if not NOTIFICATIONS_FILE.exists():
+        logger.warning(f"Developer notifications file not found: {NOTIFICATIONS_FILE}")
+        return []
+
+    try:
+        with open(NOTIFICATIONS_FILE, 'r', encoding='utf-8') as f:
+            data = json.load(f)
+        return data.get('notifications', [])
+    except json.JSONDecodeError as e:
+        logger.error(f"Error parsing developer notifications JSON: {e}")
+        return []
+    except Exception as e:
+        logger.error(f"Error loading developer notifications: {e}")
+        return []
+
+
+def sync_developer_notifications() -> dict[str, int]:
+    """
+    Sync developer notifications from JSON file to database.
+
+    - Adds new notifications that don't exist in the DB
+    - Removes DB notifications that are no longer in the JSON file
+    - Updates existing notifications if they've changed
+
+    Returns a dict with counts of added, updated, and removed notifications.
+    """
+    from core.models import SystemNotification
+
+    results = {'added': 0, 'updated': 0, 'removed': 0, 'skipped': 0}
+
+    notifications = load_developer_notifications()
+    json_notification_keys = set()
+    notifications_to_remove = set()  # Track notifications to remove (out of range or expired)
+
+    for notif_data in notifications:
+        notification_id = notif_data.get('id')
+        if not notification_id:
+            logger.warning("Notification missing 'id' field, skipping")
+            results['skipped'] += 1
+            continue
+
+        json_notification_keys.add(notification_id)
+
+        # Check version constraints (only add if current version is in range)
+        if not is_version_in_range(
+            __version__,
+            notif_data.get('min_version'),
+            notif_data.get('max_version')
+        ):
+            logger.debug(f"Notification {notification_id} not in version range, marking for removal")
+            results['skipped'] += 1
+            notifications_to_remove.add(notification_id)
+            continue
+
+        # Parse expires_at if provided
+        expires_at = None
+        if notif_data.get('expires_at'):
+            try:
+                expires_at = datetime.fromisoformat(
+                    notif_data['expires_at'].replace('Z', '+00:00')
+                )
+                # Skip if already expired and mark for removal
+                if expires_at < timezone.now():
+                    logger.debug(f"Notification {notification_id} has expired, marking for removal")
+                    results['skipped'] += 1
+                    notifications_to_remove.add(notification_id)
+                    continue
+            except (ValueError, TypeError) as e:
+                logger.warning(f"Invalid expires_at for {notification_id}: {e}")
+
+        # Map notification_type from JSON to model choices
+        type_mapping = {
+            'version_update': SystemNotification.NotificationType.VERSION_UPDATE,
+            'setting_recommendation': SystemNotification.NotificationType.SETTING_RECOMMENDATION,
+            'announcement': SystemNotification.NotificationType.ANNOUNCEMENT,
+            'warning': SystemNotification.NotificationType.WARNING,
+            'info': SystemNotification.NotificationType.INFO,
+        }
+        notification_type = type_mapping.get(
+            notif_data.get('notification_type', 'info'),
+            SystemNotification.NotificationType.INFO
+        )
+
+        # Map priority
+        priority_mapping = {
+            'low': SystemNotification.Priority.LOW,
+            'normal': SystemNotification.Priority.NORMAL,
+            'high': SystemNotification.Priority.HIGH,
+            'critical': SystemNotification.Priority.CRITICAL,
+        }
+        priority = priority_mapping.get(
+            notif_data.get('priority', 'normal'),
+            SystemNotification.Priority.NORMAL
+        )
+
+        # Prepare action_data
+        action_data = {
+            'action_url': notif_data.get('action_url'),
+            'action_text': notif_data.get('action_text'),
+            'condition': notif_data.get('condition', []),
+            'min_version': notif_data.get('min_version'),
+            'max_version': notif_data.get('max_version'),
+            'user_level': notif_data.get('user_level', 'all'),
+        }
+
+        # Determine if admin-only based on user_level
+        admin_only = notif_data.get('user_level', 'all') == 'admin'
+
+        # Create or update the notification
+        notification, created = SystemNotification.objects.update_or_create(
+            notification_key=notification_id,
+            defaults={
+                'notification_type': notification_type,
+                'priority': priority,
+                'source': SystemNotification.Source.DEVELOPER,
+                'title': notif_data.get('title', 'Notification'),
+                'message': notif_data.get('message', ''),
+                'action_data': action_data,
+                'is_active': True,
+                'admin_only': admin_only,
+                'expires_at': expires_at,
+            }
+        )
+
+        if created:
+            logger.info(f"Added developer notification: {notification_id}")
+            results['added'] += 1
+        else:
+            logger.debug(f"Updated developer notification: {notification_id}")
+            results['updated'] += 1
+
+    # Remove developer notifications that are:
+    # - No longer in the JSON file, OR
+    # - Out of version range for the current version, OR
+    # - Expired
+    removed_count, _ = SystemNotification.objects.filter(
+        source=SystemNotification.Source.DEVELOPER
+    ).filter(
+        models.Q(notification_key__in=notifications_to_remove) |
+        ~models.Q(notification_key__in=json_notification_keys)
+    ).delete()
+
+    if removed_count:
+        logger.info(f"Removed {removed_count} obsolete/expired/out-of-range developer notification(s)")
+        results['removed'] = removed_count
+
+    logger.info(
+        f"Developer notification sync complete: "
+        f"{results['added']} added, {results['updated']} updated, "
+        f"{results['removed']} removed, {results['skipped']} skipped"
+    )
+
+    # Send websocket notification to frontend to refresh notifications
+    try:
+        from core.utils import send_websocket_update
+        send_websocket_update('updates', 'update', {
+            'type': 'notifications_cleared',
+        })
+        logger.debug("Sent websocket notification for notifications refresh")
+    except Exception as e:
+        logger.warning(f"Failed to send websocket update: {e}")
+
+    return results
+
+
+def get_user_developer_notifications(user) -> list:
+    """
+    Get all developer notifications that should be shown to a specific user.
+    Evaluates conditions and user_level for each notification.
+    """
+    from core.models import SystemNotification
+
+    # Get all active developer notifications
+    notifications = SystemNotification.objects.filter(
+        source=SystemNotification.Source.DEVELOPER,
+        is_active=True
+    )
+
+    # Filter by admin_only based on user
+    if getattr(user, 'user_level', 0) < 10:
+        notifications = notifications.filter(admin_only=False)
+
+    # Filter by conditions
+    result = []
+    for notification in notifications:
+        action_data = notification.action_data or {}
+
+        # Evaluate conditions
+        conditions = action_data.get('condition', [])
+        if evaluate_conditions(conditions, user):
+            result.append(notification)
+
+    return result

core/fixtures/developer_notifications.json

@@ -0,0 +1,43 @@
+{
+  "_schema_documentation": {
+    "description": "Developer notification definitions. Each notification is evaluated at sync time.",
+    "fields": {
+      "id": "[REQUIRED] Unique identifier (notification_key in database).",
+      "notification_type": "[OPTIONAL] Type: 'version_update', 'setting_recommendation', 'announcement', 'warning', 'info'. Default: 'info'",
+      "priority": "[OPTIONAL] Priority level: 'low', 'normal', 'high', 'critical'. Default: 'normal'",
+      "title": "[REQUIRED] Notification title/heading.",
+      "message": "[REQUIRED] Detailed notification message body.",
+      "min_version": "[OPTIONAL] Minimum version (inclusive). null = no minimum. Example: '0.17.0'",
+      "max_version": "[OPTIONAL] Maximum version (inclusive). null = no maximum. Example: '0.18.1'",
+      "created_at": "[OPTIONAL] ISO timestamp when notification was created. For tracking only.",
+      "expires_at": "[OPTIONAL] ISO timestamp when notification expires. null = never expires. Example: '2026-12-31T23:59:59Z'",
+      "condition": "[OPTIONAL] Array of condition check names that must all pass. Empty/null = always show. Example: ['m3u_epg_network_insecure']",
+      "user_level": "[OPTIONAL] User level required: 'all' or 'admin'. Default: 'all'",
+      "action_url": "[OPTIONAL] Internal URL to navigate to when action button clicked. Example: '/settings#network-access'",
+      "action_text": "[OPTIONAL] Text for action button. Required if action_url is set. Example: 'Review Settings'"
+    },
+    "notes": [
+      "Notifications are synced from this file to database on startup and when relevant settings change",
+      "Out-of-range versions are automatically removed from database",
+      "Expired notifications are automatically removed from database",
+      "Conditions are evaluated per-user at display time (see CONDITION_CHECKS in developer_notifications.py)"
+    ]
+  },
+  "notifications": [
+    {
+      "id": "network_security_m3u_epg",
+      "notification_type": "warning",
+      "priority": "high",
+      "title": "Network Access Security Warning",
+      "message": "Your EPG/M3U output is accessible from any network. Consider restricting access to improve security.",
+      "min_version": null,
+      "max_version": null,
+      "created_at": "2026-02-02T00:00:00Z",
+      "expires_at": null,
+      "condition": ["m3u_epg_network_insecure"],
+      "user_level": "admin",
+      "action_url": "/settings#network-access",
+      "action_text": "Review Settings"
+    }
+  ]
+}

core/fixtures/initial_data.json

@@ -23,7 +23,7 @@
     "model": "core.streamprofile",
     "pk": 1,
     "fields": {
-      "name": "ffmpeg",
+      "name": "FFmpeg",
       "command": "ffmpeg",
       "parameters": "-i {streamUrl} -c:v copy -c:a copy -f mpegts pipe:1",
       "is_active": true,
@@ -34,11 +34,22 @@
     "model": "core.streamprofile",
     "pk": 2,
     "fields": {
-      "name": "streamlink",
+      "name": "Streamlink",
       "command": "streamlink",
       "parameters": "{streamUrl} best --stdout",
       "is_active": true,
       "user_agent": "1"
     }
+  },
+  {
+    "model": "core.streamprofile",
+    "pk": 3,
+    "fields": {
+      "name": "VLC",
+      "command": "cvlc",
+      "parameters": "-vv -I dummy --no-video-title-show --http-user-agent {userAgent} {streamUrl} --sout #standard{access=file,mux=ts,dst=-}",
+      "is_active": true,
+      "user_agent": "1"
+    }
   }
 ]

core/management/commands/reset_network_access.py

@@ -1,13 +1,13 @@
 # your_app/management/commands/update_column.py
 
 from django.core.management.base import BaseCommand
-from core.models import CoreSettings, NETWORK_ACCESS
+from core.models import CoreSettings, NETWORK_ACCESS_KEY
 
 
 class Command(BaseCommand):
     help = "Reset network access settings"
 
     def handle(self, *args, **options):
-        setting = CoreSettings.objects.get(key=NETWORK_ACCESS)
-        setting.value = "{}"
+        setting = CoreSettings.objects.get(key=NETWORK_ACCESS_KEY)
+        setting.value = {}
         setting.save()