28 changed files with 33 additions and 2113 deletions
--- a/.env.example
+++ b/.env.example
@ -3,8 +3,3 @@ DEBUG=True
 AMAZON_AFFILIATE_TAG=diora-20
 LASTFM_API_KEY=
 LASTFM_API_SECRET=
 # Cloud import (WebDAV/Nextcloud): allow connections to LAN/loopback addresses.
 # Leave False on any instance with open registration — it is what stops a user
 # from probing the internal network through the import proxy.
 WEBDAV_ALLOW_PRIVATE_HOSTS=False
--- a/.forgejo/workflows/test.yml
+++ b/.forgejo/workflows/test.yml
@ -11,25 +11,16 @@ jobs:
  test:
    runs-on: ubuntu-latest
    container:
-      # 22.04 ships Python 3.10, which cannot install the pinned Django (it
+      image: catthehacker/ubuntu:act-22.04
      # needs >= 3.12). While requirements.txt still said "django>=4.2" that
      # went unnoticed and pip quietly resolved a 4.x here — so CI was testing
      # a different Django than the image actually shipped. 24.04 gives us
      # 3.12, matching the Dockerfile's python:3.12-slim.
      image: catthehacker/ubuntu:act-24.04
    steps:
      - uses: actions/checkout@v4
      - name: Install Python dependencies
-        # 24.04 marks its system Python as externally managed (PEP 668), so a
+        run: pip install --no-cache-dir -r requirements.txt
        # bare `pip install` is refused. A venv is the sanctioned way in.
        run: |
          python -m venv /tmp/venv
          /tmp/venv/bin/pip install --no-cache-dir -r requirements.txt
      - name: Django system check
-        run: /tmp/venv/bin/python manage.py check
+        run: python manage.py check
      - name: Run tests
-        run: /tmp/venv/bin/python manage.py test
+        run: python manage.py test
--- a/.gitignore
+++ b/.gitignore
@ -19,7 +19,6 @@ env/
 media/
 staticfiles/
 .env
 tts_models/
 # IDE
 .idea/
--- a/18
+++ b/18
@ -4,26 +4,10 @@ WORKDIR /app
 RUN apt-get update && apt-get install -y --no-install-recommends \
    gcc \
    curl \
    && rm -rf /var/lib/apt/lists/*
 COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
+RUN pip install --no-cache-dir -r requirements.txt gunicorn
 # Piper voices for the reader's read-aloud feature (see tts/piper_engine.py).
 # Fetched at build time rather than kept in git or bind-mounted — there's no
 # existing volume-mount pattern for extra binary assets in this repo, and
 # baking them into the image keeps the watchtower "just pull the new image"
 # deploy flow working unchanged.
 RUN mkdir -p /app/tts_models && \
    curl -fsSL -o /app/tts_models/de_DE-thorsten-medium.onnx \
      https://huggingface.co/rhasspy/piper-voices/resolve/main/de/de_DE/thorsten/medium/de_DE-thorsten-medium.onnx && \
    curl -fsSL -o /app/tts_models/de_DE-thorsten-medium.onnx.json \
      https://huggingface.co/rhasspy/piper-voices/resolve/main/de/de_DE/thorsten/medium/de_DE-thorsten-medium.onnx.json && \
    curl -fsSL -o /app/tts_models/en_US-lessac-medium.onnx \
      https://huggingface.co/rhasspy/piper-voices/resolve/main/en/en_US/lessac/medium/en_US-lessac-medium.onnx && \
    curl -fsSL -o /app/tts_models/en_US-lessac-medium.onnx.json \
      https://huggingface.co/rhasspy/piper-voices/resolve/main/en/en_US/lessac/medium/en_US-lessac-medium.onnx.json
 ARG BUILD_TIME
 ENV BUILD_TIME=${BUILD_TIME}
--- a/accounts/migrations/0005_webdavsource.py
+++ b/accounts/migrations/0005_webdavsource.py
@ -1,33 +0,0 @@
 # Generated by Django 6.1 on 2026-08-28 08:01
 import django.db.models.deletion
 from django.conf import settings
 from django.db import migrations, models
 class Migration(migrations.Migration):
    dependencies = [
        ('accounts', '0004_apitoken'),
        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
    ]
    operations = [
        migrations.CreateModel(
            name='WebDAVSource',
            fields=[
                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
                ('label', models.CharField(max_length=100)),
                ('base_url', models.URLField(max_length=500)),
                ('username', models.CharField(blank=True, max_length=200)),
                ('password', models.CharField(blank=True, max_length=500)),
                ('root_path', models.CharField(blank=True, default='', max_length=500)),
                ('created_at', models.DateTimeField(auto_now_add=True)),
                ('last_used_at', models.DateTimeField(blank=True, null=True)),
                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='webdav_sources', to=settings.AUTH_USER_MODEL)),
            ],
            options={
                'ordering': ['created_at'],
            },
        ),
    ]
--- a/accounts/models.py
+++ b/accounts/models.py
@ -1,5 +1,4 @@
 import secrets
 from urllib.parse import urlsplit
 from django.db import models
 from django.contrib.auth.models import User
@ -38,57 +37,6 @@ def save_user_profile(sender, instance, **kwargs):
        instance.profile.save()
 class WebDAVSource(models.Model):
    """A user-supplied WebDAV endpoint that ebooks can be imported from.
    Deliberately generic rather than Nextcloud-specific — any WebDAV server
    (Nextcloud, ownCloud, Synology, rclone serve, …) works, Nextcloud just gets
    a URL-shorthand in `normalized_base_url`.
    The password is stored in the clear because the server has to replay it on
    every PROPFIND/GET (same trade-off as `lastfm_session_key` above). The UI
    therefore tells users to create a revocable *app password* rather than
    handing over their account password.
    """
    user = models.ForeignKey(User, on_delete=models.CASCADE, related_name='webdav_sources')
    label = models.CharField(max_length=100)
    base_url = models.URLField(max_length=500)
    username = models.CharField(max_length=200, blank=True)
    password = models.CharField(max_length=500, blank=True)
    root_path = models.CharField(max_length=500, blank=True, default='')
    created_at = models.DateTimeField(auto_now_add=True)
    last_used_at = models.DateTimeField(null=True, blank=True)
    class Meta:
        ordering = ['created_at']
    def __str__(self):
        return f"WebDAVSource({self.label}, user={self.user_id})"
    def normalized_base_url(self) -> str:
        """Collection root to resolve browse paths against, always ending in '/'.
        A bare host ('https://cloud.example.com') is expanded to the Nextcloud
        files endpoint, since that is the URL users actually have at hand; an
        URL that already points into a DAV tree is left alone so non-Nextcloud
        servers stay usable.
        """
        url = self.base_url.strip()
        if not url.endswith('/'):
            url += '/'
        # Match against the path only — a host literally named "webdav.…" or
        # "dav.…" must not be mistaken for a URL that already points into a
        # DAV tree.
        path = urlsplit(url).path.lower()
        is_dav = any(marker in path for marker in ('/remote.php/', '/dav/', '/webdav'))
        if not is_dav and self.username:
            url += f'remote.php/dav/files/{self.username}/'
        root = self.root_path.strip().strip('/')
        if root:
            url += root + '/'
        return url
 def _generate_token():
    return secrets.token_hex(32)
--- a/accounts/tests.py
+++ b/accounts/tests.py
@ -1,13 +1,9 @@
 import json
 import socket
 from types import SimpleNamespace
 from unittest.mock import patch
 from django.contrib.auth.models import User
-from django.test import TestCase, override_settings
+from django.test import TestCase
-from .models import ApiToken, WebDAVSource
+from .models import ApiToken
 from .webdav import WebDAVError, assert_safe_url, fetch_file, list_directory, safe_rel_path
 from books.models import EBook, EBookProgress, EBookHighlights
@ -93,436 +89,3 @@ class SyncSnapshotTests(TestCase):
        # No data_ct/data_iv leaked into the snapshot (book bytes stay lazy-fetched)
        self.assertNotIn('data_ct', data['books'][0])
 # ---------------------------------------------------------------------------
 # WebDAV cloud import
 # ---------------------------------------------------------------------------
 PROPFIND_RESPONSE = b'''<?xml version="1.0"?>
 <d:multistatus xmlns:d="DAV:">
  <d:response>
    <d:href>/remote.php/dav/files/alice/Books/</d:href>
    <d:propstat><d:prop><d:resourcetype><d:collection/></d:resourcetype></d:prop></d:propstat>
  </d:response>
  <d:response>
    <d:href>/remote.php/dav/files/alice/Books/Sci-Fi/</d:href>
    <d:propstat><d:prop><d:resourcetype><d:collection/></d:resourcetype></d:prop></d:propstat>
  </d:response>
  <d:response>
    <d:href>/remote.php/dav/files/alice/Books/Der%20Steppenwolf.epub</d:href>
    <d:propstat><d:prop><d:resourcetype/><d:getcontentlength>4096</d:getcontentlength></d:prop></d:propstat>
  </d:response>
  <d:response>
    <d:href>/remote.php/dav/files/alice/Books/notes.txt</d:href>
    <d:propstat><d:prop><d:resourcetype/><d:getcontentlength>12</d:getcontentlength></d:prop></d:propstat>
  </d:response>
 </d:multistatus>'''
 class _FakeSocket:
    def __init__(self, peer):
        self._peer = peer
    def getpeername(self):
        return (self._peer, 443)
 class _FakeResponse:
    def __init__(self, status_code=207, content=b'', headers=None, peer=None):
        self.status_code = status_code
        self.content = content
        self.headers = headers or {}
        self.closed = False
        # Mirrors requests' response.raw._connection.sock, which is what
        # _assert_peer_is_safe introspects. None means "nothing to check".
        if peer is None:
            self.raw = None
        else:
            self.raw = SimpleNamespace(_connection=SimpleNamespace(sock=_FakeSocket(peer)))
    def iter_content(self, chunk_size=None):
        yield self.content
    def close(self):
        self.closed = True
 class NormalizedBaseUrlTests(TestCase):
    def setUp(self):
        self.user = User.objects.create_user(username='alice', password='pw12345678')
    def _source(self, **kwargs):
        kwargs.setdefault('label', 'cloud')
        kwargs.setdefault('username', 'alice')
        return WebDAVSource(user=self.user, **kwargs)
    def test_bare_host_expands_to_nextcloud_files_endpoint(self):
        source = self._source(base_url='https://cloud.example.com')
        self.assertEqual(
            source.normalized_base_url(),
            'https://cloud.example.com/remote.php/dav/files/alice/',
        )
    def test_root_path_is_appended(self):
        source = self._source(base_url='https://cloud.example.com', root_path='/Buecher/')
        self.assertEqual(
            source.normalized_base_url(),
            'https://cloud.example.com/remote.php/dav/files/alice/Buecher/',
        )
    def test_explicit_dav_url_is_left_alone(self):
        source = self._source(base_url='https://dav.example.com/webdav')
        self.assertEqual(source.normalized_base_url(), 'https://dav.example.com/webdav/')
    def test_generic_server_without_username_is_not_rewritten(self):
        source = self._source(base_url='https://files.example.com/share', username='')
        self.assertEqual(source.normalized_base_url(), 'https://files.example.com/share/')
 class SafeRelPathTests(TestCase):
    def test_traversal_is_rejected(self):
        with self.assertRaises(WebDAVError):
            safe_rel_path('Books/../../etc/passwd')
    def test_leading_slashes_and_dots_are_stripped(self):
        self.assertEqual(safe_rel_path('/Books/./Sci-Fi/'), 'Books/Sci-Fi')
    def test_empty_path_is_root(self):
        self.assertEqual(safe_rel_path(''), '')
        self.assertEqual(safe_rel_path('/'), '')
 class AssertSafeUrlTests(TestCase):
    def _resolve_to(self, ip):
        return [(2, 1, 6, '', (ip, 443))]
    def test_non_http_scheme_rejected(self):
        with self.assertRaises(WebDAVError):
            assert_safe_url('file:///etc/passwd')
    def test_private_address_rejected(self):
        with patch('accounts.webdav.socket.getaddrinfo', return_value=self._resolve_to('172.18.0.4')):
            with self.assertRaises(WebDAVError):
                assert_safe_url('https://internal.example.com/dav/')
    def test_loopback_rejected(self):
        with patch('accounts.webdav.socket.getaddrinfo', return_value=self._resolve_to('127.0.0.1')):
            with self.assertRaises(WebDAVError):
                assert_safe_url('http://localhost:11000/remote.php/dav/')
    def test_link_local_metadata_endpoint_rejected(self):
        with patch('accounts.webdav.socket.getaddrinfo', return_value=self._resolve_to('169.254.169.254')):
            with self.assertRaises(WebDAVError):
                assert_safe_url('http://metadata.example.com/')
    def test_public_address_allowed(self):
        with patch('accounts.webdav.socket.getaddrinfo', return_value=self._resolve_to('85.214.6.118')):
            assert_safe_url('https://nc.example.com/remote.php/dav/')
    def test_unresolvable_host_rejected(self):
        with patch('accounts.webdav.socket.getaddrinfo', side_effect=socket.gaierror):
            with self.assertRaises(WebDAVError):
                assert_safe_url('https://nope.example.com/')
    @override_settings(WEBDAV_ALLOW_PRIVATE_HOSTS=True)
    def test_private_allowed_when_opted_in(self):
        assert_safe_url('http://192.168.1.10/dav/')
 class ListDirectoryTests(TestCase):
    def setUp(self):
        self.user = User.objects.create_user(username='alice', password='pw12345678')
        self.source = WebDAVSource.objects.create(
            user=self.user, label='cloud', base_url='https://cloud.example.com',
            username='alice', password='app-pw', root_path='Books',
        )
    def _list(self, response=None):
        with patch('accounts.webdav.assert_safe_url'), \
             patch('accounts.webdav.requests.request',
                   return_value=response or _FakeResponse(content=PROPFIND_RESPONSE)):
            return list_directory(self.source)
    def test_entries_are_parsed_and_sorted_dirs_first(self):
        entries = self._list()
        self.assertEqual([e['name'] for e in entries],
                         ['Sci-Fi', 'Der Steppenwolf.epub', 'notes.txt'])
    def test_collection_itself_is_excluded(self):
        self.assertNotIn('Books', [e['name'] for e in self._list()])
    def test_book_flag_and_size(self):
        by_name = {e['name']: e for e in self._list()}
        self.assertTrue(by_name['Der Steppenwolf.epub']['is_book'])
        self.assertEqual(by_name['Der Steppenwolf.epub']['size'], 4096)
        self.assertFalse(by_name['notes.txt']['is_book'])
        self.assertTrue(by_name['Sci-Fi']['is_dir'])
    def test_redirect_is_refused_rather_than_followed(self):
        redirect_response = _FakeResponse(status_code=302, headers={'Location': 'http://127.0.0.1/'})
        with self.assertRaises(WebDAVError):
            self._list(redirect_response)
    def test_bad_credentials_surface_clearly(self):
        with self.assertRaises(WebDAVError) as ctx:
            self._list(_FakeResponse(status_code=401))
        self.assertIn('App-Passwort', str(ctx.exception))
 class FetchFileTests(TestCase):
    def setUp(self):
        self.user = User.objects.create_user(username='alice', password='pw12345678')
        self.source = WebDAVSource.objects.create(
            user=self.user, label='cloud', base_url='https://cloud.example.com', username='alice',
        )
    def test_non_book_extension_refused_before_any_request(self):
        with patch('accounts.webdav.requests.request') as mock_request:
            with self.assertRaises(WebDAVError):
                fetch_file(self.source, 'secrets.env', 1024)
        mock_request.assert_not_called()
    def test_declared_oversize_refused(self):
        response = _FakeResponse(status_code=200, headers={'Content-Length': '99999'})
        with patch('accounts.webdav.assert_safe_url'), \
             patch('accounts.webdav.requests.request', return_value=response):
            with self.assertRaises(WebDAVError):
                fetch_file(self.source, 'big.epub', 1024)
    def test_streamed_oversize_refused_even_without_content_length(self):
        response = _FakeResponse(status_code=200, content=b'x' * 5000)
        with patch('accounts.webdav.assert_safe_url'), \
             patch('accounts.webdav.requests.request', return_value=response):
            with self.assertRaises(WebDAVError):
                fetch_file(self.source, 'sneaky.epub', 1024)
    def test_successful_fetch_returns_bytes(self):
        response = _FakeResponse(status_code=200, content=b'EPUB-BYTES')
        with patch('accounts.webdav.assert_safe_url'), \
             patch('accounts.webdav.requests.request', return_value=response):
            self.assertEqual(fetch_file(self.source, 'ok.epub', 1024), b'EPUB-BYTES')
 class CloudImportViewTests(TestCase):
    def setUp(self):
        self.user = User.objects.create_user(username='alice', password='pw12345678')
        self.other = User.objects.create_user(username='bob', password='pw12345678')
        self.source = WebDAVSource.objects.create(
            user=self.user, label='cloud', base_url='https://cloud.example.com', username='alice',
        )
        self.foreign = WebDAVSource.objects.create(
            user=self.other, label='bobs', base_url='https://other.example.com', username='bob',
        )
    def test_endpoints_require_authentication(self):
        self.assertEqual(self.client.get('/books/cloud/sources/').status_code, 401)
        self.assertEqual(self.client.get(f'/books/cloud/{self.source.pk}/browse/').status_code, 401)
        self.assertEqual(self.client.get(f'/books/cloud/{self.source.pk}/fetch/?path=a.epub').status_code, 401)
    def test_sources_are_scoped_to_the_owner(self):
        self.client.force_login(self.user)
        labels = [s['label'] for s in self.client.get('/books/cloud/sources/').json()['sources']]
        self.assertEqual(labels, ['cloud'])
    def test_foreign_source_is_not_browsable(self):
        self.client.force_login(self.user)
        resp = self.client.get(f'/books/cloud/{self.foreign.pk}/browse/')
        self.assertEqual(resp.status_code, 404)
    def test_browse_returns_entries(self):
        self.client.force_login(self.user)
        entries = [{'name': 'Dune.epub', 'path': 'Dune.epub', 'is_dir': False,
                    'size': 10, 'modified': '', 'is_book': True}]
        with patch('books.webdav.list_directory', return_value=entries):
            resp = self.client.get(f'/books/cloud/{self.source.pk}/browse/')
        self.assertEqual(resp.status_code, 200)
        self.assertEqual(resp.json()['entries'], entries)
    def test_browse_reports_upstream_failure_as_502(self):
        self.client.force_login(self.user)
        with patch('books.webdav.list_directory', side_effect=WebDAVError('kaputt')):
            resp = self.client.get(f'/books/cloud/{self.source.pk}/browse/')
        self.assertEqual(resp.status_code, 502)
        self.assertEqual(resp.json()['error'], 'kaputt')
    def test_bad_user_input_is_400_not_502(self):
        self.client.force_login(self.user)
        resp = self.client.get(f'/books/cloud/{self.source.pk}/fetch/?path=../../etc/passwd')
        self.assertEqual(resp.status_code, 400)
        resp = self.client.get(f'/books/cloud/{self.source.pk}/fetch/?path=notes.txt')
        self.assertEqual(resp.status_code, 400)
    def test_fetch_streams_bytes_without_storing_them(self):
        self.client.force_login(self.user)
        with patch('books.webdav.fetch_file', return_value=b'EPUB-BYTES'):
            resp = self.client.get(f'/books/cloud/{self.source.pk}/fetch/?path=Dune.epub')
        self.assertEqual(resp.status_code, 200)
        self.assertEqual(resp.content, b'EPUB-BYTES')
        # The proxy is a pass-through: nothing is persisted server-side.
        self.assertEqual(EBook.objects.count(), 0)
 BILLION_LAUGHS = b'''<?xml version="1.0"?>
 <!DOCTYPE lolz [
 <!ENTITY lol "lol">
 <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
 <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
 <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
 <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
 ]>
 <d:multistatus xmlns:d="DAV:"><d:response><d:href>&lol4;</d:href></d:response></d:multistatus>'''
 # A server that answers with the 404 propstat first — legal per RFC 4918, and
 # what made directories disappear from the listing before _select_prop existed.
 PROPSTAT_404_FIRST = b'''<?xml version="1.0"?>
 <d:multistatus xmlns:d="DAV:">
  <d:response>
    <d:href>/remote.php/dav/files/alice/Books/</d:href>
    <d:propstat><d:prop><d:resourcetype><d:collection/></d:resourcetype></d:prop>
      <d:status>HTTP/1.1 200 OK</d:status></d:propstat>
  </d:response>
  <d:response>
    <d:href>/remote.php/dav/files/alice/Books/Sci-Fi/</d:href>
    <d:propstat><d:prop><d:getcontentlength/></d:prop>
      <d:status>HTTP/1.1 404 Not Found</d:status></d:propstat>
    <d:propstat><d:prop><d:resourcetype><d:collection/></d:resourcetype></d:prop>
      <d:status>HTTP/1.1 200 OK</d:status></d:propstat>
  </d:response>
 </d:multistatus>'''
 RELATIVE_HREF_RESPONSE = b'''<?xml version="1.0"?>
 <d:multistatus xmlns:d="DAV:">
  <d:response><d:href>Dune.epub</d:href>
    <d:propstat><d:prop><d:resourcetype/><d:getcontentlength>7</d:getcontentlength></d:prop>
      <d:status>HTTP/1.1 200 OK</d:status></d:propstat>
  </d:response>
 </d:multistatus>'''
 class WebDAVHardeningTests(TestCase):
    """Regressions for the SSRF / resource-exhaustion review findings."""
    def setUp(self):
        self.user = User.objects.create_user(username='alice', password='pw12345678')
        self.source = WebDAVSource.objects.create(
            user=self.user, label='cloud', base_url='https://cloud.example.com',
            username='alice', password='app-pw', root_path='Books',
        )
    def _list(self, response):
        with patch('accounts.webdav.assert_safe_url'), \
             patch('accounts.webdav.requests.request', return_value=response):
            return list_directory(self.source)
    # --- DNS rebinding -----------------------------------------------------
    def test_peer_address_is_rechecked_after_connecting(self):
        """A resolver that answers public-then-private must not leak a body.
        assert_safe_url passes (it is given a public answer), but the socket
        actually landed on a Docker-internal address.
        """
        response = _FakeResponse(content=PROPFIND_RESPONSE, peer='172.18.0.5')
        with self.assertRaises(WebDAVError):
            self._list(response)
        self.assertTrue(response.closed)
    def test_public_peer_is_accepted(self):
        response = _FakeResponse(content=PROPFIND_RESPONSE, peer='85.214.6.118')
        self.assertTrue(self._list(response))
    @override_settings(WEBDAV_ALLOW_PRIVATE_HOSTS=True)
    def test_peer_check_respects_the_opt_out(self):
        response = _FakeResponse(content=PROPFIND_RESPONSE, peer='192.168.1.10')
        self.assertTrue(self._list(response))
    # --- Resource exhaustion ----------------------------------------------
    def test_entity_expansion_is_refused(self):
        with self.assertRaises(WebDAVError):
            self._list(_FakeResponse(content=BILLION_LAUGHS))
    def test_oversized_listing_is_refused(self):
        oversized = _FakeResponse(headers={'Content-Length': str(9 * 1024 * 1024)})
        with self.assertRaises(WebDAVError):
            self._list(oversized)
        self.assertTrue(oversized.closed)
    # --- Information disclosure -------------------------------------------
    def test_rejection_message_leaks_neither_ip_nor_resolvability(self):
        private = [(2, 1, 6, '', ('172.18.0.5', 443))]
        with patch('accounts.webdav.socket.getaddrinfo', return_value=private):
            with self.assertRaises(WebDAVError) as private_ctx:
                assert_safe_url('http://forgejo-db/')
        with patch('accounts.webdav.socket.getaddrinfo', side_effect=socket.gaierror):
            with self.assertRaises(WebDAVError) as missing_ctx:
                assert_safe_url('http://forgejo-db/')
        self.assertNotIn('172.18.0.5', str(private_ctx.exception))
        # Same wording either way, so the endpoint cannot be used to tell an
        # existing internal host from a nonexistent one.
        self.assertEqual(str(private_ctx.exception), str(missing_ctx.exception))
    # --- Malformed input ---------------------------------------------------
    def test_invalid_port_is_reported_not_crashed(self):
        with self.assertRaises(WebDAVError):
            assert_safe_url('https://example.com:99999/dav/')
    def test_ipv6_transition_ranges_are_rejected(self):
        for address in ('64:ff9b::7f00:1', '::127.0.0.1'):
            with patch('accounts.webdav.socket.getaddrinfo',
                       return_value=[(10, 1, 6, '', (address, 443, 0, 0))]):
                with self.assertRaises(WebDAVError, msg=address):
                    assert_safe_url('https://nat64.example.com/')
    # --- PROPFIND parsing --------------------------------------------------
    def test_directory_survives_a_404_propstat_listed_first(self):
        entries = self._list(_FakeResponse(content=PROPSTAT_404_FIRST))
        by_name = {e['name']: e for e in entries}
        self.assertTrue(by_name['Sci-Fi']['is_dir'])
    def test_relative_hrefs_are_resolved(self):
        entries = self._list(_FakeResponse(content=RELATIVE_HREF_RESPONSE))
        self.assertEqual([e['name'] for e in entries], ['Dune.epub'])
    # --- URL normalisation -------------------------------------------------
    def test_host_named_webdav_still_gets_the_nextcloud_path(self):
        source = WebDAVSource(user=self.user, label='x',
                              base_url='https://webdav.example.com', username='alice')
        self.assertEqual(
            source.normalized_base_url(),
            'https://webdav.example.com/remote.php/dav/files/alice/',
        )
 class WebDAVSourceLimitTests(TestCase):
    def setUp(self):
        self.user = User.objects.create_user(username='alice', password='pw12345678')
        self.client.force_login(self.user)
    @override_settings(WEBDAV_MAX_SOURCES_PER_USER=2)
    def test_sources_are_capped_per_user(self):
        with patch('accounts.views._probe_source', return_value=(20, 'ok')):
            for i in range(3):
                self.client.post('/accounts/webdav/add/',
                                 {'label': f'c{i}', 'base_url': 'https://example.com'})
        self.assertEqual(self.user.webdav_sources.count(), 2)
 class CloudFetchCachingTests(TestCase):
    def setUp(self):
        self.user = User.objects.create_user(username='alice', password='pw12345678')
        self.source = WebDAVSource.objects.create(
            user=self.user, label='cloud', base_url='https://cloud.example.com', username='alice',
        )
    def test_plaintext_bytes_are_not_cacheable(self):
        self.client.force_login(self.user)
        with patch('books.webdav.fetch_file', return_value=b'EPUB-BYTES'):
            resp = self.client.get(f'/books/cloud/{self.source.pk}/fetch/?path=Dune.epub')
        self.assertEqual(resp['Cache-Control'], 'no-store')
--- a/accounts/urls.py
+++ b/accounts/urls.py
@ -16,7 +16,4 @@ urlpatterns = [
    path('check-password/', views.check_password, name='check_password'),
    path('change-password/', views.change_password, name='change_password'),
    path('api-token/regenerate/', views.regenerate_api_token, name='regenerate_api_token'),
    path('webdav/add/', views.webdav_add, name='webdav_add'),
    path('webdav/<int:pk>/test/', views.webdav_test, name='webdav_test'),
    path('webdav/<int:pk>/delete/', views.webdav_delete, name='webdav_delete'),
 ]
--- a/accounts/views.py
+++ b/accounts/views.py
@ -1,7 +1,6 @@
 import base64
 import json
 from django.conf import settings
 from django.contrib import messages
 from django.contrib.auth import authenticate, login, get_user_model, update_session_auth_hash
 from django.contrib.auth.decorators import login_required
 from django.contrib.auth.forms import UserCreationForm, AuthenticationForm, PasswordChangeForm
@ -12,8 +11,7 @@ from django.views.decorators.http import require_http_methods
 from radio import lastfm as lastfm_module
-from .models import ApiToken, WebDAVSource
+from .models import ApiToken
 from .webdav import WebDAVError, list_directory
 User = get_user_model()
@ -77,7 +75,6 @@ def settings_view(request):
        'has_lastfm': profile.has_lastfm(),
        'password_form': PasswordChangeForm(request.user),
        'api_token': getattr(request.user, 'api_token', None),
        'webdav_sources': request.user.webdav_sources.all(),
    }
    return render(request, 'accounts/settings.html', context)
@ -216,7 +213,6 @@ def change_password(request):
        'password_form': form,
        'password_form_open': True,
        'api_token': getattr(request.user, 'api_token', None),
        'webdav_sources': request.user.webdav_sources.all(),
    })
@ -240,73 +236,3 @@ def regenerate_api_token(request):
    token, _ = ApiToken.objects.get_or_create(user=request.user)
    token.regenerate()
    return redirect('settings')
 # ---------------------------------------------------------------------------
 # WebDAV sources (Nextcloud & friends) — used by the ebook cloud import
 # ---------------------------------------------------------------------------
 def _probe_source(source):
    """Report a source's reachability as a (level, message) pair for messages."""
    try:
        entries = list_directory(source)
    except WebDAVError as exc:
        return messages.WARNING, f'„{source.label}“ gespeichert, aber nicht erreichbar: {exc}'
    books = sum(1 for e in entries if e['is_book'])
    folders = sum(1 for e in entries if e['is_dir'])
    return messages.SUCCESS, (
        f'„{source.label}“ verbunden — {books} Buch/Bücher und {folders} Ordner im Startverzeichnis.'
    )
@login_required
@require_http_methods(['POST'])
 def webdav_add(request):
    label = request.POST.get('label', '').strip()
    base_url = request.POST.get('base_url', '').strip()
    if not label or not base_url:
        messages.error(request, 'Name und Server-URL sind erforderlich.')
        return redirect('settings')
    # Each source costs a synchronous probe on add and is reachable from the
    # import endpoints, so cap how many one account can pile up.
    max_sources = getattr(settings, 'WEBDAV_MAX_SOURCES_PER_USER', 10)
    if request.user.webdav_sources.count() >= max_sources:
        messages.error(request, f'Maximal {max_sources} Cloud-Verbindungen pro Konto.')
        return redirect('settings')
    source = WebDAVSource.objects.create(
        user=request.user,
        label=label[:100],
        base_url=base_url[:500],
        username=request.POST.get('username', '').strip()[:200],
        password=request.POST.get('password', '')[:500],
        root_path=request.POST.get('root_path', '').strip()[:500],
    )
    level, message = _probe_source(source)
    messages.add_message(request, level, message)
    return redirect('settings')
@login_required
@require_http_methods(['POST'])
 def webdav_test(request, pk):
    source = WebDAVSource.objects.filter(pk=pk, user=request.user).first()
    if not source:
        messages.error(request, 'Verbindung nicht gefunden.')
        return redirect('settings')
    level, message = _probe_source(source)
    messages.add_message(request, level, message)
    return redirect('settings')
@login_required
@require_http_methods(['POST'])
 def webdav_delete(request, pk):
    deleted, _ = WebDAVSource.objects.filter(pk=pk, user=request.user).delete()
    if deleted:
        messages.success(request, 'Verbindung entfernt.')
    return redirect('settings')
--- a/accounts/webdav.py
+++ b/accounts/webdav.py
@ -1,380 +0,0 @@
 """Minimal, hardened WebDAV client behind the ebook cloud import.
 Only PROPFIND (Depth 1) and GET are implemented — enough to browse a remote
 folder and pull a single file out of it.
 Every request here is made by the server to a URL the *user* supplied, which
 makes this an SSRF surface: registration is open (accounts/views.py:23) and
 diora normally runs in a Docker network next to other services. Three things
 guard it, and all three are load-bearing:
  * `assert_safe_url` refuses hosts that resolve to non-public addresses,
  * `_assert_peer_is_safe` re-checks the address we *actually* connected to,
    because requests resolves the hostname a second time and a hostile resolver
    can answer differently across the two lookups (DNS rebinding),
  * redirects are refused rather than followed, so a public host cannot bounce
    us onto a private one.
 Residual risk worth knowing about: a rebinding attacker can still cause a
 single request to be *sent* to an internal address; the peer check runs before
 the body is read, so nothing comes back to them. Fully closing that needs
 connect-time DNS pinning, which requests does not expose without reaching into
 urllib3.
 Response bodies are read through `_read_capped` and parsed only after any DTD
 is refused — the remote server is attacker-chosen, so an unbounded read or a
 billion-laughs document would otherwise be a cheap way to OOM the container.
 """
 import ipaddress
 import socket
 import xml.etree.ElementTree as ET
 from urllib.parse import quote, unquote, urljoin, urlsplit
 import requests
 from django.conf import settings
 DAV_NS = '{DAV:}'
 BOOK_EXTENSIONS = ('.epub', '.pdf')
 # A directory listing is XML; anything this large is not a real one.
 MAX_LISTING_BYTES = 8 * 1024 * 1024
 class WebDAVError(Exception):
    """Failure with a message that is safe to show the user directly."""
 class WebDAVInputError(WebDAVError):
    """The user's own URL/path/credentials are at fault, not the remote server.
    Separated so views can answer 400 instead of 502 — a rejected traversal
    attempt is not an upstream outage.
    """
 def _timeout():
    return getattr(settings, 'WEBDAV_TIMEOUT', 15)
 def _allow_private():
    return getattr(settings, 'WEBDAV_ALLOW_PRIVATE_HOSTS', False)
 # ---------------------------------------------------------------------------
 # SSRF guard
 # ---------------------------------------------------------------------------
 def _unreachable(host):
    """One message for every "we won't talk to this" case.
    Deliberately does not say whether the name failed to resolve or resolved to
    a private address, and never echoes the resolved IP: telling those apart
    would turn this endpoint into a scanner for the Docker network's service
    names and addresses.
    """
    return WebDAVInputError(
        f'„{host}“ ist nicht öffentlich erreichbar. Aus Sicherheitsgründen sind nur '
        'öffentlich auflösbare Server erlaubt.'
    )
 def _is_public(raw_address):
    """True only for addresses we are willing to open a connection to."""
    try:
        # Scope IDs ('fe80::1%eth0') are not part of the address itself.
        ip = ipaddress.ip_address(raw_address.split('%')[0])
    except ValueError:
        return False
    if not ip.is_global:
        return False
    # is_global misses two IPv6 transition ranges that can carry an embedded
    # private IPv4 address: the well-known NAT64 prefix (RFC 6052) and the
    # deprecated IPv4-compatible range.
    if ip.version == 6:
        for unsafe in ('64:ff9b::/96', '::/96'):
            if ip in ipaddress.ip_network(unsafe):
                return False
    return True
 def assert_safe_url(url):
    """Reject URLs that don't resolve to a public address.
    Self-hosted setups that legitimately want a LAN target can opt out with
    WEBDAV_ALLOW_PRIVATE_HOSTS=True, which is why this is a setting and not a
    hard rule.
    """
    parts = urlsplit(url)
    if parts.scheme not in ('http', 'https'):
        raise WebDAVInputError('Nur http:// und https:// werden unterstützt.')
    host = parts.hostname
    if not host:
        raise WebDAVInputError('Die URL enthält keinen Hostnamen.')
    try:
        port = parts.port or (443 if parts.scheme == 'https' else 80)
    except ValueError:
        # urlsplit validates the port lazily, on attribute access.
        raise WebDAVInputError('Die URL enthält einen ungültigen Port.')
    if _allow_private():
        return
    try:
        infos = socket.getaddrinfo(host, port, proto=socket.IPPROTO_TCP)
    except socket.gaierror:
        raise _unreachable(host)
    for info in infos:
        if not _is_public(info[4][0]):
            raise _unreachable(host)
 def _assert_peer_is_safe(response):
    """Re-check the address the socket actually connected to.
    `assert_safe_url` validates DNS before the request, but requests resolves
    the name again when it opens the connection. A resolver answering
    public-then-private across those two lookups would otherwise hand us an
    internal service's response body.
    """
    if _allow_private():
        return
    sock = getattr(getattr(response.raw, '_connection', None), 'sock', None)
    if sock is None:
        return  # nothing to introspect (mocked, or already released)
    try:
        peer = sock.getpeername()[0]
    except OSError:
        return
    if not _is_public(peer):
        raise WebDAVInputError('Der Server ist nicht öffentlich erreichbar.')
 # ---------------------------------------------------------------------------
 # Path helpers
 # ---------------------------------------------------------------------------
 def safe_rel_path(raw):
    """Normalise a client-supplied path and keep it inside the source root.
    Whatever survives here is percent-encoded by `_build_url` with `quote()`'s
    default `safe='/'`, and that is what stops double-encoded traversal
    ('%252e%252e%252f') and smuggled absolute URLs: '%' and ':' both get
    escaped, so they land as literal filename characters. Widening that safe
    set would reopen those paths.
    """
    raw = (raw or '').strip().strip('/')
    if not raw:
        return ''
    segments = []
    for segment in raw.split('/'):
        if not segment or segment == '.':
            continue
        if segment == '..':
            raise WebDAVInputError('Ungültiger Pfad.')
        segments.append(segment)
    return '/'.join(segments)
 def _build_url(source, rel_path):
    base = source.normalized_base_url()
    if not rel_path:
        return base
    return base + quote(rel_path)
 def _request(method, url, source, **kwargs):
    assert_safe_url(url)
    auth = (source.username, source.password) if source.username else None
    try:
        # Always streamed: it keeps the connection open long enough to inspect
        # the peer, and stops requests from buffering an unbounded body before
        # we get the chance to cap it.
        response = requests.request(
            method, url, auth=auth, timeout=_timeout(),
            allow_redirects=False, stream=True, **kwargs
        )
    except requests.Timeout:
        raise WebDAVError('Zeitüberschreitung beim Server.')
    except requests.RequestException as exc:
        raise WebDAVError(f'Verbindung fehlgeschlagen: {exc.__class__.__name__}')
    try:
        _assert_peer_is_safe(response)
        if response.status_code in (301, 302, 303, 307, 308):
            raise WebDAVError(
                'Der Server hat eine Weiterleitung geschickt. '
                'Bitte trage die Ziel-URL direkt ein.'
            )
        if response.status_code in (401, 403):
            raise WebDAVInputError('Anmeldung abgelehnt — Benutzername oder App-Passwort prüfen.')
        if response.status_code == 404:
            raise WebDAVError('Pfad auf dem Server nicht gefunden.')
        if response.status_code >= 400:
            raise WebDAVError(f'Server antwortete mit HTTP {response.status_code}.')
    except Exception:
        response.close()
        raise
    return response
 def _read_capped(response, max_bytes, oversize_error):
    """Read a streamed body, aborting as soon as it exceeds `max_bytes`."""
    declared = response.headers.get('Content-Length')
    if declared and declared.isdigit() and int(declared) > max_bytes:
        response.close()
        raise oversize_error()
    chunks = []
    total = 0
    try:
        for chunk in response.iter_content(chunk_size=64 * 1024):
            total += len(chunk)
            if total > max_bytes:
                raise oversize_error()
            chunks.append(chunk)
    except requests.RequestException:
        raise WebDAVError('Übertragung abgebrochen.')
    finally:
        response.close()
    return b''.join(chunks)
 # ---------------------------------------------------------------------------
 # PROPFIND / GET
 # ---------------------------------------------------------------------------
 _PROPFIND_BODY = (
    '<?xml version="1.0" encoding="utf-8"?>'
    '<d:propfind xmlns:d="DAV:"><d:prop>'
    '<d:resourcetype/><d:getcontentlength/><d:getlastmodified/>'
    '</d:prop></d:propfind>'
 )
 def _parse_listing_xml(payload):
    """Parse a multistatus body, refusing any document that carries a DTD.
    The remote server is chosen by the user, so a billion-laughs document is
    within an attacker's reach, and ElementTree *does* expand internal entities
    (verified on 3.12: a 3-level document expands). Installing an expat
    EntityDeclHandler is not an option either — `XMLParser.parser` no longer
    exists in 3.12, so setting it silently does nothing.
    That leaves rejecting the DTD before parsing. It costs nothing: a real
    multistatus never has one, and a filename containing this text would arrive
    escaped as `&lt;!DOCTYPE`, so these bytes can only ever be markup.
    """
    lowered = payload.lower()
    if b'<!doctype' in lowered or b'<!entity' in lowered:
        raise WebDAVError('Die Antwort enthält eine DTD und wurde abgelehnt.')
    try:
        return ET.fromstring(payload)
    except (ET.ParseError, ValueError):
        raise WebDAVError('Unerwartete Antwort — ist das wirklich eine WebDAV-URL?')
 def _select_prop(node):
    """Return the <prop> block that actually applies.
    RFC 4918 lets a server split its answer across several <propstat> blocks —
    typically a 200 for the properties it found and a 404 for the ones it did
    not, in no guaranteed order. Taking the first one blindly mislabels
    directories (whose getcontentlength is the missing property) as files, and
    the client then filters them out of the listing entirely.
    """
    fallback = None
    for propstat in node.findall(f'{DAV_NS}propstat'):
        prop = propstat.find(f'{DAV_NS}prop')
        if prop is None:
            continue
        if ' 200 ' in (propstat.findtext(f'{DAV_NS}status') or ''):
            return prop
        if fallback is None:
            fallback = prop
    return fallback
 def list_directory(source, rel_path=''):
    """PROPFIND Depth 1, returned as entries relative to the source root."""
    rel_path = safe_rel_path(rel_path)
    url = _build_url(source, rel_path)
    if not url.endswith('/'):
        url += '/'
    response = _request(
        'PROPFIND', url, source,
        headers={'Depth': '1', 'Content-Type': 'application/xml; charset=utf-8'},
        data=_PROPFIND_BODY.encode('utf-8'),
    )
    payload = _read_capped(
        response, MAX_LISTING_BYTES,
        lambda: WebDAVError('Verzeichnisliste ist unerwartet groß.'),
    )
    root = _parse_listing_xml(payload)
    base_path = unquote(urlsplit(url).path)
    entries = []
    for node in root.findall(f'{DAV_NS}response'):
        href = node.findtext(f'{DAV_NS}href') or ''
        # hrefs come as absolute URLs, absolute paths, or relative references.
        href_path = unquote(urlsplit(urljoin(url, href)).path)
        if not href_path.startswith(base_path):
            continue
        remainder = href_path[len(base_path):].strip('/')
        if not remainder:
            continue  # the collection we asked about
        if '/' in remainder:
            continue  # Depth 1 should not return these, but be strict anyway
        prop = _select_prop(node)
        is_dir = (
            prop is not None
            and prop.find(f'{DAV_NS}resourcetype/{DAV_NS}collection') is not None
        )
        size_text = prop.findtext(f'{DAV_NS}getcontentlength') if prop is not None else None
        try:
            size = int(size_text) if size_text else 0
        except ValueError:
            size = 0
        entries.append({
            'name': remainder,
            'path': f'{rel_path}/{remainder}' if rel_path else remainder,
            'is_dir': is_dir,
            'size': size,
            'modified': (prop.findtext(f'{DAV_NS}getlastmodified') or '') if prop is not None else '',
            'is_book': (not is_dir) and remainder.lower().endswith(BOOK_EXTENSIONS),
        })
    entries.sort(key=lambda e: (not e['is_dir'], e['name'].lower()))
    return entries
 def fetch_file(source, rel_path, max_bytes):
    """Download one file, refusing anything larger than `max_bytes`.
    Reads into memory rather than to disk: the caller hands the bytes straight
    back to the browser, which encrypts them. Nothing readable is persisted
    server-side.
    """
    rel_path = safe_rel_path(rel_path)
    if not rel_path:
        raise WebDAVInputError('Kein Pfad angegeben.')
    if not rel_path.lower().endswith(BOOK_EXTENSIONS):
        raise WebDAVInputError('Nur .epub- und .pdf-Dateien können importiert werden.')
    response = _request('GET', _build_url(source, rel_path), source)
    return _read_capped(
        response, max_bytes,
        lambda: WebDAVInputError(f'Datei ist zu groß (max. {max_bytes // 1024 // 1024} MB).'),
    )
--- a/books/urls.py
+++ b/books/urls.py
@ -1,12 +1,9 @@
 from django.urls import path
-from . import views, webdav
+from . import views
 urlpatterns = [
    path('', views.book_list, name='book_list'),
    path('upload/', views.upload_book, name='upload_book'),
    path('cloud/sources/', webdav.cloud_sources, name='cloud_sources'),
    path('cloud/<int:pk>/browse/', webdav.cloud_browse, name='cloud_browse'),
    path('cloud/<int:pk>/fetch/', webdav.cloud_fetch, name='cloud_fetch'),
    path('metadata-lookup/', views.lookup_book_metadata, name='lookup_book_metadata'),
    path('<int:pk>/data/', views.get_book_data, name='get_book_data'),
    path('<int:pk>/delete/', views.delete_book, name='delete_book'),
--- a/books/webdav.py
+++ b/books/webdav.py
@ -1,89 +0,0 @@
 """Cloud import endpoints for the ebook library.
 These let the browser browse a user-configured WebDAV server and pull one book
 out of it. The fetch is proxied through the server rather than done in the
 browser because the WebDAV host is a different origin and will not send CORS
 headers for it.
 That proxy is a deliberate, narrow relaxation of the same rule the ISBN lookup
 in books/views.py bends: the server sees the file's bytes in memory for the
 duration of one request, but never persists them. The book is encrypted in the
 browser and only then POSTed to /books/upload/ as ciphertext, exactly like a
 local upload — nothing readable is ever stored server-side.
 """
 from django.conf import settings
 from django.http import HttpResponse, JsonResponse
 from django.utils import timezone
 from django.views.decorators.http import require_http_methods
 from accounts.models import WebDAVSource
 from accounts.webdav import WebDAVError, WebDAVInputError, list_directory, fetch_file
 from .views import _require_auth
 def _get_source(request, pk):
    return WebDAVSource.objects.filter(pk=pk, user=request.user).first()
@require_http_methods(['GET'])
 def cloud_sources(request):
    unauthorized = _require_auth(request)
    if unauthorized:
        return unauthorized
    sources = request.user.webdav_sources.all()
    return JsonResponse({'sources': [
        {'id': s.id, 'label': s.label, 'host': s.base_url}
        for s in sources
    ]})
@require_http_methods(['GET'])
 def cloud_browse(request, pk):
    unauthorized = _require_auth(request)
    if unauthorized:
        return unauthorized
    source = _get_source(request, pk)
    if not source:
        return JsonResponse({'error': 'unknown source'}, status=404)
    path = request.GET.get('path', '')
    try:
        entries = list_directory(source, path)
    except WebDAVInputError as exc:
        return JsonResponse({'error': str(exc)}, status=400)
    except WebDAVError as exc:
        return JsonResponse({'error': str(exc)}, status=502)
    source.last_used_at = timezone.now()
    source.save(update_fields=['last_used_at'])
    return JsonResponse({'ok': True, 'path': path, 'entries': entries})
@require_http_methods(['GET'])
 def cloud_fetch(request, pk):
    unauthorized = _require_auth(request)
    if unauthorized:
        return unauthorized
    source = _get_source(request, pk)
    if not source:
        return JsonResponse({'error': 'unknown source'}, status=404)
    path = request.GET.get('path', '')
    try:
        payload = fetch_file(source, path, settings.EBOOK_MAX_BYTES)
    except WebDAVInputError as exc:
        return JsonResponse({'error': str(exc)}, status=400)
    except WebDAVError as exc:
        return JsonResponse({'error': str(exc)}, status=502)
    response = HttpResponse(payload, content_type='application/octet-stream')
    # These are the book's plaintext bytes, on their way to be encrypted in the
    # browser. Keeping them out of the HTTP disk cache (and any reverse proxy
    # in front) is what makes "nothing readable is stored" true end to end.
    response['Cache-Control'] = 'no-store'
    return response
--- a/diora/settings.py
+++ b/diora/settings.py
@ -30,7 +30,6 @@ INSTALLED_APPS = [
    'podcasts',
    'books',
    'gpodder',
    'tts',
 ]
 EBOOK_MAX_BYTES = 50 * 1024 * 1024  # 50 MB
@ -98,23 +97,7 @@ STATIC_URL = '/static/'
 STATICFILES_DIRS = [BASE_DIR / 'static']
 STATIC_ROOT = BASE_DIR / 'staticfiles'
-# Django 5.1 removed STATICFILES_STORAGE in favour of STORAGES. The old setting
+STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage'
 # sat here being silently ignored, so whitenoise fell back to plain
 # StaticFilesStorage and served everything uncompressed — app.js went out at
 # 251 KB instead of 62 KB on every cold load.
 #
 # The hashed filenames this also generates are inert: no template uses
 # {% static %}, they all hardcode /static/… paths. Cache busting comes from the
 # service worker's CACHE version instead (static/js/sw.js), which is why it is
 # bumped on each release.
 STORAGES = {
    'default': {
        'BACKEND': 'django.core.files.storage.FileSystemStorage',
    },
    'staticfiles': {
        'BACKEND': 'whitenoise.storage.CompressedManifestStaticFilesStorage',
    },
 }
 MEDIA_URL = '/media/'
 MEDIA_ROOT = BASE_DIR / 'media'
@ -123,11 +106,9 @@ BG_MAX_BYTES = 5 * 1024 * 1024          # 5 MB
 HIGHLIGHTS_MAX_BYTES = 700 * 1024       # 700 KB
 BOOKMARKS_MAX_BYTES = 100 * 1024        # 100 KB
-VOLUME_DEFAULT = 102                    # out of 255 (40%)
+VOLUME_DEFAULT = 204                    # out of 255
 ITUNES_TIMEOUT = 6                      # seconds
 BOOK_METADATA_TIMEOUT = 6               # seconds (DNB / Open Library shelf lookup)
 WEBDAV_TIMEOUT = 15                     # seconds (cloud import browse/fetch)
 WEBDAV_MAX_SOURCES_PER_USER = 10
 PODCAST_INBOX_PAGE_SIZE = 200
 DEFAULT_AUTO_FIELD = 'django.db.models.BigAutoField'
@ -144,18 +125,4 @@ LASTFM_API_SECRET = os.environ.get('LASTFM_API_SECRET', '')
 AMAZON_AFFILIATE_TAG = os.environ.get('AMAZON_AFFILIATE_TAG', 'diora-20')
 AMAZON_AFFILIATE_ENABLED = os.environ.get('AMAZON_AFFILIATE_ENABLED', 'True') == 'True'
 # WebDAV cloud import (ebooks). Users supply the target URL, so by default the
 # server refuses to talk to non-public addresses — otherwise any registered
 # account could probe the internal network through it. Set to True only when
 # every account on this instance is trusted and the WebDAV server is on the LAN.
 WEBDAV_ALLOW_PRIVATE_HOSTS = os.environ.get('WEBDAV_ALLOW_PRIVATE_HOSTS', 'False') == 'True'
 BUILD_TIME = os.environ.get('BUILD_TIME', '')
 # Piper voice models for the reader's read-aloud feature (see tts/piper_engine.py).
 TTS_VOICES = {
    'de': os.environ.get(
        'TTS_MODEL_PATH_DE', str(BASE_DIR / 'tts_models' / 'de_DE-thorsten-medium.onnx')),
    'en': os.environ.get(
        'TTS_MODEL_PATH_EN', str(BASE_DIR / 'tts_models' / 'en_US-lessac-medium.onnx')),
 }
--- a/diora/urls.py
+++ b/diora/urls.py
@ -11,7 +11,6 @@ urlpatterns = [
    path('accounts/', include('accounts.urls')),
    path('podcasts/', include('podcasts.urls')),
    path('books/', include('books.urls')),
    path('tts/', include('tts.urls')),
    path('api/2/', include('gpodder.urls')),
    path('api/sync/', sync_snapshot, name='api_sync'),
    # Served at the root (not /static/js/sw.js) so its default scope covers
--- a/radio/urls.py
+++ b/radio/urls.py
@ -19,6 +19,4 @@ urlpatterns = [
    path('radio/focus/record/', views.record_focus_session, name='record_focus_session'),
    path('radio/focus/stats/', views.focus_stats, name='focus_stats'),
    path('radio/stream-player/', views.stream_player, name='stream_player'),
    path('radio/creamfresh-stream/', views.creamfresh_stream, name='creamfresh_stream'),
    path('radio/creamfresh-feedback/', views.creamfresh_feedback, name='creamfresh_feedback'),
 ]
--- a/radio/views.py
+++ b/radio/views.py
@ -581,74 +581,6 @@ def import_m3u(request):
 # Minimal HTTP stream player (standalone tab for mixed-content streams)
 # ---------------------------------------------------------------------------
 # ---------------------------------------------------------------------------
 # creamfresh radio proxy
 # ---------------------------------------------------------------------------
 # Held server-side only -- never exposed to the browser this way. The
 # upstream is protected by HTTP Basic Auth; a plain <audio src="user:pass@..">
 # doesn't get credentials honoured consistently across browsers, so this
 # transparently relays the request instead (including the client's own
 # Icy-MetaData header, so the existing icy.py-based metadata SSE keeps
 # working unmodified when pointed at this URL instead of the direct one).
 CREAMFRESH_STREAM_URL = 'https://radio.creamfresh.xyz/stream.mp3'
 CREAMFRESH_AUTH = ('player', 'MJMr58p83zAU5zZaDGU0_BIn')
 def creamfresh_stream(request):
    headers = {}
    if request.META.get('HTTP_ICY_METADATA'):
        headers['Icy-MetaData'] = request.META['HTTP_ICY_METADATA']
    try:
        upstream = requests.get(
            CREAMFRESH_STREAM_URL,
            auth=CREAMFRESH_AUTH,
            headers=headers,
            stream=True,
            timeout=15,
        )
    except requests.RequestException:
        return HttpResponse(status=502)
    response = StreamingHttpResponse(
        upstream.iter_content(chunk_size=4096),
        content_type=upstream.headers.get('Content-Type', 'audio/mpeg'),
        status=upstream.status_code,
    )
    for h in ('icy-metaint', 'icy-name', 'icy-genre', 'icy-br', 'icy-description', 'icy-url'):
        if h in upstream.headers:
            response[h] = upstream.headers[h]
    response['Cache-Control'] = 'no-cache'
    return response
@csrf_exempt
@require_http_methods(['POST'])
 def creamfresh_feedback(request):
    """Relays a thumbs up/down to the creamfresh DJ's own /dj/feedback --
    same server-side-credentials reasoning as creamfresh_stream above."""
    try:
        body = json.loads(request.body)
    except (json.JSONDecodeError, ValueError):
        return JsonResponse({'error': 'invalid JSON'}, status=400)
    vote = body.get('vote')
    if vote not in ('up', 'down'):
        return JsonResponse({'error': "vote must be 'up' or 'down'"}, status=400)
    try:
        upstream = requests.post(
            'https://radio.creamfresh.xyz/dj/feedback',
            auth=CREAMFRESH_AUTH,
            json={'vote': vote},
            timeout=15,
        )
    except requests.RequestException:
        return JsonResponse({'error': 'upstream unreachable'}, status=502)
    return JsonResponse(upstream.json(), status=upstream.status_code, safe=False)
 def stream_player(request):
    url  = request.GET.get('url',  '').strip()
    name = request.GET.get('name', '').strip()
--- a/requirements.txt
+++ b/requirements.txt
@ -1,19 +1,7 @@
-# Pinned to exact versions. These are what production runs and what the test
+django>=4.2
-# suite is green against — with `>=` the image you get depends on the day you
+pylast>=5.2
-# build it, which is how a rebuild once swapped in a gunicorn that could not
+requests>=2.31
-# boot the gevent worker at all.
+python-dotenv>=1.0
-#
+whitenoise>=6.6
-# Nothing here updates on its own any more, so bump deliberately: change a
+feedparser>=6.0
-# version, let CI run, then deploy.
+gevent>=24.0
 Django==6.1
 pylast==7.1.0
 requests==2.34.2
 python-dotenv==1.2.3
 whitenoise==6.12.0
 feedparser==6.0.14
 gevent==26.8.0
 # gunicorn 26.2.0 imports packaging.version in ggevent.py while declaring no
 # dependencies of its own, so packaging has to be requested explicitly.
 gunicorn==26.2.0
 packaging==26.3
 piper-tts==1.7.0
--- a/static/css/app.css
+++ b/static/css/app.css
@ -710,161 +710,6 @@ a:hover {
  padding: 1.5rem 0;
 }
 /* --- WebDAV cloud connections (settings) --- */
 .webdav-list {
  list-style: none;
  margin: 0 0 1rem;
  padding: 0;
  display: flex;
  flex-direction: column;
  gap: 0.5rem;
 }
 .webdav-item {
  display: flex;
  align-items: center;
  justify-content: space-between;
  gap: 0.75rem;
  flex-wrap: wrap;
  border: 1px solid var(--border);
  border-radius: var(--radius);
  padding: 0.6rem 0.75rem;
 }
 .webdav-item-info {
  display: flex;
  flex-direction: column;
  gap: 0.15rem;
  min-width: 0;
  word-break: break-all;
 }
 .webdav-item-actions {
  display: flex;
  gap: 0.5rem;
 }
 .webdav-form {
  display: flex;
  flex-direction: column;
  gap: 0.6rem;
  border-top: 1px solid var(--border);
  padding-top: 1rem;
 }
 .webdav-field {
  display: flex;
  flex-direction: column;
  gap: 0.25rem;
  font-size: 0.85rem;
  color: var(--text-muted);
 }
 .webdav-field input {
  background: var(--bg-alt);
  border: 1px solid var(--border);
  border-radius: var(--radius);
  color: var(--text);
  font-family: var(--font);
  font-size: 0.9rem;
  padding: 0.45rem 0.7rem;
  outline: none;
  width: 100%;
 }
 .webdav-field input:focus {
  border-color: var(--accent);
 }
 .webdav-form .btn {
  align-self: flex-start;
 }
 /* --- Cloud import browser (books tab) --- */
 .cloud-browser {
  display: flex;
  flex-direction: column;
  gap: 0.5rem;
  border: 1px solid var(--border);
  border-radius: var(--radius);
  padding: 0.75rem;
  margin-bottom: 1rem;
 }
 .cloud-browser-head {
  display: flex;
  align-items: center;
  justify-content: space-between;
  gap: 0.75rem;
  flex-wrap: wrap;
 }
 .cloud-browser-head select {
  background: var(--bg-alt);
  border: 1px solid var(--border);
  border-radius: var(--radius);
  color: var(--text);
  font-family: var(--font);
  font-size: 0.85rem;
  padding: 0.3rem 0.5rem;
  outline: none;
 }
 .cloud-path {
  font-size: 0.8rem;
  color: var(--text-muted);
  word-break: break-all;
 }
 .cloud-entries {
  list-style: none;
  margin: 0;
  padding: 0;
  max-height: 320px;
  overflow-y: auto;
  display: flex;
  flex-direction: column;
 }
 .cloud-entry {
  display: flex;
  align-items: center;
  justify-content: space-between;
  gap: 0.75rem;
  padding: 0.4rem 0.25rem;
  border-bottom: 1px solid var(--border);
 }
 .cloud-entry:last-child {
  border-bottom: none;
 }
 .cloud-entry-name {
  background: none;
  border: none;
  color: inherit;
  font-family: var(--font);
  font-size: 0.9rem;
  text-align: left;
  padding: 0;
  cursor: pointer;
  word-break: break-all;
  flex: 1;
  min-width: 0;
 }
 .cloud-entry-name:hover {
  color: var(--accent);
 }
 .cloud-entry-size {
  font-size: 0.75rem;
  color: var(--text-muted);
  white-space: nowrap;
 }
 /* =========================================================
   RESPONSIVE
   ========================================================= */
@ -1636,12 +1481,6 @@ body.dnd-mode .timer-display {
  padding: 4px 6px; font-size: 0.82rem; cursor: pointer;
 }
 .tts-lang-select {
  background: var(--surface, #1e1e2e); color: var(--fg, #fff);
  border: 1px solid var(--border, #444); border-radius: 4px;
  padding: 2px 4px; font-size: 0.8rem; cursor: pointer;
 }
 .reader-marker-btn-mobile { display: none; }
@media (max-width: 600px) {
@ -2203,12 +2042,6 @@ mark.reader-search-match { background:rgba(241,196,15,.6); color:inherit; border
 mark.reader-search-match.active { background:rgba(230,57,70,.7); }
 #rs-search-count { font-size:12px; min-width:50px; }
 /* Read-aloud (TTS) */
 mark.tts-current { background:rgba(230,57,70,.55); color:inherit; border-radius:2px; }
 .tts-bar { position:fixed; bottom:calc(var(--bar-h) + 16px); left:50%; transform:translateX(-50%); display:flex; align-items:center; gap:14px; background:var(--bg-card,#1a1a1a); border:1px solid var(--border); border-radius:var(--radius); padding:8px 16px; box-shadow:0 4px 16px rgba(0,0,0,.5); z-index:600; }
 .tts-bar button { background:none; border:none; color:inherit; font-size:16px; cursor:pointer; padding:2px 4px; line-height:1; }
 .tts-bar button:hover { opacity:0.7; }
 /* Bookmarks sidebar */
 .bookmark-entry { display:flex; width:100%; padding:6px 0; font-size:13px; justify-content:space-between; border-bottom:1px solid var(--border); }
--- a/static/js/app.js
+++ b/static/js/app.js
@ -9,10 +9,6 @@
 // State
 // ---------------------------------------------------------------------------
 // Hardcoded for now -- only creamfresh radio gets the vote buttons, since
 // only its backend (the DJ) actually does anything with them.
 const CREAMFRESH_RADIO_URL = 'https://diora.creamfresh.xyz/radio/creamfresh-stream/';
 let currentStation = null;   // { url, name, id } | null
 let currentTrack = '';
 let sseSource = null;
@ -180,12 +176,6 @@ function playStation(url, name, stationId) {
  $('play-stop-btn').classList.add('playing');
  $('save-station-btn').style.display = '';
  const isCreamfresh = url === CREAMFRESH_RADIO_URL;
  $('creamfresh-vote-up-btn').style.display = isCreamfresh ? '' : 'none';
  $('creamfresh-vote-down-btn').style.display = isCreamfresh ? '' : 'none';
  $('creamfresh-vote-up-btn').classList.remove('active');
  $('creamfresh-vote-down-btn').classList.remove('active');
  startMetadataSSE(url);
  startPlaySession(name, url);
  maybeShowDonationHint(url, name);
@ -230,8 +220,6 @@ function stopPlayback(clearStation = true) {
  $('play-stop-btn').textContent = '▶ Play';
  $('play-stop-btn').classList.remove('playing');
  $('save-station-btn').style.display = 'none';
  $('creamfresh-vote-up-btn').style.display = 'none';
  $('creamfresh-vote-down-btn').style.display = 'none';
  $('affiliate-section').style.display = 'none';
  stopPlaySession();
@ -616,36 +604,6 @@ async function saveCurrentStation() {
  await saveStation(data);
 }
 // ---------------------------------------------------------------------------
 // creamfresh radio: DJ feedback (hardcoded to this one station, see
 // CREAMFRESH_RADIO_URL above)
 // ---------------------------------------------------------------------------
 async function creamfreshVote(direction) {
  const upBtn = $('creamfresh-vote-up-btn');
  const downBtn = $('creamfresh-vote-down-btn');
  upBtn.disabled = true;
  downBtn.disabled = true;
  try {
    const res = await fetch('/radio/creamfresh-feedback/', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'X-CSRFToken': getCsrfToken(),
      },
      body: JSON.stringify({ vote: direction }),
    });
    if (!res.ok) throw new Error(`feedback returned ${res.status}`);
    upBtn.classList.toggle('active', direction === 'up');
    downBtn.classList.toggle('active', direction === 'down');
  } catch (err) {
    console.warn('creamfresh vote failed', err);
  } finally {
    upBtn.disabled = false;
    downBtn.disabled = false;
  }
 }
 async function saveStation(station) {
  try {
    const res = await fetch('/radio/save/', {
@ -3818,31 +3776,23 @@ async function deriveAndStoreKey() {
 async function uploadEbook(file) {
  const statusEl = $('book-upload-status');
-  if (file.size > DIORA_CONFIG.ebookMaxBytes) {
+  const isPdf = /\.pdf$/i.test(file.name);
-    if (statusEl) statusEl.textContent = `File too large (max ${DIORA_CONFIG.ebookMaxBytes / 1024 / 1024} MB).`;
+  const isEpub = /\.epub$/i.test(file.name);
    return false;
  }
  return _importEbookBuffer(await file.arrayBuffer(), file.name, statusEl);
 }
 // Shared tail of every import path (local file, cloud): parse metadata, encrypt
 // with the user's key and POST ciphertext. Plaintext never leaves the browser.
 async function _importEbookBuffer(buf, filename, statusEl) {
  const isPdf = /\.pdf$/i.test(filename);
  const isEpub = /\.epub$/i.test(filename);
  if (!isPdf && !isEpub) {
    if (statusEl) statusEl.textContent = 'Only .epub and .pdf files are supported.';
-    return false;
+    return;
  }
-  if (buf.byteLength > DIORA_CONFIG.ebookMaxBytes) {
+  if (file.size > DIORA_CONFIG.ebookMaxBytes) {
    if (statusEl) statusEl.textContent = `File too large (max ${DIORA_CONFIG.ebookMaxBytes / 1024 / 1024} MB).`;
-    return false;
+    return;
  }
  if (statusEl) statusEl.textContent = 'Encrypting…';
  try {
-    let title = filename.replace(/\.(epub|pdf)$/i, '');
+    const buf = await file.arrayBuffer();
    let title = file.name.replace(/\.(epub|pdf)$/i, '');
    let author = '';
    let isbn = '';
    const type = isPdf ? 'pdf' : 'epub';
@ -3871,7 +3821,7 @@ async function _importEbookBuffer(buf, filename, statusEl) {
    }
    const key = await getOrCreateEncKey();
-    const metaJson = new TextEncoder().encode(JSON.stringify({title, author, filename, type, isbn, folder: '', shelfTag: ''}));
+    const metaJson = new TextEncoder().encode(JSON.stringify({title, author, filename: file.name, type, isbn, folder: '', shelfTag: ''}));
    const [metaEnc, dataEnc] = await Promise.all([
      encryptBytes(key, metaJson),
      encryptBytes(key, buf),
@ -3893,165 +3843,11 @@ async function _importEbookBuffer(buf, filename, statusEl) {
    if (data.ok) {
      if (statusEl) statusEl.textContent = `✓ "${title}" uploaded`;
      loadBookList();
-      return true;
+    } else {
    }
      if (statusEl) statusEl.textContent = 'Error: ' + (data.error || 'upload failed');
-    return false;
+    }
  } catch (e) {
    if (statusEl) statusEl.textContent = 'Upload failed: ' + e.message;
    return false;
  }
 }
 // ---------------------------------------------------------------------------
 // Cloud import — browse a user-configured WebDAV server and pull a book in.
 //
 // The download is proxied by the server because the remote host is a different
 // origin and sends no CORS headers. It still lands here as raw bytes and goes
 // through _importEbookBuffer like any local file, so what gets stored is
 // ciphertext the server cannot read.
 // ---------------------------------------------------------------------------
 let _cloudSources = [];
 let _cloudSourceId = null;
 let _cloudPath = '';
 async function toggleCloudImport() {
  const panel = $('cloud-browser');
  if (!panel) return;
  if (panel.style.display !== 'none') { closeCloudImport(); return; }
  try {
    const res = await fetch('/books/cloud/sources/');
    _cloudSources = (await res.json()).sources || [];
  } catch (e) {
    await customAlert('Cloud-Verbindungen konnten nicht geladen werden: ' + e.message);
    return;
  }
  if (!_cloudSources.length) {
    await customAlert(
      'Noch keine Cloud-Verbindung eingerichtet. Unter Einstellungen → '
      + '„Cloud-Verbindungen für Bücher“ kannst du eine hinzufügen.'
    );
    return;
  }
  const select = $('cloud-source-select');
  if (select) {
    select.innerHTML = '';
    for (const source of _cloudSources) {
      const option = document.createElement('option');
      option.value = source.id;
      option.textContent = source.label;
      select.appendChild(option);
    }
    select.style.display = _cloudSources.length > 1 ? '' : 'none';
  }
  panel.style.display = '';
  _cloudSourceId = _cloudSources[0].id;
  _cloudBrowse('');
 }
 function closeCloudImport() {
  const panel = $('cloud-browser');
  if (panel) panel.style.display = 'none';
 }
 function _onCloudSourceChange(value) {
  _cloudSourceId = parseInt(value, 10);
  _cloudBrowse('');
 }
 function _cloudParentPath(path) {
  const parts = path.split('/').filter(Boolean);
  parts.pop();
  return parts.join('/');
 }
 function _formatBytes(n) {
  if (!n) return '';
  if (n < 1024) return n + ' B';
  if (n < 1024 * 1024) return Math.round(n / 1024) + ' KB';
  return (n / 1024 / 1024).toFixed(1) + ' MB';
 }
 function _cloudEntryRow(label, onClick, sizeText) {
  const li = document.createElement('li');
  li.className = 'cloud-entry';
  const button = document.createElement('button');
  button.type = 'button';
  button.className = 'cloud-entry-name';
  button.textContent = label;
  button.addEventListener('click', onClick);
  li.appendChild(button);
  if (sizeText) {
    const size = document.createElement('span');
    size.className = 'cloud-entry-size';
    size.textContent = sizeText;
    li.appendChild(size);
  }
  return li;
 }
 async function _cloudBrowse(path) {
  const listEl = $('cloud-entries');
  const pathEl = $('cloud-path');
  const statusEl = $('cloud-status');
  if (!listEl) return;
  if (statusEl) statusEl.textContent = 'Lade…';
  listEl.innerHTML = '';
  let data;
  try {
    const res = await fetch(`/books/cloud/${_cloudSourceId}/browse/?path=${encodeURIComponent(path)}`);
    data = await res.json();
    if (!res.ok) throw new Error(data.error || `HTTP ${res.status}`);
  } catch (e) {
    if (statusEl) statusEl.textContent = 'Fehler: ' + e.message;
    return;
  }
  _cloudPath = data.path || '';
  if (pathEl) pathEl.textContent = '/' + _cloudPath;
  if (statusEl) statusEl.textContent = '';
  if (_cloudPath) {
    listEl.appendChild(_cloudEntryRow('⬑ ..', () => _cloudBrowse(_cloudParentPath(_cloudPath))));
  }
  const entries = (data.entries || []).filter(e => e.is_dir || e.is_book);
  if (!entries.length && statusEl) {
    statusEl.textContent = 'Keine Bücher oder Ordner in diesem Verzeichnis.';
  }
  for (const entry of entries) {
    listEl.appendChild(entry.is_dir
      ? _cloudEntryRow('📁 ' + entry.name, () => _cloudBrowse(entry.path))
      : _cloudEntryRow('📖 ' + entry.name, () => _cloudImport(entry), _formatBytes(entry.size)));
  }
 }
 async function _cloudImport(entry) {
  const statusEl = $('cloud-status');
  if (statusEl) statusEl.textContent = `Lade „${entry.name}“…`;
  try {
    const res = await fetch(`/books/cloud/${_cloudSourceId}/fetch/?path=${encodeURIComponent(entry.path)}`);
    if (!res.ok) {
      const err = await res.json().catch(() => ({}));
      throw new Error(err.error || `HTTP ${res.status}`);
    }
    const buf = await res.arrayBuffer();
    if (await _importEbookBuffer(buf, entry.name, statusEl) && statusEl) {
      statusEl.textContent = `✓ „${entry.name}“ importiert`;
    }
  } catch (e) {
    if (statusEl) statusEl.textContent = 'Import fehlgeschlagen: ' + e.message;
  }
 }
@ -4178,239 +3974,6 @@ async function renderPdf(arrayBuffer, contentEl, scaleOverride, pivotPage) {
  return {title: pdfTitle, author: pdfAuthor, toc, numPages: pdf.numPages};
 }
 // ---------------------------------------------------------------------------
 // Read-aloud (TTS) — server-side Piper synthesis, one sentence per request.
 // EPUB only (no block model for PDFs). Highlights the sentence currently
 // playing and scrolls it into view; playback advances sentence-by-sentence,
 // then block-by-block, until stopped or the book ends.
 // ---------------------------------------------------------------------------
 const TTS_MAX_CHARS = 480; // stay under the server's 500-char cap with margin
 let ttsActive = false;
 let ttsPaused = false;
 let ttsRunToken = 0;
 let ttsAudio = null;
 let ttsCurrentMark = null;
 let ttsBarEl = null;
 let ttsLang = localStorage.getItem('diora_tts_lang') || 'de';
 function setTtsLang(lang) {
  ttsLang = lang;
  localStorage.setItem('diora_tts_lang', lang);
 }
 function _ttsSplitSentences(text) {
  const raw = text.split(/(?<=[.!?])\s+/).map(s => s.trim()).filter(Boolean);
  const pieces = raw.length ? raw : [text];
  const out = [];
  for (const piece of pieces) {
    let rest = piece;
    while (rest.length > TTS_MAX_CHARS) {
      let cut = rest.lastIndexOf(' ', TTS_MAX_CHARS);
      if (cut <= 0) cut = TTS_MAX_CHARS;
      out.push(rest.slice(0, cut).trim());
      rest = rest.slice(cut).trim();
    }
    if (rest) out.push(rest);
  }
  return out;
 }
 async function _ttsFetchAudio(sentence) {
  const resp = await fetch('/tts/synthesize/', {
    method: 'POST',
    headers: {'Content-Type': 'application/json'},
    body: JSON.stringify({text: sentence, lang: ttsLang}),
  });
  if (!resp.ok) throw new Error('tts request failed');
  return await resp.blob();
 }
 function _ttsClearHighlight() {
  if (ttsCurrentMark && ttsCurrentMark.parentNode) {
    const parent = ttsCurrentMark.parentNode;
    while (ttsCurrentMark.firstChild) parent.insertBefore(ttsCurrentMark.firstChild, ttsCurrentMark);
    parent.removeChild(ttsCurrentMark);
    parent.normalize();
  }
  ttsCurrentMark = null;
 }
 // Finds `sentence` as a substring of block.textContent starting at fromOffset
 // (so repeated sentence text earlier in the block isn't matched again), turns
 // it into a DOM Range via the same char-offset addressing highlights use, and
 // wraps it in a <mark>. Returns the offset to resume searching from.
 function _ttsHighlightSentence(block, sentence, fromOffset) {
  _ttsClearHighlight();
  const full = block.textContent;
  const idx = full.indexOf(sentence, fromOffset);
  if (idx === -1) return fromOffset;
  const start = _nodeAtCharOffset(block, idx);
  const end = _nodeAtCharOffset(block, idx + sentence.length);
  if (!start || !end) return idx + sentence.length;
  try {
    const range = document.createRange();
    range.setStart(start.node, start.offset);
    range.setEnd(end.node, end.offset);
    const mark = document.createElement('mark');
    mark.className = 'tts-current';
    range.surroundContents(mark);
    ttsCurrentMark = mark;
    _ttsScrollIntoView(mark);
  } catch (e) {}
  return idx + sentence.length;
 }
 function _ttsScrollIntoView(el) {
  const contentEl = $('reader-content');
  if (!contentEl) return;
  const top = el.getBoundingClientRect().top - contentEl.getBoundingClientRect().top;
  if (top < 40 || top > contentEl.clientHeight - 80) {
    _suppressScrollJumpDetect();
    contentEl.scrollBy({top: top - contentEl.clientHeight * 0.3, behavior: 'smooth'});
  }
 }
 function _ttsPlayBlob(blob) {
  return new Promise((resolve) => {
    const url = URL.createObjectURL(blob);
    const audio = new Audio(url);
    ttsAudio = audio;
    const done = () => { URL.revokeObjectURL(url); resolve(); };
    audio.addEventListener('ended', done);
    audio.addEventListener('error', done);
    if (!ttsPaused) audio.play().catch(done);
  });
 }
 // Walks blocks/sentences from startBlockIndex onward, fetching one sentence
 // ahead while the current one plays so there's no gap between them.
 async function _ttsPlayLoop(blocks, startBlockIndex, runToken) {
  function* sentenceStream() {
    for (let bi = startBlockIndex; bi < blocks.length; bi++) {
      const block = blocks[bi];
      const text = (block.textContent || '').trim();
      if (!text) continue;
      for (const sentence of _ttsSplitSentences(text)) yield {block, sentence};
    }
  }
  const iter = sentenceStream();
  let cur = iter.next();
  if (cur.done) { stopReadAloud(); return; }
  let curFetch = _ttsFetchAudio(cur.value.sentence);
  let lastBlock = null;
  let blockSearchOffset = 0;
  while (!cur.done) {
    if (runToken !== ttsRunToken) return;
    const {block, sentence} = cur.value;
    const next = iter.next();
    const nextFetch = next.done ? null : _ttsFetchAudio(next.value.sentence).catch(() => null);
    let audioBlob;
    try {
      audioBlob = await curFetch;
    } catch (e) {
      stopReadAloud();
      return;
    }
    if (runToken !== ttsRunToken) return;
    if (block !== lastBlock) { lastBlock = block; blockSearchOffset = 0; }
    blockSearchOffset = _ttsHighlightSentence(block, sentence, blockSearchOffset);
    await _ttsPlayBlob(audioBlob);
    if (runToken !== ttsRunToken) return;
    cur = next;
    curFetch = nextFetch;
  }
  if (runToken === ttsRunToken) stopReadAloud();
 }
 function _ttsTogglePause() {
  ttsPaused = !ttsPaused;
  if (ttsAudio) {
    if (ttsPaused) ttsAudio.pause();
    else ttsAudio.play().catch(() => {});
  }
  _ttsUpdateBar();
 }
 function _ttsUpdateBar() {
  if (!ttsBarEl) return;
  const btn = ttsBarEl.querySelector('.tts-pause-btn');
  if (btn) btn.textContent = ttsPaused ? '▶' : '⏸';
 }
 function _ttsShowBar() {
  _ttsRemoveBar();
  const bar = document.createElement('div');
  bar.className = 'tts-bar';
  bar.innerHTML = `
    <button type="button" class="tts-pause-btn" title="Pause/Weiter">⏸</button>
    <button type="button" class="tts-stop-btn" title="Vorlesen beenden">■</button>
  `;
  document.body.appendChild(bar);
  ttsBarEl = bar;
  bar.querySelector('.tts-pause-btn').addEventListener('click', _ttsTogglePause);
  bar.querySelector('.tts-stop-btn').addEventListener('click', stopReadAloud);
 }
 function _ttsRemoveBar() {
  if (ttsBarEl) { ttsBarEl.remove(); ttsBarEl = null; }
 }
 function toggleReadAloud() {
  if (ttsActive) stopReadAloud();
  else startReadAloud();
 }
 function startReadAloud() {
  if (ttsActive) return;
  if (currentPdfDoc) {
    const toast = document.createElement('div');
    toast.className = 'reader-toast';
    toast.textContent = 'Vorlesen ist aktuell nur für EPUB-Bücher verfügbar.';
    document.body.appendChild(toast);
    setTimeout(() => toast.remove(), 2200);
    return;
  }
  const contentEl = $('reader-content');
  if (!contentEl) return;
  const blocks = Array.from(contentEl.querySelectorAll(EPUB_BLOCK_SELECTOR));
  if (!blocks.length) return;
  const [anchorBlock] = _anchorParts(getPositionAnchor(contentEl));
  const startIndex = (anchorBlock >= 0 && anchorBlock < blocks.length) ? anchorBlock : 0;
  ttsActive = true;
  ttsPaused = false;
  ttsRunToken++;
  const runToken = ttsRunToken;
  const btn = $('reader-tts-btn');
  if (btn) { btn.classList.add('active'); btn.title = 'Vorlesen beenden'; }
  _ttsShowBar();
  _ttsPlayLoop(blocks, startIndex, runToken);
 }
 function stopReadAloud() {
  ttsRunToken++;
  ttsActive = false;
  ttsPaused = false;
  if (ttsAudio) {
    try { ttsAudio.pause(); ttsAudio.src = ''; } catch (e) {}
    ttsAudio = null;
  }
  _ttsClearHighlight();
  _ttsRemoveBar();
  const btn = $('reader-tts-btn');
  if (btn) { btn.classList.remove('active'); btn.title = 'Vorlesen'; }
 }
 // ---------------------------------------------------------------------------
 // Immersive reader mode — tap centre of screen to toggle bars
 // ---------------------------------------------------------------------------
@ -4418,7 +3981,7 @@ let _immBarsVisible = true;
 function _immHandleTap(e) {
  // Ignore taps on interactive elements (buttons, links, inputs, settings panel, footnote popover)
-  if (e.target.closest('button, a, input, select, label, #reader-settings-panel, .reader-header, .footnote-popover, #reader-margin, #highlight-popover, .note-bottom-sheet, .tts-bar')) return;
+  if (e.target.closest('button, a, input, select, label, #reader-settings-panel, .reader-header, .footnote-popover, #reader-margin, #highlight-popover, .note-bottom-sheet')) return;
  // In marker mode, taps have a dedicated meaning (highlight/create a note) —
  // don't also toggle the immersive bars underneath.
  if (markerModeActive) return;
@ -4817,7 +4380,6 @@ async function saveReaderProgress(force = false) {
 function closeReader() {
  exitReaderImmersiveMode();
  stopReadAloud();
  // Save progress BEFORE hiding — scrollHeight/clientHeight return 0 once display:none
  saveReaderProgress();
  if (bookmarksDirty) saveBookmarks();
@ -6817,10 +6379,6 @@ function openRadioSidebar() {
    setVolume(vol);
  }
  // Restore persisted read-aloud language
  const ttsLangSelect = $('reader-tts-lang');
  if (ttsLangSelect) ttsLangSelect.value = ttsLang;
  // Load recommendations on page load
  loadRecommendations();
--- a/static/js/sw.js
+++ b/static/js/sw.js
@ -2,7 +2,7 @@
 * diora service worker — caches the app shell for offline use.
 */
-const CACHE = 'diora-v43';
+const CACHE = 'diora-v40';
 const PODCAST_CACHE = 'diora-podcast-v1';
 const SHELL = [
  '/static/css/app.css',
@ -53,7 +53,6 @@ self.addEventListener('fetch', function (event) {
  if (url.pathname.startsWith('/radio/sse/') ||
      url.pathname.startsWith('/radio/record/') ||
      url.pathname.startsWith('/radio/affiliate/') ||
      url.pathname.startsWith('/tts/') ||
      url.pathname.startsWith('/admin/') ||
      url.pathname.startsWith('/podcasts/progress/') ||
      url.pathname.startsWith('/podcasts/queue/') ||
--- a/templates/accounts/settings.html
+++ b/templates/accounts/settings.html
@ -125,75 +125,6 @@
      </form>
    {% endif %}
  </section>
  <!-- Cloud connections (WebDAV / Nextcloud) for the ebook import -->
  <section class="settings-section">
    <h2>Cloud-Verbindungen für Bücher</h2>
    <p class="lastfm-description">
      Verbinde einen WebDAV-Server — Nextcloud, ownCloud, Synology oder was auch immer WebDAV
      spricht — und importiere <code>.epub</code>- und <code>.pdf</code>-Dateien direkt daraus in
      deine Bibliothek. Die Datei läuft dabei nur durch den Server hindurch; verschlüsselt wird sie
      wie immer erst in deinem Browser, gespeichert wird ausschließlich der Geheimtext.
    </p>
    <p class="lastfm-description">
      Lege dafür bitte ein <strong>App-Passwort</strong> an (bei Nextcloud unter
      Einstellungen → Sicherheit) statt dein Konto-Passwort einzutragen — es wird serverseitig
      gespeichert und lässt sich jederzeit einzeln widerrufen.
    </p>
    {% if webdav_sources %}
      <ul class="webdav-list">
        {% for source in webdav_sources %}
          <li class="webdav-item">
            <div class="webdav-item-info">
              <strong>{{ source.label }}</strong>
              <span class="muted">{{ source.base_url }}{% if source.root_path %} · /{{ source.root_path }}{% endif %}</span>
            </div>
            <div class="webdav-item-actions">
              <form method="post" action="{% url 'webdav_test' source.pk %}" class="inline-form">
                {% csrf_token %}
                <button type="submit" class="btn">Testen</button>
              </form>
              <form method="post" action="{% url 'webdav_delete' source.pk %}" class="inline-form"
                    onsubmit="return confirm('Verbindung „{{ source.label|escapejs }}“ entfernen?');">
                {% csrf_token %}
                <button type="submit" class="btn btn-danger">Entfernen</button>
              </form>
            </div>
          </li>
        {% endfor %}
      </ul>
    {% endif %}
    <form method="post" action="{% url 'webdav_add' %}" class="webdav-form">
      {% csrf_token %}
      <label class="webdav-field">
        <span>Name</span>
        <input type="text" name="label" required placeholder="Meine Nextcloud">
      </label>
      <label class="webdav-field">
        <span>Server-URL</span>
        <input type="url" name="base_url" required placeholder="https://cloud.example.com">
      </label>
      <label class="webdav-field">
        <span>Benutzername</span>
        <input type="text" name="username" autocomplete="off" placeholder="dein-login">
      </label>
      <label class="webdav-field">
        <span>App-Passwort</span>
        <input type="password" name="password" autocomplete="new-password">
      </label>
      <label class="webdav-field">
        <span>Unterordner <span class="muted">(optional)</span></span>
        <input type="text" name="root_path" placeholder="Buecher">
      </label>
      <p class="lastfm-description" style="margin:0;">
        Bei Nextcloud/ownCloud genügt die Server-Adresse — der WebDAV-Pfad wird aus dem
        Benutzernamen ergänzt. Andere Server brauchen die vollständige WebDAV-URL.
      </p>
      <button type="submit" class="btn">Verbindung hinzufügen</button>
    </form>
  </section>
 </div>
 {% endblock %}
--- a/templates/radio/player.html
+++ b/templates/radio/player.html
@ -13,12 +13,10 @@
    <button class="btn btn-play" id="play-stop-btn" onclick="togglePlayStop()" style="display:none;">&#9654; Play</button>
    <label class="volume-label">
      <span>vol</span>
-      <input type="range" id="volume" min="0" max="255" value="102" class="volume-slider">
+      <input type="range" id="volume" min="0" max="255" value="204" class="volume-slider">
-      <input type="number" id="volume-num" min="0" max="255" value="102" class="volume-num">
+      <input type="number" id="volume-num" min="0" max="255" value="204" class="volume-num">
    </label>
    <button class="btn btn-save" id="save-station-btn" style="display:none;" onclick="saveCurrentStation()">&#9733; Save</button>
    <button class="btn-icon" id="creamfresh-vote-up-btn" style="display:none;" onclick="creamfreshVote('up')" title="Gefällt mir">&#128077;</button>
    <button class="btn-icon" id="creamfresh-vote-down-btn" style="display:none;" onclick="creamfreshVote('down')" title="Gefällt mir nicht">&#128078;</button>
    <button class="btn-icon" id="dnd-btn" onclick="toggleDND()" title="Focus mode (hides UI, press Esc to exit)">⊙</button>
    <button class="btn-icon" id="focus-station-btn" onclick="openRadioSidebar()" title="Radio">◉</button>
  </div>
@ -321,16 +319,6 @@
      <input type="file" id="book-file-input" accept=".epub,.pdf" style="display:none;" onchange="bookFileSelected(this)">
      <span id="book-upload-status" class="muted"></span>
    </div>
    <button type="button" class="btn" style="margin:0.5rem 0;" onclick="toggleCloudImport()">☁ Aus Cloud importieren</button>
    <div id="cloud-browser" class="cloud-browser" style="display:none;">
      <div class="cloud-browser-head">
        <select id="cloud-source-select" onchange="_onCloudSourceChange(this.value)"></select>
        <button type="button" class="btn" onclick="closeCloudImport()">Schließen</button>
      </div>
      <div id="cloud-path" class="cloud-path"></div>
      <ul id="cloud-entries" class="cloud-entries"></ul>
      <span id="cloud-status" class="muted"></span>
    </div>
  </div>
  <label class="book-list-filter">
    <input type="checkbox" id="book-show-read-toggle" onchange="_onBookShowReadToggle(this.checked)">
@ -356,11 +344,6 @@
      </span>
      <button class="btn-icon" id="reader-search-btn"   onclick="toggleReaderSearch()"        title="Search">⌕</button>
      <button class="btn-icon" id="reader-settings-btn" onclick="toggleSettingsPanel()"        title="Font &amp; layout">⚙</button>
      <select id="reader-tts-lang" class="tts-lang-select" title="Vorlese-Sprache" onchange="setTtsLang(this.value)">
        <option value="de">DE</option>
        <option value="en">EN</option>
      </select>
      <button class="btn-icon" id="reader-tts-btn"      onclick="toggleReadAloud()"           title="Vorlesen">▶</button>
      <button class="btn-icon" id="reader-bookmark-btn" onclick="addBookmark()"               title="Bookmark">★</button>
      <button class="btn-icon" id="reader-bm-list-btn"  onclick="openBookmarksSidebar()"      title="Bookmarks">▤</button>
      <button class="btn-icon" id="reader-toc-btn"      onclick="openTocSidebar()"            title="Table of contents">≡</button>
--- a/tts/init.py
+++ b/tts/init.py
--- a/tts/apps.py
+++ b/tts/apps.py
@ -1,6 +0,0 @@
 from django.apps import AppConfig
 class TtsConfig(AppConfig):
    default_auto_field = 'django.db.models.BigAutoField'
    name = 'tts'
--- a/tts/piper_engine.py
+++ b/tts/piper_engine.py
@ -1,41 +0,0 @@
 import io
 import threading
 import wave
 from django.conf import settings
 DEFAULT_LANGUAGE = 'de'
 SUPPORTED_LANGUAGES = tuple(settings.TTS_VOICES.keys())
 # Lazy per-process singletons, one per language: each gunicorn worker loads a
 # voice only once it's actually requested, rather than all workers loading
 # every model at startup (the host runs several other containers with limited
 # spare RAM). One lock guards both the lazy-load and the inference call below
 # — a single self-hosted user never needs concurrent synthesis across
 # languages, so there's no reason for a lock per voice.
 _voices = {}
 _lock = threading.Lock()
 def _get_voice(lang):
    if lang not in _voices:
        with _lock:
            if lang not in _voices:
                from piper import PiperVoice
                _voices[lang] = PiperVoice.load(str(settings.TTS_VOICES[lang]))
    return _voices[lang]
 def synthesize_wav(text, lang=DEFAULT_LANGUAGE):
    """Synthesize `text` (in `lang`) to WAV bytes.
    Never persists or logs `text` — callers must not log it either. The lock
    also serializes inference, since one onnxruntime session isn't meant to
    run concurrent calls within a process.
    """
    voice = _get_voice(lang)
    buf = io.BytesIO()
    with _lock:
        with wave.open(buf, 'wb') as wav_file:
            voice.synthesize_wav(text, wav_file)
    return buf.getvalue()
--- a/tts/tests.py
+++ b/tts/tests.py
@ -1,55 +0,0 @@
 from unittest.mock import patch
 from django.contrib.auth.models import User
 from django.test import TestCase
 from . import piper_engine
 class TtsSynthesizeTests(TestCase):
    def setUp(self):
        self.user = User.objects.create_user(username='alice', password='pw12345678')
    def test_requires_auth(self):
        resp = self.client.post('/tts/synthesize/', {'text': 'Hallo'}, content_type='application/json')
        self.assertEqual(resp.status_code, 401)
    def test_rejects_empty_text(self):
        self.client.force_login(self.user)
        resp = self.client.post('/tts/synthesize/', {'text': '  '}, content_type='application/json')
        self.assertEqual(resp.status_code, 400)
    def test_rejects_text_over_limit(self):
        self.client.force_login(self.user)
        resp = self.client.post(
            '/tts/synthesize/', {'text': 'a' * 501}, content_type='application/json')
        self.assertEqual(resp.status_code, 400)
    def test_rejects_invalid_json(self):
        self.client.force_login(self.user)
        resp = self.client.post('/tts/synthesize/', 'not json', content_type='application/json')
        self.assertEqual(resp.status_code, 400)
    @patch.object(piper_engine, 'synthesize_wav', return_value=b'RIFF....WAVEfmt fake')
    def test_synthesizes_audio_default_lang(self, mock_synth):
        self.client.force_login(self.user)
        resp = self.client.post(
            '/tts/synthesize/', {'text': 'Hallo Welt.'}, content_type='application/json')
        self.assertEqual(resp.status_code, 200)
        self.assertEqual(resp['Content-Type'], 'audio/wav')
        self.assertEqual(b''.join(resp.streaming_content), b'RIFF....WAVEfmt fake')
        mock_synth.assert_called_once_with('Hallo Welt.', 'de')
    @patch.object(piper_engine, 'synthesize_wav', return_value=b'RIFF....WAVEfmt fake')
    def test_synthesizes_audio_explicit_lang(self, mock_synth):
        self.client.force_login(self.user)
        resp = self.client.post(
            '/tts/synthesize/', {'text': 'Hello world.', 'lang': 'en'}, content_type='application/json')
        self.assertEqual(resp.status_code, 200)
        mock_synth.assert_called_once_with('Hello world.', 'en')
    def test_rejects_unsupported_lang(self):
        self.client.force_login(self.user)
        resp = self.client.post(
            '/tts/synthesize/', {'text': 'Hallo', 'lang': 'fr'}, content_type='application/json')
        self.assertEqual(resp.status_code, 400)
--- a/tts/urls.py
+++ b/tts/urls.py
@ -1,7 +0,0 @@
 from django.urls import path
 from . import views
 urlpatterns = [
    path('synthesize/', views.synthesize, name='tts_synthesize'),
 ]
--- a/tts/views.py
+++ b/tts/views.py
@ -1,57 +0,0 @@
 import json
 from django.http import JsonResponse, StreamingHttpResponse
 from django.views.decorators.csrf import csrf_exempt
 from django.views.decorators.http import require_http_methods
 from gevent.threadpool import ThreadPool
 from . import piper_engine
 # One sentence per request, hard-capped — this is the load-bearing part of the
 # "server never holds more than a small, transient snippet of book text"
 # agreement (see CLAUDE.md), not just a client-side convention.
 MAX_TEXT_LENGTH = 500
 # Offloads the CPU-bound Piper inference off the gevent hub's event loop, so a
 # synthesis call doesn't stall other concurrent greenlets (radio SSE, other
 # requests) in the same worker the way a plain in-greenlet call would.
 _synth_pool = ThreadPool(1)
 def _require_auth(request):
    if not request.user.is_authenticated:
        return JsonResponse({'error': 'authentication required'}, status=401)
    return None
@csrf_exempt
@require_http_methods(['POST'])
 def synthesize(request):
    err = _require_auth(request)
    if err:
        return err
    try:
        body = json.loads(request.body)
    except (json.JSONDecodeError, ValueError):
        return JsonResponse({'error': 'invalid JSON'}, status=400)
    text = body.get('text', '')
    if not isinstance(text, str) or not text.strip():
        return JsonResponse({'error': 'text required'}, status=400)
    if len(text) > MAX_TEXT_LENGTH:
        return JsonResponse({'error': f'text exceeds {MAX_TEXT_LENGTH} characters'}, status=400)
    lang = body.get('lang', piper_engine.DEFAULT_LANGUAGE)
    if lang not in piper_engine.SUPPORTED_LANGUAGES:
        return JsonResponse({'error': 'unsupported lang'}, status=400)
    try:
        audio = _synth_pool.apply(piper_engine.synthesize_wav, (text, lang))
    except Exception:
        return JsonResponse({'error': 'synthesis failed'}, status=500)
    response = StreamingHttpResponse(iter([audio]), content_type='audio/wav')
    response['Cache-Control'] = 'no-store'
    response['X-Accel-Buffering'] = 'no'
    return response