style: auto-fix lint and format

The token must only be used for repositories that are registered in the
widget's saved options, matched by provider:identifier (not by fragile
cuid2 id). This prevents tokens from being sent to arbitrary providerUrl
values submitted by the caller.

The saved providerUrl is used in preference to the request's providerUrl
when a token is being applied.

packages/api/src/router/widgets/releases.ts

@@ -45,7 +45,7 @@ export const releasesRouter = createTRPCRouter({
     )
     .query(async ({ ctx, input }) => {
       const tokensByProvider = new Map<string, string>();
-      let allowedRepoIds: Set<string> | null = null;
+      const savedRepos = new Map<string, { providerUrl?: string }>();
 
       if (input.itemId) {
         try {
@@ -54,9 +54,15 @@ export const releasesRouter = createTRPCRouter({
             await throwIfActionForbiddenAsync(ctx, eq(boards.id, item.boardId), "view");
 
             const options = SuperJSON.parse<Record<string, unknown>>(item.options);
-            const repos = options.repositories as Array<{ id?: string }> | undefined;
+            const repos = options.repositories as
+              | Array<{ provider?: string; identifier: string; providerUrl?: string }>
+              | undefined;
             if (repos) {
-              allowedRepoIds = new Set(repos.map((r) => r.id).filter((id): id is string => Boolean(id)));
+              for (const repo of repos) {
+                if (repo.provider && repo.identifier) {
+                  savedRepos.set(`${repo.provider}:${repo.identifier}`, { providerUrl: repo.providerUrl });
+                }
+              }
             }
 
             const secrets = await ctx.db.query.widgetSecrets.findMany({
@@ -78,16 +84,16 @@ export const releasesRouter = createTRPCRouter({
       return await Promise.all(
         input.repositories.map(async (repository) => {
           const repositoryId = repository.id ?? repository.identifier;
+          const savedRepo = savedRepos.get(`${repository.provider}:${repository.identifier}`);
           try {
-            const useToken = allowedRepoIds === null || allowedRepoIds.has(repositoryId);
             const response = await releasesRequestHandler
               .handler({
                 id: repositoryId,
                 provider: repository.provider,
                 identifier: repository.identifier,
                 versionRegex: formatVersionFilterRegex(repository.versionFilter),
-                providerUrl: repository.providerUrl,
+                providerUrl: savedRepo?.providerUrl ?? repository.providerUrl,
-                token: useToken ? tokensByProvider.get(repository.provider) : undefined,
+                token: savedRepo ? tokensByProvider.get(repository.provider) : undefined,
               })
               .getDataAsync();
 

packages/definitions/src/docs/homarr-docs-sitemap.ts

@@ -159,6 +159,7 @@ export type HomarrDocumentationPath =
   | "/docs/integrations/archiveteam-warrior"
   | "/docs/integrations/aria2"
   | "/docs/integrations/audiobookshelf"
+  | "/docs/integrations/bazarr"
   | "/docs/integrations/beszel"
   | "/docs/integrations/coolify"
   | "/docs/integrations/dash-dot"
@@ -183,6 +184,7 @@ export type HomarrDocumentationPath =
   | "/docs/integrations/opnsense"
   | "/docs/integrations/overseerr"
   | "/docs/integrations/paperless-ngx"
+  | "/docs/integrations/patchmon"
   | "/docs/integrations/peanut"
   | "/docs/integrations/pi-hole"
   | "/docs/integrations/plex"
@@ -223,6 +225,7 @@ export type HomarrDocumentationPath =
   | "/docs/widgets/anchor-note"
   | "/docs/widgets/app"
   | "/docs/widgets/audio-stats"
+  | "/docs/widgets/bazarr"
   | "/docs/widgets/beszel-alerts"
   | "/docs/widgets/beszel-system-grid"
   | "/docs/widgets/beszel-system-stats"
@@ -242,6 +245,7 @@ export type HomarrDocumentationPath =
   | "/docs/widgets/immich-album-carousel"
   | "/docs/widgets/immich-server-stats"
   | "/docs/widgets/indexer-manager"
+  | "/docs/widgets/media-missing"
   | "/docs/widgets/media-releases"
   | "/docs/widgets/media-request-list"
   | "/docs/widgets/media-request-stats"
@@ -253,6 +257,7 @@ export type HomarrDocumentationPath =
   | "/docs/widgets/notebook"
   | "/docs/widgets/notifications"
   | "/docs/widgets/paperless-ngx"
+  | "/docs/widgets/patchmon"
   | "/docs/widgets/releases"
   | "/docs/widgets/rss-feed"
   | "/docs/widgets/smart-home-entity-state"
@@ -341,6 +346,7 @@ export type HomarrDocumentationPath =
   | "/docs/widgets/media-request-list"
   | "/docs/widgets/media-request-stats"
   | "/docs/widgets/media-transcoding"
+  | "/docs/widgets/media-missing"
   | "/docs/widgets/minecraft-server-status"
   | "/docs/widgets/network-controller-summary"
   | "/docs/widgets/network-controller-status"

packages/request-handler/src/release-providers.ts

@@ -134,7 +134,7 @@ const getGithubApi = (baseUrl: string, userAgent: string, token?: string) =>
     baseUrl,
     auth: token,
     request: { fetch: fetchWithTrustedCertificatesAsync },
-    throttle: { enabled: false },
+    throttle: { enabled: true },
     userAgent,
   });