manage/.pi-tmp/svc-hub-slice1-out.md

Slice 1 — Backend: new service types + Jellyseerr absorption (worker output)

Files changed

File	Status	Lines
backend/src/media_library_viewer_api/integrations/backups.py	new	48
backend/src/media_library_viewer_api/integrations/authentik.py	new	35
backend/src/media_library_viewer_api/integrations/jellyfin.py	modified	+11 / -3
backend/src/media_library_viewer_api/integrations/jellyseerr.py	deleted	-33
backend/src/media_library_viewer_api/integrations/registry.py	modified	+5 / -4
backend/src/media_library_viewer_api/services/settings_store.py	modified	+74 / -0
backend/tests/test_services.py	modified	+136 / -12

Total: ~343 changed lines (353 insertions, 52 deletions across tracked + new files). Under the 400-line budget.

What was implemented

1.1 — backups integration (integrations/backups.py)

• BackupsConfig(ServiceConfigBase): ingestion_label: str = "default".
• No secret fields.
• Widget kind summary (declared on the service definition; the adapter BackupsWidgetSource stays in widgets/sources.py for now as instructed).
• Registered as BACKUPS in SERVICE_DEFINITIONS.

1.2 — authentik integration (integrations/authentik.py)

• AuthentikConfig(ServiceConfigBase): base_url: ServiceBaseUrl, timeout_seconds: int = 10.
• Secret field: api_token (label "API token", required=True).
• No widget kinds (empty list).
• Registered as AUTHENTIK in SERVICE_DEFINITIONS.

1.3 — Jellyseerr absorbed into JellyfinConfig

• Added optional jellyseerr_url: str = "" and jellyseerr_api_key: str = "" to JellyfinConfig with a docstring noting they are the paired Jellyseerr companion config.
• Deleted integrations/jellyseerr.py.
• Removed the JELLYSEERR import and registry entry from registry.py.
• integrations/__init__.py was already clean (no jellyseerr reference).
• clients/jellyseerr.py was left intact (JellyseerrClient stays for the existing enrichment flow).
• Verified: no remaining references to integrations.jellyseerr anywhere in src/.

1.4 — Jellyseerr migration (settings_store.py)

Added _migrate_jellyseerr_into_jellyfin() method, called from ensure_defaults() after the existing machine seeding. Policy:

1. Query services WHERE service_type = 'jellyseerr'. If none, return (idempotent).
2. For each jellyseerr row:
   • Decrypt the api_key from the encrypted secrets blob (the secrets_json stores ciphertext; config stores plaintext). The jellyseerr_api_key goes into config as plaintext.
   • Exactly one Jellyfin: merge into it.
   • Multiple Jellyfins: pick the first whose jellyseerr_url is empty.
   • No Jellyfin or all already paired: drop with a logged warning.
3. Delete the jellyseerr row.

Migration is idempotent — running it twice is a no-op (no jellyseerr rows remain).

1.5 — Tests

• test_registry_contains_eight_service_types: asserts the 8-type registry (alertmanager, authentik, backups, grafana, jellyfin, nextcloud, prometheus, ssh_tasks).
• test_jellyseerr_absorbed_into_jellyfin: asserts jellyseerr NOT in registry; JellyfinConfig has jellyseerr_url/jellyseerr_api_key in schema.
• test_backups_service_definition: asserts config fields, no secrets, summary widget kind.
• test_authentik_service_definition: asserts config fields, api_token secret (required), no widgets.
• test_definitions_declare_widget_kinds: updated for backups + authentik.
• test_list_service_types: updated for the 8-type registry (API endpoint test).
• test_service_base_url_accepts_absolute_urls: parametrize updated (jellyseerr → authentik).
• Migration tests: test_jellyseerr_migrates_into_single_jellyfin, test_jellyseerr_dropped_when_no_jellyfin, test_jellyseerr_migration_is_idempotent.

Final registry type list

alertmanager, authentik, backups, grafana, jellyfin, nextcloud, prometheus, ssh_tasks

(8 types; jellyseerr removed)

Migration policy implemented

• Exactly one Jellyfin: merge unconditionally.
• Multiple Jellyfins: first Jellyfin whose jellyseerr_url is empty (first-unpaired).
• No Jellyfin / all paired: drop with logged warning.
• Idempotent: no-op when no jellyseerr rows remain.
• Decryption: the jellyseerr api_key is decrypted before being placed into Jellyfin config (config_json is plaintext; secrets_json is encrypted).

Validation

cd backend && .venv/bin/python -m ruff check src/ tests/  → All checks passed!
cd backend && .venv/bin/python -m pytest tests/           → 256 passed, 2 warnings

Warnings are pre-existing (Starlette/httpx deprecation, pythonjsonlogger).

Deviations from design

1. jellyseerr_api_key stored in config as plaintext. The design said "encrypted at rest via the existing secrets mechanism if you prefer — design choice for tasks phase." I chose config (plaintext in config_json) for simplicity because: (a) the existing Jellyfin secret field is api_key only — adding a jellyseerr_api_key secret field would require adding it to SecretField on the Jellyfin DEFINITION, expanding scope; (b) the migration would then need to re-encrypt the decrypted value, adding complexity. The config_json column stores plaintext in SQLite regardless. If encryption is desired, a follow-up can add it as a Jellyfin secret field.

2. No separate BackupsSummaryWidgetConfig reuse of BackupsWidgetSource. The design said "move BackupsWidgetSource adapter to bind the service_id." I declared the widget kind summary on the service definition, but left the adapter in sources.py unchanged (as instructed: "The adapter itself can stay in sources.py for now"). The built-in backups widget kind in builtin.py still exists — this creates a temporary overlap (built-in backups kind + service summary kind). This is intentional per the task instructions and will be resolved in Slice 3 (backups service attribution).

3. _normalize_service_payload is called indirectly via upsert_service during migration. The migration reads the current Jellyfin config via list_services, merges fields, and calls upsert_service to persist. This is safe because upsert_service handles config as a raw dict and doesn't validate against JellyfinConfig (validation happens at the API layer). The jellyseerr_url/jellyseerr_api_key fields are optional with defaults, so the config round-trips correctly.

skill_resolution

none — no project/user SKILL.md paths were injected by the parent, and no .atl/skill-registry.md was found. The task was self-contained against the OpenSpec design/tasks docs.

Residual risks

• Built-in backups widget still exists alongside the new service summary widget kind. This temporary overlap is intentional and will be resolved in Slice 3 when backups gets service attribution. The built-in backups kind keeps working; the service summary kind is declared but not yet wired to an adapter.
• jellyseerr_api_key in config is plaintext (see deviation #1 above).
• JellyseerrClient in clients/jellyseerr.py is still imported by dependencies.py and routers/users_impl.py for the existing enrichment flow. These references are valid (the client stays; only the integration definition was removed). They will be rewired in later slices.

Review findings

No blockers identified during self-review. All validation commands green. No staged files.