Accounts with limits: a Newznab key and a tier per user, daily API and NZB counts, invites

ACCESS=accounts (config/access.ts; open stays the default and behaves as
before): Newznab and the catalog's releases routes name a user (apikey or
the web interface's token), whose tier sets searches and NZBs per UTC day
(Newznab 500/501, the catalog 429) and how far back they see (102/403).
Counted in one upsert per use, so the last one can't be taken twice;
caps, stats and refused requests aren't counted. Signup takes an invite
(SIGNUP), which may give a tier; ace access:invite, access:tier (extends a
running tier), access:suspend. The web interface signs in and shows the
day's usage and the Newznab key.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/controllers/releases_controller.ts

@@ -1,5 +1,6 @@
 import type { HttpContext } from '@adonisjs/core/http'
 import NzbService from '#services/nzb_service'
+import AccessService from '#services/access_service'
 import SearchService, { type SortOrder } from '#services/search_service'
 import { expandCategories } from '#lib/newznab/index'
 
@@ -14,13 +15,16 @@ function megabytes(value: unknown): number | undefined {
 /** The catalog for the web interface (REBUILD.md, part 9). */
 export default class ReleasesController {
   /** GET /api/v1/releases?q=&cat=5000,2040&readable=1&complete=1&unlocked=1&min_size=&max_size=(MB)&source=&poster=&sort=&page=&per_page= */
-  async index({ request }: HttpContext) {
-    const qs = request.qs()
+  async index(ctx: HttpContext) {
+    const qs = ctx.request.qs()
+    const grant = await AccessService.authorize(ctx, qs.apikey)
+    await AccessService.charge(grant, 'api')
     const categories = String(qs.cat ?? '')
       .split(',')
       .map((c) => Number(c.trim()))
       .filter((c) => Number.isInteger(c) && c > 0)
     return SearchService.search({
+      maxAgeDays: AccessService.maxAgeDays(grant),
       q: typeof qs.q === 'string' ? qs.q : undefined,
       categories: categories.length ? expandCategories(categories) : undefined,
       readable: flag(qs.readable),
@@ -39,13 +43,20 @@ export default class ReleasesController {
   }
 
   /** GET /api/v1/releases/:id, with its files */
-  async show({ params, response }: HttpContext) {
-    const release = await SearchService.release(Number(params.id))
-    return release ?? response.notFound({ error: 'Release not found' })
+  async show(ctx: HttpContext) {
+    const grant = await AccessService.authorize(ctx, ctx.request.qs().apikey)
+    if (!(await AccessService.checkRelease(grant, Number(ctx.params.id)))) return ctx.response.notFound({ error: 'Release not found' })
+    await AccessService.charge(grant, 'api')
+    const release = await SearchService.release(Number(ctx.params.id))
+    return release ?? ctx.response.notFound({ error: 'Release not found' })
   }
 
-  /** GET /api/v1/releases/:id/nzb */
-  async nzb({ params, response }: HttpContext) {
+  /** GET /api/v1/releases/:id/nzb (?apikey= for a plain link, as the web interface's) */
+  async nzb(ctx: HttpContext) {
+    const { params, response } = ctx
+    const grant = await AccessService.authorize(ctx, ctx.request.qs().apikey)
+    if (!(await AccessService.checkRelease(grant, Number(params.id)))) return response.notFound({ error: 'Release not found' })
+    await AccessService.charge(grant, 'grab')
     const nzb = await NzbService.build(Number(params.id))
     if (!nzb) return response.notFound({ error: 'Release not found' })
     const filename = `${nzb.name.replace(/[^\w.\-()[\] ]+/g, '_').slice(0, 180) || 'release'}.nzb`
@@ -54,7 +65,12 @@ export default class ReleasesController {
     return response.send(nzb.xml)
   }
 
-  /** GET /api/v1/stats */
+  /** GET /api/v1/access: whether the web interface needs an account, and how one is made. */
+  async access() {
+    return { mode: AccessService.mode, signup: AccessService.signup }
+  }
+
+  /** GET /api/v1/stats (open: what the index holds, not what's in it) */
   async stats() {
     return SearchService.stats()
   }