navidrome/server/initial_setup.go
Adrián Sánchez Zapico 27483a46dc
fix(server): fail startup on initial setup errors and fix JSON/M3U response headers (#5897)
* fix(server): stop swallowing errors and correct two response bugs

Four independent bugs found while reviewing the HTTP layer:

initial_setup.go: createInitialAdminUser assigned the users.Put error to a
shadowed err, so the outer err (always nil by then, since a CountAll failure
panics) was returned instead. A failure to create the admin user was reported
as success, and initialSetup went on to commit the "setup complete" property
in the same transaction — so no admin user existed and initial setup was
skipped on every later boot.

auth.go: createAdminUser logged the Put error but returned nil, so createAdmin
fell through to doLogin and answered 401 "Invalid username or password"
instead of surfacing the real failure. It also logged the whole model.User,
which puts the new admin's password in the log in clear text; every other call
site logs user.UserName.

native_api.go: writeDeleteManyResponse did not return after http.Error when
marshaling failed, then wrote a nil body over the 500. It also built the
single-id body by hand with html.EscapeString, which does not escape
backslashes, so an id ending in one produced `{"id":"a\"}` — invalid JSON.
Both shapes now go through json.Marshal. A failed Write is now logged rather
than answered with http.Error, which could not work once the body had started.

handle_shares.go: handleM3U set Content-Type after WriteHeader, so it was
never sent and shared playlists were served with a sniffed type.

Signed-off-by: zapisanchez <zapisanchez@gmail.com>

* fix(server): address review feedback

- writeDeleteManyResponse uses rest.RespondWithJSON, so the response now
  has Content-Type: application/json. This also removes a marshal error
  branch that could never run.
- createInitialAdminUser returns the CountAll error instead of panicking,
  and wraps its errors. initialSetup now stops the server with log.Fatal
  when setup fails. Before, the error was dropped and the server started
  with a half-done setup.
- Trim comments that described PR history.

---------

Signed-off-by: zapisanchez <zapisanchez@gmail.com>
Co-authored-by: Deluan <deluan@navidrome.org>
2026-09-23 12:10:25 -04:00

100 lines
2.8 KiB
Go

package server
import (
"context"
"fmt"
"time"
"github.com/Masterminds/squirrel"
"github.com/navidrome/navidrome/conf"
"github.com/navidrome/navidrome/consts"
"github.com/navidrome/navidrome/core/ffmpeg"
"github.com/navidrome/navidrome/log"
"github.com/navidrome/navidrome/model"
"github.com/navidrome/navidrome/model/id"
)
func initialSetup(ds model.DataStore) {
ctx := context.TODO()
err := ds.WithTx(func(tx model.DataStore) error {
if err := tx.Library(ctx).StoreMusicFolder(); err != nil {
return err
}
properties := tx.Property(ctx)
_, err := properties.Get(consts.InitialSetupFlagKey)
if err == nil {
return nil
}
log.Info("Running initial setup")
if conf.Server.DevAutoCreateAdminPassword != "" {
if err = createInitialAdminUser(tx, conf.Server.DevAutoCreateAdminPassword); err != nil {
return err
}
}
err = properties.Put(consts.InitialSetupFlagKey, time.Now().String())
return err
}, "initial setup")
if err != nil {
log.Fatal("Error running initial setup", err)
}
}
// If the Dev Admin user is not present, create it
func createInitialAdminUser(ds model.DataStore, initialPassword string) error {
users := ds.User(context.TODO())
c, err := users.CountAll(model.QueryOptions{Filters: squirrel.Eq{"user_name": consts.DevInitialUserName}})
if err != nil {
return fmt.Errorf("could not access User table: %w", err)
}
if c == 0 {
newID := id.NewRandom()
log.Warn("Creating initial admin user. This should only be used for development purposes!!",
"user", consts.DevInitialUserName, "password", initialPassword, "id", newID)
initialUser := model.User{
ID: newID,
UserName: consts.DevInitialUserName,
Name: consts.DevInitialName,
Email: "",
NewPassword: initialPassword,
IsAdmin: true,
}
if err := users.Put(&initialUser); err != nil {
return fmt.Errorf("could not create initial admin user: %w", err)
}
}
return nil
}
func checkFFmpegInstallation() {
f := ffmpeg.New()
_, err := f.CmdPath()
if err != nil {
log.Warn("Unable to find ffmpeg. Transcoding will fail if used", err)
if conf.Server.Scanner.Extractor == "ffmpeg" {
log.Warn("ffmpeg cannot be used for metadata extraction. Falling back to taglib")
conf.Server.Scanner.Extractor = "taglib"
}
return
}
if !f.IsProbeAvailable() {
log.Warn("Unable to find ffprobe. Transcoding decisions will be limited")
}
}
func checkExternalCredentials() {
if conf.Server.EnableExternalServices {
if !conf.Server.LastFM.Enabled {
log.Info("Last.fm integration is DISABLED")
} else {
log.Debug("Last.fm integration is ENABLED")
}
if !conf.Server.ListenBrainz.Enabled {
log.Info("ListenBrainz integration is DISABLED")
} else {
log.Debug("ListenBrainz integration is ENABLED", "ListenBrainz.BaseURL", conf.Server.ListenBrainz.BaseURL)
}
}
}