bvandeusenandClaude Opus 5.5 3bfddd0862 feat(auth): throttle login, register, password reset and Subsonic auth failures (M462 #4976) ...

Every password-shaped check was mounted bare, so guessing was limited only
by bcrypt cost. A shared in-memory AttemptLimiter now sits in front of them:

- login: 10 failures per account and 50 per address per 15 min, checked
  before the user lookup and bcrypt; 429 with Retry-After. A success clears
  the account's count but not the address's.
- unknown usernames run a dummy bcrypt compare, so timing no longer says
  which accounts exist.
- register: 10 per address per hour; forgot-password: 5 per address and 3
  per email per hour (applied whether or not the email matches); reset: 20
  failed tokens per address per 15 min.
- Subsonic /rest: same limits as login, counting only wrong credentials,
  since clients authenticate on every request.

Web login, register, reset and forgot-password screens say how long to
wait; web and Android carry copy for the rate_limited code.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-06 08:28:29 -04:00

..

admin_cover_sources_test.go

test(coverart): fix registry-wipe + stale provider signature

2026-05-17 21:05:36 -04:00

admin_cover_sources.go

fix(server/api): preserve 500-class messages via apierror.InternalMsg

2026-05-07 20:10:18 -04:00

admin_coverage_test.go

fix: drift audit batch 1 — six small mechanical wins

2026-06-02 18:11:25 -04:00

admin_coverage.go

feat(admin): fingerprinting settings — on/off, length, match threshold, concurrency, sweep interval (M400 #3913)

2026-09-11 17:53:55 -04:00

admin_coverart_research_test.go

feat(server/web/coverart): manual Re-search missing art button

2026-05-07 07:59:40 -04:00

admin_coverart_research.go

fix(server/api): preserve 500-class messages via apierror.InternalMsg

2026-05-07 20:10:18 -04:00

admin_covers_test.go

feat(coverart): #388 remove global cover-art backfill cap

2026-05-16 18:41:21 -04:00

admin_covers.go

feat(coverart): #388 remove global cover-art backfill cap

2026-05-16 18:41:21 -04:00

admin_duplicates_test.go

feat(admin): the duplicates report — review proposed duplicate groups (M400 #3912)

2026-09-11 17:11:11 -04:00

admin_duplicates.go

feat(admin): fingerprinting settings — on/off, length, match threshold, concurrency, sweep interval (M400 #3913)

2026-09-11 17:53:55 -04:00

admin_fingerprint_settings_test.go

feat(admin): fingerprinting settings — on/off, length, match threshold, concurrency, sweep interval (M400 #3913)

2026-09-11 17:53:55 -04:00

admin_fingerprint_settings.go

feat(admin): fingerprinting settings — on/off, length, match threshold, concurrency, sweep interval (M400 #3913)

2026-09-11 17:53:55 -04:00

admin_invites_test.go

feat(server/m7-user-mgmt): admin endpoints (invites, users, promote/demote)

2026-05-07 12:01:16 -04:00

admin_invites.go

fix(server): repair go vet failures from A1+A2 cleanup (orphan imports + needle deref)

2026-05-08 10:46:43 -04:00

admin_library_missing_test.go

feat(api): admin surface for files the library has lost — #2527

2026-08-16 11:48:45 -04:00

admin_library_missing.go

feat: show what re-acquisition has done, per folder — #2527

2026-08-17 00:19:48 -04:00

admin_lidarr_test.go

fix: A2 (relax art-source CHECK) + D + E integration residual

2026-05-17 20:22:30 -04:00

admin_lidarr.go

feat(server/admin): test endpoint returns profiles + folders on success

2026-05-08 23:07:15 -04:00

admin_network.go

feat(net): trusted-proxy depth so real client IPs survive a proxy — #2453

2026-08-05 10:07:43 -04:00

admin_quarantine_test.go

fix(library): a track delete that cannot remove its file deletes nothing — #3918

2026-09-11 14:23:01 -04:00

admin_quarantine.go

fix(library): a track delete that cannot remove its file deletes nothing — #3918

2026-09-11 14:23:01 -04:00

admin_reacquisition.go

feat(api): admin endpoints for the re-acquisition policy — #2527

2026-08-17 00:02:41 -04:00

admin_recommendation_trends_test.go

feat(tuning): weekly trend view — per-surface series + knob-turn markers

2026-07-03 09:29:33 -04:00

admin_recommendation_trends.go

feat(tuning): weekly trend view — per-surface series + knob-turn markers

2026-07-03 09:29:33 -04:00

admin_recommendation_tuning_test.go

feat(tuning): scoring weights → DB-backed admin tuning lab

2026-07-03 09:22:03 -04:00

admin_recommendation_tuning.go

fix(recommendation): Songs-like gets its own profile so it stops wandering

2026-09-10 20:51:15 -04:00

admin_requests_test.go

fix(player+lidarr): mini-player sync race; durable approve + dedup

2026-05-18 12:24:20 -04:00

admin_requests.go

feat(#392): publish track-like + request-status events to SSE bus

2026-05-12 20:55:33 -04:00

admin_scan_test.go

feat(server/m7-381): admin scan-status + manual trigger endpoints

2026-05-04 20:13:31 -04:00

admin_scan.go

fix(server/api): preserve 500-class messages via apierror.InternalMsg

2026-05-07 20:10:18 -04:00

admin_smtp_test.go

feat(server/m7-user-mgmt): mailer package + SMTP config endpoints (U3)

2026-05-07 12:43:44 -04:00

admin_smtp.go

refactor(server/api): migrate admin_smtp/admin_tracks + playlist refresh preludes (A2 6/N)

2026-05-08 10:18:35 -04:00

admin_tag_sources_test.go

feat(api): admin tag-sources endpoints (#1490 Step 4 backend)

2026-07-13 22:24:28 -04:00

admin_tag_sources.go

feat(api): admin tag-sources endpoints (#1490 Step 4 backend)

2026-07-13 22:24:28 -04:00

admin_tracks_test.go

refactor(server/api/test): withUser helper; migrate 51 context-value sites (A3)

2026-05-08 10:40:03 -04:00

admin_tracks.go

fix(library): a track delete that cannot remove its file deletes nothing — #3918

2026-09-11 14:23:01 -04:00

admin_users_test.go

fix: A2 (relax art-source CHECK) + D + E integration residual

2026-05-17 20:22:30 -04:00

admin_users.go

feat(server/diagnostics): device debug-reporting ingest + admin timeline + retention (M9)

2026-06-29 18:38:56 -04:00

api.go

feat(auth): throttle login, register, password reset and Subsonic auth failures (M462 #4976)

2026-10-06 08:28:29 -04:00

auth_forgot_test.go

feat(server/m7-user-mgmt): forgot + reset password endpoints (U3)

2026-05-07 12:49:30 -04:00

auth_forgot.go

feat(auth): throttle login, register, password reset and Subsonic auth failures (M462 #4976)

2026-10-06 08:28:29 -04:00

auth_register_test.go

feat(server/m7-user-mgmt): self-registration handler

2026-05-07 11:56:19 -04:00

auth_register.go

feat(auth): throttle login, register, password reset and Subsonic auth failures (M462 #4976)

2026-10-06 08:28:29 -04:00

auth_reset_test.go

feat(server/m7-user-mgmt): forgot + reset password endpoints (U3)

2026-05-07 12:49:30 -04:00

auth_reset.go

feat(auth): throttle login, register, password reset and Subsonic auth failures (M462 #4976)

2026-10-06 08:28:29 -04:00

auth_test.go

feat(auth): throttle login, register, password reset and Subsonic auth failures (M462 #4976)

2026-10-06 08:28:29 -04:00

auth.go

feat(auth): throttle login, register, password reset and Subsonic auth failures (M462 #4976)

2026-10-06 08:28:29 -04:00

cast_token_test.go

test(server): seed track for cast-token tests + assert file-ext in URL

2026-06-04 07:44:33 -04:00

cast_token.go

refactor(server): unify stream URL builders + MIME tables + cover-path helper

2026-06-04 08:29:51 -04:00

client_assets_test.go

feat(version): sidecar and /api/client/version carry name, code and channel

2026-09-09 21:51:41 -04:00

client_assets.go

feat(version): sidecar and /api/client/version carry name, code and channel

2026-09-09 21:51:41 -04:00

convert_test.go

style: gofmt fixes across api package

2026-04-21 23:02:20 -04:00

convert.go

fix: stop the sync feed hiding missing files from clients — #2704

2026-08-17 12:56:31 -04:00

diagnostics.go

feat(diagnostics): 'playback' kind, newest-first sort, fix active-route subtitle

2026-06-30 16:33:01 -04:00

errors_test.go

refactor(server/api): writeErr accepts error; migrate admin handlers (1/3)

2026-05-07 19:48:25 -04:00

errors.go

feat(auth): throttle login, register, password reset and Subsonic auth failures (M462 #4976)

2026-10-06 08:28:29 -04:00

events_publish.go

feat(server): emit playlist.system_rebuilt on daily + manual system-playlist rebuild

2026-06-20 12:59:27 -04:00

events_stream.go

feat(#392): SSE event stream foundation — eventbus + /api/events/stream

2026-05-12 20:44:37 -04:00

events_test.go

fix(server/api/test): drop unused 'context' imports A3 sed left behind

2026-05-08 11:29:36 -04:00

events.go

feat(taste): device-class context conditioning — #1551

2026-07-14 12:47:59 -04:00

file_remove_error_test.go

fix(library): a track delete that cannot remove its file deletes nothing — #3918

2026-09-11 14:23:01 -04:00

file_remove_error.go

fix(library): a track delete that cannot remove its file deletes nothing — #3918

2026-09-11 14:23:01 -04:00

home_test.go

feat(api): GET /api/home/index for per-item rendering (Slice B)

2026-05-13 20:41:44 -04:00

home.go

feat(server): "You might like" album/artist Home rows (#790)

2026-06-11 19:33:46 -04:00

library_albums_test.go

feat(api): add GET /api/library/albums handler

2026-05-01 18:00:59 -04:00

library_albums.go

feat(library): genre + year browse queries and endpoints — #367

2026-08-05 13:22:30 -04:00

library_browse_test.go

fix(library): a fully-missing album leaves the year axis too — #2702

2026-08-17 13:38:08 -04:00

library_browse.go

fix(scanner): read multi-value genre frames correctly — #2499

2026-08-05 21:17:59 -04:00

library_fixtures_test.go

feat(api): add GET/PUT /api/me/listenbrainz endpoints

2026-04-28 09:27:06 -04:00

library_sync_test.go

fix(server): wrap defer tx.Rollback for errcheck + gofmt -s alignment

2026-05-09 22:47:25 -04:00

library_sync_views_test.go

fix: stop the sync feed hiding missing files from clients — #2704

2026-08-17 12:56:31 -04:00

library_sync_views.go

fix: stop the sync feed hiding missing files from clients — #2704

2026-08-17 12:56:31 -04:00

library_sync.go

fix(server,flutter): sync wire format + systemVariant column (#357)

2026-05-10 18:47:30 -04:00

library_test.go

test(api): pass fingerprint settings to Mount in the route-registration test (M400 #3913)

2026-09-11 17:58:05 -04:00

library.go

feat(library): genre + year quick-jumps on album and artist detail — #367

2026-08-05 13:50:29 -04:00

lidarr_test.go

fix(api): gofmt + revive cleanup on lidarr search handler

2026-04-29 17:35:45 -04:00

lidarr.go

refactor(server): final writeErr migration + ErrNotFound aliases (T3c)

2026-05-07 21:19:35 -04:00

likes_test.go

refactor(server/api/test): withUser helper; migrate 51 context-value sites (A3)

2026-05-08 10:40:03 -04:00

likes.go

feat(#402): publish album/artist like events on the SSE bus

2026-05-13 14:27:23 -04:00

listenbrainz_test.go

feat(api): add GET/PUT /api/me/listenbrainz endpoints

2026-04-28 09:27:06 -04:00

listenbrainz.go

refactor(server/api): migrate requests/quarantine/me_token/listenbrainz/admin_invites preludes (A2 3/N)

2026-05-08 08:26:43 -04:00

me_history_test.go

fix(server/m7-365): silence unused-pool-param lint in history test

2026-05-04 07:05:49 -04:00

me_history.go

refactor(server/api): migrate me/* + events preludes (A2 5/N)

2026-05-08 08:44:50 -04:00

me_password_test.go

feat(server/m7-user-mgmt): self-service /me endpoints (U3)

2026-05-07 12:38:48 -04:00

me_password.go

refactor(server/api): migrate me/* + events preludes (A2 5/N)

2026-05-08 08:44:50 -04:00

me_profile_test.go

feat(server/m7-user-mgmt): self-service /me endpoints (U3)

2026-05-07 12:38:48 -04:00

me_profile.go

feat(server/diagnostics): device debug-reporting ingest + admin timeline + retention (M9)

2026-06-29 18:38:56 -04:00

me_recommendation_metrics_test.go

feat(discover): taste-targeted novelty bucket + rebalance toward discovery

2026-07-13 18:16:04 -04:00

me_recommendation_metrics.go

feat(metrics): publish margin of error on every delta — #2495, #2524

2026-08-06 21:08:58 -04:00

me_sessions_test.go

feat(auth): active sessions API with origin/current IP — #370

2026-08-05 09:17:40 -04:00

me_sessions.go

feat(auth): active sessions API with origin/current IP — #370

2026-08-05 09:17:40 -04:00

me_system_playlists_test.go

feat(server/m7-352): GET /api/me/system-playlists-status for home placeholders

2026-05-04 18:13:13 -04:00

me_system_playlists.go

refactor(server/api): migrate me/* + events preludes (A2 5/N)

2026-05-08 08:44:50 -04:00

me_test.go

fix(server): drift #578 — /api/me returns profile shape with display_name + email

2026-06-02 18:24:23 -04:00

me_timezone_test.go

fix: A2 (relax art-source CHECK) + D + E integration residual

2026-05-17 20:22:30 -04:00

me_timezone.go

feat(playlists): wire Refresh into PUT /api/me/timezone + registration

2026-05-13 11:58:24 -04:00

me_token_test.go

feat(server/m7-user-mgmt): self-service /me endpoints (U3)

2026-05-07 12:38:48 -04:00

me_token.go

refactor(server/api): migrate requests/quarantine/me_token/listenbrainz/admin_invites preludes (A2 3/N)

2026-05-08 08:26:43 -04:00

me.go

fix(server): drift #578 — /api/me returns profile shape with display_name + email

2026-06-02 18:24:23 -04:00

media_test.go

fix(server,web/m7-353): post-review fixes (test compilation, AlbumRef field, bulk handler, design system)

2026-05-04 15:21:24 -04:00

media.go

refactor(server): unify stream URL builders + MIME tables + cover-path helper

2026-06-04 08:29:51 -04:00

metrics_significance_test.go

feat(metrics): publish margin of error on every delta — #2495, #2524

2026-08-06 21:08:58 -04:00

metrics_significance.go

feat(metrics): publish margin of error on every delta — #2495, #2524

2026-08-06 21:08:58 -04:00

playback_errors.go

feat(server): playback_errors table + admin inbox endpoints

2026-06-02 11:25:50 -04:00

playlists_system_shuffle.go

feat(server): emit playlist.system_rebuilt on daily + manual system-playlist rebuild

2026-06-20 12:59:27 -04:00

playlists_system_test.go

fix: A2 (relax art-source CHECK) + D + E integration residual

2026-05-17 20:22:30 -04:00

playlists_test.go

refactor(server/api/test): withUser helper; migrate 51 context-value sites (A3)

2026-05-08 10:40:03 -04:00

playlists.go

feat(library): a missing file stays in the playlist, greyed and unplayable — #2527

2026-08-16 11:43:05 -04:00

prelude.go

fix: A2 (relax art-source CHECK) + D + E integration residual

2026-05-17 20:22:30 -04:00

quarantine_test.go

feat(api): /api/quarantine user + admin endpoints + Service wiring

2026-04-30 20:19:39 -04:00

quarantine.go

feat(#392): publish quarantine + playlist mutation events

2026-05-12 21:28:05 -04:00

radio_test.go

fix(server/api/test): retype callRadio user param to dbq.User for withUser helper

2026-05-08 11:05:25 -04:00

radio.go

fix(recommendation): make the candidate draw reproducible, not accidentally so

2026-09-11 08:44:33 -04:00

requests_test.go

fix(server): repair recursive withUser, gofmt 2 files (golangci-lint)

2026-05-08 12:05:35 -04:00

requests.go

feat(#392): publish track-like + request-status events to SSE bus

2026-05-12 20:55:33 -04:00

resolve_test.go

fix(server/api): silence unused-parameter lint in resolve_test fakes

2026-05-07 22:18:40 -04:00

resolve.go

refactor(server/api): resolveByID helper for parseUUID->fetch->404 (T4)

2026-05-07 21:28:20 -04:00

search_test.go

feat(api): GET /api/search with three paged facets

2026-04-21 08:29:28 -04:00

search.go

fix(server): repair go vet failures from A1+A2 cleanup (orphan imports + needle deref)

2026-05-08 10:46:43 -04:00

stream_token_test.go

feat(server): HMAC stream token auth path (UPnP slice 1/6)

2026-06-03 11:34:02 -04:00

stream_token.go

fix(server): errcheck violations from UPnP slice

2026-06-03 13:41:54 -04:00

suggestions_test.go

feat(api): /api/discover/suggestions handler

2026-05-01 06:23:08 -04:00

suggestions.go

feat(discover): rank suggestions by taste-tag overlap — #2377 (server)

2026-08-02 20:31:12 -04:00

types.go

fix: stop the sync feed hiding missing files from clients — #2704

2026-08-17 12:56:31 -04:00