fix: post-filter rating check was gated behind blockUnrated flag

Critical bug: postFilterDiscoverMovies and postFilterDiscoverTv had an early return that only ran the rating post-filter when blockUnrated was enabled. Routes like /trending that lack TMDB certification.lte pre-filter rely entirely on post-filtering, so R-rated movies and TV-MA shows passed through unfiltered when a user had a max rating set but blockUnrated was false.

Fixes: postFilterDiscoverMovies runs when maxMovieRating OR blockUnrated is set. postFilterDiscoverTv runs when maxTvRating OR blockUnrated is set. filterMovieBatch and filterTvBatch use actual limits.blockUnrated instead of hardcoded true.

Author: mcfalld

server/routes/discover.ts

@@ -9,9 +9,9 @@ import type {
 import type { UserContentRatingLimits } from '@server/constants/contentRatings';
 import {
   MOVIE_RATINGS,
+  UNRATED_VALUES,
   shouldFilterMovie,
   shouldFilterTv,
-  UNRATED_VALUES,
   type MovieRating,
 } from '@server/constants/contentRatings';
 import { MediaType } from '@server/constants/media';
@@ -45,15 +45,15 @@ export const createTmdbWithRegionLanguage = (user?: User): TheMovieDb => {
     user?.settings?.streamingRegion === 'all'
       ? ''
       : user?.settings?.streamingRegion
-      ? user?.settings?.streamingRegion
-      : settings.main.discoverRegion;
+        ? user?.settings?.streamingRegion
+        : settings.main.discoverRegion;
 
   const originalLanguage =
     user?.settings?.originalLanguage === 'all'
       ? ''
       : user?.settings?.originalLanguage
-      ? user?.settings?.originalLanguage
-      : settings.main.originalLanguage;
+        ? user?.settings?.originalLanguage
+        : settings.main.originalLanguage;
 
   return new TheMovieDb({
     discoverRegion,
@@ -213,7 +213,7 @@ const filterMovieBatch = async (
   for (const outcome of settled) {
     if (outcome.status !== 'fulfilled') continue;
     const { movie, cert, title } = outcome.value;
-    if (!shouldFilterMovie(cert, limits.maxMovieRating, true)) {
+    if (!shouldFilterMovie(cert, limits.maxMovieRating, limits.blockUnrated)) {
       filtered.push(movie);
     } else {
       logger.debug('Blocked movie by rating (post-filter)', {
@@ -239,7 +239,7 @@ const postFilterDiscoverMovies = async (
     ? results.filter((movie) => !movie.adult)
     : results;
 
-  if (!limits.blockUnrated) return filtered;
+  if (!limits.blockUnrated && !limits.maxMovieRating) return filtered;
 
   filtered = await filterMovieBatch(filtered, tmdb, limits);
 
@@ -277,7 +277,7 @@ const filterTvBatch = async (
   for (const outcome of settled) {
     if (outcome.status !== 'fulfilled') continue;
     const { show, cert, title } = outcome.value;
-    if (!shouldFilterTv(cert, limits.maxTvRating, true)) {
+    if (!shouldFilterTv(cert, limits.maxTvRating, limits.blockUnrated)) {
       filtered.push(show);
     } else {
       logger.debug('Blocked TV show by rating (post-filter)', {
@@ -298,7 +298,7 @@ const postFilterDiscoverTv = async (
   limits: UserContentRatingLimits,
   fetchNextPage?: () => Promise<TmdbTvResult[] | null>
 ): Promise<TmdbTvResult[]> => {
-  if (!limits.blockUnrated) return results;
+  if (!limits.blockUnrated && !limits.maxTvRating) return results;
 
   const filtered = await filterTvBatch(results, tmdb, limits);
 
@@ -858,9 +858,8 @@ discoverRoutes.get('/tv', async (req, res, next) => {
       ratingLimits,
       tvPage < data.total_pages
         ? async () =>
-            (
-              await tmdb.getDiscoverTv({ page: tvPage + 1, ...tvDiscoverOpts })
-            ).results
+            (await tmdb.getDiscoverTv({ page: tvPage + 1, ...tvDiscoverOpts }))
+              .results
         : undefined
     );
 
@@ -1294,16 +1293,16 @@ discoverRoutes.get('/trending', async (req, res, next) => {
               )
             )
           : isPerson(result)
-          ? mapPersonResult(result)
-          : isCollection(result)
-          ? mapCollectionResult(result)
-          : mapTvResult(
-              result,
-              media.find(
-                (med) =>
-                  med.tmdbId === result.id && med.mediaType === MediaType.TV
-              )
-            )
+            ? mapPersonResult(result)
+            : isCollection(result)
+              ? mapCollectionResult(result)
+              : mapTvResult(
+                  result,
+                  media.find(
+                    (med) =>
+                      med.tmdbId === result.id && med.mediaType === MediaType.TV
+                  )
+                )
       ),
     });
   } catch (e) {