feat: fix search, poster serving, and add hover overlay UI for cards

- Fix search store exports to match component expectations (inputValue,
  bangumiList, onSearch) and transform data to SearchResult format
- Fix poster endpoint path check that incorrectly blocked all requests
- Add resolvePosterUrl utility to handle both external URLs and local paths
- Move tags into hover overlay on homepage cards and calendar cards
- Show title and tags on poster hover with dark semi-transparent styling
- Add downloader API, store, and page
- Update backend to async patterns and uv migration changes
- Remove .claude/settings.local.json from tracking

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: EstrellaXD

.claude/settings.local.json

@@ -216,3 +216,7 @@ dev-dist
 
 # test file
 test.*
+
+# local config
+/backend/config/
+.claude/settings.local.json

.gitignore

@@ -40,8 +40,8 @@ def create_app() -> FastAPI:
 
 @app.get("/posters/{path:path}", tags=["posters"])
 def posters(path: str):
-    # only allow access to files in the posters directory
-    if not path.startswith("posters/"):
+    # prevent path traversal
+    if ".." in path:
         return HTMLResponse(status_code=403)
     return FileResponse(f"data/posters/{path}")
 

backend/src/main.py

@@ -1,33 +1,35 @@
+import asyncio
+import functools
 import logging
-import threading
-import time
 
 from .timeout import timeout
 
 logger = logging.getLogger(__name__)
-lock = threading.Lock()
+_lock = asyncio.Lock()
 
 
 def qb_connect_failed_wait(func):
-    def wrapper(*args, **kwargs):
+    @functools.wraps(func)
+    async def wrapper(*args, **kwargs):
         times = 0
         while times < 5:
             try:
-                return func(*args, **kwargs)
+                return await func(*args, **kwargs)
             except Exception as e:
                 logger.debug(f"URL: {args[0]}")
                 logger.warning(e)
                 logger.warning("Cannot connect to qBittorrent. Wait 5 min and retry...")
-                time.sleep(300)
+                await asyncio.sleep(300)
                 times += 1
 
     return wrapper
 
 
 def api_failed(func):
-    def wrapper(*args, **kwargs):
+    @functools.wraps(func)
+    async def wrapper(*args, **kwargs):
         try:
-            return func(*args, **kwargs)
+            return await func(*args, **kwargs)
         except Exception as e:
             logger.debug(f"URL: {args[0]}")
             logger.warning("Wrong API response.")
@@ -37,8 +39,9 @@ def wrapper(*args, **kwargs):
 
 
 def locked(func):
-    def wrapper(*args, **kwargs):
-        with lock:
-            return func(*args, **kwargs)
+    @functools.wraps(func)
+    async def wrapper(*args, **kwargs):
+        async with _lock:
+            return await func(*args, **kwargs)
 
     return wrapper

backend/src/module/ab_decorator/__init__.py

@@ -3,6 +3,7 @@
 from .auth import router as auth_router
 from .bangumi import router as bangumi_router
 from .config import router as config_router
+from .downloader import router as downloader_router
 from .log import router as log_router
 from .passkey import router as passkey_router
 from .program import router as program_router
@@ -19,5 +20,6 @@
 v1.include_router(program_router)
 v1.include_router(bangumi_router)
 v1.include_router(config_router)
+v1.include_router(downloader_router)
 v1.include_router(rss_router)
 v1.include_router(search_router)

backend/src/module/api/__init__.py

@@ -45,7 +45,7 @@ async def update_rule(
     data: BangumiUpdate,
 ):
     with TorrentManager() as manager:
-        resp = manager.update_rule(bangumi_id, data)
+        resp = await manager.update_rule(bangumi_id, data)
     return u_response(resp)
 
 
@@ -56,7 +56,7 @@ async def update_rule(
 )
 async def delete_rule(bangumi_id: str, file: bool = False):
     with TorrentManager() as manager:
-        resp = manager.delete_rule(bangumi_id, file)
+        resp = await manager.delete_rule(bangumi_id, file)
     return u_response(resp)
 
 
@@ -68,7 +68,7 @@ async def delete_rule(bangumi_id: str, file: bool = False):
 async def delete_many_rule(bangumi_id: list, file: bool = False):
     with TorrentManager() as manager:
         for i in bangumi_id:
-            resp = manager.delete_rule(i, file)
+            resp = await manager.delete_rule(i, file)
     return u_response(resp)
 
 
@@ -79,7 +79,7 @@ async def delete_many_rule(bangumi_id: list, file: bool = False):
 )
 async def disable_rule(bangumi_id: str, file: bool = False):
     with TorrentManager() as manager:
-        resp = manager.disable_rule(bangumi_id, file)
+        resp = await manager.disable_rule(bangumi_id, file)
     return u_response(resp)
 
 
@@ -91,7 +91,7 @@ async def disable_rule(bangumi_id: str, file: bool = False):
 async def disable_many_rule(bangumi_id: list, file: bool = False):
     with TorrentManager() as manager:
         for i in bangumi_id:
-            resp = manager.disable_rule(i, file)
+            resp = await manager.disable_rule(i, file)
     return u_response(resp)
 
 
@@ -111,19 +111,19 @@ async def enable_rule(bangumi_id: str):
     response_model=APIResponse,
     dependencies=[Depends(get_current_user)],
 )
-async def refresh_poster():
+async def refresh_poster_all():
     with TorrentManager() as manager:
-        resp = manager.refresh_poster()
+        resp = await manager.refresh_poster()
     return u_response(resp)
 
 @router.get(
     path="/refresh/poster/{bangumi_id}",
     response_model=APIResponse,
     dependencies=[Depends(get_current_user)],
 )
-async def refresh_poster(bangumi_id: int):
+async def refresh_poster_one(bangumi_id: int):
     with TorrentManager() as manager:
-        resp = manager.refind_poster(bangumi_id)
+        resp = await manager.refind_poster(bangumi_id)
     return u_response(resp)
 
 
@@ -134,7 +134,7 @@ async def refresh_poster(bangumi_id: int):
 )
 async def refresh_calendar():
     with TorrentManager() as manager:
-        resp = manager.refresh_calendar()
+        resp = await manager.refresh_calendar()
     return u_response(resp)
 
 

backend/src/module/api/bangumi.py

@@ -0,0 +1,46 @@
+from fastapi import APIRouter, Depends
+from pydantic import BaseModel
+
+from module.downloader import DownloadClient
+from module.security.api import get_current_user
+
+router = APIRouter(prefix="/downloader", tags=["downloader"])
+
+
+class TorrentHashesRequest(BaseModel):
+    hashes: list[str]
+
+
+class TorrentDeleteRequest(BaseModel):
+    hashes: list[str]
+    delete_files: bool = False
+
+
+@router.get("/torrents", dependencies=[Depends(get_current_user)])
+async def get_torrents():
+    async with DownloadClient() as client:
+        return await client.get_torrent_info(category="Bangumi", status_filter=None)
+
+
+@router.post("/torrents/pause", dependencies=[Depends(get_current_user)])
+async def pause_torrents(req: TorrentHashesRequest):
+    hashes = "|".join(req.hashes)
+    async with DownloadClient() as client:
+        await client.pause_torrent(hashes)
+    return {"msg_en": "Torrents paused", "msg_zh": "种子已暂停"}
+
+
+@router.post("/torrents/resume", dependencies=[Depends(get_current_user)])
+async def resume_torrents(req: TorrentHashesRequest):
+    hashes = "|".join(req.hashes)
+    async with DownloadClient() as client:
+        await client.resume_torrent(hashes)
+    return {"msg_en": "Torrents resumed", "msg_zh": "种子已恢复"}
+
+
+@router.post("/torrents/delete", dependencies=[Depends(get_current_user)])
+async def delete_torrents(req: TorrentDeleteRequest):
+    hashes = "|".join(req.hashes)
+    async with DownloadClient() as client:
+        await client.delete_torrent(hashes, delete_files=req.delete_files)
+    return {"msg_en": "Torrents deleted", "msg_zh": "种子已删除"}

backend/src/module/api/downloader.py

@@ -25,7 +25,7 @@ async def get_rss():
 )
 async def add_rss(rss: RSSItem):
     with RSSEngine() as engine:
-        result = engine.add_rss(rss.url, rss.name, rss.aggregate, rss.parser)
+        result = await engine.add_rss(rss.url, rss.name, rss.aggregate, rss.parser)
     return u_response(result)
 
 
@@ -133,12 +133,13 @@ async def update_rss(
     dependencies=[Depends(get_current_user)],
 )
 async def refresh_all():
-    with RSSEngine() as engine, DownloadClient() as client:
-        engine.refresh_rss(client)
-        return JSONResponse(
-            status_code=200,
-            content={"msg_en": "Refresh all RSS successfully.", "msg_zh": "刷新 RSS 成功。"},
-        )
+    async with DownloadClient() as client:
+        with RSSEngine() as engine:
+            await engine.refresh_rss(client)
+    return JSONResponse(
+        status_code=200,
+        content={"msg_en": "Refresh all RSS successfully.", "msg_zh": "刷新 RSS 成功。"},
+    )
 
 
 @router.get(
@@ -147,12 +148,13 @@ async def refresh_all():
     dependencies=[Depends(get_current_user)],
 )
 async def refresh_rss(rss_id: int):
-    with RSSEngine() as engine, DownloadClient() as client:
-        engine.refresh_rss(client, rss_id)
-        return JSONResponse(
-            status_code=200,
-            content={"msg_en": "Refresh RSS successfully.", "msg_zh": "刷新 RSS 成功。"},
-        )
+    async with DownloadClient() as client:
+        with RSSEngine() as engine:
+            await engine.refresh_rss(client, rss_id)
+    return JSONResponse(
+        status_code=200,
+        content={"msg_en": "Refresh RSS successfully.", "msg_zh": "刷新 RSS 成功。"},
+    )
 
 
 @router.get(
@@ -175,7 +177,7 @@ async def get_torrent(
     "/analysis", response_model=Bangumi, dependencies=[Depends(get_current_user)]
 )
 async def analysis(rss: RSSItem):
-    data = analyser.link_to_data(rss)
+    data = await analyser.link_to_data(rss)
     if isinstance(data, Bangumi):
         return data
     else:
@@ -186,15 +188,14 @@ async def analysis(rss: RSSItem):
     "/collect", response_model=APIResponse, dependencies=[Depends(get_current_user)]
 )
 async def download_collection(data: Bangumi):
-    with SeasonCollector() as collector:
-        resp = collector.collect_season(data, data.rss_link)
+    async with SeasonCollector() as collector:
+        resp = await collector.collect_season(data, data.rss_link)
         return u_response(resp)
 
 
 @router.post(
     "/subscribe", response_model=APIResponse, dependencies=[Depends(get_current_user)]
 )
 async def subscribe(data: Bangumi, rss: RSSItem):
-    with SeasonCollector() as collector:
-        resp = collector.subscribe_season(data, parser=rss.parser)
-        return u_response(resp)
+    resp = await SeasonCollector.subscribe_season(data, parser=rss.parser)
+    return u_response(resp)

backend/src/module/api/rss.py

@@ -18,10 +18,13 @@ async def search_torrents(site: str = "mikan", keywords: str = Query(None)):
     if not keywords:
         return []
     keywords = keywords.split(" ")
-    with SearchTorrent() as st:
-        return EventSourceResponse(
-            content=st.analyse_keyword(keywords=keywords, site=site),
-        )
+
+    async def event_generator():
+        async with SearchTorrent() as st:
+            async for item in st.analyse_keyword(keywords=keywords, site=site):
+                yield item
+
+    return EventSourceResponse(content=event_generator())
 
 
 @router.get(