fix: add global adult library visibility controls

internal/handler/admin.go

@@ -182,10 +182,19 @@ func updateSettingHandler(svc *service.Container) gin.HandlerFunc {
 			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 			return
 		}
+		oldValue := ""
+		if req.Key == service.AdultLibraryIDsSettingKey {
+			oldValue, _ = svc.Repo.Setting.Get(c.Request.Context(), req.Key)
+		}
 		if err := svc.Repo.Setting.Set(c.Request.Context(), req.Key, req.Value); err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 			return
 		}
+		oldAdultLibraryIDs := service.DecodeAllowedLibraryIDs(oldValue)
+		newAdultLibraryIDs := service.DecodeAllowedLibraryIDs(req.Value)
+		if req.Key == service.AdultLibraryIDsSettingKey && len(oldAdultLibraryIDs) == 0 && len(newAdultLibraryIDs) > 0 {
+			_ = svc.Repo.DB.WithContext(c.Request.Context()).Model(&model.User{}).Where("hide_adult = ?", false).Update("hide_adult", true).Error
+		}
 		service.ApplyRuntimeSetting(svc.Cfg, req.Key, req.Value)
 		if req.Key == "transcode.enabled" && !svc.Cfg.Transcoder.Enabled {
 			svc.Transcoder.StopAll()

internal/handler/media.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
+	"github.com/ShukeBta/MediaStationGo/internal/middleware"
 	"github.com/ShukeBta/MediaStationGo/internal/service"
 )
 
@@ -25,6 +26,17 @@ func listLibrariesHandler(svc *service.Container) gin.HandlerFunc {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 			return
 		}
+		role, _ := c.Get(middleware.CtxUserRole)
+		if role != "admin" {
+			visibility := mediaVisibilityForRequest(c, svc)
+			filtered := libs[:0]
+			for _, lib := range libs {
+				if service.LibraryVisibleForUser(c.Request.Context(), svc.Repo, lib, visibility) {
+					filtered = append(filtered, lib)
+				}
+			}
+			libs = filtered
+		}
 		c.JSON(http.StatusOK, libs)
 	}
 }

internal/handler/media_extra.go

@@ -18,8 +18,8 @@ func recentMediaHandler(svc *service.Container) gin.HandlerFunc {
 		if limit <= 0 || limit > 100 {
 			limit = 12
 		}
-		var items []model.Media
-		if err := svc.Repo.DB.Order("created_at desc").Limit(limit).Find(&items).Error; err != nil {
+		items, err := svc.Media.SearchMediaVisible(c.Request.Context(), "", limit, mediaVisibilityForRequest(c, svc))
+		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 			return
 		}

internal/handler/series.go

@@ -25,6 +25,12 @@ type seasonGroup struct {
 func listSeasonsHandler(svc *service.Container) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		libID := c.Param("id")
+		if lib, err := svc.Repo.Library.FindByID(c.Request.Context(), libID); err == nil && lib != nil {
+			if !service.LibraryVisibleForUser(c.Request.Context(), svc.Repo, *lib, mediaVisibilityForRequest(c, svc)) {
+				c.JSON(http.StatusNotFound, gin.H{"error": "not found"})
+				return
+			}
+		}
 		var rows []model.Media
 		err := svc.Repo.DB.Where(&model.Media{LibraryID: libID}).
 			Order("season_num asc, episode_num asc").
@@ -33,8 +39,12 @@ func listSeasonsHandler(svc *service.Container) gin.HandlerFunc {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 			return
 		}
+		visibility := mediaVisibilityForRequest(c, svc)
 		buckets := make(map[int][]model.Media)
 		for _, r := range rows {
+			if !visibility.Allows(&r) {
+				continue
+			}
 			buckets[r.SeasonNum] = append(buckets[r.SeasonNum], r)
 		}
 		out := make([]seasonGroup, 0, len(buckets))

internal/handler/visibility.go

@@ -33,6 +33,11 @@ func mediaVisibilityForRequest(c *gin.Context, svc *service.Container) service.M
 	}
 	visibility.IncludeNSFW = adultEnabled && profile.AllowAdult && !userHidesAdult
 	visibility.AllowedLibraryIDs = profileAllowedLibraryIDs(*profile)
+	if !visibility.IncludeNSFW {
+		visibility.HiddenLibraryIDs = service.AdultLibraryIDs(c.Request.Context(), svc.Repo)
+	} else {
+		visibility.HiddenLibraryIDs = nil
+	}
 	return visibility
 }