mirror of
https://github.com/navidrome/navidrome.git
synced 2026-10-08 10:27:08 +02:00
1e7996f5d7
Share repository read methods (Get, GetAll, Read, ReadAll, Exists, Count, CountAll) did not apply an owner filter, so non-admin users saw shares belonging to other users. The write paths already enforced per-user ownership; this brings reads in line with them. Add an addRestriction()/ownerFilter() based scope to share reads, keeping admins and the headless public-share resolution path unrestricted. Route share and player Delete through a new base-repo deleteOwned() primitive that applies the ownership predicate in the DELETE's WHERE clause (atomic, no select-then- delete window) and classifies a zero-row result as permission-denied vs not-found, mirroring updateOwned. The addRestriction helper and the write-miss classifier are hoisted onto the base repository so player and share share one implementation. Also map rest.ErrPermissionDenied and rest.ErrNotFound in the Subsonic error handler so ownership/not-found failures from the rest-backed repositories return the proper Subsonic codes (50 / 70) instead of a generic error. Covered by unit tests (persistence, subsonic error mapping) and an end-to-end cross-user sharing isolation test. |
||
|---|---|---|
| .. | ||
| doc.go | ||
| e2e_suite_test.go | ||
| subsonic_album_lists_test.go | ||
| subsonic_bookmarks_test.go | ||
| subsonic_browsing_test.go | ||
| subsonic_media_annotation_test.go | ||
| subsonic_media_retrieval_test.go | ||
| subsonic_multilibrary_test.go | ||
| subsonic_multiuser_test.go | ||
| subsonic_playlists_test.go | ||
| subsonic_radio_test.go | ||
| subsonic_scan_test.go | ||
| subsonic_searching_test.go | ||
| subsonic_sharing_test.go | ||
| subsonic_sonic_similarity_test.go | ||
| subsonic_stream_test.go | ||
| subsonic_system_test.go | ||
| subsonic_transcode_test.go | ||
| subsonic_users_test.go | ||