[request] Add rpdb rating to catalog.

[ericvlog]

Hello, the rpdb announce it open free to user who free tier without limit.

That mean all catalog with support it rpdb rating api can enjoy catalog with rating poster.

https://www.reddit.com/r/StremioAddons/comments/1f12nz9/free_rpdb_is_now_generally_available/

Thanks.

[yortem]

Technically, this chrome extension has nothing to do with showing posters in catalogs, so I assume you talk about this tool: https://www.journey.co.il/stremio/ But I don't know enough about it in order to decide if to implement it or not. so for now, I don't think I'll add it. if in the future I will learn more about it and it will be suitable for the catalogs on that tools, then yes. but I don't think it will be soon.

[ericvlog]

thank for your consider, for implement the developer of rpdb have mention on

https://github.com/megadrive/stremio-letterboxd/issues/41#issuecomment-2310230623

https://github.com/megadrive/stremio-letterboxd/issues/41#issuecomment-2310239370

Thanks

[yortem]

Oh that's useful. I'll consider that. thank you.

[yortem]

Okay, after checking it. I don't think I'll implement it because the addons created by this tool do not require configuration and anyone can install them. and if I add an option for adding a key on the user level it will be a big security issue to expose the key to others. in order to change that, as far as I know, it will require a significant change to the way some things work there, and I'm not ready for that kind of change. I will discuss this with the creator of rpdb perhaps

[ericvlog]

Okay, take it the easy way

Thanks ya.

[jaruba]

@yortem i'm here, there was only one case in the past where user keys got leaked in an addon due to javascript object mutation, which is easily solvable by cloning the object (so it removes the refs, and thus does not mutate the object) prior to replacing the posters on response

including the api key in the URL path is not a security risk as long as you use an SSL certificate, because the URL path for HTTPS is encrypted with the SSL certificate

[jaruba]

ah, looking at ur addon configuration page, i think i see the issue, you are converting lists to catalogs and probably saving the output catalogs to disk, then the addon is sharing these catalogs to all users

so if u change the posters prior to saving the catalog to disk, then those posters and api keys get leaked to anyone installing those catalogs, because u are delivering straight from disk to the http response

i think the issue here is clear and the solution is a proxy addon, which would be an addon that just requests the catalogs from ur addon, changes the posters for it and delivers to the users, in ur configuration page u could have an input field for the api key, and it would change the install button to use the proxy addon url instead, i can build this proxy addon for u if you want

[yortem]

@jaruba I also thought about the idea of having a different URL for the addon based on the user that clicks on the install, and then each user will have a "unique addon" and not the publically available addon. but still, I don't know where it can get me (for example, what if a user shares the link of the addon) and will complicate the tool that I tried to make as simple as possible, at least for me, and it will require more details on the security aspect which now is very basic.

[jaruba]

@yortem i think you may be overthinking this in thinking that it will complicate things, let me show you a POC

so this manifest url:

https://www.journey.co.il/stremio/manifest.json?list=4664001724731899&name=+Best+Picture+Oscar+Nominees

becomes:

https://1fe84bc728af-lists-addon.baby-beamup.club/${apiKey}/manifest.json?list=4664001724731899&name=+Best+Picture+Oscar+Nominees

(where ${apiKey} needs to be substituted for an actual API key)

I created an api key just for these tests, we don't need to worry about it being leaked as i will deactivate it after we finish, so you can try it out with this addon url:

https://1fe84bc728af-lists-addon.baby-beamup.club/t1-ci90c15a-5e29-4498-8359-75cb9c8a54a9/manifest.json?list=4664001724731899&name=+Best+Picture+Oscar+Nominees

it supports both imdb id and tmdb id, both catalogs and meta requests, and the code for it is just 66 lines (with nodejs):

const express = require('express')
const needle = require('needle')
const app = express()
const cors = require('cors')

app.use(cors())

const tAddon = 'https://www.journey.co.il/stremio'

function attachHeaders(resp, res) {
    if (resp.headers['cache-control'])
        res.setHeader('Cache-Control', resp.headers['cache-control'])
    if (resp.headers['content-type'])
        res.setHeader('Content-Type', resp.headers['content-type'])
}

function isUserKeySane(key) {
    return key && [0,1,2,3,4].find(el => key.startsWith(`t${el}-`)) !== undefined
}

app.get('/:userKey/manifest.json', (req, res) => {
    const userKey = req.params.userKey
    if (!isUserKeySane(userKey)) {
        res.status(500).send('Invalid RPDB Key')
        return
    }
    needle.get(`${tAddon}${req.originalUrl.replace(`/${userKey}`, '')}`, { follow_max: 3 }, (err, resp, body) => {
        attachHeaders(resp, res)
        res.json(body || {})
    })
})

app.get('/:userKey/catalog/*', (req, res) => {
    const userKey = req.params.userKey
    if (!isUserKeySane(userKey)) {
        res.status(500).send('Invalid RPDB Key')
        return
    }
    needle.get(`${tAddon}${req.originalUrl.replace(`/${userKey}`, '')}`, { follow_max: 3 }, (err, resp, body) => {
        let newBody
        if (((body || {}).metas || []).length) {
            attachHeaders(resp, res)
            newBody = {
                metas: body.metas.map(el => {
                    if ((el || {}).id && el.id.startsWith('tt'))
                        el.poster = `https://api.ratingposterdb.com/${userKey}/imdb/poster-default/${el.id}.jpg?fallback=true`
                    else if ((el || {}).id && el.id.startsWith('tmdb:'))
                        el.poster = `https://api.ratingposterdb.com/${userKey}/tmdb/poster-default/${el.id.replace('tmdb:', el.type+'-')}.jpg?fallback=true`
                    return el
                })
            }
        }
        res.json(newBody || body || {})
    })
})

app.get('/:userKey/meta/*', (req, res) => {
    const userKey = req.params.userKey
    res.redirect(301, `${tAddon}${req.originalUrl.replace(`/${req.params.userKey}`, '')}`)
})

const port = process.env.PORT || 64321

app.listen(port, () => {
    console.log(`http://localhost:${port}/manifest.json`)   
})

[yortem]

@jaruba my code is in PHP so I'm a bit confused what's the idea of the process is, and what's the difference between using the proxy and giving a unique URL with a parameter on the same server, in both of them the user expose the apikey in the URL. I can just add a parameter &api={apikey} and decide that the poster will be different based on this, and it will do the same thing. am I wrong?

[jaruba]

yeah, if you want you can do that and it would be the same thing, well now you have a working example in nodejs also, i imagined that your project was serving static files and you didn't want to complicate it more than that

i don't see sensitive details in the url as a security risk, as i said SSL encrypts the url paths and this is how all Stremio addons work, it's down to user common sense what happens with addon links 🤷‍♂️

[yortem]

@ericvlog I think it works now. after logging in, go to "Your Catalogs" and you can update the RPDB key there. then you will need to reinstall the addons (if in the future you will change or remove your API key you will not need to reinstall again).

[jaruba]

@yortem i tested with the Newest Movies catalog, but there is an issue, so the poster url is:

https://api.ratingposterdb.com/${rpdbKey}/tmdb/poster-default/970347.jpg?fallback=true

but, as the docs explain here: https://rpdb.docs.apiary.io/#reference/0/posters-with-ratings/example

for tmdb you must also add the type, so either:

/movie-970347.jpg?fallback=true

or

/series-970347.jpg?fallback=true

this is because tmdb can have the same id value for both movie and series, while not setting type works, it will fail sometimes because it needs to guess the type

the type is only needed for tmdb, because imdb (and all other metadata providers) have a unique id regardless of the item type

[yortem]

@jaruba I fixed it. thanks. and thank you for the entirety of the helpful comments.

I actually wasn't aware there's a documentation, I just followed the general idea that the link contains the API and the id of the movie. is there anything to know more? for example, I don't see the free tear listed there where the limit requests show, or any other thing regard the free tear, I assume it's not updated. I feel most of it already comes from the user settings and not from actually programming to work in a certain way, at least for Stremio.

[jaruba]

yeah, i didn't get a chance to describe the free tier on the website and docs yet, since releasing it i have been in almost constant communication with the users and that took most of my time

there is nothing else to do really unless you want to support more metadata IDs from other providers, everything is handled on the RPDB side through various settings

although unrelated i would suggest to look into using skip for your catalogs to paginate, because i noticed that the Oscar movies list just dumps the whole 599 movies at once on one page, while Stremio has no page limit, loading such a big json could even possibly crash some Stremio apps (like the Samsung, LG or Android TV app versions which can have bad hardware)

oh, i also added ur addon on this list: https://github.com/RatingPosterDB/rpdb-help/blob/main/stremio.md

i didn't know what to call it as it doesn't seem to have an obvious name so i just called it "Stremio Lists", if you prefer a different name, do feel free to tell me 😅

[yortem]

@jaruba yes whatever I did here is a complete mess. even the current github reporisotory for the chrome extension is called "imdb open in stremio" which was what it did first, but now it does a lot of other things, other sites and lists, eve a right-click menu and whatever. it's absurd. and the other tool started with just IMDB list but now it can do a lot of other things including manual insertion of names, and soon I might consider to just make an index where people would be able to browse existing lists.

Anyway, I don't know what to tell you, just leave it with this name. it's not important.

Thanks.

[jaruba]

@yortem how about "Yortem's Lists"? 🙂

[yortem]

@jaruba No I don't want it to be with my nickname, there are a few reasons why it's not a great idea. to be honest, so far I don't care if it doesn't have a name at all, and who knows if I will add more features and then the name will be irrelevant again. anyway, you're a busy guy as you said, don't waste your time thinking of names for this marginal addon haha it will be fine

By the way, off topic - the addons people install there work on any platform besides Android mobile, and I don't know why. I assume I did something wrong, maybe the URL itself is bad. I tried to get help on Discord but with no avail. if I could somehow get the error on mobile or debug somehow, it would be useful, but I don't know how. how do you suggest debug it?

[jaruba]

let me show you something, in Radarr's supported lists, there is a thing called "StevenLu Custom": https://wiki.servarr.com/radarr/supported#stevenluimport

if you google for "stevenlu list" you reach https://movies.stevenlu.com/

owned by a guy that is shockingly named Steven Lu, that created a very simple standard of sending a movie list with JSON (much like the Stremio addons really), imo it got pretty popular because there was no other standard to compete with it 😄

now i'm not trying to convince you, i'm just telling you the story of Steven Lu, a guy i found out about because of his movie lists 🙂

regarding android mobile support, not sure if i understand what doesn't work with it (can you explain the issue better?), but i can explain this:

• android mobile and desktop (win / macos / linux) are the last apps that still use an old version of the stremio core
• android tv, web app, samsung tv, lg tv, etc. all use the new stremio core (which is written in rust) because these apps use a different core (desktop and android mobile are still in a transition period), they can behave differently with addons (depending on the addon responses)

[yortem]

Well, I don't think it is a version issue because it works well on PC \ Web \ Android TV which I understand do not share the same version. but not on Android Mobile.

The catalogs do not appear at all on the main page. they appear in the discover menu, but when I choose them, it says catalog is empty + a purple error: the content did not load, error accured.

Here's a screenshot

My best guess is because the URL of the addon has get parameters and do not end with "json". which I think is not the orthodox way to do it, but since it worked initially on other platforms I based my entire code around it, so it's too late for me to change. I doubt it's because the content itself. also, I hope it will get solved by itself when you will upgrade Android mobile to the next version.

[jaruba]

but u can create 2 routes that go to the same data? so u could make this data part of the url and optionally querystring too? old installs will work on some devices then but new installs will work on all devices?

u could also create a https://www.journey.co.il/stremio/manifest.json too with manifest.behaviorHints.configurable: true and manifest.behaviorHints.configurationRequired: true, then redirect https://www.journey.co.il/stremio/configure to https://www.journey.co.il/stremio/ and submit https://www.journey.co.il/stremio/manifest.json to the stremio addon catalog at: https://stremio.github.io/stremio-publish-addon/index.html

so it can be discovered easier by more users

[yortem]

@jaruba to be honest, at this point I don't even know what I need to change in the URL, because I tried multiple things and yet nothing worked. and now after I added the API key there are probably more parameters, but only for registered users. so it's kinda mess, the entire tool is a mess. :(

I didn't understand the 2nd idea. or maybe the 2nd idea is just to add it to the stremio addons catalog

[jaruba]

yeah, it was just to add it to the stremio catalog once properly configured

if u can make it open source somehow i can try to help, i haven't used php in a long time but it sounds like u need help 😄

[ericvlog]

@ericvlog I think it works now. after logging in, go to "Your Catalogs" and you can update the RPDB key there. then you will need to reinstall the addons (if in the future you will change or remove your API key you will not need to reinstall again).

wow, yesterday you just say won't consider in near future, now already done!! thanks so much.

[yortem]

@jaruba no need i will just try again in another time or give up until there's some version update or whatever.

@ericvlog well, i was worth trying.

[ericvlog]

The popular actor catalog became a movie poster is this okay?

I still remember it should show the actor no movie poster.

[yortem]

@ericvlog Oh damn, that's a good point. I'll fix it.

@jaruba by the way, is there a way to make that clicking on an item in the catalog will refer to the search and not to an imdb item in the catalog? because I have the people catalog

https://www.journey.co.il/stremio/1/Popular%20People/preview.php

and I wish people would be able to click on an actor and search his name on Stremio, but right now I don't know how to do it and I don't see it in the documentation.

[jaruba]

@yortem i don't believe there is a way to do that, i think the proper way for it to be handled would be to create a new metadata type for "people" that allows requesting addon catalogs, but this would be far from a high priority task, unfortunately

there are also deep links: https://github.com/Stremio/stremio-addon-sdk/blob/master/docs/deep-links.md

there is one for the search page too, but they are not expected to work like that (started from a catalog item)

[yortem]

@jaruba well, yea I use deep links in the chrome extension but not from catalogs. okay, I understand it's not possible at the moment