bvandeusen 7c11cdc4d1 fix(server): handleGetStream - auth check before DB lookup ...

TestRoutesRegisteredInMount failed because handleGetStream did the
DB lookup (404 on missing track) BEFORE streamAuthOk (401 on
unauth). For an unauth request to a non-existent track, the test
saw 404 and concluded the route wasn't registered when actually it
was - the handler just bailed at the lookup before auth.

Reorder: extract trackID via chi.URLParam, run streamAuthOk on the
raw path id first (the HMAC token is signed over the same id
string so we don't need the resolved row yet), then do the DB
lookup. Test now sees 401 on the unauth probe as it expected.

Also closes a small info-leak: previously a 404/401 differential
let unauth callers probe which track IDs exist. Now both unknown
and known IDs return 401 for unauth requests.

2026-06-03 13:43:28 -04:00

..

admin_cover_sources_test.go

test(coverart): fix registry-wipe + stale provider signature

2026-05-17 21:05:36 -04:00

admin_cover_sources.go

fix(server/api): preserve 500-class messages via apierror.InternalMsg

2026-05-07 20:10:18 -04:00

admin_coverage_test.go

fix: drift audit batch 1 — six small mechanical wins

2026-06-02 18:11:25 -04:00

admin_coverage.go

fix(server/api): preserve 500-class messages via apierror.InternalMsg

2026-05-07 20:10:18 -04:00

admin_coverart_research_test.go

feat(server/web/coverart): manual Re-search missing art button

2026-05-07 07:59:40 -04:00

admin_coverart_research.go

fix(server/api): preserve 500-class messages via apierror.InternalMsg

2026-05-07 20:10:18 -04:00

admin_covers_test.go

feat(coverart): #388 remove global cover-art backfill cap

2026-05-16 18:41:21 -04:00

admin_covers.go

feat(coverart): #388 remove global cover-art backfill cap

2026-05-16 18:41:21 -04:00

admin_invites_test.go

feat(server/m7-user-mgmt): admin endpoints (invites, users, promote/demote)

2026-05-07 12:01:16 -04:00

admin_invites.go

fix(server): repair go vet failures from A1+A2 cleanup (orphan imports + needle deref)

2026-05-08 10:46:43 -04:00

admin_lidarr_test.go

fix: A2 (relax art-source CHECK) + D + E integration residual

2026-05-17 20:22:30 -04:00

admin_lidarr.go

feat(server/admin): test endpoint returns profiles + folders on success

2026-05-08 23:07:15 -04:00

admin_quarantine_test.go

refactor(server/api/test): withUser helper; migrate 51 context-value sites (A3)

2026-05-08 10:40:03 -04:00

admin_quarantine.go

feat(#392): publish quarantine + playlist mutation events

2026-05-12 21:28:05 -04:00

admin_requests_test.go

fix(player+lidarr): mini-player sync race; durable approve + dedup

2026-05-18 12:24:20 -04:00

admin_requests.go

feat(#392): publish track-like + request-status events to SSE bus

2026-05-12 20:55:33 -04:00

admin_scan_schedule_test.go

test(server/m7-recurring-scans): TZ-tolerant next-fire assertion

2026-05-06 22:59:23 -04:00

admin_scan_schedule.go

fix(server/api): preserve 500-class messages via apierror.InternalMsg

2026-05-07 20:10:18 -04:00

admin_scan_test.go

feat(server/m7-381): admin scan-status + manual trigger endpoints

2026-05-04 20:13:31 -04:00

admin_scan.go

fix(server/api): preserve 500-class messages via apierror.InternalMsg

2026-05-07 20:10:18 -04:00

admin_smtp_test.go

feat(server/m7-user-mgmt): mailer package + SMTP config endpoints (U3)

2026-05-07 12:43:44 -04:00

admin_smtp.go

refactor(server/api): migrate admin_smtp/admin_tracks + playlist refresh preludes (A2 6/N)

2026-05-08 10:18:35 -04:00

admin_tracks_test.go

refactor(server/api/test): withUser helper; migrate 51 context-value sites (A3)

2026-05-08 10:40:03 -04:00

admin_tracks.go

fix(server): repair go vet failures from A1+A2 cleanup (orphan imports + needle deref)

2026-05-08 10:46:43 -04:00

admin_users_test.go

fix: A2 (relax art-source CHECK) + D + E integration residual

2026-05-17 20:22:30 -04:00

admin_users.go

refactor(server/api): prelude helpers (requireUser/requireURLUUID/decodeBody); migrate admin_users.go (A2 1/N)

2026-05-08 08:17:35 -04:00

api.go

feat(server): POST /api/cast/stream-token + secret bootstrap (UPnP slice 2/6)

2026-06-03 11:46:57 -04:00

auth_forgot_test.go

feat(server/m7-user-mgmt): forgot + reset password endpoints (U3)

2026-05-07 12:49:30 -04:00

auth_forgot.go

refactor(server): audit.WriteOrLog wrapper; migrate 13 sites (T5)

2026-05-07 21:33:14 -04:00

auth_register_test.go

feat(server/m7-user-mgmt): self-registration handler

2026-05-07 11:56:19 -04:00

auth_register.go

feat(playlists): wire Refresh into PUT /api/me/timezone + registration

2026-05-13 11:58:24 -04:00

auth_reset_test.go

feat(server/m7-user-mgmt): forgot + reset password endpoints (U3)

2026-05-07 12:49:30 -04:00

auth_reset.go

refactor(server): audit.WriteOrLog wrapper; migrate 13 sites (T5)

2026-05-07 21:33:14 -04:00

auth_test.go

refactor(server/api/test): withUser helper; migrate 51 context-value sites (A3)

2026-05-08 10:40:03 -04:00

auth.go

refactor(server/api): migrate auth/me handlers to writeErr(err) (T3a)

2026-05-07 20:25:26 -04:00

cast_token_test.go

feat(server): POST /api/cast/stream-token + secret bootstrap (UPnP slice 2/6)

2026-06-03 11:46:57 -04:00

cast_token.go

feat(server): POST /api/cast/stream-token + secret bootstrap (UPnP slice 2/6)

2026-06-03 11:46:57 -04:00

client_assets_test.go

fix(server,web): auth-gate client APK + version endpoints + per-user rate limit (#397)

2026-05-10 20:28:27 -04:00

client_assets.go

fix(server,web): auth-gate client APK + version endpoints + per-user rate limit (#397)

2026-05-10 20:28:27 -04:00

convert_test.go

style: gofmt fixes across api package

2026-04-21 23:02:20 -04:00

convert.go

fix(server): forward-fix CI — gofmt convert/types + rename unused r in enricher_test

2026-05-04 17:41:16 -04:00

errors_test.go

refactor(server/api): writeErr accepts error; migrate admin handlers (1/3)

2026-05-07 19:48:25 -04:00

errors.go

refactor(server/api): writeErr accepts error; migrate admin handlers (1/3)

2026-05-07 19:48:25 -04:00

events_publish.go

feat(#392): publish quarantine + playlist mutation events

2026-05-12 21:28:05 -04:00

events_stream.go

feat(#392): SSE event stream foundation — eventbus + /api/events/stream

2026-05-12 20:44:37 -04:00

events_test.go

fix(server/api/test): drop unused 'context' imports A3 sed left behind

2026-05-08 11:29:36 -04:00

events.go

feat(playevents): #426B server — RecordOfflinePlay + /api/events play_offline

2026-05-15 11:14:21 -04:00

home_test.go

feat(api): GET /api/home/index for per-item rendering (Slice B)

2026-05-13 20:41:44 -04:00

home.go

feat(api): GET /api/home/index for per-item rendering (Slice B)

2026-05-13 20:41:44 -04:00

library_albums_test.go

feat(api): add GET /api/library/albums handler

2026-05-01 18:00:59 -04:00

library_albums.go

refactor(server/api): migrate library/media handlers to writeErr(err) (T3b)

2026-05-07 20:48:20 -04:00

library_fixtures_test.go

feat(api): add GET/PUT /api/me/listenbrainz endpoints

2026-04-28 09:27:06 -04:00

library_sync_test.go

fix(server): wrap defer tx.Rollback for errcheck + gofmt -s alignment

2026-05-09 22:47:25 -04:00

library_sync_views_test.go

fix(server,flutter): sync wire format + systemVariant column (#357)

2026-05-10 18:47:30 -04:00

library_sync_views.go

fix(server,flutter): sync wire format + systemVariant column (#357)

2026-05-10 18:47:30 -04:00

library_sync.go

fix(server,flutter): sync wire format + systemVariant column (#357)

2026-05-10 18:47:30 -04:00

library_test.go

fix(server): TestRoutesRegisteredInMount - missing streamSecret arg

2026-06-03 13:30:36 -04:00

library.go

feat(offline): #427 S4a — Shuffle all + offline system-playlist gate

2026-05-15 21:37:29 -04:00

lidarr_test.go

fix(api): gofmt + revive cleanup on lidarr search handler

2026-04-29 17:35:45 -04:00

lidarr.go

refactor(server): final writeErr migration + ErrNotFound aliases (T3c)

2026-05-07 21:19:35 -04:00

likes_test.go

refactor(server/api/test): withUser helper; migrate 51 context-value sites (A3)

2026-05-08 10:40:03 -04:00

likes.go

feat(#402): publish album/artist like events on the SSE bus

2026-05-13 14:27:23 -04:00

listenbrainz_test.go

feat(api): add GET/PUT /api/me/listenbrainz endpoints

2026-04-28 09:27:06 -04:00

listenbrainz.go

refactor(server/api): migrate requests/quarantine/me_token/listenbrainz/admin_invites preludes (A2 3/N)

2026-05-08 08:26:43 -04:00

me_history_test.go

fix(server/m7-365): silence unused-pool-param lint in history test

2026-05-04 07:05:49 -04:00

me_history.go

refactor(server/api): migrate me/* + events preludes (A2 5/N)

2026-05-08 08:44:50 -04:00

me_password_test.go

feat(server/m7-user-mgmt): self-service /me endpoints (U3)

2026-05-07 12:38:48 -04:00

me_password.go

refactor(server/api): migrate me/* + events preludes (A2 5/N)

2026-05-08 08:44:50 -04:00

me_profile_test.go

feat(server/m7-user-mgmt): self-service /me endpoints (U3)

2026-05-07 12:38:48 -04:00

me_profile.go

refactor(server/api): migrate me/* + events preludes (A2 5/N)

2026-05-08 08:44:50 -04:00

me_system_playlists_test.go

feat(server/m7-352): GET /api/me/system-playlists-status for home placeholders

2026-05-04 18:13:13 -04:00

me_system_playlists.go

refactor(server/api): migrate me/* + events preludes (A2 5/N)

2026-05-08 08:44:50 -04:00

me_test.go

fix(server): drift #578 — /api/me returns profile shape with display_name + email

2026-06-02 18:24:23 -04:00

me_timezone_test.go

fix: A2 (relax art-source CHECK) + D + E integration residual

2026-05-17 20:22:30 -04:00

me_timezone.go

feat(playlists): wire Refresh into PUT /api/me/timezone + registration

2026-05-13 11:58:24 -04:00

me_token_test.go

feat(server/m7-user-mgmt): self-service /me endpoints (U3)

2026-05-07 12:38:48 -04:00

me_token.go

refactor(server/api): migrate requests/quarantine/me_token/listenbrainz/admin_invites preludes (A2 3/N)

2026-05-08 08:26:43 -04:00

me.go

fix(server): drift #578 — /api/me returns profile shape with display_name + email

2026-06-02 18:24:23 -04:00

media_test.go

fix(server,web/m7-353): post-review fixes (test compilation, AlbumRef field, bulk handler, design system)

2026-05-04 15:21:24 -04:00

media.go

fix(server): handleGetStream - auth check before DB lookup

2026-06-03 13:43:28 -04:00

playback_errors.go

feat(server): playback_errors table + admin inbox endpoints

2026-06-02 11:25:50 -04:00

playlists_system_shuffle.go

refactor(playlists): #411 R2 — generic registry-driven system endpoints

2026-05-15 13:21:09 -04:00

playlists_system_test.go

fix: A2 (relax art-source CHECK) + D + E integration residual

2026-05-17 20:22:30 -04:00

playlists_test.go

refactor(server/api/test): withUser helper; migrate 51 context-value sites (A3)

2026-05-08 10:40:03 -04:00

playlists.go

style: gofmt playlists.go after Refreshable field add (#411 R2)

2026-05-15 13:33:52 -04:00

prelude.go

fix: A2 (relax art-source CHECK) + D + E integration residual

2026-05-17 20:22:30 -04:00

quarantine_test.go

feat(api): /api/quarantine user + admin endpoints + Service wiring

2026-04-30 20:19:39 -04:00

quarantine.go

feat(#392): publish quarantine + playlist mutation events

2026-05-12 21:28:05 -04:00

radio_test.go

fix(server/api/test): retype callRadio user param to dbq.User for withUser helper

2026-05-08 11:05:25 -04:00

radio.go

refactor(server/api): migrate library/suggestions/radio/home preludes (A2 4/N)

2026-05-08 08:43:36 -04:00

requests_test.go

fix(server): repair recursive withUser, gofmt 2 files (golangci-lint)

2026-05-08 12:05:35 -04:00

requests.go

feat(#392): publish track-like + request-status events to SSE bus

2026-05-12 20:55:33 -04:00

resolve_test.go

fix(server/api): silence unused-parameter lint in resolve_test fakes

2026-05-07 22:18:40 -04:00

resolve.go

refactor(server/api): resolveByID helper for parseUUID->fetch->404 (T4)

2026-05-07 21:28:20 -04:00

search_test.go

feat(api): GET /api/search with three paged facets

2026-04-21 08:29:28 -04:00

search.go

fix(server): repair go vet failures from A1+A2 cleanup (orphan imports + needle deref)

2026-05-08 10:46:43 -04:00

stream_token_test.go

feat(server): HMAC stream token auth path (UPnP slice 1/6)

2026-06-03 11:34:02 -04:00

stream_token.go

fix(server): errcheck violations from UPnP slice

2026-06-03 13:41:54 -04:00

suggestions_test.go

feat(api): /api/discover/suggestions handler

2026-05-01 06:23:08 -04:00

suggestions.go

feat(discover): on-demand Lidarr artist art for suggestions

2026-05-16 20:16:56 -04:00

types.go

feat(api): GET /api/home/index for per-item rendering (Slice B)

2026-05-13 20:41:44 -04:00