From de0b1c2baf1d2abe2cc3b31687246ef2e6d75566 Mon Sep 17 00:00:00 2001
From: DebaucheryLibrarian <DebaucheryLibrarian@unknown.name>
Date: Thu, 17 Sep 2026 01:17:03 +0200
Subject: [PATCH] Added scene chapters to GraphQL. Verifying API credential
 types.

---
 src/auth.js        |  8 ++++++++
 src/web/graphql.js |  2 +-
 src/web/scenes.js  | 11 +++++++++++
 src/web/server.js  |  2 +-
 4 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/src/auth.js b/src/auth.js
index 262b9f2..8fa06ca 100755
--- a/src/auth.js
+++ b/src/auth.js
@@ -628,6 +628,14 @@ export async function verifyKey(userId, key, req) {
 		throw new HttpError('The API credentials are not provided.', 401);
 	}
 
+	if (typeof userId !== 'number') {
+		throw new HttpError('User ID is not a number', 400);
+	}
+
+	if (typeof key !== 'string') {
+		throw new HttpError('Key is not a string', 400);
+	}
+
 	const hashedKey = (await scrypt(key, '', 64)).toString('hex'); // salt redundant for randomly generated key
 
 	const storedKey = await knex('users_keys')
diff --git a/src/web/graphql.js b/src/web/graphql.js
index d9d757d..f00d5ad 100644
--- a/src/web/graphql.js
+++ b/src/web/graphql.js
@@ -112,7 +112,7 @@ export async function graphqlApi(req, res) {
 		return;
 	}
 
-	await verifyKey(req.headers['api-user'], req.headers['api-key'], req);
+	await verifyKey(Number(req.headers['api-user']), req.headers['api-key'], req);
 
 	req.user = {
 		id: Number(req.headers['api-user']),
diff --git a/src/web/scenes.js b/src/web/scenes.js
index be2082a..2712fde 100644
--- a/src/web/scenes.js
+++ b/src/web/scenes.js
@@ -131,6 +131,7 @@ export const scenesSchema = `
 		network: Entity
 		actors: [Actor!]!
 		tags: [Tag!]!
+		chapters: [Chapter!]!
 		poster: Media
 		trailer: Media
 		photos: [Media!]!
@@ -160,6 +161,16 @@ export const scenesSchema = `
 		size: Int
 		createdAt: Int
 	}
+
+	type Chapter {
+		id: Int!
+		time: Int!
+		tags: [Tag!]!
+		date: Date
+		description: String
+		title: String
+		poster: Media
+	}
 `;
 
 function getScope(query) {
diff --git a/src/web/server.js b/src/web/server.js
index a08c6ad..32fda6a 100644
--- a/src/web/server.js
+++ b/src/web/server.js
@@ -119,7 +119,7 @@ export default async function initServer() {
 
 	router.use('/api/{*splat}', async (req, _res, next) => {
 		if (req.headers['api-user']) {
-			req.user = await verifyKey(req.headers['api-user'], req.headers['api-key'], req);
+			req.user = await verifyKey(Number(req.headers['api-user']), req.headers['api-key'], req);
 		}
 
 		next();