Deluan Quintão fa138afea5 fix(playlist/share): apply user library access to import and sharing paths (#5640) ... * fix(playlist): respect the user's library access when resolving M3U paths FindByPaths looked up paths across all libraries, so importing an M3U could add tracks from libraries the importing user has no access to. Apply the user's library filter to the lookup, matching every other media_file read. Admins and the (admin-context) scanner are unaffected. * fix(share): scope shared playlist tracks to the owner's libraries loadMedia loaded playlist tracks with a fake-admin context, so a shared playlist could include tracks from libraries the owner has no access to. Load as the share owner instead, so the library filter applies. Admin-owned shares are unchanged. * fix(share): only serve shared tracks the owner can access A shared stream fetched the media file by id without checking the share owner's library access, so it could serve tracks from libraries the owner has no access to. Gate share-scoped streams on the owner's library access. Non-share streams are unaffected. * test(share): tidy library-access test setup Consolidate the repeated share-owner test fixture in handleStream into a helper, assert on track fields with HaveField instead of building an id slice, and delete the scratch media file through the public repository method. * style: trim verbose comments in library-access checks * fix(share): guard against nil owner and clean up test users Add a nil check after loading the share owner so a missing user yields a clear error instead of a possible nil dereference, and delete the users created by the new tests in their AfterEach blocks. * fix(share): avoid panic when a shared playlist is no longer visible to its owner Tracks() returns nil when the playlist can't be loaded under the owner's context (e.g. a public playlist shared by a non-owner that was later made private). Capture the result and return early instead of chaining GetAll on a nil repository, leaving the share with no tracks.		2026-06-23 18:53:51 -04:00
..
handle_downloads.go	Replace all utils.Param* with req.Params	2023-12-21 17:41:09 -05:00
handle_images.go	fix(server): use http.TimeFormat for Last-Modified header (#5219)	2026-03-17 08:04:47 -04:00
handle_images_test.go	refactor(auth): replace untyped JWT claims with typed Claims struct	2026-03-02 14:03:27 -05:00
handle_shares.go	fix(sharing): validate JWT expiration and share existence on stream endpoint (#5426)	2026-04-27 19:36:57 -04:00
handle_streams.go	fix(playlist/share): apply user library access to import and sharing paths (#5640)	2026-06-23 18:53:51 -04:00
handle_streams_test.go	fix(playlist/share): apply user library access to import and sharing paths (#5640)	2026-06-23 18:53:51 -04:00
public.go	fix(server): prevent artwork throttle token starvation on slow clients (#5472)	2026-05-06 00:12:50 -04:00
public_suite_test.go	Move artwork id encoding to public package	2023-01-16 15:24:25 -05:00