GET /settings/plex/library disables all libraries when called without ?enable= #3308

Description

GET /api/v1/settings/plex/library turns off every one of your Plex libraries if you call it without an enable param. It's a GET, and it writes to settings.

server/routes/settings/index.ts:246-253 on develop:

const enabledLibraries = req.query.enable
  ? (req.query.enable as string).split(',')
  : [];
settings.plex.libraries = settings.plex.libraries.map((library) => ({
  ...library,
  enabled: enabledLibraries.includes(library.id),
}));
await settings.save();

No enable means enabledLibraries is [], so includes() is false for
everything and all your libraries get written back as enabled: false.

I hit this while poking at the API for the memory stuff in #3307. All I wanted was to read back which libraries were on. Instead it silently disabled Plex scanning, and I didn't notice for about 9 hours. What tipped me off was the scheduled full scan "completing" in 86ms:

2026-07-29T09:00:00.086Z [info][Plex Scan]: Full Scan Complete

Nothing in the logs says anything got disabled, so if you aren't watching for it you just quietly stop scanning.

Same thing in the Jellyfin route at server/routes/settings/index.ts:385-392.

The UI always sends enable, so you won't hit this clicking around. It's only a problem if anything else talks to the API, which is why I think it's worth fixing rather than just documenting.

Version

3.4.0 (commit 2dbe8860179e83ed2044d5fc8ed17679ae05e5ad), also present on develop

Steps to Reproduce

1. Settings > Plex, turn on one or more libraries.
2. curl -H "X-Api-Key: $KEY" http://localhost:5055/api/v1/settings/plex/library
3. Look at the response, or reload the settings page. Everything is off now.
4. To get back where you were: .../plex/library?enable=<comma separated ids>

Screenshots

n/a

Logs

before:
["Kids' Movies=false","Movies=true","Kids' TV Shows=false","TV Shows=true","Home Movies=false"]

after a plain GET with no enable param:
["Kids' Movies=false","Movies=false","Kids' TV Shows=false","TV Shows=false","Home Movies=false"]

next scheduled full scan, having nothing to scan:
2026-07-29T09:00:00.086Z [info][Plex Scan]: Full Scan Complete

Platform

desktop

Database

SQLite (default)

Device

Beelink mini PC, Proxmox, docker in an LXC

Operating System

Debian 12 (LXC), Docker 29.6.1, Node 22.22.2

Browser

Firefox

Additional Context

Not sure what you'd prefer here, so just flagging the options I can see. Only applying the enable/disable when req.query.enable is actually present would fix it without breaking the UI, since the UI always sends the param. Moving the mutation to POST/PUT would be the tidier fix but it's a breaking API change.

Happy to put up a PR for the first one if that's the direction you want.

AI disclosure: I used an AI assistant while looking into this and writing it up. I hit the bug on my own instance, confirmed the behaviour myself, and checked the code above on develop.

Search Existing Issues

• Yes, I have searched existing issues.
  Went through the open ones and couldn't find this. Related only in that I ran
  into it while working on Library scans blow out the V8 heap and kill the process (still happens at mem_limit 1g) #3307.

Code of Conduct

• I agree to follow Seerr's Code of Conduct