navidrome/core
Deluan 406a2e9cf4 fix(api): never widen the scopes an access token claims
Authenticate ran token claims through Expand, so a token claiming `all`
would have gained every known scope. Only a holder of the signing key
could mint one, but tokens should carry concrete scopes only. Claims now
go through Allowed, which keeps known scopes (and admin only for admins)
and never expands `all`.
2026-09-28 20:06:28 -04:00
..
agents refactor(persistence): stateless repositories with per-call context (#6149) 2026-09-25 18:06:10 -04:00
apiauth fix(api): never widen the scopes an access token claims 2026-09-28 20:06:28 -04:00
artwork refactor(persistence): stateless repositories with per-call context (#6149) 2026-09-25 18:06:10 -04:00
auth fix(server): create the first admin inside one locked transaction 2026-09-28 20:06:27 -04:00
external refactor(persistence): stateless repositories with per-call context (#6149) 2026-09-25 18:06:10 -04:00
ffmpeg refactor(scanner): remove the unused legacy ffmpeg metadata extractor (#6231) 2026-09-26 12:30:52 -04:00
lyrics refactor(persistence): stateless repositories with per-call context (#6149) 2026-09-25 18:06:10 -04:00
matcher refactor(persistence): stateless repositories with per-call context (#6149) 2026-09-25 18:06:10 -04:00
metrics refactor(persistence): stateless repositories with per-call context (#6149) 2026-09-25 18:06:10 -04:00
playback refactor(persistence): stateless repositories with per-call context (#6149) 2026-09-25 18:06:10 -04:00
playlists refactor(persistence): stateless repositories with per-call context (#6149) 2026-09-25 18:06:10 -04:00
publicurl fix(plugins): build public URLs on the caller's address instead of localhost (#6059) 2026-08-31 21:27:43 -04:00
quickconnect feat(jellyfin): add Quick Connect sign-in (#6174) 2026-09-19 14:57:01 -04:00
scrobbler refactor(persistence): stateless repositories with per-call context (#6149) 2026-09-25 18:06:10 -04:00
sonic refactor(persistence): stateless repositories with per-call context (#6149) 2026-09-25 18:06:10 -04:00
storage fix: miscellaneous fixes for shares, artwork resize, auth limits, and watcher start (#6098) 2026-09-11 15:03:54 -04:00
stream refactor(persistence): stateless repositories with per-call context (#6149) 2026-09-25 18:06:10 -04:00
archiver.go refactor(persistence): stateless repositories with per-call context (#6149) 2026-09-25 18:06:10 -04:00
archiver_test.go refactor(persistence): stateless repositories with per-call context (#6149) 2026-09-25 18:06:10 -04:00
common.go refactor(persistence): stateless repositories with per-call context (#6149) 2026-09-25 18:06:10 -04:00
common_test.go test: unskip path-separator tests on Windows (#5381) (#5916) 2026-08-19 11:50:32 -04:00
core_suite_test.go Rename log.LevelCritical to log.LevelFatal 2022-12-21 14:53:36 -05:00
inspect.go refactor: multiple syntax updates for Go 1.26 2026-05-19 18:02:36 -03:00
library.go refactor(persistence): stateless repositories with per-call context (#6149) 2026-09-25 18:06:10 -04:00
library_test.go refactor(persistence): stateless repositories with per-call context (#6149) 2026-09-25 18:06:10 -04:00
maintenance.go refactor(persistence): stateless repositories with per-call context (#6149) 2026-09-25 18:06:10 -04:00
maintenance_test.go refactor(persistence): stateless repositories with per-call context (#6149) 2026-09-25 18:06:10 -04:00
players.go feat(subsonic): OpenSubsonic API key authentication (#6219) 2026-09-27 21:56:58 -04:00
players_test.go feat(subsonic): OpenSubsonic API key authentication (#6219) 2026-09-27 21:56:58 -04:00
share.go refactor(persistence): stateless repositories with per-call context (#6149) 2026-09-25 18:06:10 -04:00
share_test.go refactor(persistence): stateless repositories with per-call context (#6149) 2026-09-25 18:06:10 -04:00
user.go refactor(persistence): stateless repositories with per-call context (#6149) 2026-09-25 18:06:10 -04:00
user_test.go refactor(persistence): stateless repositories with per-call context (#6149) 2026-09-25 18:06:10 -04:00
wire_providers.go feat(jellyfin): add Quick Connect sign-in (#6174) 2026-09-19 14:57:01 -04:00