bvandeusenandClaude Opus 5.5 327d49428f feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983) ...

users.api_token held each user's apiKey in plaintext and was looked up by
equality, so a leaked row or backup handed out working keys. Migration
0063 replaces it with api_token_hash (sha256, hex), computed in place
from the existing keys so every Subsonic client keeps working.

The key can no longer be read back: GET /api/me/api-token is gone, and
POST returns the new key once. Settings shows it right after Regenerate
with a copy button and a "won't be shown again" note.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-06 09:42:35 -04:00

..

build

feat(web): scaffold SvelteKit SPA with Tailwind + adapter-static

2026-04-22 09:26:36 -04:00

scripts

test(web/m7-362): tokens-to-css generator unit test

2026-05-03 13:52:13 -04:00

src

feat(auth): store Subsonic API keys hashed; a new key is shown once (M462 #4983)

2026-10-06 09:42:35 -04:00

static

fix(web): vendor the web fonts instead of loading them from Google

2026-09-09 13:49:47 -04:00

.gitignore

refactor(web): extract design tokens to tokens.json source of truth

2026-05-02 14:55:46 -04:00

csp_test.go

feat(server): security headers and a hash-based CSP for the web app (M462 #4980)

2026-10-06 09:29:26 -04:00

csp.go

feat(server): security headers and a hash-based CSP for the web app (M462 #4980)

2026-10-06 09:29:26 -04:00

embed_test.go

fix(server,web): update test fixtures for new New/Handler signatures

2026-05-03 18:44:34 -04:00

embed.go

feat(server): security headers and a hash-based CSP for the web app (M462 #4980)

2026-10-06 09:29:26 -04:00

package-lock.json

chore(deps): Tier A cross-ecosystem patch/minor sweep

2026-05-20 12:58:24 -04:00

package.json

chore(deps): Tier A cross-ecosystem patch/minor sweep

2026-05-20 12:58:24 -04:00

postcss.config.cjs

feat(web): scaffold SvelteKit SPA with Tailwind + adapter-static

2026-04-22 09:26:36 -04:00

svelte.config.js

refactor(web): sweep 8 test files to use pageUrlModule() (#375)

2026-05-10 15:39:25 -04:00

tailwind.config.js

feat(web/m7-362): add Tailwind text-action-fg alias for non-flipping label color

2026-05-03 13:40:20 -04:00

template_test.go

test(server/m7-363): script-context XSS test asserts </script> count

2026-05-03 17:24:42 -04:00

template.go

feat(server/m7-363): branding-aware index handler with html/template

2026-05-03 17:21:30 -04:00

tsconfig.json

feat(web): add Shell component with header, sidebar, and user menu

2026-04-22 22:20:18 -04:00

vite.config.ts

refactor(web): drive vite-injected theme-color from tokens.json (#375)

2026-05-10 15:29:48 -04:00

vitest.config.ts

test(web): un-skip discover/requests route tests — mock $app (#374)

2026-05-19 15:42:11 -04:00

vitest.setup.ts

test(web): no-op scrollIntoView in vitest setup (jsdom lacks it) — #1931

2026-07-22 21:27:35 -04:00