4 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5.5	3bfddd0862	feat(auth): throttle login, register, password reset and Subsonic auth failures (M462 #4976) ... Every password-shaped check was mounted bare, so guessing was limited only by bcrypt cost. A shared in-memory AttemptLimiter now sits in front of them: - login: 10 failures per account and 50 per address per 15 min, checked before the user lookup and bcrypt; 429 with Retry-After. A success clears the account's count but not the address's. - unknown usernames run a dummy bcrypt compare, so timing no longer says which accounts exist. - register: 10 per address per hour; forgot-password: 5 per address and 3 per email per hour (applied whether or not the email matches); reset: 20 failed tokens per address per 15 min. - Subsonic /rest: same limits as login, counting only wrong credentials, since clients authenticate on every request. Web login, register, reset and forgot-password screens say how long to wait; web and Android carry copy for the rate_limited code. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 08:28:29 -04:00
bvandeusenandClaude Opus 4.7	1cc7eb6cad	refactor(server/api): writeErr accepts error; migrate admin handlers (1/3) ... Rewrite writeErr(w, err) to wrap *apierror.Error via apierror.From, preserving the existing {"error": {"code", "message"}} wire envelope. Add writeErrWithLog helper for 500-class errors that need an operator log line. Migrate all 13 admin_*.go handler files (~76 call sites) to the new signature; T3 will sweep the remaining api package. The old 4-arg writeErr is removed, so non-admin call sites in internal/api will not compile until T3 lands. This is by design — T2 and T3 are paired. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-07 19:48:25 -04:00
bvandeusenandClaude Sonnet 4.6	8c18e44d5b	feat(api): GET /api/tracks/{id} handler with parent metadata ... Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-21 07:12:11 -04:00
bvandeusenandClaude Opus 4.7	dc43921bcc	feat(api): package skeleton + error envelope ... Introduces internal/api with Mount(), the {error:{code,message}} response shape, and stubbed login/logout/me so later tasks can land one handler at a time without breaking the build. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-04-20 20:57:09 -04:00