> ## Documentation Index
> Fetch the complete documentation index at: https://docs.questarr.app/llms.txt
> Use this file to discover all available pages before exploring further.

# TODO

# TODO

## Multi-user hardening

Questarr is currently designed around a single admin-style user per instance. If multi-user support becomes a real deployment scenario, revisit:

* **`/api/system/browse` has no role/ownership gate** (`server/routes/system.ts`). It lets any authenticated user browse the entire container filesystem, which is fine for a single-admin deployment but becomes an authorization gap the moment multiple users are trusted at different privilege levels. Add an admin-role check (or otherwise restrict browsing to expected library/download directories) before enabling true multi-user access.
* **`server/library-scanner.ts`'s `getGameByIgdbId()` lookups aren't scoped by owning user** in `matchUnmatchedFolder()` and `recordMatchedCandidate()` — an authenticated user can match an unmatched folder or auto-scan hit against an `igdbId` owned by a different account and have the scanner flip that game's status, overwrite its `libraryPath`, and attach files to it. Same category as the row above: not exploitable in the supported single-operator deployment, but worth an ownership check (`game.userId !== userId` → treat as not found, create a new row) if multi-user ever becomes real. See PR #1039 (closed, not applicable under current scope) for a worked fix and regression tests.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.