Added stash GraphQL mutations. Added movies to GraphQL queries. Moved key management to profile page, only for approved users.

2025-03-31 06:14:56 +02:00
parent 09bba4fe1e
commit 1025285796
14 changed files with 721 additions and 235 deletions
--- a/src/stashes.js
+++ b/src/stashes.js
@@ -40,6 +40,21 @@ export function curateStash(stash, assets = {}) {
 	return curatedStash;
 }

+function curateStashed(stashed) {
+	if (!stashed) {
+		return null;
+	}
+
+	const curatedStashed = {
+		id: stashed.id,
+		stashId: stashed.stash_id,
+		actorId: stashed.actor_id,
+		createdAt: stashed.created_at,
+	};
+
+	return curatedStashed;
+}
+
 function curateStashEntry(stash, user) {
 	const curatedStashEntry = {
 		user_id: user?.id || undefined,
@@ -57,9 +72,17 @@ function verifyStashAccess(stash, sessionUser) {
 	}
 }

-export async function fetchStashById(stashId, sessionUser) {
+export async function fetchStashById(stashIdOrSlug, sessionUser) {
 	const stash = await knex('stashes')
-		.where('id', stashId)
+		.where((builder) => {
+			if (typeof stashIdOrSlug === 'number') {
+				builder.where('id', stashIdOrSlug);
+			} else {
+				builder
+					.where('slug', stashIdOrSlug)
+					.where('user_id', sessionUser.id);
+			}
+		})
 		.first();

 	verifyStashAccess(stash, sessionUser);
@@ -67,8 +90,16 @@ export async function fetchStashById(stashId, sessionUser) {
 	return curateStash(stash);
 }

-export async function fetchStashByUsernameAndSlug(username, stashSlug, sessionUser) {
-	const user = await knex('users').where('username', username).first();
+export async function fetchStashByUsernameAndSlug(usernameOrId, stashSlug, sessionUser) {
+	const user = await knex('users')
+		.where((builder) => {
+			if (typeof usernameOrId === 'number') {
+				builder.where('id', usernameOrId);
+			} else {
+				builder.where('username', usernameOrId);
+			}
+		})
+		.first();

 	if (!user) {
 		throw new HttpError('This user does not exist.', 404);
@@ -86,10 +117,22 @@ export async function fetchStashByUsernameAndSlug(username, stashSlug, sessionUs
 	return curateStash(stash, { user });
 }

-export async function fetchUserStashes(userId, reqUser) {
+export async function fetchUserStashes(usernameOrId, reqUser) {
+	const userId = typeof usernameOrId === 'number'
+		? usernameOrId
+		: await knex('users')
+			.where('username', usernameOrId)
+			.first()
+			.then((user) => user?.id);
+
+	if (!userId) {
+		throw new HttpError(`Could not find user '${usernameOrId}'`);
+	}
+
 	const stashes = await knex('stashes')
 		.select('stashes.*', 'stashes_meta.*')
 		.leftJoin('stashes_meta', 'stashes_meta.stash_id', 'stashes.id')
+		.leftJoin('users', 'users.id', 'stashes.user_id')
 		.where('user_id', userId)
 		.modify((builder) => {
 			if (userId !== reqUser?.id) {
@@ -172,7 +215,7 @@ export async function createStash(newStash, sessionUser) {
 	}
 }

-export async function updateStash(stashId, updatedStash, sessionUser) {
+export async function updateStash(stashIdOrSlug, updatedStash, sessionUser) {
 	if (!sessionUser) {
 		throw new HttpError('You are not authenthicated', 401);
 	}
@@ -182,11 +225,15 @@ export async function updateStash(stashId, updatedStash, sessionUser) {
 	}

 	try {
-		const stash = await knex('stashes')
-			.where({
-				id: stashId,
-				user_id: sessionUser.id,
+		const [stash] = await knex('stashes')
+			.where((builder) => {
+				if (typeof stashIdOrSlug === 'number') {
+					builder.where('id', stashIdOrSlug);
+				} else {
+					builder.where('slug', stashIdOrSlug);
+				}
 			})
+			.where('user_id', sessionUser.id)
 			.update(curateStashEntry(updatedStash))
 			.returning('*');

@@ -209,57 +256,86 @@ export async function removeStash(stashId, sessionUser) {
 		throw new HttpError('You are not authenthicated', 401);
 	}

-	const removed = await knex('stashes')
+	const stash = await fetchStashById(stashId, sessionUser);
+
+	if (!stash) {
+		throw new HttpError(`Could not find stash '${stashId}'`, 404);
+	}
+
+	const [removed] = await knex('stashes')
 		.where({
-			id: stashId,
+			id: stash.id,
 			user_id: sessionUser.id,
 			primary: false,
 		})
-		.delete();
+		.delete()
+		.returning('*');

 	if (removed === 0) {
 		throw new HttpError('Unable to remove this stash', 400);
 	}
+
+	return curateStash(stash);
 }

 export async function stashActor(actorId, stashId, sessionUser) {
 	const stash = await fetchStashById(stashId, sessionUser);

-	const [stashed] = await knex('stashes_actors')
-		.insert({
-			stash_id: stash.id,
-			actor_id: actorId,
-		})
-		.returning(['id', 'created_at']);
+	if (!stash) {
+		throw new HttpError(`Could not find stash '${stashId}'`, 404);
+	}

-	await indexApi.replace({
-		index: 'actors_stashed',
-		id: stashed.id,
-		doc: {
-			actor_id: actorId,
-			user_id: sessionUser.id,
-			stash_id: stashId,
-			created_at: Math.round(stashed.created_at.getTime() / 1000),
-		},
-	});
+	try {
+		const [stashed] = await knex('stashes_actors')
+			.insert({
+				stash_id: stash.id,
+				actor_id: actorId,
+			})
+			.returning('*');

-	logger.verbose(`${sessionUser.username} (${sessionUser.id}) stashed actor ${actorId} to stash ${stash.id} (${stash.name})`);
+		await indexApi.replace({
+			index: 'actors_stashed',
+			id: stashed.id,
+			doc: {
+				actor_id: actorId,
+				user_id: sessionUser.id,
+				stash_id: stash.id,
+				created_at: Math.round(stashed.created_at.getTime() / 1000),
+			},
+		});

-	refreshView('actors');
+		logger.verbose(`${sessionUser.username} (${sessionUser.id}) stashed actor ${actorId} to stash ${stash.id} (${stash.name})`);

-	return fetchDomainStashes('actor', actorId, sessionUser);
+		refreshView('actors');
+
+		// return fetchDomainStashes('actor', actorId, sessionUser);
+		return curateStashed(stashed);
+	} catch (error) {
+		if (error.routine === '_bt_check_unique') {
+			throw new HttpError(`Actor ${actorId} is already stashed in '${stash.name}'`, 409);
+		}
+
+		throw error;
+	}
 }

 export async function unstashActor(actorId, stashId, sessionUser) {
-	await knex
+	const stash = await fetchStashById(stashId, sessionUser);
+
+	if (!stash) {
+		throw new HttpError(`Could not find stash '${stashId}'`, 404);
+	}
+
+	const [unstashed] = await knex
 		.from('stashes_actors AS deletable')
 		.where('deletable.actor_id', actorId)
-		.where('deletable.stash_id', stashId)
+		.where('deletable.stash_id', stash.id)
 		.whereExists(knex('stashes_actors') // verify user owns this stash, complimentary to row-level security
 			.leftJoin('stashes', 'stashes.id', 'stashes_actors.stash_id')
 			.where('stashes_actors.stash_id', knex.raw('deletable.stash_id'))
 			.where('stashes.user_id', sessionUser.id))
-		.delete();
+		.delete()
+		.returning('*');

 	try {
 		await indexApi.callDelete({
@@ -268,7 +344,7 @@ export async function unstashActor(actorId, stashId, sessionUser) {
 				bool: {
 					must: [
 						{ equals: { actor_id: actorId } },
-						{ equals: { stash_id: stashId } },
+						{ equals: { stash_id: stash.id } },
 						{ equals: { user_id: sessionUser.id } },
 					],
 				},
@@ -278,52 +354,73 @@ export async function unstashActor(actorId, stashId, sessionUser) {
 		console.log(error);
 	}

-	logger.verbose(`${sessionUser.username} (${sessionUser.id}) unstashed actor ${actorId} from stash ${stashId}`);
+	logger.verbose(`${sessionUser.username} (${sessionUser.id}) unstashed actor ${actorId} from stash ${stashId} (${stash.name})`);

 	refreshView('actors');

-	return fetchDomainStashes('actor', actorId, sessionUser);
+	// return fetchDomainStashes('actor', actorId, sessionUser);
+	return curateStashed(unstashed);
 }

 export async function stashScene(sceneId, stashId, sessionUser) {
 	const stash = await fetchStashById(stashId, sessionUser);

-	const [stashed] = await knex('stashes_scenes')
-		.insert({
-			stash_id: stash.id,
-			scene_id: sceneId,
-		})
-		.returning(['id', 'created_at']);
+	if (!stash) {
+		throw new HttpError(`Could not find stash '${stashId}'`, 404);
+	}

-	await indexApi.replace({
-		index: 'scenes_stashed',
-		id: stashed.id,
-		doc: {
-			// ...doc.replace.doc,
-			scene_id: sceneId,
-			user_id: sessionUser.id,
-			stash_id: stashId,
-			created_at: Math.round(stashed.created_at.getTime() / 1000),
-		},
-	});
+	try {
+		const [stashed] = await knex('stashes_scenes')
+			.insert({
+				stash_id: stash.id,
+				scene_id: sceneId,
+			})
+			.returning('*');

-	logger.verbose(`${sessionUser.username} (${sessionUser.id}) stashed scene ${sceneId} to stash ${stash.id} (${stash.name})`);
+		await indexApi.replace({
+			index: 'scenes_stashed',
+			id: stashed.id,
+			doc: {
+				// ...doc.replace.doc,
+				scene_id: sceneId,
+				user_id: sessionUser.id,
+				stash_id: stash.id,
+				created_at: Math.round(stashed.created_at.getTime() / 1000),
+			},
+		});

-	refreshView('scenes');
+		logger.verbose(`${sessionUser.username} (${sessionUser.id}) stashed scene ${sceneId} to stash ${stash.id} (${stash.name})`);

-	return fetchDomainStashes('scene', sceneId, sessionUser);
+		refreshView('scenes');
+
+		// return fetchDomainStashes('scene', sceneId, sessionUser);
+		return curateStashed(stashed);
+	} catch (error) {
+		if (error.routine === '_bt_check_unique') {
+			throw new HttpError(`Scene ${sceneId} is already stashed in '${stash.name}'`, 409);
+		}
+
+		throw error;
+	}
 }

 export async function unstashScene(sceneId, stashId, sessionUser) {
-	await knex
+	const stash = await fetchStashById(stashId, sessionUser);
+
+	if (!stash) {
+		throw new HttpError(`Could not find stash '${stashId}'`, 404);
+	}
+
+	const [unstashed] = await knex
 		.from('stashes_scenes AS deletable')
 		.where('deletable.scene_id', sceneId)
-		.where('deletable.stash_id', stashId)
+		.where('deletable.stash_id', stash.id)
 		.whereExists(knex('stashes_scenes') // verify user owns this stash, complimentary to row-level security
 			.leftJoin('stashes', 'stashes.id', 'stashes_scenes.stash_id')
 			.where('stashes_scenes.stash_id', knex.raw('deletable.stash_id'))
 			.where('stashes.user_id', sessionUser.id))
-		.delete();
+		.delete()
+		.returning('*');

 	await indexApi.callDelete({
 		index: 'scenes_stashed',
@@ -331,57 +428,78 @@ export async function unstashScene(sceneId, stashId, sessionUser) {
 			bool: {
 				must: [
 					{ equals: { scene_id: sceneId } },
-					{ equals: { stash_id: stashId } },
+					{ equals: { stash_id: stash.id } },
 					{ equals: { user_id: sessionUser.id } },
 				],
 			},
 		},
 	});

-	logger.verbose(`${sessionUser.username} (${sessionUser.id}) unstashed scene ${sceneId} from stash ${stashId}`);
+	logger.verbose(`${sessionUser.username} (${sessionUser.id}) unstashed scene ${sceneId} from stash ${stash.id} (${stash.name})`);

 	refreshView('scenes');

-	return fetchDomainStashes('scene', sceneId, sessionUser);
+	// return fetchDomainStashes('scene', sceneId, sessionUser);
+	return curateStashed(unstashed);
 }

 export async function stashMovie(movieId, stashId, sessionUser) {
 	const stash = await fetchStashById(stashId, sessionUser);

-	const [stashed] = await knex('stashes_movies')
-		.insert({
-			stash_id: stash.id,
-			movie_id: movieId,
-		})
-		.returning(['id', 'created_at']);
+	if (!stash) {
+		throw new HttpError(`Could not find stash '${stashId}'`, 404);
+	}

-	await indexApi.replace({
-		index: 'movies_stashed',
-		id: stashed.id,
-		doc: {
-			movie_id: movieId,
-			user_id: sessionUser.id,
-			stash_id: stashId,
-			created_at: Math.round(stashed.created_at.getTime() / 1000),
-		},
-	});
+	try {
+		const [stashed] = await knex('stashes_movies')
+			.insert({
+				stash_id: stash.id,
+				movie_id: movieId,
+			})
+			.returning('*');

-	logger.verbose(`${sessionUser.username} (${sessionUser.id}) stashed movie ${movieId} to stash ${stash.id} (${stash.name})`);
+		await indexApi.replace({
+			index: 'movies_stashed',
+			id: stashed.id,
+			doc: {
+				movie_id: movieId,
+				user_id: sessionUser.id,
+				stash_id: stash.id,
+				created_at: Math.round(stashed.created_at.getTime() / 1000),
+			},
+		});

-	refreshView('movies');
+		logger.verbose(`${sessionUser.username} (${sessionUser.id}) stashed movie ${movieId} to stash ${stash.id} (${stash.name})`);

-	return fetchDomainStashes('movie', movieId, sessionUser);
+		refreshView('movies');
+
+		// return fetchDomainStashes('movie', movieId, sessionUser);
+		return curateStashed(stashed);
+	} catch (error) {
+		if (error.routine === '_bt_check_unique') {
+			throw new HttpError(`Movie ${movieId} is already stashed in '${stash.name}'`, 409);
+		}
+
+		throw error;
+	}
 }

 export async function unstashMovie(movieId, stashId, sessionUser) {
-	await knex
+	const stash = await fetchStashById(stashId, sessionUser);
+
+	if (!stash) {
+		throw new HttpError(`Could not find stash '${stashId}'`, 404);
+	}
+
+	const [unstashed] = await knex
 		.from('stashes_movies AS deletable')
 		.where('deletable.movie_id', movieId)
-		.where('deletable.stash_id', stashId)
+		.where('deletable.stash_id', stash.id)
 		.whereExists(knex('stashes_movies') // verify user owns this stash, complimentary to row-level security
 			.leftJoin('stashes', 'stashes.id', 'stashes_movies.stash_id')
 			.where('stashes_movies.stash_id', knex.raw('deletable.stash_id'))
 			.where('stashes.user_id', sessionUser.id))
+		.returning('*')
 		.delete();

 	await indexApi.callDelete({
@@ -390,18 +508,19 @@ export async function unstashMovie(movieId, stashId, sessionUser) {
 			bool: {
 				must: [
 					{ equals: { movie_id: movieId } },
-					{ equals: { stash_id: stashId } },
+					{ equals: { stash_id: stash.id } },
 					{ equals: { user_id: sessionUser.id } },
 				],
 			},
 		},
 	});

-	logger.verbose(`${sessionUser.username} (${sessionUser.id}) unstashed movie ${movieId} from stash ${stashId}`);
+	logger.verbose(`${sessionUser.username} (${sessionUser.id}) unstashed movie ${movieId} from stash ${stash.id} (${stash.name})`);

 	refreshView('movies');

-	return fetchDomainStashes('movie', movieId, sessionUser);
+	// return fetchDomainStashes('movie', movieId, sessionUser);
+	return curateStashed(unstashed);
 }

 CronJob.from({
--- a/src/users.js
+++ b/src/users.js
@@ -25,8 +25,8 @@ export function curateUser(user, _assets = {}) {
 		id: user.id,
 		username: user.username,
 		email: user.email,
-		emailVerified: user.email_verified,
-		identityVerified: user.identity_verified,
+		isEmailVerified: user.email_verified,
+		isIdentityVerified: user.identity_verified,
 		avatar: `/media/avatars/${user.id}_${user.username}.png`,
 		role: user.role,
 		createdAt: user.created_at,
--- a/src/web/actors.js
+++ b/src/web/actors.js
@@ -8,6 +8,8 @@ import {
 	reviewActorRevision,
 } from '../actors.js';

+import { fetchStashByUsernameAndSlug } from '../stashes.js';
+
 export function curateActorsQuery(query) {
 	return {
 		query: query.q,
@@ -49,6 +51,7 @@ export const actorsSchema = `
 	extend type Query {
 		actors(
 			query: String
+			stash: String
 			limit: Int! = 30
 			page: Int! = 1
 			order: [String!]
@@ -115,14 +118,37 @@ function curateGraphqlActor(actor) {
 	};
 }

-export async function fetchActorsGraphql(query, _req) {
+function getOrder(query) {
+	if (query.order) {
+		return query.order;
+	}
+
+	if (query.query) {
+		return ['results', 'desc'];
+	}
+
+	if (query.stash) {
+		return ['stashed', 'desc'];
+	}
+
+	return ['likes', 'desc'];
+}
+
+export async function fetchActorsGraphql(query, req) {
+	const stash = query.stash && req.user
+		? await fetchStashByUsernameAndSlug(req.user.id, query.stash, req.user)
+		: null;
+
 	const {
 		actors,
 		total,
-	} = await fetchActors(query, {
+	} = await fetchActors({
+		query: query.query,
+		stashId: stash?.id,
+	}, {
 		limit: query.limit,
 		page: query.page,
-		order: query.order,
+		order: getOrder(query),
 		aggregateCountries: false,
 	});

--- a/src/web/graphql.js
+++ b/src/web/graphql.js
@@ -13,6 +13,12 @@ import {
 	fetchScenesByIdGraphql,
 } from './scenes.js';

+import {
+	moviesSchema,
+	fetchMoviesGraphql,
+	fetchMoviesByIdGraphql,
+} from './movies.js';
+
 import {
 	entitiesSchema,
 	fetchEntitiesGraphql,
@@ -25,20 +31,39 @@ import {
 	fetchActorsByIdGraphql,
 } from './actors.js';

+import {
+	stashesSchema,
+	fetchUserStashesGraphql,
+	fetchStashGraphql,
+	createStashGraphql,
+	updateStashGraphql,
+	removeStashGraphql,
+	stashSceneGraphql,
+	unstashSceneGraphql,
+	stashActorGraphql,
+	unstashActorGraphql,
+	stashMovieGraphql,
+	unstashMovieGraphql,
+} from './stashes.js';
+
 import { verifyKey } from '../auth.js';

 const schema = buildSchema(`
 	type Query {
-		movies(
-			limit: Int = 30
-		): ReleasesResult
+		_: Boolean
+	}
+
+	type Mutation {
+		_: Boolean
 	}

 	scalar Date

 	${scenesSchema}
+	${moviesSchema}
 	${actorsSchema}
 	${entitiesSchema}
+	${stashesSchema}
 `);

 const DateTimeScalar = new GraphQLScalarType({
@@ -71,6 +96,10 @@ export async function graphqlApi(req, res) {

 	await verifyKey(req.headers['api-user'], req.headers['api-key'], req);

+	req.user = { // eslint-disable-line no-param-reassign
+		id: Number(req.headers['api-user']),
+	};
+
 	const data = await graphql({
 		schema,
 		source: req.body.query,
@@ -80,9 +109,13 @@ export async function graphqlApi(req, res) {
 			DateScalar,
 		},
 		rootValue: {
+			// queries
 			scenes: async (query) => fetchScenesGraphql(query, req),
 			scene: async (query) => fetchScenesByIdGraphql(query, req),
 			scenesById: async (query) => fetchScenesByIdGraphql(query, req),
+			movies: async (query) => fetchMoviesGraphql(query, req),
+			movie: async (query) => fetchMoviesByIdGraphql(query, req),
+			moviesById: async (query) => fetchMoviesByIdGraphql(query, req),
 			actors: async (query) => fetchActorsGraphql(query, req),
 			actor: async (query, args, info) => fetchActorsByIdGraphql(query, req, info),
 			actorsById: async (query, args, info) => fetchActorsByIdGraphql(query, req, info),
@@ -90,6 +123,18 @@ export async function graphqlApi(req, res) {
 			entity: async (query, args, info) => fetchEntitiesByIdGraphql(query, req, info),
 			entitiesBySlug: async (query, args, info) => fetchEntitiesByIdGraphql(query, req, info),
 			entitiesById: async (query, args, info) => fetchEntitiesByIdGraphql(query, req, info),
+			stashes: async (query) => fetchUserStashesGraphql(query, req),
+			stash: async (query) => fetchStashGraphql(query, req),
+			// mutation
+			createStash: async (query) => createStashGraphql(query, req),
+			updateStash: async (query) => updateStashGraphql(query, req),
+			removeStash: async (query) => removeStashGraphql(query, req),
+			stashScene: async (query) => stashSceneGraphql(query, req),
+			unstashScene: async (query) => unstashSceneGraphql(query, req),
+			stashActor: async (query) => stashActorGraphql(query, req),
+			unstashActor: async (query) => unstashActorGraphql(query, req),
+			stashMovie: async (query) => stashMovieGraphql(query, req),
+			unstashMovie: async (query) => unstashMovieGraphql(query, req),
 		},
 	});

--- a/src/web/movies.js
+++ b/src/web/movies.js
@@ -1,8 +1,12 @@
 import { stringify } from '@brillout/json-serializer/stringify'; /* eslint-disable-line import/extensions */

-import { fetchMovies } from '../movies.js';
+import { fetchMovies, fetchMoviesById } from '../movies.js';
+import { fetchStashByUsernameAndSlug } from '../stashes.js';
 import { parseActorIdentifier } from '../query.js';
 import { getIdsBySlug } from '../cache.js';
+import slugify from '../../utils/slugify.js';
+import promiseProps from '../../utils/promise-props.js';
+import { HttpError } from '../errors.js';

 export async function curateMoviesQuery(query) {
 	return {
@@ -41,3 +45,112 @@ export async function fetchMoviesApi(req, res) {
 		total,
 	}));
 }
+
+export async function fetchMovieApi(req, res) {
+	const [movie] = await fetchMoviesById([Number(req.params.movieId)], { reqUser: req.user });
+
+	if (!movie) {
+		throw new HttpError(`No movie with ID ${req.params.movieId} found`, 404);
+	}
+
+	res.send(movie);
+}
+
+export const moviesSchema = `
+	extend type Query {
+		movies(
+			query: String
+			scope: String
+			entities: [String!]
+			actorIds: [String!]
+			tags: [String!]
+			stash: String
+			limit: Int! = 30
+			page: Int! = 1
+		): ReleasesResult
+
+		movie(
+			id: Int!
+		): Release
+
+		moviesById(
+			ids: [Int!]!
+		): [Release]
+	}
+`;
+
+function getScope(query) {
+	if (query.scope) {
+		return query.scope;
+	}
+
+	if (query.query) {
+		return 'results';
+	}
+
+	if (query.stash) {
+		return 'stashed';
+	}
+
+	return 'latest';
+}
+
+export async function fetchMoviesGraphql(query, req) {
+	const mainEntity = query.entities?.find((entity) => entity.charAt(0) !== '!');
+
+	const stash = query.stash && req.user
+		? await fetchStashByUsernameAndSlug(req.user.id, query.stash, req.user)
+		: null;
+
+	if (query.stash && !stash) {
+		throw new HttpError(`Could not find stash '${query.stash}'`, 404);
+	}
+
+	const {
+		tagIds,
+		notTagIds,
+		entityId,
+		notEntityIds,
+	} = await promiseProps({
+		tagIds: getIdsBySlug(query.tags?.filter((tag) => tag.charAt(0) !== '!'), 'tags'),
+		notTagIds: getIdsBySlug(query.tags?.filter((tag) => tag.charAt(0) === '!').map((tag) => tag.slice(1)).map((tag) => slugify(tag)), 'tags'),
+		entityId: getIdsBySlug([mainEntity], 'entities').then(([id]) => id),
+		notEntityIds: getIdsBySlug(query.entities?.filter((entity) => entity.charAt(0) === '!').map((entity) => entity.slice(1)), 'entities'),
+	});
+
+	const {
+		movies,
+		total,
+	} = await fetchMovies({
+		query: query.query, // query query query query
+		tagIds,
+		// not- currently not implemented by movies module, pass here anyway for when it is
+		notTagIds,
+		entityId,
+		notEntityIds,
+		actorIds: query.actorIds?.filter((actorId) => actorId.charAt(0) !== '!').map((actorId) => Number(actorId)),
+		notActorIds: query.actorIds?.filter((actorId) => actorId.charAt(0) === '!').map((actorId) => Number(actorId.slice(1))),
+		stashId: stash?.id,
+		scope: getScope(query),
+		isShowcased: null,
+	}, {
+		page: query.page || 1,
+		limit: query.limit || 30,
+		aggregate: false,
+	}, req.user);
+
+	return {
+		nodes: movies,
+		total,
+	};
+}
+
+export async function fetchMoviesByIdGraphql(query, req) {
+	const movies = await fetchMoviesById([].concat(query.id, query.ids).filter(Boolean), req.user);
+
+	if (query.ids) {
+		return movies;
+	}
+
+	return movies[0];
+}
--- a/src/web/scenes.js
+++ b/src/web/scenes.js
@@ -9,6 +9,8 @@ import {
 	reviewSceneRevision,
 } from '../scenes.js';

+import { fetchStashByUsernameAndSlug } from '../stashes.js';
+
 import { parseActorIdentifier } from '../query.js';
 import { getIdsBySlug } from '../cache.js';
 import slugify from '../../utils/slugify.js';
@@ -87,6 +89,8 @@ export const scenesSchema = `
 			entities: [String!]
 			actorIds: [String!]
 			tags: [String!]
+			movieId: Int
+			stash: String
 			limit: Int! = 30
 			page: Int! = 1
 		): ReleasesResult
@@ -152,9 +156,33 @@ export const scenesSchema = `
 	}
 `;

+function getScope(query) {
+	if (query.scope) {
+		return query.scope;
+	}
+
+	if (query.query) {
+		return 'results';
+	}
+
+	if (query.stash) {
+		return 'stashed';
+	}
+
+	return 'latest';
+}
+
 export async function fetchScenesGraphql(query, req) {
 	const mainEntity = query.entities?.find((entity) => entity.charAt(0) !== '!');

+	const stash = query.stash && req.user
+		? await fetchStashByUsernameAndSlug(req.user.id, query.stash, req.user)
+		: null;
+
+	if (query.stash && !stash) {
+		throw new HttpError(`Could not find stash '${query.stash}'`, 404);
+	}
+
 	const {
 		tagIds,
 		notTagIds,
@@ -183,9 +211,9 @@ export async function fetchScenesGraphql(query, req) {
 		notEntityIds,
 		actorIds: query.actorIds?.filter((actorId) => actorId.charAt(0) !== '!').map((actorId) => Number(actorId)),
 		notActorIds: query.actorIds?.filter((actorId) => actorId.charAt(0) === '!').map((actorId) => Number(actorId.slice(1))),
-		scope: query.query && !query.scope
-			? 'results'
-			: query.scope,
+		movieId: query.movieId,
+		stashId: stash?.id,
+		scope: getScope(query),
 		isShowcased: null,
 	}, {
 		page: query.page || 1,
--- a/src/web/server.js
+++ b/src/web/server.js
@@ -133,7 +133,7 @@ export default async function initServer() {

 	// API KEYS
 	router.get('/api/me/keys', fetchUserKeysApi);
-	router.post('/api/keys', createKeyApi);
+	router.post('/api/me/keys', createKeyApi);
 	router.delete('/api/me/keys/:keyIdentifier', removeUserKeyApi);
 	router.delete('/api/me/keys', flushUserKeysApi);

--- a/src/web/stashes.js
+++ b/src/web/stashes.js
@@ -11,66 +11,210 @@ import {
 	unstashScene,
 	unstashMovie,
 	updateStash,
+	fetchStashByUsernameAndSlug,
 } from '../stashes.js';

+export const stashesSchema = `
+	extend type Query {
+		stashes(username: String): [Stash]
+
+		stash(
+			username: String
+			stash: String!
+		): Stash
+	}
+
+	extend type Mutation {
+		createStash(
+			name: String!
+			isPublic: Boolean
+		): Stash
+
+		updateStash(
+			stash: String!
+			name: String
+			isPublic: Boolean
+		): Stash
+
+		removeStash(
+			stash: String!
+		): Stash
+
+		stashScene(
+			sceneId: Int!
+			stash: String!
+		): Stashed
+
+		unstashScene(
+			sceneId: Int!
+			stash: String!
+		): Stashed
+
+		stashActor(
+			actorId: Int!
+			stash: String!
+		): Stashed
+
+		unstashActor(
+			actorId: Int!
+			stash: String!
+		): Stashed
+
+		stashMovie(
+			movieId: Int!
+			stash: String!
+		): Stashed
+
+		unstashMovie(
+			movieId: Int!
+			stash: String!
+		): Stashed
+	}
+
+	type Stash {
+		id: Int
+		name: String
+		slug: String
+		isPublic: Boolean
+		isPrimary: Boolean
+		createdAt: Date
+	}
+
+	type Stashed {
+		id: Int
+		stashId: Int
+		sceneId: Int
+		actorId: Int
+		movieId: Int
+		serieId: Int
+		createdAt: Date
+	}
+`;
+
 export async function fetchUserStashesApi(req, res) {
 	const stashes = await fetchUserStashes(req.user.id, req.user);

 	res.send(stashes);
 }

+export async function fetchUserStashesGraphql(query, req) {
+	const stashes = await fetchUserStashes(query.username || req.userId, req.user);
+
+	return stashes;
+}
+
+export async function fetchStashGraphql(query, req) {
+	const stashes = await fetchStashByUsernameAndSlug(query.username || req.userId, query.stash, req.user);
+
+	return stashes;
+}
+
 export async function createStashApi(req, res) {
 	const stash = await createStash(req.body, req.user);

 	res.send(stash);
 }

+export async function createStashGraphql(query, req) {
+	const stash = await createStash(query, req.user);
+
+	return stash;
+}
+
 export async function updateStashApi(req, res) {
 	const stash = await updateStash(Number(req.params.stashId), req.body, req.user);

 	res.send(stash);
 }

+export async function updateStashGraphql(query, req) {
+	const stash = await updateStash(query.stash, query, req.user);
+
+	return stash;
+}
+
 export async function removeStashApi(req, res) {
 	await removeStash(Number(req.params.stashId), req.user);

 	res.status(204).send();
 }

+export async function removeStashGraphql(query, req) {
+	const removedId = await removeStash(query.stash, req.user);
+
+	return removedId;
+}
+
 export async function stashActorApi(req, res) {
-	const stashes = await stashActor(req.body.actorId, Number(req.params.stashId), req.user);
+	const stashed = await stashActor(req.body.actorId, Number(req.params.stashId), req.user);

-	res.send(stashes);
+	res.send(stashed);
 }

-export async function stashSceneApi(req, res) {
-	const stashes = await stashScene(req.body.sceneId, Number(req.params.stashId), req.user);
+export async function stashActorGraphql(query, req) {
+	const stashed = await stashActor(query.actorId, query.stash, req.user);

-	res.send(stashes);
-}
-
-export async function stashMovieApi(req, res) {
-	const stashes = await stashMovie(req.body.movieId, Number(req.params.stashId), req.user);
-
-	res.send(stashes);
+	return stashed;
 }

 export async function unstashActorApi(req, res) {
-	const stashes = await unstashActor(Number(req.params.actorId), Number(req.params.stashId), req.user);
+	const unstashed = await unstashActor(Number(req.params.actorId), Number(req.params.stashId), req.user);

-	res.send(stashes);
+	res.send(unstashed);
+}
+
+export async function unstashActorGraphql(query, req) {
+	const stashes = await unstashActor(query.actorId, query.stash, req.user);
+
+	return stashes;
+}
+
+export async function stashSceneApi(req, res) {
+	const stashed = await stashScene(req.body.sceneId, Number(req.params.stashId), req.user);
+
+	res.send(stashed);
+}
+
+export async function stashSceneGraphql(query, req) {
+	const stashed = await stashScene(query.sceneId, query.stash, req.user);
+
+	return stashed;
 }

 export async function unstashSceneApi(req, res) {
-	const stashes = await unstashScene(Number(req.params.sceneId), Number(req.params.stashId), req.user);
+	const unstashed = await unstashScene(Number(req.params.sceneId), Number(req.params.stashId), req.user);

-	res.send(stashes);
+	res.send(unstashed);
+}
+
+export async function unstashSceneGraphql(query, req) {
+	const unstashed = await unstashScene(query.sceneId, query.stash, req.user);
+
+	return unstashed;
+}
+
+export async function stashMovieApi(req, res) {
+	const stashed = await stashMovie(req.body.movieId, Number(req.params.stashId), req.user);
+
+	res.send(stashed);
+}
+
+export async function stashMovieGraphql(query, req) {
+	const stashed = await stashMovie(query.movieId, query.stash, req.user);
+
+	return stashed;
 }

 export async function unstashMovieApi(req, res) {
-	const stashes = await unstashMovie(Number(req.params.movieId), Number(req.params.stashId), req.user);
+	const unstashed = await unstashMovie(Number(req.params.movieId), Number(req.params.stashId), req.user);

-	res.send(stashes);
+	res.send(unstashed);
+}
+
+export async function unstashMovieGraphql(query, req) {
+	const unstashed = await unstashMovie(query.movieId, query.stash, req.user);
+
+	return unstashed;
 }

 export const router = Router();