From f982166028105ee2cc844a6b031402a9b5f947ad Mon Sep 17 00:00:00 2001
From: Florian <52180080+florianjs@users.noreply.github.com>
Date: Thu, 8 Jan 2026 09:00:04 +0100
Subject: [PATCH] Add torrent edit/delete, favicon upload, gitignore sync check

---
 .gitignore                                |   9 +
 .gitignore.public                         |   9 +
 README.md                                 |  15 +-
 app/components/EditTorrentModal.vue       | 437 ++++++++++++++++++++++
 app/pages/torrents/[hash].vue             | 181 ++++++++-
 package.json                              |   2 +-
 server/api/torrents/[hash].delete.ts      |  22 +-
 server/api/torrents/[hash]/index.patch.ts | 112 ++++++
 8 files changed, 761 insertions(+), 26 deletions(-)
 create mode 100644 app/components/EditTorrentModal.vue
 create mode 100644 server/api/torrents/[hash]/index.patch.ts

diff --git a/.gitignore b/.gitignore
index 95fd55f..edaab24 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,6 +4,10 @@
 .nuxt
 .nitro
 .cache
+.dev-test
+.dev-downloads
+.vitepress/cache
+doc/node_modules
 dist
 
 # Agents
@@ -22,6 +26,11 @@ logs
 .fleet
 .idea
 
+# Secrets
+CREDENTIALS.txt
+secrets/
+docker/pgbouncer/userlist.txt
+
 # Local env files
 .env
 .env.*
diff --git a/.gitignore.public b/.gitignore.public
index 95fd55f..edaab24 100644
--- a/.gitignore.public
+++ b/.gitignore.public
@@ -4,6 +4,10 @@
 .nuxt
 .nitro
 .cache
+.dev-test
+.dev-downloads
+.vitepress/cache
+doc/node_modules
 dist
 
 # Agents
@@ -22,6 +26,11 @@ logs
 .fleet
 .idea
 
+# Secrets
+CREDENTIALS.txt
+secrets/
+docker/pgbouncer/userlist.txt
+
 # Local env files
 .env
 .env.*
diff --git a/README.md b/README.md
index 0ad7a8c..a1d2371 100644
--- a/README.md
+++ b/README.md
@@ -391,18 +391,6 @@ Trackarr is built on the shoulders of giants. We'd like to thank the following o
 
 ---
 
----
-
----
-
----
-
----
-
----
-
----
-
 <!-- CONTRIBUTORS:START -->
 
 ## 👥 Contributors
@@ -411,7 +399,8 @@ Thanks to all our contributors! Sorted by number of commits.
 
 |                                                      Avatar                                                       | Contributor                             | Commits |
 | :---------------------------------------------------------------------------------------------------------------: | --------------------------------------- | :-----: |
-| <img src="https://avatars.githubusercontent.com/u/64362443?v=4" width="40" height="40" style="border-radius:50%"> | **[IkiaeM](https://github.com/IkiaeM)** |    2    |
+| <img src="https://avatars.githubusercontent.com/u/50747004?v=4" width="40" height="40" style="border-radius:50%"> | **[Dim145](https://github.com/Dim145)** |    4    |
+| <img src="https://avatars.githubusercontent.com/u/64362443?v=4" width="40" height="40" style="border-radius:50%"> | **[IkiaeM](https://github.com/IkiaeM)** |    4    |
 
 <!-- CONTRIBUTORS:END -->
 
diff --git a/app/components/EditTorrentModal.vue b/app/components/EditTorrentModal.vue
new file mode 100644
index 0000000..529c085
--- /dev/null
+++ b/app/components/EditTorrentModal.vue
@@ -0,0 +1,437 @@
+<template>
+  <Teleport to="body">
+    <div
+      v-if="isOpen"
+      class="fixed inset-0 z-50 flex items-center justify-center bg-black/60 backdrop-blur-sm"
+      @click.self="close"
+    >
+      <div
+        class="bg-bg-secondary border border-border rounded shadow-2xl w-full max-w-md mx-4 overflow-hidden"
+      >
+        <!-- Header -->
+        <div
+          class="flex items-center justify-between px-4 py-3 border-b border-border bg-bg-tertiary/50"
+        >
+          <div class="flex items-center gap-2">
+            <Icon name="ph:pencil-simple-bold" class="text-text-muted" />
+            <h3
+              class="text-xs font-bold uppercase tracking-widest text-text-primary"
+            >
+              Edit Torrent
+            </h3>
+          </div>
+          <button
+            class="text-text-muted hover:text-white transition-colors"
+            @click="close"
+          >
+            <Icon name="ph:x-bold" />
+          </button>
+        </div>
+
+        <!-- Body -->
+        <div class="p-6 space-y-6">
+          <!-- Torrent Name (read-only) -->
+          <div class="space-y-2">
+            <label
+              class="text-[10px] font-bold uppercase tracking-widest text-text-muted ml-1"
+              >Torrent Name</label
+            >
+            <div
+              class="input w-full !py-2 text-xs font-medium bg-bg-tertiary/50 text-text-secondary cursor-not-allowed"
+            >
+              {{ torrent.name }}
+            </div>
+          </div>
+
+          <!-- Category Select -->
+          <div class="space-y-2">
+            <label
+              class="text-[10px] font-bold uppercase tracking-widest text-text-muted ml-1"
+              >Category</label
+            >
+            <select
+              v-model="selectedCategoryId"
+              class="input w-full !py-2 text-xs font-bold uppercase tracking-wider"
+            >
+              <option value="">No category</option>
+              <option
+                v-for="cat in getFlattenedCategories(categories || [])"
+                :key="cat.id"
+                :value="cat.id"
+              >
+                {{ cat.name }}
+              </option>
+            </select>
+          </div>
+
+          <!-- Description -->
+          <div class="space-y-2">
+            <div class="flex items-center justify-between ml-1">
+              <label
+                class="text-[10px] font-bold uppercase tracking-widest text-text-muted"
+                >Description (Markdown)</label
+              >
+              <button
+                type="button"
+                class="text-[10px] font-bold uppercase tracking-widest transition-colors"
+                :class="
+                  isPreview ? 'text-white' : 'text-text-muted hover:text-white'
+                "
+                @click="isPreview = !isPreview"
+              >
+                {{ isPreview ? 'Edit' : 'Preview' }}
+              </button>
+            </div>
+
+            <div v-if="!isPreview" class="space-y-0">
+              <!-- Toolbar -->
+              <div
+                class="flex items-center gap-1 p-1 bg-bg-tertiary border border-border rounded-t-sm border-b-0"
+              >
+                <button
+                  type="button"
+                  class="toolbar-btn"
+                  title="Bold"
+                  @click="insertMarkdown('bold')"
+                >
+                  <Icon name="ph:text-b-bold" />
+                </button>
+                <button
+                  type="button"
+                  class="toolbar-btn"
+                  title="Italic"
+                  @click="insertMarkdown('italic')"
+                >
+                  <Icon name="ph:text-italic-bold" />
+                </button>
+                <div class="w-px h-3 bg-border mx-1"></div>
+                <button
+                  type="button"
+                  class="toolbar-btn"
+                  title="Link"
+                  @click="insertMarkdown('link')"
+                >
+                  <Icon name="ph:link-bold" />
+                </button>
+                <button
+                  type="button"
+                  class="toolbar-btn"
+                  title="Image"
+                  @click="insertMarkdown('image')"
+                >
+                  <Icon name="ph:image-bold" />
+                </button>
+                <div class="w-px h-3 bg-border mx-1"></div>
+                <button
+                  type="button"
+                  class="toolbar-btn"
+                  title="List"
+                  @click="insertMarkdown('list')"
+                >
+                  <Icon name="ph:list-bullets-bold" />
+                </button>
+                <button
+                  type="button"
+                  class="toolbar-btn"
+                  title="Quote"
+                  @click="insertMarkdown('quote')"
+                >
+                  <Icon name="ph:quotes-bold" />
+                </button>
+                <button
+                  type="button"
+                  class="toolbar-btn"
+                  title="Code"
+                  @click="insertMarkdown('code')"
+                >
+                  <Icon name="ph:code-bold" />
+                </button>
+              </div>
+              <textarea
+                ref="textareaRef"
+                v-model="description"
+                rows="6"
+                class="input w-full !py-2 text-xs font-medium resize-none rounded-t-none"
+                placeholder="Enter torrent description, images, etc..."
+              ></textarea>
+            </div>
+
+            <div
+              v-else
+              class="input w-full min-h-[158px] !py-3 text-xs overflow-y-auto bg-bg-primary/50"
+            >
+              <div
+                v-if="description"
+                class="prose prose-invert prose-xs max-w-none description-preview"
+                v-html="renderedDescription"
+              ></div>
+              <div v-else class="text-text-muted italic text-[10px]">
+                Nothing to preview
+              </div>
+            </div>
+          </div>
+
+          <!-- Error Message -->
+          <div
+            v-if="error"
+            class="bg-error/10 border border-error/20 rounded p-3 flex items-start gap-2"
+          >
+            <Icon
+              name="ph:warning-circle-fill"
+              class="text-error text-lg shrink-0 mt-0.5"
+            />
+            <p class="text-xs text-error">{{ error }}</p>
+          </div>
+
+          <!-- Actions -->
+          <div class="flex gap-2">
+            <button
+              class="btn btn-secondary flex-1 text-[10px] font-bold uppercase tracking-widest"
+              :disabled="isSaving"
+              @click="close"
+            >
+              Cancel
+            </button>
+            <button
+              class="btn btn-primary flex-1 text-[10px] font-bold uppercase tracking-widest flex items-center justify-center gap-2"
+              :disabled="isSaving"
+              @click="save"
+            >
+              <Icon
+                v-if="isSaving"
+                name="ph:circle-notch"
+                class="animate-spin"
+              />
+              <span>{{ isSaving ? 'Saving...' : 'Save Changes' }}</span>
+            </button>
+          </div>
+        </div>
+      </div>
+    </div>
+  </Teleport>
+</template>
+
+<script setup lang="ts">
+import { marked } from 'marked';
+
+interface Category {
+  id: string;
+  name: string;
+  subcategories?: Category[];
+}
+
+interface TorrentData {
+  infoHash: string;
+  name: string;
+  description: string | null;
+  categoryId: string | null;
+}
+
+const props = defineProps<{
+  isOpen: boolean;
+  torrent: TorrentData;
+}>();
+
+const emit = defineEmits<{
+  close: [];
+  saved: [];
+}>();
+
+const textareaRef = ref<HTMLTextAreaElement | null>(null);
+const selectedCategoryId = ref('');
+const description = ref('');
+const isPreview = ref(false);
+const isSaving = ref(false);
+const error = ref<string | null>(null);
+
+const { data: categories } = await useFetch<Category[]>('/api/categories');
+
+const renderedDescription = computed(() => {
+  return marked.parse(description.value || '');
+});
+
+// Initialize form data when torrent prop changes
+watch(
+  () => props.torrent,
+  (torrent) => {
+    if (torrent) {
+      selectedCategoryId.value = torrent.categoryId || '';
+      description.value = torrent.description || '';
+    }
+  },
+  { immediate: true }
+);
+
+// Reset form when modal opens
+watch(
+  () => props.isOpen,
+  (isOpen) => {
+    if (isOpen && props.torrent) {
+      selectedCategoryId.value = props.torrent.categoryId || '';
+      description.value = props.torrent.description || '';
+      isPreview.value = false;
+      error.value = null;
+    }
+  }
+);
+
+function getFlattenedCategories(
+  categories: Category[],
+  prefix = ''
+): Array<{ id: string; name: string }> {
+  let result: Array<{ id: string; name: string }> = [];
+
+  for (const category of categories) {
+    result.push({ id: category.id, name: prefix + category.name });
+
+    if (category.subcategories) {
+      result = result.concat(
+        getFlattenedCategories(category.subcategories, prefix + '╚=> ')
+      );
+    }
+  }
+
+  return result;
+}
+
+function close() {
+  emit('close');
+}
+
+function insertMarkdown(type: string) {
+  if (!textareaRef.value) return;
+
+  const start = textareaRef.value.selectionStart;
+  const end = textareaRef.value.selectionEnd;
+  const text = description.value;
+  const selected = text.substring(start, end);
+
+  let before = '';
+  let after = '';
+  let placeholder = '';
+
+  switch (type) {
+    case 'bold':
+      before = '**';
+      after = '**';
+      placeholder = 'bold text';
+      break;
+    case 'italic':
+      before = '*';
+      after = '*';
+      placeholder = 'italic text';
+      break;
+    case 'link':
+      before = '[';
+      after = '](url)';
+      placeholder = 'link text';
+      break;
+    case 'image':
+      before = '![';
+      after = '](url)';
+      placeholder = 'alt text';
+      break;
+    case 'list':
+      before = '\n- ';
+      after = '';
+      placeholder = 'list item';
+      break;
+    case 'quote':
+      before = '\n> ';
+      after = '';
+      placeholder = 'quote';
+      break;
+    case 'code':
+      before = '`';
+      after = '`';
+      placeholder = 'code';
+      break;
+  }
+
+  const content = selected || placeholder;
+  description.value =
+    text.substring(0, start) + before + content + after + text.substring(end);
+
+  // Focus back and select
+  nextTick(() => {
+    if (!textareaRef.value) return;
+    textareaRef.value.focus();
+    const newStart = start + before.length;
+    const newEnd = newStart + content.length;
+    textareaRef.value.setSelectionRange(newStart, newEnd);
+  });
+}
+
+async function save() {
+  isSaving.value = true;
+  error.value = null;
+
+  try {
+    await fetch(`/api/torrents/${props.torrent.infoHash}`, {
+      method: 'PATCH',
+      headers: {
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({
+        description: description.value,
+        categoryId: selectedCategoryId.value || null,
+      }),
+    }).then(async (res) => {
+      if (!res.ok) {
+        const data = await res.json().catch(() => ({}));
+        throw new Error(data.message || 'Failed to save changes');
+      }
+      return res.json();
+    });
+
+    emit('saved');
+    close();
+  } catch (err: unknown) {
+    const fetchError = err as { message?: string };
+    error.value = fetchError.message || 'Failed to save changes';
+  } finally {
+    isSaving.value = false;
+  }
+}
+</script>
+
+<style scoped>
+.toolbar-btn {
+  @apply w-7 h-7 flex items-center justify-center rounded-sm text-text-muted hover:text-white hover:bg-white/5 transition-all;
+}
+
+.toolbar-btn :deep(svg) {
+  @apply w-3.5 h-3.5;
+}
+
+.description-preview :deep(img) {
+  max-width: 100%;
+  height: auto;
+  border-radius: 2px;
+  border: 1px solid rgba(255, 255, 255, 0.1);
+}
+
+.description-preview :deep(p) {
+  margin-bottom: 0.75rem;
+}
+
+.description-preview :deep(p:last-child) {
+  margin-bottom: 0;
+}
+
+.description-preview :deep(a) {
+  color: #fff;
+  text-decoration: underline;
+  text-underline-offset: 2px;
+}
+
+.description-preview :deep(ul),
+.description-preview :deep(ol) {
+  margin-bottom: 0.75rem;
+  padding-left: 1.25rem;
+}
+
+.description-preview :deep(li) {
+  margin-bottom: 0.25rem;
+}
+</style>
diff --git a/app/pages/torrents/[hash].vue b/app/pages/torrents/[hash].vue
index ce6293e..9e64384 100644
--- a/app/pages/torrents/[hash].vue
+++ b/app/pages/torrents/[hash].vue
@@ -27,8 +27,34 @@
             <h2 class="text-2xl font-bold text-text-primary tracking-tight">
               {{ torrent.name }}
             </h2>
+            <!-- Category Badge -->
+            <div v-if="torrent.category" class="mt-2">
+              <span
+                class="text-[10px] font-bold bg-bg-tertiary border border-border px-2 py-1 rounded-sm text-text-secondary uppercase tracking-wider"
+              >
+                {{ torrent.category.name }}
+              </span>
+            </div>
           </div>
-          <div class="flex items-center gap-2">
+          <div class="flex items-center gap-2 flex-wrap">
+            <!-- Edit Button (owner/mod/admin only) -->
+            <button
+              v-if="canEdit"
+              class="btn btn-secondary flex items-center gap-2 !py-2 text-xs font-bold uppercase tracking-wider"
+              @click="showEditModal = true"
+            >
+              <Icon name="ph:pencil-simple-bold" />
+              <span>Edit</span>
+            </button>
+            <!-- Delete Button (owner/mod/admin only) -->
+            <button
+              v-if="canDelete"
+              class="btn btn-secondary flex items-center gap-2 !py-2 text-xs font-bold uppercase tracking-wider text-error hover:bg-error/10"
+              @click="confirmDelete"
+            >
+              <Icon name="ph:trash-bold" />
+              <span>Delete</span>
+            </button>
             <button
               class="btn btn-secondary flex items-center gap-2 !py-2 text-xs font-bold uppercase tracking-wider"
               @click="copyHash"
@@ -157,9 +183,11 @@
                 No active peers detected in swarm
               </td>
             </tr>
-            <tr v-for="peer in torrent.peers" :key="`${peer.ip}:${peer.port}`">
+            <tr v-for="peer in torrent.peers" :key="peer.id">
               <td class="font-mono text-xs">
-                <span class="text-text-primary">{{ peer.ip }}</span>
+                <span class="text-text-muted"
+                  >{{ peer.id.slice(0, 12) }}...</span
+                >
                 <span class="text-text-muted">:{{ peer.port }}</span>
               </td>
               <td>
@@ -190,6 +218,73 @@
         </table>
       </div>
     </div>
+
+    <!-- Edit Modal -->
+    <EditTorrentModal
+      :is-open="showEditModal"
+      :torrent="editableTorrent"
+      @close="showEditModal = false"
+      @saved="handleSaved"
+    />
+
+    <!-- Delete Confirmation Dialog -->
+    <Teleport to="body">
+      <div
+        v-if="showDeleteConfirm"
+        class="fixed inset-0 z-50 flex items-center justify-center bg-black/60 backdrop-blur-sm"
+        @click.self="showDeleteConfirm = false"
+      >
+        <div
+          class="bg-bg-secondary border border-border rounded shadow-2xl w-full max-w-sm mx-4 overflow-hidden"
+        >
+          <div
+            class="flex items-center gap-2 px-4 py-3 border-b border-border bg-bg-tertiary/50"
+          >
+            <Icon name="ph:warning-circle-bold" class="text-error" />
+            <h3
+              class="text-xs font-bold uppercase tracking-widest text-text-primary"
+            >
+              Confirm Delete
+            </h3>
+          </div>
+          <div class="p-6">
+            <p class="text-sm text-text-secondary mb-4">
+              Are you sure you want to delete this torrent? This action cannot
+              be undone.
+            </p>
+            <p
+              class="text-xs font-mono text-text-muted bg-bg-tertiary p-2 rounded border border-border mb-6 truncate"
+            >
+              {{ torrent.name }}
+            </p>
+            <div v-if="deleteError" class="mb-4 text-xs text-error">
+              {{ deleteError }}
+            </div>
+            <div class="flex gap-2">
+              <button
+                class="btn btn-secondary flex-1 text-[10px] font-bold uppercase tracking-widest"
+                :disabled="isDeleting"
+                @click="showDeleteConfirm = false"
+              >
+                Cancel
+              </button>
+              <button
+                class="btn btn-primary flex-1 text-[10px] font-bold uppercase tracking-widest bg-error hover:bg-error/80 flex items-center justify-center gap-2"
+                :disabled="isDeleting"
+                @click="deleteTorrent"
+              >
+                <Icon
+                  v-if="isDeleting"
+                  name="ph:circle-notch"
+                  class="animate-spin"
+                />
+                <span>{{ isDeleting ? 'Deleting...' : 'Delete' }}</span>
+              </button>
+            </div>
+          </div>
+        </div>
+      </div>
+    </Teleport>
   </div>
 </template>
 
@@ -197,7 +292,7 @@
 import { marked } from 'marked';
 
 interface Peer {
-  ip: string;
+  id: string;
   port: number;
   isSeeder: boolean;
   uploaded: number;
@@ -205,12 +300,21 @@ interface Peer {
   lastSeen: string;
 }
 
+interface Category {
+  id: string;
+  name: string;
+  slug: string;
+}
+
 interface TorrentDetail {
   id: string;
   infoHash: string;
   name: string;
   size: number;
   description: string | null;
+  uploaderId: string | null;
+  categoryId: string | null;
+  category: Category | null;
   createdAt: string;
   stats: {
     seeders: number;
@@ -223,9 +327,41 @@ interface TorrentDetail {
 const route = useRoute();
 const hash = route.params.hash as string;
 
-const { data: torrent, error } = await useFetch<TorrentDetail>(
-  `/api/torrents/${hash}`
-);
+const {
+  data: torrent,
+  error,
+  refresh,
+} = await useFetch<TorrentDetail>(`/api/torrents/${hash}`);
+
+// Get current user session
+const { loggedIn, user } = useUserSession();
+
+// Edit/delete state
+const showEditModal = ref(false);
+const showDeleteConfirm = ref(false);
+const isDeleting = ref(false);
+const deleteError = ref<string | null>(null);
+
+// Compute permissions
+const canEdit = computed(() => {
+  if (!loggedIn.value || !user.value) return false;
+  const isOwner = torrent.value?.uploaderId === user.value.id;
+  return isOwner || user.value.isAdmin || user.value.isModerator;
+});
+
+const canDelete = computed(() => {
+  if (!loggedIn.value || !user.value) return false;
+  const isOwner = torrent.value?.uploaderId === user.value.id;
+  return isOwner || user.value.isAdmin || user.value.isModerator;
+});
+
+// Editable data for modal
+const editableTorrent = computed(() => ({
+  infoHash: torrent.value?.infoHash || '',
+  name: torrent.value?.name || '',
+  description: torrent.value?.description || null,
+  categoryId: torrent.value?.categoryId || null,
+}));
 
 const renderedDescription = computed(() => {
   if (!torrent.value?.description) return '';
@@ -239,6 +375,37 @@ if (error.value || !torrent.value) {
 async function copyHash() {
   await navigator.clipboard.writeText(torrent.value!.infoHash);
 }
+
+function confirmDelete() {
+  deleteError.value = null;
+  showDeleteConfirm.value = true;
+}
+
+async function deleteTorrent() {
+  isDeleting.value = true;
+  deleteError.value = null;
+
+  try {
+    await $fetch(`/api/torrents/${torrent.value!.infoHash}`, {
+      method: 'DELETE',
+    });
+    // Navigate back to torrents list
+    navigateTo('/torrents');
+  } catch (err: unknown) {
+    const fetchError = err as { data?: { message?: string }; message?: string };
+    deleteError.value =
+      fetchError.data?.message ||
+      fetchError.message ||
+      'Failed to delete torrent';
+  } finally {
+    isDeleting.value = false;
+  }
+}
+
+async function handleSaved() {
+  // Refresh torrent data
+  await refresh();
+}
 </script>
 
 <style scoped>
diff --git a/package.json b/package.json
index 27b25ce..d7b7042 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "trackarr",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "type": "module",
   "private": true,
   "scripts": {
diff --git a/server/api/torrents/[hash].delete.ts b/server/api/torrents/[hash].delete.ts
index f36e62c..22ef33a 100644
--- a/server/api/torrents/[hash].delete.ts
+++ b/server/api/torrents/[hash].delete.ts
@@ -1,20 +1,21 @@
 /**
  * DELETE /api/torrents/:hash
  * Delete a torrent from the tracker
+ * Owner, moderator, or admin can delete
  */
 import { eq } from 'drizzle-orm';
 import { db } from '../../db';
 import { torrents } from '../../db/schema';
 import { redis } from '../../redis/client';
-import { requireAdminSession } from '../../utils/adminAuth';
+import { requireAuthSession } from '../../utils/adminAuth';
 import { rateLimit, RATE_LIMITS } from '../../utils/rateLimit';
 
 export default defineEventHandler(async (event) => {
-  // Rate limit admin endpoints
-  rateLimit(event, RATE_LIMITS.admin);
+  // Rate limit mutations
+  rateLimit(event, RATE_LIMITS.mutation);
 
-  // Require admin authentication
-  await requireAdminSession(event);
+  // Require authentication
+  const { user } = await requireAuthSession(event);
 
   const hash = getRouterParam(event, 'hash');
 
@@ -39,6 +40,17 @@ export default defineEventHandler(async (event) => {
     });
   }
 
+  // Check permissions: owner, moderator, or admin
+  const isOwner = existing.uploaderId === user.id;
+  const canDelete = isOwner || user.isAdmin || user.isModerator;
+
+  if (!canDelete) {
+    throw createError({
+      statusCode: 403,
+      message: 'You do not have permission to delete this torrent',
+    });
+  }
+
   // Delete from PostgreSQL
   await db.delete(torrents).where(eq(torrents.infoHash, infoHash));
 
diff --git a/server/api/torrents/[hash]/index.patch.ts b/server/api/torrents/[hash]/index.patch.ts
new file mode 100644
index 0000000..7b27d1a
--- /dev/null
+++ b/server/api/torrents/[hash]/index.patch.ts
@@ -0,0 +1,112 @@
+/**
+ * PATCH /api/torrents/:hash
+ * Update torrent description and/or category
+ * Owner, moderator, or admin can edit
+ */
+import { eq } from 'drizzle-orm';
+import { db } from '../../../db';
+import { torrents, categories } from '../../../db/schema';
+import { requireAuthSession } from '../../../utils/adminAuth';
+import { rateLimit, RATE_LIMITS } from '../../../utils/rateLimit';
+
+export default defineEventHandler(async (event) => {
+  // Rate limit mutations
+  rateLimit(event, RATE_LIMITS.mutation);
+
+  // Require authentication
+  const { user } = await requireAuthSession(event);
+
+  const hash = getRouterParam(event, 'hash');
+
+  if (!hash) {
+    throw createError({
+      statusCode: 400,
+      message: 'Missing info hash',
+    });
+  }
+
+  const infoHash = hash.toLowerCase();
+
+  // Get the torrent
+  const existing = await db.query.torrents.findFirst({
+    where: eq(torrents.infoHash, infoHash),
+  });
+
+  if (!existing) {
+    throw createError({
+      statusCode: 404,
+      message: 'Torrent not found',
+    });
+  }
+
+  // Check permissions: owner, moderator, or admin
+  const isOwner = existing.uploaderId === user.id;
+  const canEdit = isOwner || user.isAdmin || user.isModerator;
+
+  if (!canEdit) {
+    throw createError({
+      statusCode: 403,
+      message: 'You do not have permission to edit this torrent',
+    });
+  }
+
+  // Read body
+  const body = await readBody(event);
+  const { description, categoryId } = body || {};
+
+  // Validate categoryId if provided
+  if (categoryId !== undefined && categoryId !== null && categoryId !== '') {
+    const categoryExists = await db.query.categories.findFirst({
+      where: eq(categories.id, categoryId),
+    });
+
+    if (!categoryExists) {
+      throw createError({
+        statusCode: 400,
+        message: 'Invalid category',
+      });
+    }
+  }
+
+  // Build update object
+  const updateData: {
+    description?: string | null;
+    categoryId?: string | null;
+  } = {};
+
+  if (description !== undefined) {
+    updateData.description = description || null;
+  }
+
+  if (categoryId !== undefined) {
+    updateData.categoryId = categoryId || null;
+  }
+
+  // Update the torrent
+  if (Object.keys(updateData).length > 0) {
+    await db
+      .update(torrents)
+      .set(updateData)
+      .where(eq(torrents.infoHash, infoHash));
+  }
+
+  // Fetch updated torrent
+  const updated = await db.query.torrents.findFirst({
+    where: eq(torrents.infoHash, infoHash),
+    with: {
+      category: true,
+    },
+  });
+
+  return {
+    success: true,
+    message: 'Torrent updated',
+    data: {
+      infoHash: updated!.infoHash,
+      name: updated!.name,
+      description: updated!.description,
+      categoryId: updated!.categoryId,
+      category: updated!.category,
+    },
+  };
+});