feat: pages_enabled admin controls with subscription-only search

config/config.example.yml

@@ -296,12 +296,13 @@ https_only: false
 # -----------------------------
 
 ##
-## Enable/Disable the "Popular" tab on the main page.
+## Enable/Disable specific pages on the main page.
 ##
-## Accepted values: true, false
-## Default: true
+#pages_enabled:
+#  trending: false
+#  popular: true
+#  search: true
 ##
-#popular_enabled: true
 
 ##
 ## Enable/Disable statstics (available at /api/v1/stats).

docker-compose.yml

@@ -14,10 +14,6 @@ services:
     restart: unless-stopped
     ports:
       - "127.0.0.1:3000:3000"
-    depends_on:
-      invidious-db:
-        condition: service_healthy
-        restart: true
     environment:
       # Please read the following file for a comprehensive list of all available
       # configuration options and their associated syntax:

spec/invidious/config_spec.cr

@@ -0,0 +1,50 @@
+require "../spec_helper"
+require "../../src/invidious/jobs.cr"
+require "../../src/invidious/jobs/*"
+require "../../src/invidious/config.cr"
+require "../../src/invidious/user/preferences.cr"
+
+# Allow this file to be executed independently of other specs
+{% if !@type.has_constant?("CONFIG") %}
+  CONFIG = Config.from_yaml("")
+{% end %}
+
+private def construct_config(yaml)
+  config = Config.from_yaml(yaml)
+  File.open(File::NULL, "w") { |io| config.process_deprecation(io) }
+  return config
+end
+
+Spectator.describe Config do
+  context "page_enabled" do
+    it "Can disable pages" do
+      config = construct_config <<-YAML
+        pages_enabled:
+          popular: false
+          search: false
+      YAML
+
+      expect(config.page_enabled?("trending")).to eq(false)
+      expect(config.page_enabled?("popular")).to eq(false)
+      expect(config.page_enabled?("search")).to eq(false)
+    end
+
+    it "Takes precedence over popular_enabled" do
+      config = construct_config <<-YAML
+        popular_enabled: false
+        pages_enabled:
+          popular: true
+      YAML
+
+      expect(config.page_enabled?("popular")).to eq(true)
+    end
+  end
+
+  it "Deprecated popular_enabled still works" do
+    config = construct_config <<-YAML
+      popular_enabled: false
+    YAML
+
+    expect(config.page_enabled?("popular")).to eq(false)
+  end
+end

src/ext/kemal_static_file_handler.cr

@@ -185,7 +185,7 @@ module Kemal
         if is_dir
           if config.is_a?(Hash) && config["dir_listing"] == true
             context.response.content_type = "text/html"
-            directory_listing(context.response, request_path, file_path)
+            directory_listing(context.response, Path[request_path], Path[file_path])
           else
             call_next(context)
           end

src/invidious.cr

@@ -178,7 +178,7 @@ if (CONFIG.use_pubsub_feeds.is_a?(Bool) && CONFIG.use_pubsub_feeds.as(Bool)) ||
   Invidious::Jobs.register Invidious::Jobs::SubscribeToFeedsJob.new(PG_DB, HMAC_KEY)
 end
 
-if CONFIG.popular_enabled
+if CONFIG.page_enabled?("popular")
   Invidious::Jobs.register Invidious::Jobs::PullPopularVideosJob.new(PG_DB)
 end
 
@@ -200,6 +200,12 @@ end
 
 before_all do |env|
   Invidious::Routes::BeforeAll.handle(env)
+
+  # If before_all flagged a halt (e.g. disabled page), stop the route handler.
+  # Use halt with the already-set status code to prevent the route handler from running.
+  if env.get?("halted")
+    halt env, status_code: env.response.status_code
+  end
 end
 
 Invidious::Routing.register_all

src/invidious/config.cr

@@ -73,6 +73,31 @@ struct HTTPProxyConfig
   property port : Int32
 end
 
+# Structure used for global per-page feature toggles
+record PagesEnabled,
+  trending : Bool = false,
+  popular : Bool = true,
+  search : Bool = true do
+  include YAML::Serializable
+
+  def [](key : String) : Bool
+    fetch(key) { raise KeyError.new("Unknown page '#{key}'") }
+  end
+
+  def []?(key : String) : Bool
+    fetch(key) { nil }
+  end
+
+  private def fetch(key : String, &)
+    case key
+    when "trending" then @trending
+    when "popular"  then @popular
+    when "search"   then @search
+    else                 yield
+    end
+  end
+end
+
 class Config
   include YAML::Serializable
 
@@ -116,13 +141,37 @@ class Config
 
   # Used to tell Invidious it is behind a proxy, so links to resources should be https://
   property https_only : Bool?
+
   # HMAC signing key for CSRF tokens and verifying pubsub subscriptions
   property hmac_key : String = ""
   # Domain to be used for links to resources on the site where an absolute URL is required
   property domain : String?
   # Subscribe to channels using PubSubHubbub (requires domain, hmac_key)
   property use_pubsub_feeds : Bool | Int32 = false
+
+  # —————————————————————————————————————————————————————————————————————————————————————
+
+  # A @{{key}}_present variable is required for both fields in order to handle the precedence for
+  # the deprecated `popular_enabled` in relations to `pages_enabled`
+
+  # DEPRECATED: use `pages_enabled["popular"]` instead.
+  @[Deprecated("`popular_enabled` will be removed in a future release; use pages_enabled[\"popular\"] instead")]
+  @[YAML::Field(presence: true)]
   property popular_enabled : Bool = true
+
+  @[YAML::Field(ignore: true)]
+  property popular_enabled_present : Bool
+
+  # Global per-page feature toggles.
+  # Valid keys: "trending", "popular", "search"
+  # If someone sets both `popular_enabled` and `pages_enabled["popular"]`, the latter takes precedence.
+  @[YAML::Field(presence: true)]
+  property pages_enabled : PagesEnabled = PagesEnabled.from_yaml("")
+
+  @[YAML::Field(ignore: true)]
+  property pages_enabled_present : Bool
+  # —————————————————————————————————————————————————————————————————————————————————————
+
   property captcha_enabled : Bool = true
   property login_enabled : Bool = true
   property registration_enabled : Bool = true
@@ -185,16 +234,17 @@ class Config
     when Bool
       return disabled
     when Array
-      if disabled.includes? option
-        return true
-      else
-        return false
-      end
+      disabled.includes?(option)
     else
-      return false
+      false
     end
   end
 
+  # Centralized page toggle with legacy fallback for `popular_enabled`
+  def page_enabled?(page : String) : Bool
+    return @pages_enabled[page]
+  end
+
   def self.load
     # Load config from file or YAML string env var
     env_config_file = "INVIDIOUS_CONFIG_FILE"
@@ -232,6 +282,12 @@ class Config
                         begin
                             config.{{ivar.id}} = ivar_type.from_yaml(env_value)
                             success = true
+
+                            # Update associated _present key if any
+                            {% other_ivar = @type.instance_vars.find { |other_ivar| other_ivar.name == ivar.name + "_present" } %}
+                            {% if other_ivar && (ann = other_ivar.annotation(YAML::Field)) && ann[:ignore] == true %}
+                              config.{{other_ivar.name.id}} = true
+                            {% end %}
                         rescue
                             # nop
                         end
@@ -283,6 +339,8 @@ class Config
       exit(1)
     end
 
+    config.process_deprecation
+
     # Build database_url from db.* if it's not set directly
     if config.database_url.to_s.empty?
       if db = config.db
@@ -320,4 +378,24 @@ class Config
 
     return config
   end
+
+  # Processes deprecated values
+  #
+  # Warns when they are set and handles any precedence issue that may arise when present alongside a successor attribute
+  #
+  # This method is public as to allow specs to test the behavior without going through #load
+  #
+  # :nodoc:
+  def process_deprecation(log_io : IO = STDOUT)
+    # Handle deprecated popular_enabled config and warn if it is set
+    if self.popular_enabled_present
+      log_io.puts "Warning: `popular_enabled` has been deprecated and replaced by the `pages_enabled` config"
+      log_io.puts "If both are set `pages_enabled` will take precedence over `popular_enabled`"
+
+      # Only use popular_enabled value when pages_enabled is unset
+      if !self.pages_enabled_present
+        self.pages_enabled = self.pages_enabled.copy_with(popular: self.popular_enabled)
+      end
+    end
+  end
 end

src/invidious/routes/api/v1/authenticated.cr

@@ -313,6 +313,11 @@ module Invidious::Routes::API::V1::Authenticated
       return error_json(403, "Invalid videoId")
     end
 
+    # Prevent duplicate videos in the same playlist
+    if Invidious::Database::PlaylistVideos.select_index(plid, video_id)
+      return error_json(409, "Video already exists in this playlist")
+    end
+
     begin
       video = get_video(video_id)
     rescue ex : NotFoundException

src/invidious/routes/api/v1/feeds.cr

@@ -29,11 +29,6 @@ module Invidious::Routes::API::V1::Feeds
 
     env.response.content_type = "application/json"
 
-    if !CONFIG.popular_enabled
-      error_message = {"error" => "Administrator has disabled this endpoint."}.to_json
-      haltf env, 403, error_message
-    end
-
     JSON.build do |json|
       json.array do
         popular_videos.each do |video|

src/invidious/routes/before_all.cr

@@ -115,6 +115,8 @@ module Invidious::Routes::BeforeAll
     preferences.locale = locale
     env.set "preferences", preferences
 
+    path = env.request.path
+
     # Allow media resources to be loaded from google servers
     # TODO: check if *.youtube.com can be removed
     #
@@ -130,7 +132,7 @@ module Invidious::Routes::BeforeAll
       env.response.headers["Content-Security-Policy"] = env.response.headers["Content-Security-Policy"].gsub("media-src", "media-src https://*.googlevideo.com:443 https://*.youtube.com:443")
     end
 
-    current_page = env.request.path
+    current_page = path
     if env.request.query
       query = HTTP::Params.parse(env.request.query.not_nil!)
 
@@ -142,5 +144,72 @@ module Invidious::Routes::BeforeAll
     end
 
     env.set "current_page", URI.encode_www_form(current_page)
+
+    page_key = case path
+               when "/feed/popular", "/api/v1/popular"
+                 "popular"
+               when "/feed/trending", "/api/v1/trending"
+                 "trending"
+               when "/api/v1/search", "/api/v1/search/suggestions"
+                 "search"
+               when .starts_with?("/api/v1/hashtag/")
+                 "search"
+               when "/search", "/results"
+                 # Handled by the search route (subscription-only mode when search disabled)
+                 nil
+               when .starts_with?("/hashtag/")
+                 "search"
+               else
+                 nil
+               end
+
+    if page_key && !CONFIG.page_enabled?(page_key)
+      env.response.status_code = 403
+      env.set "halted", true
+
+      if path.starts_with?("/api/")
+        env.response.content_type = "application/json"
+        env.response.print({error: "Administrator has disabled this endpoint."}.to_json)
+      else
+        preferences = env.get("preferences").as(Preferences)
+        locale = preferences.locale
+        dark_mode = preferences.dark_mode
+        theme_class = dark_mode.blank? ? "no" : dark_mode
+        error_message = translate(locale, "#{page_key}_page_disabled")
+
+        env.response.content_type = "text/html"
+        env.response.print <<-HTML
+        <!DOCTYPE html>
+        <html lang="#{locale}">
+        <head>
+          <meta charset="utf-8">
+          <meta name="viewport" content="width=device-width, initial-scale=1">
+          <title>Error - Invidious</title>
+          <link rel="stylesheet" href="/css/pure-min.css">
+          <link rel="stylesheet" href="/css/grids-responsive-min.css">
+          <link rel="stylesheet" href="/css/ionicons.min.css">
+          <link rel="stylesheet" href="/css/default.css">
+        </head>
+        <body class="#{theme_class}-theme">
+          <div class="pure-g">
+            <div class="pure-u-1 pure-u-xl-20-24" id="contents">
+              <div class="pure-g navbar h-box">
+                <div class="pure-u-1 pure-u-md-16-24">
+                  <a href="/" class="index-link pure-menu-heading">Invidious</a>
+                </div>
+              </div>
+              <div class="h-box" style="margin-top: 2em;">
+                <p>#{error_message}</p>
+                <p><a href="/">← #{translate(locale, "Back")}</a></p>
+              </div>
+            </div>
+          </div>
+        </body>
+        </html>
+        HTML
+      end
+
+      return
+    end
   end
 end