remote/navidrome
1
0
Fork 0
mirror of https://github.com/navidrome/navidrome.git synced 2026-10-29 14:37:49 +01:00
Code Issues Projects Releases Packages Wiki Activity

feat(api): restrict access to library and config endpoints to admin users

Browse source 
Signed-off-by: Deluan <deluan@navidrome.org>
This commit is contained in:
Deluan 2025-06-06 14:54:28 -04:00
commit 7dce0da557
5 changed files with 178 additions and 110 deletions
Download patch file Download diff file Expand all files Collapse all files

15
server/nativeapi/library.go
View file

@ -11,13 +11,11 @@ import (
"github.com/go-chi/chi/v5"
"github.com/navidrome/navidrome/log"
"github.com/navidrome/navidrome/model"
"github.com/navidrome/navidrome/model/request"
)
// Library management endpoints (admin only)
func (n *Router) addLibraryRoute(r chi.Router) {
r.Route("/library", func(r chi.Router) {
r.Use(adminOnlyMiddleware)
r.Get("/", getLibraries(n.ds))
r.Post("/", createLibrary(n.ds))
r.Route("/{id}", func(r chi.Router) {
@ -32,25 +30,12 @@ func (n *Router) addLibraryRoute(r chi.Router) {
// User-library association endpoints (admin only)
func (n *Router) addUserLibraryRoute(r chi.Router) {
r.Route("/user/{id}/library", func(r chi.Router) {
r.Use(adminOnlyMiddleware)
r.Use(parseUserIDMiddleware)
r.Get("/", getUserLibraries(n.ds))
r.Put("/", setUserLibraries(n.ds))
})
}
// Middleware to ensure only admin users can access endpoints
func adminOnlyMiddleware(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
user, ok := request.UserFrom(r.Context())
if !ok || !user.IsAdmin {
http.Error(w, "Access denied: admin privileges required", http.StatusForbidden)
return
}
next.ServeHTTP(w, r)
})
}
// Middleware to parse library ID from URL
func parseIDMiddleware(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {