From 50f1249589669b083e12dae401c569fd55c84246 Mon Sep 17 00:00:00 2001
From: Florian <52180080+florianjs@users.noreply.github.com>
Date: Thu, 8 Jan 2026 16:00:11 +0100
Subject: [PATCH] Exclude Torznab API from session checks to fix Prowlarr
 redirect

---
 package.json                  | 2 +-
 server/middleware/security.ts | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package.json b/package.json
index 497264d..4315e0d 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "trackarr",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "type": "module",
   "private": true,
   "scripts": {
diff --git a/server/middleware/security.ts b/server/middleware/security.ts
index 85eac64..a594f78 100644
--- a/server/middleware/security.ts
+++ b/server/middleware/security.ts
@@ -229,8 +229,8 @@ export default defineEventHandler(async (event) => {
   }
 
   // 2. Check User Ban (for authenticated sessions)
-  // Skip for auth routes to avoid blocking login/logout
-  if (!path.startsWith('/api/auth/')) {
+  // Skip for auth routes and Torznab API (has its own passkey auth)
+  if (!path.startsWith('/api/auth/') && !path.startsWith('/api/torznab')) {
     const session = await getUserSession(event);
 
     if (session.user) {