remote/navidrome
1
0
Fork 0
mirror of https://github.com/navidrome/navidrome.git synced 2026-10-31 15:37:51 +01:00
Code Issues Projects Releases Packages Wiki Activity

feat(api): restrict access to library and config endpoints to admin users

Browse source 
Signed-off-by: Deluan <deluan@navidrome.org>
This commit is contained in:
Deluan 2025-06-06 14:54:28 -04:00
commit 7dce0da557
5 changed files with 178 additions and 110 deletions
Download patch file Download diff file Expand all files Collapse all files

24
server/nativeapi/native_api.go
View file

@ -16,6 +16,7 @@ import (
"github.com/navidrome/navidrome/core/metrics"
"github.com/navidrome/navidrome/log"
"github.com/navidrome/navidrome/model"
"github.com/navidrome/navidrome/model/request"
"github.com/navidrome/navidrome/server"
)
@ -62,12 +63,15 @@ func (n *Router) routes() http.Handler {
n.addSongPlaylistsRoute(r)
n.addQueueRoute(r)
n.addMissingFilesRoute(r)
n.addInspectRoute(r)
n.addConfigRoute(r)
n.addKeepAliveRoute(r)
n.addInsightsRoute(r)
n.addLibraryRoute(r)
n.addUserLibraryRoute(r)
r.With(adminOnlyMiddleware).Group(func(r chi.Router) {
n.addInspectRoute(r)
n.addConfigRoute(r)
n.addLibraryRoute(r)
n.addUserLibraryRoute(r)
})
})
return r
@ -229,3 +233,15 @@ func (n *Router) addInsightsRoute(r chi.Router) {
}
})
}
// Middleware to ensure only admin users can access endpoints
func adminOnlyMiddleware(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
user, ok := request.UserFrom(r.Context())
if !ok || !user.IsAdmin {
http.Error(w, "Access denied: admin privileges required", http.StatusForbidden)
return
}
next.ServeHTTP(w, r)
})
}