From d9527177b072afa3d710d5c2d2d87530c68f5a7c Mon Sep 17 00:00:00 2001
From: DoctorDalek1963 <dyson.dyson@icloud.com>
Date: Thu, 6 Nov 2025 20:35:14 +0000
Subject: [PATCH] Use POST for hide/unhide

---
 client/components/app/BookShelfToolbar.vue |  6 +++--
 server/controllers/MeController.js         | 23 +++--------------
 server/models/User.js                      | 30 ++++++++--------------
 server/routers/ApiRouter.js                |  3 +--
 4 files changed, 19 insertions(+), 43 deletions(-)

diff --git a/client/components/app/BookShelfToolbar.vue b/client/components/app/BookShelfToolbar.vue
index 70149eef7..e6f122e52 100644
--- a/client/components/app/BookShelfToolbar.vue
+++ b/client/components/app/BookShelfToolbar.vue
@@ -588,9 +588,11 @@ export default {
         callback: (confirmed) => {
           if (confirmed) {
             this.processingSeries = true
-            const endpoint = newIsHidden ? 'hide' : 'unhide'
+            const payload = {
+              makeHidden: newIsHidden
+            }
             this.$axios
-              .$get(`/api/me/series/${this.seriesId}/${endpoint}`)
+              .$post(`/api/me/series/${this.seriesId}/hide`, payload)
               .then(() => {
                 this.$toast.success(this.$strings.ToastSeriesUpdateSuccess)
               })
diff --git a/server/controllers/MeController.js b/server/controllers/MeController.js
index a2328bc8c..d6c28b706 100644
--- a/server/controllers/MeController.js
+++ b/server/controllers/MeController.js
@@ -382,7 +382,7 @@ class MeController {
   }
 
   /**
-   * GET: /api/me/series/:id/hide
+   * POST: /api/me/series/:id/hide
    *
    * @param {RequestWithUser} req
    * @param {Response} res
@@ -393,26 +393,9 @@ class MeController {
       return res.sendStatus(404)
     }
 
-    const hasUpdated = await req.user.hideSeries(req.params.id)
-    if (hasUpdated) {
-      SocketAuthority.clientEmitter(req.user.id, 'user_updated', req.user.toOldJSONForBrowser())
-    }
-    res.json(req.user.toOldJSONForBrowser())
-  }
+    const { makeHidden } = req.body
 
-  /**
-   * GET: /api/me/series/:id/unhide
-   *
-   * @param {RequestWithUser} req
-   * @param {Response} res
-   */
-  async unhideSeries(req, res) {
-    if (!(await Database.seriesModel.checkExistsById(req.params.id))) {
-      Logger.error(`[MeController] unhideSeries: Series ${req.params.id} not found`)
-      return res.sendStatus(404)
-    }
-
-    const hasUpdated = await req.user.unhideSeries(req.params.id)
+    const hasUpdated = await req.user.hideSeries(req.params.id, makeHidden)
     if (hasUpdated) {
       SocketAuthority.clientEmitter(req.user.id, 'user_updated', req.user.toOldJSONForBrowser())
     }
diff --git a/server/models/User.js b/server/models/User.js
index c4d0e8d48..197c286a2 100644
--- a/server/models/User.js
+++ b/server/models/User.js
@@ -943,29 +943,21 @@ class User extends Model {
   /**
    *
    * @param {string} seriesId
+   * @param {boolean} makeHidden
    * @returns {Promise<boolean>}
    */
-  async hideSeries(seriesId) {
-    if (!this.extraData) this.extraData = {}
-    const hiddenSeries = this.extraData.hiddenSeries || []
-    if (hiddenSeries.includes(seriesId)) return false
-    hiddenSeries.push(seriesId)
-    this.extraData.hiddenSeries = hiddenSeries
-    this.changed('extraData', true)
-    await this.save()
-    return true
-  }
-
-  /**
-   *
-   * @param {string} seriesId
-   * @returns {Promise<boolean>}
-   */
-  async unhideSeries(seriesId) {
+  async hideSeries(seriesId, makeHidden) {
     if (!this.extraData) this.extraData = {}
     let hiddenSeries = this.extraData.hiddenSeries || []
-    if (!hiddenSeries.includes(seriesId)) return false
-    hiddenSeries = hiddenSeries.filter((sid) => sid !== seriesId)
+
+    if (makeHidden) {
+      if (hiddenSeries.includes(seriesId)) return false
+      hiddenSeries.push(seriesId)
+    } else {
+      if (!hiddenSeries.includes(seriesId)) return false
+      hiddenSeries = hiddenSeries.filter((sid) => sid !== seriesId)
+    }
+
     this.extraData.hiddenSeries = hiddenSeries
     this.changed('extraData', true)
     await this.save()
diff --git a/server/routers/ApiRouter.js b/server/routers/ApiRouter.js
index 4b644d920..bc0a2485f 100644
--- a/server/routers/ApiRouter.js
+++ b/server/routers/ApiRouter.js
@@ -186,8 +186,7 @@ class ApiRouter {
     this.router.get('/me/items-in-progress', MeController.getAllLibraryItemsInProgress.bind(this))
     this.router.get('/me/series/:id/remove-from-continue-listening', MeController.removeSeriesFromContinueListening.bind(this))
     this.router.get('/me/series/:id/readd-to-continue-listening', MeController.readdSeriesFromContinueListening.bind(this))
-    this.router.get('/me/series/:id/hide', MeController.hideSeries.bind(this))
-    this.router.get('/me/series/:id/unhide', MeController.unhideSeries.bind(this))
+    this.router.post('/me/series/:id/hide', MeController.hideSeries.bind(this))
     this.router.get('/me/stats/year/:year', MeController.getStatsForYear.bind(this))
     this.router.post('/me/ereader-devices', MeController.updateUserEReaderDevices.bind(this))