feat: Add MyAnimeList as primary manga metadata provider (#113)

* feat: Add MyAnimeList as primary manga metadata provider

MAL provides better search coverage and metadata (titles, images,
synopsis, authors) while MangaDex continues to supply chapter data.
This hybrid approach significantly improves manga library scan match
rates (previously ~39/100+).

Backend:
- New MAL API v2 client (myanimelist.py) with search, details, rate limiting
- MangaDex cross-reference via find_by_mal_id() using links.mal field
- addMangaToDB_MAL() importer fetches MAL metadata + MangaDex chapters
- Service layer routes search/add through MAL when enabled, falls back to MangaDex
- Image proxy endpoint for MAL CDN covers (CORS/SSRF-safe allowlist)
- MangaDexID/MalID columns on comics table for cross-provider detection
- Improved fuzzy matching: normalize titles, SequenceMatcher + Jaccard + containment
- Fix NoneType crash in find_comic when ComicVine API key missing

Frontend:
- MAL settings UI (enable toggle + Client ID field) in API settings
- "MAL" source label badge on search results
- Helpful "Comic Vine API key required" message instead of generic error
- Search mode derived from URL params (fixes refresh defaulting to Comics)
- Delete series redirects to /series instead of /
- Fix horizontal overflow: min-w-0 on main layout, truncated series/author columns
- Remove redundant Library column from search results
- Column toggle button portaled next to sort controls

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: CI failures — ruff format mangasync.py, use callback ref for portal

- ruff format on mangasync.py (line length)
- Replace useRef with callback ref + state for column toggle portal
  to satisfy react-hooks/refs lint rule (no ref access during render)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: Address code review findings (P1/P2 security, logic, standards)

Security:
- Image proxy: validate URL scheme (http/https only), reject userinfo
  in URLs, pin Content-Type to image allowlist, disable redirects
- MAL Client ID: remove from safe_keys (use boolean indicator instead),
  change settings field to password type
- Move `import requests` to module level in router.py

Logic:
- find_manga/add_manga gate on MAL_ENABLED || MANGADEX_ENABLED (not just MangaDex)
- MAL empty results no longer silently fall through to MangaDex
- Safe int conversion for num_chapters (int(float()) + try/except)
- isManga check includes mal- prefix on SeriesDetailPage
- mangaEnabled considers mal_enabled in useContentSources
- Validate URL type param instead of unsafe cast
- MAL settings visible independently of MangaDex toggle

Standards:
- bare except → except Exception as e with logging
- datetime import moved to module level in myanimelist.py
- Config type: add mal_enabled, mal_client_id, mal_client_id_set fields

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: frankieramirez

comicarr/__init__.py

@@ -1335,6 +1335,8 @@ def dbcheck():
         ("ReadingDirection", "TEXT DEFAULT 'ltr'"),
         ("MetadataSource", "TEXT"),
         ("ExternalID", "TEXT"),
+        ("MangaDexID", "TEXT"),
+        ("MalID", "TEXT"),
         ("not_updated_db", "TEXT"),
     ]
     _ensure_columns(engine, "comics", comics_cols)

comicarr/app/metadata/router.py

@@ -13,9 +13,13 @@
 Low cross-domain dependency, well-bounded. Validates the domain pattern.
 """
 
-from fastapi import APIRouter, Depends
-from fastapi.responses import FileResponse, JSONResponse
+from urllib.parse import urlparse
 
+import requests
+from fastapi import APIRouter, Depends, Query
+from fastapi.responses import FileResponse, JSONResponse, Response
+
+from comicarr import logger
 from comicarr.app.core.context import AppContext, get_context
 from comicarr.app.core.exceptions import NotFoundError
 from comicarr.app.core.security import require_session
@@ -120,6 +124,50 @@ def get_artwork(comic_id: str, ctx: AppContext = Depends(get_context)):
     return FileResponse(image_path, media_type="image/jpeg")
 
 
+# Allowed domains for image proxy to prevent SSRF
+_ALLOWED_IMAGE_DOMAINS = {
+    "myanimelist.net",
+    "cdn.myanimelist.net",
+    "api-cdn.myanimelist.net",
+    "uploads.mangadex.org",
+}
+
+
+_ALLOWED_IMAGE_CONTENT_TYPES = {
+    "image/jpeg",
+    "image/png",
+    "image/webp",
+    "image/gif",
+    "image/avif",
+}
+
+
+@router.get("/image-proxy", dependencies=[Depends(require_session)])
+def image_proxy(url: str = Query(..., description="External image URL to proxy")):
+    """Proxy external cover images to avoid CORS issues.
+
+    Only allows requests to known manga metadata CDNs.
+    """
+    parsed = urlparse(url)
+    if parsed.scheme not in ("http", "https"):
+        return JSONResponse({"error": "Invalid URL scheme"}, status_code=403)
+    if parsed.hostname not in _ALLOWED_IMAGE_DOMAINS:
+        return JSONResponse({"error": "Domain not allowed"}, status_code=403)
+    if parsed.username or parsed.password:
+        return JSONResponse({"error": "Credentials in URL not allowed"}, status_code=403)
+
+    try:
+        resp = requests.get(url, timeout=(5, 10), headers={"User-Agent": "Comicarr/1.0"}, allow_redirects=False)
+        resp.raise_for_status()
+        content_type = resp.headers.get("Content-Type", "image/jpeg").split(";")[0].strip()
+        if content_type not in _ALLOWED_IMAGE_CONTENT_TYPES:
+            return JSONResponse({"error": "Invalid content type"}, status_code=502)
+        return Response(content=resp.content, media_type=content_type)
+    except Exception as e:
+        logger.error("[IMAGE-PROXY] Failed to fetch %s: %s" % (url, e))
+        return JSONResponse({"error": "Failed to fetch image"}, status_code=502)
+
+
 @router.get("/series-image/{series_id}", dependencies=[Depends(require_session)])
 def get_series_image(series_id: str, ctx: AppContext = Depends(get_context)):
     """Get cover image URL for a Metron series (lazy loading)."""

comicarr/app/search/service.py

@@ -83,31 +83,51 @@ def add_in_library(comic):
     if isinstance(searchresults, dict) and "results" in searchresults:
         searchresults["results"] = [add_in_library(c) for c in searchresults["results"]]
         return searchresults
-    else:
+    elif searchresults:
         searchresults = sorted(searchresults, key=itemgetter("comicyear", "issues"), reverse=True)
         searchresults = [add_in_library(c) for c in searchresults]
         return {"results": searchresults}
+    else:
+        return {"error": "Search returned no results"}
 
 
 def find_manga(ctx, name, limit=None, offset=None, sort=None):
-    """Search for manga via MangaDex API."""
-    if not ctx.config or not getattr(ctx.config, "MANGADEX_ENABLED", False):
-        return {"error": "MangaDex integration is not enabled"}
-
-    from comicarr import mangadex
+    """Search for manga via MAL (primary) or MangaDex (fallback)."""
+    mal_ok = getattr(ctx.config, "MAL_ENABLED", False) and getattr(ctx.config, "MAL_CLIENT_ID", None)
+    mdex_ok = getattr(ctx.config, "MANGADEX_ENABLED", False)
+    if not ctx.config or not (mal_ok or mdex_ok):
+        return {"error": "Manga integration is not enabled"}
 
     try:
         parsed_limit = int(limit) if limit else None
         parsed_offset = int(offset) if offset else None
     except (ValueError, TypeError):
         return {"error": "Invalid pagination parameters"}
 
-    searchresults = mangadex.search_manga(name, limit=parsed_limit, offset=parsed_offset, sort=sort)
-
     def add_in_library(manga):
         manga["in_library"] = manga.get("haveit") != "No"
         return manga
 
+    # Try MAL first if configured
+    mal_enabled = getattr(ctx.config, "MAL_ENABLED", False)
+    mal_client_id = getattr(ctx.config, "MAL_CLIENT_ID", None)
+
+    if mal_enabled and mal_client_id:
+        from comicarr import myanimelist
+
+        try:
+            searchresults = myanimelist.search_manga(name, limit=parsed_limit, offset=parsed_offset, sort=sort)
+            if isinstance(searchresults, dict) and "results" in searchresults:
+                searchresults["results"] = [add_in_library(m) for m in searchresults["results"]]
+                return searchresults
+        except Exception as e:
+            logger.error("[SEARCH] MAL search failed, falling back to MangaDex: %s" % e)
+
+    # Fall back to MangaDex
+    from comicarr import mangadex
+
+    searchresults = mangadex.search_manga(name, limit=parsed_limit, offset=parsed_offset, sort=sort)
+
     if isinstance(searchresults, dict) and "results" in searchresults:
         searchresults["results"] = [add_in_library(m) for m in searchresults["results"]]
         return searchresults
@@ -128,23 +148,29 @@ def add_comic(ctx, comic_id):
 
 
 def add_manga(ctx, manga_id):
-    """Add a manga by MangaDex ID."""
-    if not str(manga_id).startswith("md-"):
-        manga_id = "md-" + manga_id
-
-    if not ctx.config or not getattr(ctx.config, "MANGADEX_ENABLED", False):
-        return {"success": False, "error": "MangaDex integration is not enabled"}
+    """Add a manga by MAL ID or MangaDex ID."""
+    mal_ok = getattr(ctx.config, "MAL_ENABLED", False) and getattr(ctx.config, "MAL_CLIENT_ID", None)
+    mdex_ok = getattr(ctx.config, "MANGADEX_ENABLED", False)
+    if not ctx.config or not (mal_ok or mdex_ok):
+        return {"success": False, "error": "Manga integration is not enabled"}
 
     try:
         from comicarr import importer
 
-        result = importer.addMangaToDB(manga_id)
+        if str(manga_id).startswith("mal-"):
+            # MAL-sourced manga: fetch metadata from MAL, chapters from MangaDex
+            result = importer.addMangaToDB_MAL(manga_id)
+        else:
+            # MangaDex-sourced manga (existing flow)
+            if not str(manga_id).startswith("md-"):
+                manga_id = "md-" + manga_id
+            result = importer.addMangaToDB(manga_id)
 
         if result and result.get("status") == "complete":
             return {
                 "success": True,
                 "message": "Successfully added manga: %s" % result.get("comicname", manga_id),
-                "comicid": manga_id,
+                "comicid": result.get("comicid", manga_id),
                 "content_type": "manga",
             }
         return {"success": False, "error": "Failed to add manga: %s" % manga_id}

comicarr/app/series/service.py

@@ -765,14 +765,21 @@ def listLibrary(comicid=None):
                     comics.c.Status,
                     comics.c.ComicName,
                     comics.c.ComicYear,
+                    comics.c.MalID,
+                    comics.c.MangaDexID,
                 )
                 .outerjoin(annuals, comics.c.ComicID == annuals.c.ComicID)
                 .group_by(comics.c.ComicID)
             )
         else:
-            stmt = select(comics.c.ComicID, comics.c.Status, comics.c.ComicName, comics.c.ComicYear).group_by(
-                comics.c.ComicID
-            )
+            stmt = select(
+                comics.c.ComicID,
+                comics.c.Status,
+                comics.c.ComicName,
+                comics.c.ComicYear,
+                comics.c.MalID,
+                comics.c.MangaDexID,
+            ).group_by(comics.c.ComicID)
     else:
         cleaned_id = re.sub("4050-", "", comicid).strip()
         if comicarr.CONFIG.ANNUALS_ON is True:
@@ -783,14 +790,23 @@ def listLibrary(comicid=None):
                     comics.c.Status,
                     comics.c.ComicName,
                     comics.c.ComicYear,
+                    comics.c.MalID,
+                    comics.c.MangaDexID,
                 )
                 .outerjoin(annuals, comics.c.ComicID == annuals.c.ComicID)
                 .where(comics.c.ComicID == cleaned_id)
                 .group_by(comics.c.ComicID)
             )
         else:
             stmt = (
-                select(comics.c.ComicID, comics.c.Status, comics.c.ComicName, comics.c.ComicYear)
+                select(
+                    comics.c.ComicID,
+                    comics.c.Status,
+                    comics.c.ComicName,
+                    comics.c.ComicYear,
+                    comics.c.MalID,
+                    comics.c.MangaDexID,
+                )
                 .where(comics.c.ComicID == cleaned_id)
                 .group_by(comics.c.ComicID)
             )
@@ -811,6 +827,16 @@ def listLibrary(comicid=None):
                 library[name_key] = {"comicid": row["ComicID"], "status": row["Status"]}
         except Exception:
             pass
+        # Cross-index by MAL and MangaDex IDs for cross-provider haveit detection
+        try:
+            mal_id = row.get("MalID")
+            if mal_id:
+                library["mal-" + str(mal_id)] = {"comicid": row["ComicID"], "status": row["Status"]}
+            mangadex_id = row.get("MangaDexID")
+            if mangadex_id:
+                library["md-" + str(mangadex_id)] = {"comicid": row["ComicID"], "status": row["Status"]}
+        except Exception as e:
+            logger.fdebug("[SERIES] Cross-index by MAL/MangaDex ID failed for %s: %s" % (row.get("ComicID"), e))
 
     return library
 

comicarr/app/system/service.py

@@ -186,6 +186,7 @@ def get_safe_config(ctx):
         "METRON_USERNAME",
         "MANGADEX_LANGUAGES",
         "MANGADEX_CONTENT_RATING",
+        "MAL_ENABLED",
         "PREFERRED_QUALITY",
         "USE_MINSIZE",
         "MINSIZE",
@@ -234,6 +235,10 @@ def get_safe_config(ctx):
     metron_pw = getattr(ctx.config, "METRON_PASSWORD", None)
     result["metron_password_set"] = bool(metron_pw)
 
+    # Add boolean indicator for MAL_CLIENT_ID (not sent as plaintext)
+    mal_key = getattr(ctx.config, "MAL_CLIENT_ID", None)
+    result["MAL_CLIENT_ID_SET"] = bool(mal_key and mal_key != "None")
+
     # Lowercase all keys for frontend convention
     result = {k.lower(): v for k, v in result.items()}
     version = ctx.current_version
@@ -296,6 +301,8 @@ def get_safe_config(ctx):
     "METRON_USERNAME",
     "MANGADEX_LANGUAGES",
     "MANGADEX_CONTENT_RATING",
+    "MAL_ENABLED",
+    "MAL_CLIENT_ID",
     "PREFERRED_QUALITY",
     "USE_MINSIZE",
     "MINSIZE",

comicarr/config.py

@@ -187,6 +187,8 @@
         "MANGADEX_ENABLED": (bool, "MangaDex", True),
         "MANGADEX_LANGUAGES": (str, "MangaDex", "en"),
         "MANGADEX_CONTENT_RATING": (str, "MangaDex", "safe,suggestive"),
+        "MAL_ENABLED": (bool, "MAL", False),
+        "MAL_CLIENT_ID": (str, "MAL", None),
         "LOG_DIR": (str, "Logs", None),
         "MAX_LOGSIZE": (int, "Logs", 10000000),
         "MAX_LOGFILES": (int, "Logs", 5),