mirror of
https://github.com/navidrome/navidrome.git
synced 2026-10-08 10:27:08 +02:00
59810c3d59* feat(auth): add per-user token_epoch column and bump method * feat(auth): add aud and ep claims, omitted when zero * feat(auth): add CreateAPIToken for non-expiring, audience-scoped tokens * feat(auth): add CheckClaims for epoch and audience validation * feat(jellyfin): issue non-expiring, jellyfin-scoped access tokens * fix(subsonic): reject API-scoped and revoked tokens on the jwt path * fix(server): reject API-scoped and revoked tokens on the native API * fix(server): pin the token-subject guard and stop leaking test config Adds a regression spec for the DevAutoLogin/ExtAuth guard in tokenAllowed, switches its comparison to case-insensitive to match the user lookup's own COLLATE NOCASE semantics, and restores Subsonic JWT test config after each spec instead of leaking SessionTimeout. * feat(request): add a token epoch holder for handler-to-middleware signalling * refactor(server): write the refreshed JWT header after the handler runs * feat(auth): revoke all tokens for a user when their password changes * fix(server): restore Unwrap on the JWT refresh writer so SSE write deadlines apply * test(auth): pin that non-session tokens reject API access tokens * test(jellyfin): pin token scoping and epoch revocation end to end Exercises auth.CreateAPIToken and CheckClaims against the real Jellyfin router and SQLite DB: the minted token has no exp and is aud-scoped to jellyfin, and bumping token_epoch through the real UserRepository revokes an already-issued token on the next protected request. * test(nativeapi): pin the token-epoch handoff through a real password-change request Drive a self password change through the real Authenticator/JWTRefresher chain and a real SQLite-backed userRepository, so the epoch handoff between Put and the refreshed-token writer is verified end to end, not as two separately-tested halves. Also fix tokenAllowed to read the enriched ctx it was given instead of r.Context(), so its warning log carries the username. * refactor(server): drop tokenAllowed's now-unused request parameter Finding-2 already moved every use to ctx; r was dead weight. Also note in the new nativeapi test why it must stay the package's only real-DB spec: db.Db() is a process-wide singleton its cleanup closes for good. * refactor(auth): remove duplication in claim decoding and token minting * refactor(auth): group aud with the standard JWT claims * refactor(auth): read aud with the standard-claim accessor pattern * fix(log): redact every api_key spelling the Jellyfin API accepts * fix(auth): bind session tokens to the user id, not just the username * fix(auth): return the token epoch from the same atomic increment * fix(auth): bump the token epoch in the same statement as the password write * chore(auth): trim comments to the why-only budget |
||
|---|---|---|
| .. | ||
| e2e | ||
| album_repository.go | ||
| album_repository_test.go | ||
| artist_repository.go | ||
| artist_repository_test.go | ||
| artwork_hydration.go | ||
| artwork_hydration_test.go | ||
| artwork_queue_repository.go | ||
| artwork_queue_repository_test.go | ||
| artwork_repository.go | ||
| artwork_repository_test.go | ||
| collation_test.go | ||
| criteria_sql.go | ||
| criteria_sql_benchmark_test.go | ||
| criteria_sql_test.go | ||
| export_test.go | ||
| folder_repository.go | ||
| folder_repository_test.go | ||
| genre_repository.go | ||
| genre_repository_test.go | ||
| helpers.go | ||
| helpers_test.go | ||
| item_tags_test.go | ||
| library_repository.go | ||
| library_repository_test.go | ||
| mediafile_repository.go | ||
| mediafile_repository_test.go | ||
| persistence.go | ||
| persistence_suite_test.go | ||
| persistence_test.go | ||
| player_repository.go | ||
| player_repository_test.go | ||
| playlist_repository.go | ||
| playlist_repository_test.go | ||
| playlist_track_repository.go | ||
| playlist_track_repository_test.go | ||
| playqueue_repository.go | ||
| playqueue_repository_test.go | ||
| plugin_cleanup.go | ||
| plugin_cleanup_test.go | ||
| plugin_repository.go | ||
| plugin_repository_test.go | ||
| property_repository.go | ||
| property_repository_test.go | ||
| radio_repository.go | ||
| radio_repository_test.go | ||
| scrobble_buffer_repository.go | ||
| scrobble_buffer_repository_test.go | ||
| scrobble_repository.go | ||
| scrobble_repository_test.go | ||
| share_repository.go | ||
| share_repository_test.go | ||
| smart_playlist_repository.go | ||
| smart_playlist_repository_test.go | ||
| sort_index_coverage_test.go | ||
| sql_annotations.go | ||
| sql_annotations_test.go | ||
| sql_base_repository.go | ||
| sql_base_repository_test.go | ||
| sql_bookmarks.go | ||
| sql_bookmarks_test.go | ||
| sql_participations.go | ||
| sql_restful.go | ||
| sql_restful_test.go | ||
| sql_search.go | ||
| sql_search_fts.go | ||
| sql_search_fts_test.go | ||
| sql_search_like.go | ||
| sql_search_like_test.go | ||
| sql_search_test.go | ||
| sql_tags.go | ||
| tag_library_filtering_test.go | ||
| tag_repository.go | ||
| tag_repository_test.go | ||
| transcoding_repository.go | ||
| transcoding_repository_test.go | ||
| user_props_repository.go | ||
| user_repository.go | ||
| user_repository_test.go | ||