release / govulncheck (push) Successful in 28s
release / web (push) Successful in 1m18s
release / go (push) Successful in 1m35s
release / android (push) Successful in 4m45s
release / Build signed APK (push) Successful in 4m57s
release / integration (push) Successful in 5m3s
release / Attach APK to the Release (tag releases only) (push) Skipped
release / Build + push container image (push) Successful in 1m14s
release / Verify release artifacts (tag releases only) (push) Skipped
Minstrel keeps credentials it has to read back: indexer, Prowlarr and download-client keys and passwords, the AcoustID key, cover-art and tag provider keys, the SMTP password, and each user's ListenBrainz token and Subsonic password. They were stored in the clear; they are now sealed with AES-256-GCM under a per-column HKDF key derived from the stream secret, each value bound to its row. - internal/secret: Seal/Open/Reveal, and Columns, the one list of sealed columns (a backup will leave them out). Install takes the master key at startup; SealStored seals any value still in the clear, so an existing database is brought over in place on the first boot. - Every write seals and every read opens: acquire (one read path, getService / usableServices), acoustid settings, SMTP, ListenBrainz, Subsonic auth and password generation, cover-art and tag provider settings. - A value that does not open (the stream secret changed) is logged and reads as unset, to be entered again in Settings. docs/security.md says so. - Tests: secret unit tests (wrong owner/purpose/key, malformed, no key), a SealStored integration test over all eight columns plus a schema check that each listed column exists, and the existing tests now assert sealed storage. dbtest installs a test key for integration tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
46 lines
1.5 KiB
Go
46 lines
1.5 KiB
Go
package acquire
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"github.com/jackc/pgx/v5/pgxpool"
|
|
|
|
"git.fabledsword.com/bvandeusen/minstrel/internal/db/dbq"
|
|
"git.fabledsword.com/bvandeusen/minstrel/internal/release"
|
|
)
|
|
|
|
// Build makes a Service from the settings as they stand: every enabled
|
|
// search source behind one paced Fanout, the first enabled download client,
|
|
// and the quality profile. Built afresh for each pass and each request, so a
|
|
// changed setting takes effect on the next one.
|
|
func Build(ctx context.Context, pool *pgxpool.Pool) (*Service, dbq.AcquisitionSetting, error) {
|
|
q := dbq.New(pool)
|
|
settings, err := q.GetAcquisitionSettings(ctx)
|
|
if err != nil {
|
|
return nil, settings, fmt.Errorf("acquire: read settings: %w", err)
|
|
}
|
|
sources, err := Sources(ctx, pool)
|
|
if err != nil {
|
|
return nil, settings, fmt.Errorf("acquire: read search sources: %w", err)
|
|
}
|
|
clients, err := usableServices(ctx, q, JobDownload)
|
|
if err != nil {
|
|
return nil, settings, fmt.Errorf("acquire: read download clients: %w", err)
|
|
}
|
|
s := &Service{Profile: release.NewProfile(settings.AllowedQualities), Memory: NewMemory(pool)}
|
|
fan := &Fanout{Sources: sources, Pace: SearchPace}
|
|
if len(sources) > 0 {
|
|
s.Search = fan
|
|
}
|
|
if len(clients) > 0 {
|
|
row := clients[0]
|
|
client, err := DownloadClient(row)
|
|
if err != nil {
|
|
return nil, settings, fmt.Errorf("acquire: download client %s: %w", row.Code, err)
|
|
}
|
|
s.Grabber = &Downloader{Client: client, Code: row.Code, Landing: row.LocalPath, Fetch: fan}
|
|
}
|
|
return s, settings, nil
|
|
}
|