[bakerboy448]

TLDR

Adds /api/v5/... endpoints next to the existing /api/v3/... ones in every Sonarr template, so consumers pointed at a Sonarr v5 through the proxy keep working when they move to the v5 API. v3 entries are unchanged.

Changes

• 23 files under root/app/www/public/templates/sonarr/: for each granted /api/v3/<path>, the same <path> and methods are granted under /api/v5/.
• No PHP changes. isAllowedEndpoint matches the request path against the template keys, so it needs no v5 awareness.

Testing

Built the image from this branch (starrproxy-v5test:local), ran it on 127.0.0.1:18080 with a fresh /config per template, backed by a throwaway Sonarr 5.0.0.2742 (ghcr.io/hotio/sonarr:nightly-5.0.0.2742) with a throwaway API key. Each template was registered through /api/addstarr, then every endpoint in the template was called with GET, POST, PUT, and DELETE using the scoped key.

Check	Expected	Actual
Granted method on each /api/v3 and /api/v5 endpoint	not 401 or 405	pass
Ungranted method on a granted endpoint	405	pass
Endpoint absent from the template	401	pass
autobrr: /api/v3/system/status, /api/v5/system/status, /api/v5/series	200	200, 200, 200 (body version 5.0.0.2742)
autobrr: /api/v5/rootfolder (not granted)	401	401
Recent merged fixes (#114, #115 tag endpoints, #118 addstarr starr_id)	still work	the autobrr tag and addstarr flow above passed

Result: 1851 checks, 1848 pass. The 3 mismatches are all the same case: cross-seed.json has a bare /api key (already on develop), and the script's POST/PUT/DELETE to /api got an nginx 404 instead of 405. No v5 key is involved.

Not run: websocket and revoked-key check, since no PHP changed. No new files, so no header check.

Notes

• Only v3 paths were mirrored. Paths that exist only in v5 are not added.
• The endpoint picker UI still reads the v3 OpenAPI file from the Sonarr repo, so v5-only endpoints are not offered there. Out of scope here.

🤖 Generated with Claude Code