* fix(artwork): cap declared image dimensions before resizing
resizeStaticImage decoded the image with a raw image.Decode, so a small file declaring huge dimensions (e.g. a PNG header claiming 50k x 50k) forced a multi-gigabyte allocation on the serve-time resize path. The processor already guards its own decodes with decodeCapped; use it here too so the same 64M pixel cap applies to uploaded and sidecar images served through the cache.
* fix(share): validate every resource ID and reject mixed types when saving
Save only resolved the first ID in ResourceIDs to pick the resource type; the remaining IDs were never checked. A non-existent or hidden entity could ride along behind a valid first ID, and IDs of different kinds were accepted as one share. Resolve every ID as the current user and require all of them to be the same kind, returning ErrNotFound or ErrValidation otherwise.
* fix(share): scope album and media file shares to the owner's libraries
loadMedia already loaded artist and playlist shares as the share owner, but album and media_file shares used the repository context. Public share rendering carries no user, so the library filter was skipped and the share listed albums and tracks from libraries the owner cannot access. Streaming was already blocked, so only metadata leaked. Use ownerContext for all resource types.
* fix(server): limit login payload size and surface first-admin creation errors
The unauthenticated /login and /createAdmin handlers decoded the request body
with no size limit. Add a body-limit middleware to the /auth route group that
caps the payload at 8KiB, which is plenty for a username and password. Also
make createAdminUser return the datastore error instead of logging it and
returning nil, which previously let createAdmin proceed to a login attempt for
a user that was never saved.
* fix(conf): create the log file readable only by the owner
The log file was created with mode 0644, so other local users could read it. Logs can contain usernames, paths and, at trace level, request details, so create it with 0600 instead. Existing files keep their current mode.
* fix(lastfm): stop logging the auth token when fetching the session key fails
The Last.fm callback token was written to the log as a structured field on failure. The redaction hook only matches value patterns, so it was not masked. Drop the field; the request ID is enough to correlate the failure.
* fix(db): allow a music folder path containing a single quote on fresh databases
The library table migration interpolated conf.Server.MusicFolder into the SQL with fmt.Sprintf, so a path such as /music/Rock 'n' Roll produced invalid SQL and the migration failed on a brand new database. Bind the path as a parameter instead.
* fix(scanner): return an error when the folder watcher cannot start
When notify.Watch failed, the watcher goroutine logged the error and exited, but never signalled the started channel, so Start blocked until its context was cancelled and left the watching flag set. Call notify.Watch before spawning the event loop, so Start returns the error right away, the started/failed signalling goes away, and the storage can be watched again later.
* fix(jellyfin): limit the login request body size
The Jellyfin AuthenticateByName endpoint decoded its JSON body with no size limit, the same gap the native /auth routes had. Export the login body-limit middleware from the server package and apply it to the Jellyfin login route, before the optional per-IP rate limiter, so both unauthenticated login surfaces share the same 8KiB cap.
* fix(scanner): share one scanner instance across all injectors
Each wire injector built its own scanner controller, so the Subsonic and native API routers held a different instance from the ones used by the startup scan, the periodic scan, the folder watcher and the SIGUSR1 handler. Status reads the in-progress file and folder counters from its own instance, so getScanStatus reported scanning=true with count=0 for every scan not started through the API. Verified live with a startup scan: master reports count 0 while scanning, this branch reports the real counts. Expose the controller through a singleton, as the watcher, broker and play tracker already are, and wire everything to it. New stays available for tests that need isolated controllers.
* fix(share): do not panic when a media file share has no visible tracks
Share.CoverArtID picked a random track for media file shares without checking that any track was loaded. The tracks are empty when the files went missing, were deleted, or the owner lost access to their library, and the public share page then panicked inside the random pick and returned a 500. Return an empty artwork ID instead, so the page renders with the placeholder cover. The old guard on the split resource IDs was dead code, since SplitN always returns at least one element.
* feat(insights): initial code (WIP)
* feat(insights): add more info
* feat(insights): add fs info
* feat(insights): export insights.Data
Signed-off-by: Deluan <deluan@navidrome.org>
* feat(insights): more config info
Signed-off-by: Deluan <deluan@navidrome.org>
* refactor(insights): move data struct to its own package
Signed-off-by: Deluan <deluan@navidrome.org>
* refactor(insights): omit some attrs if empty
Signed-off-by: Deluan <deluan@navidrome.org>
* feat(insights): send insights to server, add option to disable
Signed-off-by: Deluan <deluan@navidrome.org>
* fix(insights): remove info about anonymous login
Signed-off-by: Deluan <deluan@navidrome.org>
* chore(insights): fix lint
Signed-off-by: Deluan <deluan@navidrome.org>
* fix(insights): disable collector if EnableExternalServices is false
Signed-off-by: Deluan <deluan@navidrome.org>
* fix(insights): fix type casting for 32bit platforms
Signed-off-by: Deluan <deluan@navidrome.org>
* fix(insights): remove EnableExternalServices from the collection (as it will always be false)
Signed-off-by: Deluan <deluan@navidrome.org>
* chore(insights): fix lint
Signed-off-by: Deluan <deluan@navidrome.org>
* refactor(insights): rename function for consistency
Signed-off-by: Deluan <deluan@navidrome.org>
* feat(insights): log the data sent to the collector server
Signed-off-by: Deluan <deluan@navidrome.org>
* feat(insights): add last collection timestamp to the "about" dialog.
Also add opt-out info to the SignUp form
Signed-off-by: Deluan <deluan@navidrome.org>
* feat(insights): only sends the initial data collection after an admin user is created
Signed-off-by: Deluan <deluan@navidrome.org>
* feat(insights): remove dangling comment
Signed-off-by: Deluan <deluan@navidrome.org>
* feat(insights): Translate insights messages
Signed-off-by: Deluan <deluan@navidrome.org>
* fix(insights): reporting empty library
Signed-off-by: Deluan <deluan@navidrome.org>
* refactor: move URL to consts.js
Signed-off-by: Deluan <deluan@navidrome.org>
---------
Signed-off-by: Deluan <deluan@navidrome.org>
* Fix album image_files being null.
* Fix small nitpick.
* Use ExecContext instead of Exec.
* Change more columns to not null and set default values.
* Remove columns that don't need to be changed from migration.
* Fix typo.
* Remove unnecessary select statements.
* Remove duplicate code.
* Do not apply changes to radio table.
* Do not apply changes full_text columns and respective indexes.
* Fix musicbrainz columns.
* Rename migration.
* Make ExternalInfoUpdatedAt nullable
* Make Share's timestamps nullable
---------
Co-authored-by: Deluan Quintão <deluan@navidrome.org>
* Start migration to dbx package
* Fix annotations and bookmarks bindings
* Fix tests
* Fix more tests
* Remove remaining references to beego/orm
* Add PostScanner/PostMapper interfaces
* Fix importing SmartPlaylists
* Renaming
* More renaming
* Fix artist DB mapping
* Fix playlist updates
* Remove bookmarks at the end of the test
* Remove remaining `orm` struct tags
* Fix user timestamps DB access
* Fix smart playlist evaluated_at DB access
* Fix search3
