0.15.0 MovieMerge

backend/src/services/settingsService.js

@@ -43,6 +43,15 @@ const SENSITIVE_SETTING_KEYS = new Set([
   'pushover_token',
   'pushover_user'
 ]);
+const IMMUTABLE_SETTING_KEYS = new Set([
+  'makemkv_command',
+  'mediainfo_command',
+  'handbrake_command',
+  'ffmpeg_command',
+  'ffprobe_command',
+  'cdparanoia_command',
+  'mkvmerge_command'
+]);
 const AUDIO_SELECTION_KEYS_WITH_VALUE = new Set(['-a', '--audio', '--audio-lang-list']);
 const AUDIO_SELECTION_KEYS_FLAG_ONLY = new Set(['--all-audio', '--first-audio']);
 const SUBTITLE_SELECTION_KEYS_WITH_VALUE = new Set(['-s', '--subtitle', '--subtitle-lang-list']);
@@ -159,6 +168,10 @@ function applyRuntimeLogDirSetting(rawValue) {
   }
 }
 
+function isImmutableSettingKey(key) {
+  return IMMUTABLE_SETTING_KEYS.has(String(key || '').trim().toLowerCase());
+}
+
 function normalizeTrackIds(rawList) {
   const list = Array.isArray(rawList) ? rawList : [];
   const seen = new Set();
@@ -961,6 +974,12 @@ class SettingsService {
   }
 
   async setSettingValue(key, rawValue) {
+    if (isImmutableSettingKey(key)) {
+      const error = new Error(`Setting ${key} ist schreibgeschützt und kann nicht geändert werden.`);
+      error.statusCode = 403;
+      throw error;
+    }
+
     const db = await getDb();
     const schema = await db.get('SELECT * FROM settings_schema WHERE key = ?', [key]);
     if (!schema) {
@@ -1022,6 +1041,14 @@ class SettingsService {
     const validationErrors = [];
 
     for (const [key, rawValue] of entries) {
+      if (isImmutableSettingKey(key)) {
+        validationErrors.push({
+          key,
+          message: 'Dieses Setting ist schreibgeschützt und kann nicht geändert werden.'
+        });
+        continue;
+      }
+
       const schema = schemaByKey.get(key);
       if (!schema) {
         const error = new Error(`Setting ${key} existiert nicht.`);
@@ -1047,7 +1074,9 @@ class SettingsService {
 
     if (validationErrors.length > 0) {
       const error = new Error('Mindestens ein Setting ist ungültig.');
-      error.statusCode = 400;
+      error.statusCode = validationErrors.some((item) => String(item?.message || '').includes('schreibgeschützt'))
+        ? 403
+        : 400;
       error.details = validationErrors;
       throw error;
     }