feat(config): subsonic.allow_plaintext_password

internal/config/config.go

@@ -15,6 +15,7 @@ type Config struct {
 	Log      LogConfig      `yaml:"log"`
 	Auth     AuthConfig     `yaml:"auth"`
 	Library  LibraryConfig  `yaml:"library"`
+	Subsonic SubsonicConfig `yaml:"subsonic"`
 }
 
 type ServerConfig struct {
@@ -47,6 +48,13 @@ type LibraryConfig struct {
 	ScanOnStartup bool     `yaml:"scan_on_startup"`
 }
 
+// SubsonicConfig controls wire-format concessions on the /rest/* surface.
+// AllowPlaintextPassword gates the `p=` parameter; the recommended posture is
+// to leave it disabled and require apiKey (OpenSubsonic) or t+s.
+type SubsonicConfig struct {
+	AllowPlaintextPassword bool `yaml:"allow_plaintext_password"`
+}
+
 func Default() Config {
 	return Config{
 		Server:   ServerConfig{Address: ":4533"},
@@ -98,6 +106,11 @@ func applyEnv(cfg *Config) {
 			cfg.Library.ScanOnStartup = b
 		}
 	}
+	if v, ok := os.LookupEnv("SMARTMUSIC_SUBSONIC_ALLOW_PLAINTEXT_PASSWORD"); ok {
+		if b, err := strconv.ParseBool(v); err == nil {
+			cfg.Subsonic.AllowPlaintextPassword = b
+		}
+	}
 }
 
 // splitPaths splits a colon-separated path list, dropping empty entries.