bvandeusenandClaude Opus 5.5 327d49428f feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983) ...

users.api_token held each user's apiKey in plaintext and was looked up by
equality, so a leaked row or backup handed out working keys. Migration
0063 replaces it with api_token_hash (sha256, hex), computed in place
from the existing keys so every Subsonic client keeps working.

The key can no longer be read back: GET /api/me/api-token is gone, and
POST returns the new key once. Settings shows it right after Regenerate
with a copy button and a "won't be shown again" note.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-06 09:42:35 -04:00

..

api

feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)

2026-10-06 09:42:35 -04:00

apierror

feat(auth): throttle login, register, password reset and Subsonic auth failures (M462 #4976)

2026-10-06 08:28:29 -04:00

audit

feat(library): merge duplicates without losing history (M400 #3911)

2026-09-11 17:25:06 -04:00

auth

feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)

2026-10-06 09:42:35 -04:00

config

feat(tuning): scoring weights → DB-backed admin tuning lab

2026-07-03 09:22:03 -04:00

coplay

feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)

2026-10-06 09:42:35 -04:00

coverart

refactor(server): unify stream URL builders + MIME tables + cover-path helper

2026-06-04 08:29:51 -04:00

db

feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)

2026-10-06 09:42:35 -04:00

dbtest

feat(admin): fingerprinting settings — on/off, length, match threshold, concurrency, sweep interval (M400 #3913)

2026-09-11 17:53:55 -04:00

eventbus

feat(#392): SSE event stream foundation — eventbus + /api/events/stream

2026-05-12 20:44:37 -04:00

gc

feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)

2026-10-06 09:42:35 -04:00

library

feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)

2026-10-06 09:42:35 -04:00

lidarr

fix(player+lidarr): mini-player sync race; durable approve + dedup

2026-05-18 12:24:20 -04:00

lidarrconfig

feat(admin): metadata-profile picker on integrations page

2026-05-02 00:09:13 -04:00

lidarrquarantine

feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)

2026-10-06 09:42:35 -04:00

lidarrrequests

feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)

2026-10-06 09:42:35 -04:00

logging

feat(skel): slog logger factory with text|json format and level parsing

2026-04-18 21:20:10 +00:00

mailer

fix(ci): mailer + audit lint + settings Save button collision

2026-05-07 18:15:39 -04:00

mood

feat(taste): mood taste facet — #1534

2026-07-14 10:32:41 -04:00

netsettings

fix(auth): build password-reset links from an operator-set public address, never the Host header (M462 #4981)

2026-10-06 09:32:10 -04:00

playevents

feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)

2026-10-06 09:42:35 -04:00

playlists

feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)

2026-10-06 09:42:35 -04:00

playsessions

feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)

2026-10-06 09:42:35 -04:00

reacquisition

feat(library): a missing file asks Lidarr for itself, on a backoff — #2527

2026-08-16 23:53:21 -04:00

recommendation

feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)

2026-10-06 09:42:35 -04:00

recsettings

fix(recommendation): Songs-like gets its own profile so it stops wandering

2026-09-10 20:51:15 -04:00

scrobble

feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)

2026-10-06 09:42:35 -04:00

server

feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)

2026-10-06 09:42:35 -04:00

similarity

feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)

2026-10-06 09:42:35 -04:00

subsonic

feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)

2026-10-06 09:42:35 -04:00

sync

fix(library): tell clients when a file goes missing or comes back — #2704

2026-08-17 13:04:14 -04:00

tags

feat(discover): artist-tag cache for out-of-library candidates — #2376

2026-08-02 20:04:15 -04:00

taste

feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)

2026-10-06 09:42:35 -04:00

tracks

feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)

2026-10-06 09:42:35 -04:00