mirror of
https://github.com/navidrome/navidrome.git
synced 2026-10-11 03:47:18 +02:00
59810c3d59* feat(auth): add per-user token_epoch column and bump method * feat(auth): add aud and ep claims, omitted when zero * feat(auth): add CreateAPIToken for non-expiring, audience-scoped tokens * feat(auth): add CheckClaims for epoch and audience validation * feat(jellyfin): issue non-expiring, jellyfin-scoped access tokens * fix(subsonic): reject API-scoped and revoked tokens on the jwt path * fix(server): reject API-scoped and revoked tokens on the native API * fix(server): pin the token-subject guard and stop leaking test config Adds a regression spec for the DevAutoLogin/ExtAuth guard in tokenAllowed, switches its comparison to case-insensitive to match the user lookup's own COLLATE NOCASE semantics, and restores Subsonic JWT test config after each spec instead of leaking SessionTimeout. * feat(request): add a token epoch holder for handler-to-middleware signalling * refactor(server): write the refreshed JWT header after the handler runs * feat(auth): revoke all tokens for a user when their password changes * fix(server): restore Unwrap on the JWT refresh writer so SSE write deadlines apply * test(auth): pin that non-session tokens reject API access tokens * test(jellyfin): pin token scoping and epoch revocation end to end Exercises auth.CreateAPIToken and CheckClaims against the real Jellyfin router and SQLite DB: the minted token has no exp and is aud-scoped to jellyfin, and bumping token_epoch through the real UserRepository revokes an already-issued token on the next protected request. * test(nativeapi): pin the token-epoch handoff through a real password-change request Drive a self password change through the real Authenticator/JWTRefresher chain and a real SQLite-backed userRepository, so the epoch handoff between Put and the refreshed-token writer is verified end to end, not as two separately-tested halves. Also fix tokenAllowed to read the enriched ctx it was given instead of r.Context(), so its warning log carries the username. * refactor(server): drop tokenAllowed's now-unused request parameter Finding-2 already moved every use to ctx; r was dead weight. Also note in the new nativeapi test why it must stay the package's only real-DB spec: db.Db() is a process-wide singleton its cleanup closes for good. * refactor(auth): remove duplication in claim decoding and token minting * refactor(auth): group aud with the standard JWT claims * refactor(auth): read aud with the standard-claim accessor pattern * fix(log): redact every api_key spelling the Jellyfin API accepts * fix(auth): bind session tokens to the user id, not just the username * fix(auth): return the token epoch from the same atomic increment * fix(auth): bump the token epoch in the same statement as the password write * chore(auth): trim comments to the why-only budget |
||
|---|---|---|
| .. | ||
| e2e | ||
| responses | ||
| album_lists.go | ||
| album_lists_test.go | ||
| api.go | ||
| api_suite_test.go | ||
| api_test.go | ||
| bookmarks.go | ||
| browsing.go | ||
| browsing_test.go | ||
| helpers.go | ||
| helpers_test.go | ||
| jukebox.go | ||
| library_scanning.go | ||
| library_scanning_test.go | ||
| lyrics.go | ||
| lyrics_test.go | ||
| media_annotation.go | ||
| media_annotation_test.go | ||
| media_retrieval.go | ||
| media_retrieval_test.go | ||
| middlewares.go | ||
| middlewares_test.go | ||
| opensubsonic.go | ||
| opensubsonic_test.go | ||
| playlists.go | ||
| playlists_test.go | ||
| radio.go | ||
| radio_test.go | ||
| searching.go | ||
| searching_test.go | ||
| sharing.go | ||
| sonic_similarity.go | ||
| stream.go | ||
| system.go | ||
| transcode.go | ||
| transcode_test.go | ||
| users.go | ||
| users_test.go | ||