v1.2.2 — Initial Release

First public release of Tindarr.
This replaces TindarrLegacy.

Fresh install required.

Highlights

• Full rewrite
• Multi-user swipe-based movie selection
• Shared rooms for group swiping
• Playback and casting support
• Plex / Jellyfin / Emby compatibility
• Radarr auto-add integration

Setup & Onboarding

First launch runs a setup wizard:

• Create admin account
• Configure TMDB
• Add media servers
• Configure Radarr
• Set LAN/WAN join addresses
• Optional library sync and metadata build

Users opening a room invite during setup can still join as guests.

Defaults are suggested where possible and setup progress persists between steps.

Authentication

• Username/password login
• Forced password initialization supported
• Registration flow with approval messaging
• Guest join when accessing room links

Client validates usernames and shows inline errors and loading states.

Swiping

Default view is the swipe deck.

• Like / Nope
• Superlike (permission based)
• Undo last swipe
• Tap card for details
• Deck automatically refills when running low

Transient failures present retryable messages instead of hard errors.

Rooms (Group Swiping)

Rooms follow:

Lobby → Close Room → Swipe → Matches

Features:

• Create rooms scoped to a media service
• Join via link or QR code
• Owner starts swiping phase
• Shared match calculation
• Automatic room state refresh

Room rules:

• Superlikes disabled
• Joining is idempotent
• LAN/WAN invite variants supported

Casting:

• Cast join QR
• Cast matched movies
• Switch LAN/WAN target after casting

Search

• Title search
• Clean reset between searches
• Clear distinction between “no results” and “not searched”

Search sources:

• Automation service passthrough when available
• Local metadata cache
• External metadata lookup fallback

Preferences

User-adjustable filters:

• Genre preference (neutral / preferred / excluded)
• Rating range
• Year range
• Language / region
• Sorting

Saving preferences refreshes the swipe deck.

Likes & Matches

History views for interactions.

• Batched detail loading
• Gallery or table layouts
• Clear empty states
• Retry support

Admin Console

Admin interface available at /admin.
Non-admin users are denied access.

Top-level service sections:

• Tindarr
• Radarr
• TMDB
• Plex
• Jellyfin
• Emby
• Backup & Restore

Tindarr Administration

General

• Update checker compares running version against latest GitHub release
• Displays latest version and release URL when available

Users

• Create users (User ID, display name, password, role)
• Roles: Contributor → Curator → Admin
• Approve pending registrations
• Edit display names inline
• Change passwords
• Delete users

Rooms Settings

• Configure LAN join address
• Configure WAN join address
• Room lifetime configuration
• Guest session lifetime configuration

Database

• Service scope selector
• Table or gallery viewing modes
• Populate metadata/images into cache
• Progress and status display
• Paginated movie listing per scope

Casting

• Diagnostics view with active sessions and recent events
• Subtitle preference configuration
• Audio preference configuration
• Casting policy editor

Advanced

• Open registration toggle
• Require admin approval toggle
• Default role selection for new users
• API rate limiting configuration:
  • Enable/disable
  • Request limit
  • Window duration

Console

• Live console output viewer
• Adjustable history size
• Pause/resume refresh
• Highlight filtering
• Basic severity coloring

Radarr Integration

Per-server configuration:

• Server ID (scope identity)
• URL and API key
• Connection testing
• Default quality profile selection
• Default root folder selection
• Tag label configuration
• Auto-add accepted movies toggle
• Auto-add interval configuration

Operational actions:

• Library sync
• Add accepted movies immediately
• Matching rules configuration:
  • Minimum users
  • Minimum percentage of users

TMDB Integration

Credential configuration:

• API Key (optional)
• Read Access Token (optional)

Cache settings:

• Maximum cached movies
• Image handling mode (local proxy or direct)
• Maximum image cache size

Metadata build tooling:

• Language and region filtering
• Discover limits
• Optional API limit bypass
• Build start/stop controls
• Live progress reporting

Backup & Restore:

• Download TMDB backup
• Restore from backup
• Detailed restore summary

Plex Integration

• PIN-based authorization flow
• Authorization polling and verification
• Server synchronization
• Connection testing

Per-server actions:

• Library sync
• Server removal

Jellyfin Integration

• Add server via URL and API key
• Server listing with sync status
• Connection testing
• Manual library sync
• Server removal

Emby Integration

• Add server via URL and API key
• Server listing with sync status
• Connection testing
• Manual library sync
• Server removal

Backup & Restore

• Master backup download (all databases + TMDB images)
• Main database download
• Plex cache backup/restore
• Jellyfin cache backup/restore
• Emby cache backup/restore

(TMDB backup and restore available under the TMDB section.)

Media Server Integration

Supported:

• Plex
• Jellyfin
• Emby

Capabilities:

• Configure servers
• Sync libraries
• Prepare playback sessions

Radarr integration enables automatic addition of accepted movies.

Playback & Casting

Tindarr acts as a playback gateway:

• Prepare playback sessions
• Proxy playback requests
• Discover casting devices
• Cast directly from matches or rooms

Security

Authentication

• JWT bearer authentication
• Issuer, audience, and lifetime validation
• HMAC-SHA256 signing
• Signing key rotation support
• PBKDF2-SHA256 password hashing (default 100k iterations)

Authorization

• Policy-based authorization
• Admin/user role separation
• Room-scoped access enforcement

Request Protection

• Global rate limiting
  • per authenticated user
  • per IP when unauthenticated
• Credential-aware CORS policy (no wildcard origins)
• Centralized API authorization pipeline

Playback Protection

Playback endpoints remain casting-compatible but require short-lived HMAC tokens.

Logging & Handling

• Correlation IDs attached to requests
• Sensitive headers and query values redacted
• Errors returned as application/problem+json
• Stack traces only exposed in development environments

Secrets & Backups

• External service credentials stored server-side only
• Secrets never returned to clients
• Backups include application databases
• Backup and restore restricted to administrators

Networking

• Binds HTTP on all interfaces by default for LAN casting
• Reverse proxy friendly
• Designed primarily for local network deployments

QoL Design Rules

Current UI behavior follows consistent patterns:

• Explicit loading states
• Retry instead of refresh
• Batched requests to avoid cascade failures
• Disabled actions during animations or submissions
• Accessible controls with visible focus states

Known Gaps

• Installation workflow still evolving
• Some remaining alert() usage instead of inline error components
• Limited keyboard-first interaction support

Notes

• TindarrLegacy databases are not compatible
• Fresh installation recommended