Extension reviewer guide

Summary

This extension streamlines searching across user-hosted Servarr applications (Sonarr, Radarr, Lidarr, Readarr) by:

• Auto-prefilling Servarr search pages when a user navigates to a URL containing /add/new/<term> (or similar).
• Adding context menu items to search selected text directly in any configured Servarr instance.
• Injecting small Servarr search icons/links into supported third-party media sites (IMDb, TMDb, TVDb, Trakt, TVmaze, MusicBrainz, Letterboxd, TV Calendar, Rotten Tomatoes, Metacritic, Simkl, IPTorrents, Last.fm, Allociné, SensCritique, Betaseries, Prime Video, Rate Your Music, MyAnimeList, Wikipedia — see the integrations gallery).
• Providing an options UI where users configure base URLs + API keys (optional) for automatic advanced selector configuration.
• Backup & restore of user settings via a dedicated options tab: exports a JSON file using a schema-versioned envelope; imports either the new envelope or legacy plain JSON with validation; supports merge or replace modes and a preview-changes diff.

The extension does not collect analytics, ship remote code, or exfiltrate user data. All API calls target only the user's own Servarr instances explicitly configured in settings. See the latest release changes in the changelog.

Repository layout (source vs built artifacts)

All minified/processed assets in dist/ are reproducible by following the build steps below.

Build & verification steps

Perform a clean build from source (commands are cross-platform):

npm ci
grunt release

This produces:

• dist/chromium (MV3 build using eventPage.chrome.js as service worker + background script bundle pieces).
• dist/firefox (MV2 build with background.scripts).

Mapping built code to source

There is no custom packer, no dynamic code generation beyond Tailwind's static CSS expansion.

Permissions & justification

manifest-chromium/manifest.json:

"permissions": ["scripting", "storage", "activeTab", "contextMenus"],
"host_permissions": [
    "*://*.allocine.fr/*", "*://*.betaseries.com/*", "*://*.imdb.com/*",
    "*://*.iptorrents.com/*", "*://*.iptorrents.net/*", "*://*.iptorrents.me/*",
    "*://*.iptorrents.eu/*", "*://*.iptorrents.ru/*", "*://*.last.fm/*",
    "*://*.letterboxd.com/*", "*://*.metacritic.com/*", "*://*.musicbrainz.org/*",
    "*://*.myanimelist.net/*", "*://*.primevideo.com/*", "*://*.rateyourmusic.com/*",
    "*://*.rottentomatoes.com/*", "*://*.senscritique.com/*", "*://*.simkl.com/*",
    "*://*.themoviedb.org/*", "*://*.thetvdb.com/*", "*://*.trakt.tv/*",
    "*://*.pogdesign.co.uk/*", "*://*.tvmaze.com/*", "*://*.wikipedia.org/*"
],
"optional_host_permissions": ["<all_urls>"]

Firefox (MV2)

manifest-firefox/manifest.json lists the same host patterns plus storage, activeTab, tabs and contextMenus under permissions (MV2 does not separate host_permissions), with <all_urls> under optional_permissions. The same justifications apply.

Background & runtime architecture

All logic is synchronous or simple async, with fetch only to user-supplied Servarr endpoints (API base derived from settings). No external analytics endpoints.

Data handling & privacy

Third-party libraries

All libraries are installed via npm ci and bundled transparently (no CDN runtime fetches). Unminified sources remain in node_modules/.

How to functionally test

8.1 Load the extension (Chromium)

1. Build: npm ci && grunt release.
2. Open chrome://extensions → enable Developer Mode.
3. Click "Load unpacked" → select dist/chromium.
4. Open the popup: verify the enable/disable button toggles state (stored in extension storage).

8.2 Load the extension (Firefox)

Option A (temporary install): build, visit about:debugging#/runtime/this-firefox, "Load Temporary Add-on" → pick any file inside dist/firefox (e.g. manifest.json).

Option B (web-ext run):

npm ci
grunt release
npm run firefox

8.3 Configure & test core features

8.4 Storage inspection

In DevTools (background page or service worker):

await browser.storage.sync.get();

Review the structure (only configuration JSON under a single key).

8.5 Backup & restore

Options → "Backup & restore" tab.

• Backup: "Download backup" produces a pretty-printed JSON file using an envelope format — type ("servarr-autosearch-settings"), schemaVersion (1), exportedAt, appVersion, and a data payload with internal fields (prefixed _/__) stripped.
• Restore: choose a saved JSON file (envelope or legacy plain JSON — legacy accepted with an informational note). Optional replace mode overwrites fully; the default is a deep merge (arrays replaced; objects merged). "Preview changes" shows a diff of added/removed/changed paths before applying. Files are minimally validated (config object, sites[], integrations[]); a newer schemaVersion warns before import, older schemas are normalised.
• Reset: "Reset settings" → confirmation prompt → resets to built-in defaults.
• No network transmission occurs during backup or restore; files are handled locally in the browser context.

Security review checklist

Testing (automated)

Playwright (site integrations) — not required for functional store acceptance but provided for transparency:

npm ci
grunt release
cd tests/playwright
npm i
npx playwright install --with-deps chromium
npx playwright test

These load integration target pages and assert icon injection or URL logic (requires network access to public sites; may be flaky if site layouts change).

Jest (unit tests) — currently minimal; used as a development safeguard:

npm ci
npm test

Notable implementation details

How to trace code paths

Typical icon injection path on an integration page:

1. Content script runs (sonarr_radarr_lidarr_autosearch.js).
2. Loads settings via helpers in core.js.
3. Detects page type via site-specific selectors.
4. Builds search URLs and injects an <a> or <img> element with a click handler.
5. If disabled (settings.config.enabled === false) it returns early.

Auto-search path:

1. User navigates to an add/new URL carrying trailing search text.
2. Content script checks the path & extracts the trailing segment.
3. Waits for the search input (configurable selectors) up to a timeout.
4. Sets the value and dispatches an input event.

Known limitations / edge cases

Reviewer quick script audit pointers

Search for any suspicious patterns:

• eval( → not present.
• new Function( → not present.
• fetch( / XMLHttpRequest → confined to Servarr API probing in core.js (search for callApi).
• Event listeners for the context menu: background script only (eventPage.*).
• Storage key: sonarrRadarrLidarrAutosearchSettings (searchable).

Contact

If clarification is required during review, please raise an issue in the repository or include reviewer notes in the store submission feedback.

Summary assertion: all shipped code is deterministic & build-reproducible with npm ci && grunt release, free of remote executable payloads, limited to user-directed network activity, and structured for least complexity in review (no bundler obfuscation).

Thank you for reviewing this extension. 📡