bvandeusenandClaude Opus 5.5 24b767c23b feat(server): cap request bodies, bound body reads, private cache headers, JSON-only cookie writes (M462 #4979) ...

- Every request body is capped at 4 MiB and must arrive within 30s. The
  deadline is set per request and cleared at end of body rather than via
  http.Server.ReadTimeout, which would cancel audio streams and the SSE
  stream once the background read hit it.
- IdleTimeout 120s closes idle keep-alive connections. Still no global
  WriteTimeout, for the same streaming reason.
- Streams, album covers and playlist covers are Cache-Control: private, so
  a shared cache never keeps an authenticated response for others.
- A cookie-authenticated write to /api must be application/json (415
  otherwise). SameSite=Strict can't see a sibling app on the same
  registrable domain; forms and no-preflight fetches can't send JSON.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-06 08:34:26 -04:00

..

admin_cover_sources_test.go

test(coverart): fix registry-wipe + stale provider signature

2026-05-17 21:05:36 -04:00

admin_cover_sources.go

fix(server/api): preserve 500-class messages via apierror.InternalMsg

2026-05-07 20:10:18 -04:00

admin_coverage_test.go

fix: drift audit batch 1 — six small mechanical wins

2026-06-02 18:11:25 -04:00

admin_coverage.go

feat(admin): fingerprinting settings — on/off, length, match threshold, concurrency, sweep interval (M400 #3913)

2026-09-11 17:53:55 -04:00

admin_coverart_research_test.go

feat(server/web/coverart): manual Re-search missing art button

2026-05-07 07:59:40 -04:00

admin_coverart_research.go

fix(server/api): preserve 500-class messages via apierror.InternalMsg

2026-05-07 20:10:18 -04:00

admin_covers_test.go

feat(coverart): #388 remove global cover-art backfill cap

2026-05-16 18:41:21 -04:00

admin_covers.go

feat(coverart): #388 remove global cover-art backfill cap

2026-05-16 18:41:21 -04:00

admin_duplicates_test.go

feat(admin): the duplicates report — review proposed duplicate groups (M400 #3912)

2026-09-11 17:11:11 -04:00

admin_duplicates.go

feat(admin): fingerprinting settings — on/off, length, match threshold, concurrency, sweep interval (M400 #3913)

2026-09-11 17:53:55 -04:00

admin_fingerprint_settings_test.go

feat(admin): fingerprinting settings — on/off, length, match threshold, concurrency, sweep interval (M400 #3913)

2026-09-11 17:53:55 -04:00

admin_fingerprint_settings.go

feat(admin): fingerprinting settings — on/off, length, match threshold, concurrency, sweep interval (M400 #3913)

2026-09-11 17:53:55 -04:00

admin_invites_test.go

feat(server/m7-user-mgmt): admin endpoints (invites, users, promote/demote)

2026-05-07 12:01:16 -04:00

admin_invites.go

fix(server): repair go vet failures from A1+A2 cleanup (orphan imports + needle deref)

2026-05-08 10:46:43 -04:00

admin_library_missing_test.go

feat(api): admin surface for files the library has lost — #2527

2026-08-16 11:48:45 -04:00

admin_library_missing.go

feat: show what re-acquisition has done, per folder — #2527

2026-08-17 00:19:48 -04:00

admin_lidarr_test.go

fix: A2 (relax art-source CHECK) + D + E integration residual

2026-05-17 20:22:30 -04:00

admin_lidarr.go

feat(server/admin): test endpoint returns profiles + folders on success

2026-05-08 23:07:15 -04:00

admin_network.go

feat(net): trusted-proxy depth so real client IPs survive a proxy — #2453

2026-08-05 10:07:43 -04:00

admin_quarantine_test.go

fix(library): a track delete that cannot remove its file deletes nothing — #3918

2026-09-11 14:23:01 -04:00

admin_quarantine.go

fix(library): a track delete that cannot remove its file deletes nothing — #3918

2026-09-11 14:23:01 -04:00

admin_reacquisition.go

feat(api): admin endpoints for the re-acquisition policy — #2527

2026-08-17 00:02:41 -04:00

admin_recommendation_trends_test.go

feat(tuning): weekly trend view — per-surface series + knob-turn markers

2026-07-03 09:29:33 -04:00

admin_recommendation_trends.go

feat(tuning): weekly trend view — per-surface series + knob-turn markers

2026-07-03 09:29:33 -04:00

admin_recommendation_tuning_test.go

feat(tuning): scoring weights → DB-backed admin tuning lab

2026-07-03 09:22:03 -04:00

admin_recommendation_tuning.go

fix(recommendation): Songs-like gets its own profile so it stops wandering

2026-09-10 20:51:15 -04:00

admin_requests_test.go

fix(player+lidarr): mini-player sync race; durable approve + dedup

2026-05-18 12:24:20 -04:00

admin_requests.go

feat(#392): publish track-like + request-status events to SSE bus

2026-05-12 20:55:33 -04:00

admin_scan_test.go

feat(server/m7-381): admin scan-status + manual trigger endpoints

2026-05-04 20:13:31 -04:00

admin_scan.go

fix(server/api): preserve 500-class messages via apierror.InternalMsg

2026-05-07 20:10:18 -04:00

admin_smtp_test.go

feat(server/m7-user-mgmt): mailer package + SMTP config endpoints (U3)

2026-05-07 12:43:44 -04:00

admin_smtp.go

refactor(server/api): migrate admin_smtp/admin_tracks + playlist refresh preludes (A2 6/N)

2026-05-08 10:18:35 -04:00

admin_tag_sources_test.go

feat(api): admin tag-sources endpoints (#1490 Step 4 backend)

2026-07-13 22:24:28 -04:00

admin_tag_sources.go

feat(api): admin tag-sources endpoints (#1490 Step 4 backend)

2026-07-13 22:24:28 -04:00

admin_tracks_test.go

refactor(server/api/test): withUser helper; migrate 51 context-value sites (A3)

2026-05-08 10:40:03 -04:00

admin_tracks.go

fix(library): a track delete that cannot remove its file deletes nothing — #3918

2026-09-11 14:23:01 -04:00

admin_users_test.go

fix: A2 (relax art-source CHECK) + D + E integration residual

2026-05-17 20:22:30 -04:00

admin_users.go

feat(auth): sessions expire server-side; password change and reset end other sessions (M462 #4978)

2026-10-06 08:32:39 -04:00

api.go

feat(auth): throttle login, register, password reset and Subsonic auth failures (M462 #4976)

2026-10-06 08:28:29 -04:00

auth_forgot_test.go

feat(server/m7-user-mgmt): forgot + reset password endpoints (U3)

2026-05-07 12:49:30 -04:00

auth_forgot.go

feat(auth): throttle login, register, password reset and Subsonic auth failures (M462 #4976)

2026-10-06 08:28:29 -04:00

auth_register_test.go

feat(server/m7-user-mgmt): self-registration handler

2026-05-07 11:56:19 -04:00

auth_register.go

fix(auth): set the session cookie's Secure flag behind a TLS-terminating proxy (M462 #4977)

2026-10-06 08:30:46 -04:00

auth_reset_test.go

feat(server/m7-user-mgmt): forgot + reset password endpoints (U3)

2026-05-07 12:49:30 -04:00

auth_reset.go

feat(auth): sessions expire server-side; password change and reset end other sessions (M462 #4978)

2026-10-06 08:32:39 -04:00

auth_test.go

feat(auth): throttle login, register, password reset and Subsonic auth failures (M462 #4976)

2026-10-06 08:28:29 -04:00

auth.go

fix(auth): set the session cookie's Secure flag behind a TLS-terminating proxy (M462 #4977)

2026-10-06 08:30:46 -04:00

cast_token_test.go

test(server): seed track for cast-token tests + assert file-ext in URL

2026-06-04 07:44:33 -04:00

cast_token.go

refactor(server): unify stream URL builders + MIME tables + cover-path helper

2026-06-04 08:29:51 -04:00

client_assets_test.go

feat(version): sidecar and /api/client/version carry name, code and channel

2026-09-09 21:51:41 -04:00

client_assets.go

feat(version): sidecar and /api/client/version carry name, code and channel

2026-09-09 21:51:41 -04:00

convert_test.go

style: gofmt fixes across api package

2026-04-21 23:02:20 -04:00

convert.go

fix: stop the sync feed hiding missing files from clients — #2704

2026-08-17 12:56:31 -04:00

diagnostics.go

feat(diagnostics): 'playback' kind, newest-first sort, fix active-route subtitle

2026-06-30 16:33:01 -04:00

errors_test.go

refactor(server/api): writeErr accepts error; migrate admin handlers (1/3)

2026-05-07 19:48:25 -04:00

errors.go

feat(auth): throttle login, register, password reset and Subsonic auth failures (M462 #4976)

2026-10-06 08:28:29 -04:00

events_publish.go

feat(server): emit playlist.system_rebuilt on daily + manual system-playlist rebuild

2026-06-20 12:59:27 -04:00

events_stream.go

feat(#392): SSE event stream foundation — eventbus + /api/events/stream

2026-05-12 20:44:37 -04:00

events_test.go

fix(server/api/test): drop unused 'context' imports A3 sed left behind

2026-05-08 11:29:36 -04:00

events.go

feat(taste): device-class context conditioning — #1551

2026-07-14 12:47:59 -04:00

file_remove_error_test.go

fix(library): a track delete that cannot remove its file deletes nothing — #3918

2026-09-11 14:23:01 -04:00

file_remove_error.go

fix(library): a track delete that cannot remove its file deletes nothing — #3918

2026-09-11 14:23:01 -04:00

home_test.go

feat(api): GET /api/home/index for per-item rendering (Slice B)

2026-05-13 20:41:44 -04:00

home.go

feat(server): "You might like" album/artist Home rows (#790)

2026-06-11 19:33:46 -04:00

library_albums_test.go

feat(api): add GET /api/library/albums handler

2026-05-01 18:00:59 -04:00

library_albums.go

feat(library): genre + year browse queries and endpoints — #367

2026-08-05 13:22:30 -04:00

library_browse_test.go

fix(library): a fully-missing album leaves the year axis too — #2702

2026-08-17 13:38:08 -04:00

library_browse.go

fix(scanner): read multi-value genre frames correctly — #2499

2026-08-05 21:17:59 -04:00

library_fixtures_test.go

feat(api): add GET/PUT /api/me/listenbrainz endpoints

2026-04-28 09:27:06 -04:00

library_sync_test.go

fix(server): wrap defer tx.Rollback for errcheck + gofmt -s alignment

2026-05-09 22:47:25 -04:00

library_sync_views_test.go

fix: stop the sync feed hiding missing files from clients — #2704

2026-08-17 12:56:31 -04:00

library_sync_views.go

fix: stop the sync feed hiding missing files from clients — #2704

2026-08-17 12:56:31 -04:00

library_sync.go

fix(server,flutter): sync wire format + systemVariant column (#357)

2026-05-10 18:47:30 -04:00

library_test.go

test(api): pass fingerprint settings to Mount in the route-registration test (M400 #3913)

2026-09-11 17:58:05 -04:00

library.go

feat(library): genre + year quick-jumps on album and artist detail — #367

2026-08-05 13:50:29 -04:00

lidarr_test.go

fix(api): gofmt + revive cleanup on lidarr search handler

2026-04-29 17:35:45 -04:00

lidarr.go

refactor(server): final writeErr migration + ErrNotFound aliases (T3c)

2026-05-07 21:19:35 -04:00

likes_test.go

refactor(server/api/test): withUser helper; migrate 51 context-value sites (A3)

2026-05-08 10:40:03 -04:00

likes.go

feat(#402): publish album/artist like events on the SSE bus

2026-05-13 14:27:23 -04:00

listenbrainz_test.go

feat(api): add GET/PUT /api/me/listenbrainz endpoints

2026-04-28 09:27:06 -04:00

listenbrainz.go

refactor(server/api): migrate requests/quarantine/me_token/listenbrainz/admin_invites preludes (A2 3/N)

2026-05-08 08:26:43 -04:00

me_history_test.go

fix(server/m7-365): silence unused-pool-param lint in history test

2026-05-04 07:05:49 -04:00

me_history.go

refactor(server/api): migrate me/* + events preludes (A2 5/N)

2026-05-08 08:44:50 -04:00

me_password_test.go

feat(server/m7-user-mgmt): self-service /me endpoints (U3)

2026-05-07 12:38:48 -04:00

me_password.go

feat(auth): sessions expire server-side; password change and reset end other sessions (M462 #4978)

2026-10-06 08:32:39 -04:00

me_profile_test.go

feat(server/m7-user-mgmt): self-service /me endpoints (U3)

2026-05-07 12:38:48 -04:00

me_profile.go

feat(server/diagnostics): device debug-reporting ingest + admin timeline + retention (M9)

2026-06-29 18:38:56 -04:00

me_recommendation_metrics_test.go

feat(discover): taste-targeted novelty bucket + rebalance toward discovery

2026-07-13 18:16:04 -04:00

me_recommendation_metrics.go

feat(metrics): publish margin of error on every delta — #2495, #2524

2026-08-06 21:08:58 -04:00

me_sessions_test.go

feat(auth): active sessions API with origin/current IP — #370

2026-08-05 09:17:40 -04:00

me_sessions.go

feat(auth): active sessions API with origin/current IP — #370

2026-08-05 09:17:40 -04:00

me_system_playlists_test.go

feat(server/m7-352): GET /api/me/system-playlists-status for home placeholders

2026-05-04 18:13:13 -04:00

me_system_playlists.go

refactor(server/api): migrate me/* + events preludes (A2 5/N)

2026-05-08 08:44:50 -04:00

me_test.go

fix(server): drift #578 — /api/me returns profile shape with display_name + email

2026-06-02 18:24:23 -04:00

me_timezone_test.go

fix: A2 (relax art-source CHECK) + D + E integration residual

2026-05-17 20:22:30 -04:00

me_timezone.go

feat(playlists): wire Refresh into PUT /api/me/timezone + registration

2026-05-13 11:58:24 -04:00

me_token_test.go

feat(server/m7-user-mgmt): self-service /me endpoints (U3)

2026-05-07 12:38:48 -04:00

me_token.go

refactor(server/api): migrate requests/quarantine/me_token/listenbrainz/admin_invites preludes (A2 3/N)

2026-05-08 08:26:43 -04:00

me.go

fix(server): drift #578 — /api/me returns profile shape with display_name + email

2026-06-02 18:24:23 -04:00

media_test.go

fix(server,web/m7-353): post-review fixes (test compilation, AlbumRef field, bulk handler, design system)

2026-05-04 15:21:24 -04:00

media.go

feat(server): cap request bodies, bound body reads, private cache headers, JSON-only cookie writes (M462 #4979)

2026-10-06 08:34:26 -04:00

metrics_significance_test.go

feat(metrics): publish margin of error on every delta — #2495, #2524

2026-08-06 21:08:58 -04:00

metrics_significance.go

feat(metrics): publish margin of error on every delta — #2495, #2524

2026-08-06 21:08:58 -04:00

playback_errors.go

feat(server): playback_errors table + admin inbox endpoints

2026-06-02 11:25:50 -04:00

playlists_system_shuffle.go

feat(server): emit playlist.system_rebuilt on daily + manual system-playlist rebuild

2026-06-20 12:59:27 -04:00

playlists_system_test.go

fix: A2 (relax art-source CHECK) + D + E integration residual

2026-05-17 20:22:30 -04:00

playlists_test.go

refactor(server/api/test): withUser helper; migrate 51 context-value sites (A3)

2026-05-08 10:40:03 -04:00

playlists.go

feat(server): cap request bodies, bound body reads, private cache headers, JSON-only cookie writes (M462 #4979)

2026-10-06 08:34:26 -04:00

prelude.go

fix: A2 (relax art-source CHECK) + D + E integration residual

2026-05-17 20:22:30 -04:00

quarantine_test.go

feat(api): /api/quarantine user + admin endpoints + Service wiring

2026-04-30 20:19:39 -04:00

quarantine.go

feat(#392): publish quarantine + playlist mutation events

2026-05-12 21:28:05 -04:00

radio_test.go

fix(server/api/test): retype callRadio user param to dbq.User for withUser helper

2026-05-08 11:05:25 -04:00

radio.go

fix(recommendation): make the candidate draw reproducible, not accidentally so

2026-09-11 08:44:33 -04:00

requests_test.go

fix(server): repair recursive withUser, gofmt 2 files (golangci-lint)

2026-05-08 12:05:35 -04:00

requests.go

feat(#392): publish track-like + request-status events to SSE bus

2026-05-12 20:55:33 -04:00

resolve_test.go

fix(server/api): silence unused-parameter lint in resolve_test fakes

2026-05-07 22:18:40 -04:00

resolve.go

refactor(server/api): resolveByID helper for parseUUID->fetch->404 (T4)

2026-05-07 21:28:20 -04:00

search_test.go

feat(api): GET /api/search with three paged facets

2026-04-21 08:29:28 -04:00

search.go

fix(server): repair go vet failures from A1+A2 cleanup (orphan imports + needle deref)

2026-05-08 10:46:43 -04:00

session_lifecycle_test.go

feat(auth): sessions expire server-side; password change and reset end other sessions (M462 #4978)

2026-10-06 08:32:39 -04:00

stream_token_test.go

feat(server): HMAC stream token auth path (UPnP slice 1/6)

2026-06-03 11:34:02 -04:00

stream_token.go

fix(server): errcheck violations from UPnP slice

2026-06-03 13:41:54 -04:00

suggestions_test.go

feat(api): /api/discover/suggestions handler

2026-05-01 06:23:08 -04:00

suggestions.go

feat(discover): rank suggestions by taste-tag overlap — #2377 (server)

2026-08-02 20:31:12 -04:00

types.go

fix: stop the sync feed hiding missing files from clients — #2704

2026-08-17 12:56:31 -04:00