5 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5.5	327d49428f	feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983) ... users.api_token held each user's apiKey in plaintext and was looked up by equality, so a leaked row or backup handed out working keys. Migration 0063 replaces it with api_token_hash (sha256, hex), computed in place from the existing keys so every Subsonic client keeps working. The key can no longer be read back: GET /api/me/api-token is gone, and POST returns the new key once. Settings shows it right after Regenerate with a copy button and a "won't be shown again" note. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 09:42:35 -04:00
bvandeusen	dde3dd2804	refactor(server/api): migrate requests/quarantine/me_token/listenbrainz/admin_invites preludes (A2 3/N)	2026-05-08 08:26:43 -04:00
bvandeusen	965df28127	refactor(server): audit.WriteOrLog wrapper; migrate 13 sites (T5) ... Add audit.WriteOrLog: a one-line wrapper around Write that logs at Warn and swallows the error, matching the package contract that audit failures must not break user-facing operations. Migrate the 13 call sites across 7 files in internal/api/ from the 3-line "if err != nil { logger.Warn(...) }" shape to a single call. audit.Write stays exported for tests + any future caller that needs strict semantics. Adds three tests: success (no log), failure-via-closed-pool (Warn record with action+err keys), and nil-logger (no panic). Tests skip when MINSTREL_TEST_DATABASE_URL is unset, matching the existing harness convention.	2026-05-07 21:33:14 -04:00
bvandeusen	e382b0d718	refactor(server/api): migrate auth/me handlers to writeErr(err) (T3a)	2026-05-07 20:25:26 -04:00
bvandeusenandClaude Sonnet 4.6	aa73c93f85	feat(server/m7-user-mgmt): self-service /me endpoints (U3) ... Four authenticated endpoints for the user's own account: - PUT /api/me/password — change own password. Caller must supply current_password (verified via bcrypt). Distinct from admin-driven reset (which doesn't require knowing the old). Audits ActionPasswordChangeSelf. - PUT /api/me/profile — set display_name + email. Both fields are nullable; empty string clears, omitted leaves unchanged. Email is lowercased before store + format-validated. Unique violation → 409 email_taken. - GET /api/me/api-token — returns current API token (for copy-paste into Subsonic clients). - POST /api/me/api-token — regenerates token. Old one stops working immediately. Audits ActionTokenRegenerate. All four use the existing RequireUser middleware on the authed sub-router; audit writes are best-effort (logged on failure). Tests cover happy paths, wrong-password 401, password-too-short 400, email-invalid 400, email-taken 409, clear-by-empty-string, omit-leaves-unchanged, token GET + regen. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-07 12:38:48 -04:00