[Joly0]

I have been running this feature on my own instance since March and only now got around to filing it upstream. For this PR it was rebased onto current develop and partly reworked; the reworked version is what is tested below.

Problem

Prowlarr exposes every indexer as a Newznab/Torznab feed at /{id}/api and serves grabs at /{id}/download. Apps that search indexers directly through those feeds (Listenarr, for example) cannot go through starrproxy: nginx only routes .../api/..., so /{id}/api falls into the JSON 404 block.

Prowlarr also writes its own URL and API key into the download links of every feed result (http://prowlarr:9696/{id}/download?apikey=<prowlarr key>&link=...). Any consumer of the feed therefore receives Prowlarr's full API key, and downloads go straight to Prowlarr instead of through the proxy.

Fix

• nginx: a location for /{id}/api and /{id}/download (also behind a base URL, the prefix is stripped like on the other routes) that passes endpoint=/{id}/api to api/index.php. The existing /api/ route is unchanged.
• No bypass: both paths are in Prowlarr's openapi.json (/{id}/api, /{id}/download), so they go through the normal access check, logging, usage and blocked notifications. An app needs them granted like any other endpoint.
• Feed responses: Prowlarr's URL is replaced with the proxy URL the client used, and Prowlarr's key with the caller's proxy key, so downloads come back through the proxy and Prowlarr's key never leaves it. Content-Length is dropped for the rewritten body.
• Field redaction is skipped for non-JSON (XML) responses instead of iterating over a string.
• The new location sets fastcgi_ignore_headers X-Accel-Redirect like the other fastcgi locations.

3 files: root/etc/nginx/template.conf, api/index.php, functions/api.php.

Testing

Built from this branch, real Prowlarr 2.6.5, proxied app granted /api/v1/indexer, /{id}/api, /{id}/download.

Request	Result
/1/api?t=caps with the app's key	200 application/rss+xml, Prowlarr caps
/foo/1/api?t=caps (base URL)	200 application/rss+xml
/1/api?t=search&q=...&limit=1	200, <link> points at http://<proxy>/1/download?apikey=<proxy key>
/api/v1/indexer and /foo/api/v1/indexer	200 JSON
/api/v1/system/status (not granted)	401 missing access
/1/api with a key without the indexer grant	401 missing access to /1/api
/1/api without a key	401 no apikey provided
/foo/api	404 {"error":"Starr Proxy: Invalid starr route"}

[austinwbest]

Let me get that signalr one landed on develop and then we can loop back to this one as well

[Joly0]

SignalR is in, so I rebased this onto current develop. Since #124 added fastcgi_ignore_headers X-Accel-Redirect to every fastcgi location, I added it to the new indexer location too. Re-tested caps, search, download links and an ungranted endpoint against Prowlarr. Ready for a look whenever you have time.