mirror of
https://github.com/navidrome/navidrome.git
synced 2026-07-10 01:28:50 +00:00
1e7996f5d7
Share repository read methods (Get, GetAll, Read, ReadAll, Exists, Count, CountAll) did not apply an owner filter, so non-admin users saw shares belonging to other users. The write paths already enforced per-user ownership; this brings reads in line with them. Add an addRestriction()/ownerFilter() based scope to share reads, keeping admins and the headless public-share resolution path unrestricted. Route share and player Delete through a new base-repo deleteOwned() primitive that applies the ownership predicate in the DELETE's WHERE clause (atomic, no select-then- delete window) and classifies a zero-row result as permission-denied vs not-found, mirroring updateOwned. The addRestriction helper and the write-miss classifier are hoisted onto the base repository so player and share share one implementation. Also map rest.ErrPermissionDenied and rest.ErrNotFound in the Subsonic error handler so ownership/not-found failures from the rest-backed repositories return the proper Subsonic codes (50 / 70) instead of a generic error. Covered by unit tests (persistence, subsonic error mapping) and an end-to-end cross-user sharing isolation test. |
||
|---|---|---|
| .. | ||
| backgrounds | ||
| e2e | ||
| events | ||
| nativeapi | ||
| public | ||
| subsonic | ||
| testdata | ||
| auth.go | ||
| auth_test.go | ||
| initial_setup.go | ||
| initial_setup_test.go | ||
| middlewares.go | ||
| middlewares_test.go | ||
| serve_index.go | ||
| serve_index_test.go | ||
| server.go | ||
| server_suite_test.go | ||
| server_test.go | ||
| throttle_backlog.go | ||
| throttle_backlog_test.go | ||