harden auth, playback, scanner and websocket core

[klabast]

Fixes the findings from a review of the four core subsystems. Every bug fix is guarded by a test that fails without it — 14 new test files. Full suite green, -race clean on all concurrent packages.

Stacked on nothing; branches off main. #40 (deps) is independent.

the two that matter most

The entire catalog was readable without authentication. Six library read routes — /libraries/{id}/albums, /search, /scan-status, /albums/{id}, /cover, /tracks — had no auth call at all. Anyone who could reach the port could enumerate album titles, artists, track listings and cover art; a logged-in user restricted to library 1 could read library 2 by changing the path id, because library_access was never consulted on those paths. Only the audio bytes were protected.

Root cause was structural: there was no middleware, so every handler re-implemented its own check and protection was a thing you had to remember. Authentication is now decided at route registration (auth.RequireUser / RequireAdminUser), the read paths take a userID and check access, and a table-driven test walks every registered route so a new one can't ship open.

An MPD device going offline permanently destroyed the user's queue. GetSession treated any ResolveDevice error as "orphaned session, delete it" — but a refused TCP dial returns an ordinary error just like an unknown device. Amp reboots, next page load, queue/position/history gone from the DB for good. The resolver now distinguishes ErrDeviceNotFound (delete) from ErrDeviceUnreachable (keep).

auth

• password changes revoked nothing — a stolen cookie survived the one remediation a user knows to perform. All three password paths now drop the user's other sessions.
• auth-disabled mode handed any caller on the network full admin over user management, password reset and the auth toggle itself, and the damage outlived the toggle. Privilege-granting surfaces now require a real signed-in admin regardless of the setting. audiod system auth on is the new recovery path when no session exists, so tightening this can't lock an owner out.
• jwt secret: no length check (a truncated file meant an empty HMAC key and forgeable stream tokens), any read error regenerated and destroyed the existing secret, and log.Fatalf ran inside live requests. Resolved once at startup now.
• reset codes are no longer logged in plaintext, the response no longer discloses the data dir, expired code files get cleaned up.
• setup TOCTOU could create two admins; rate limiting on the credential endpoints; cookie Secure derived from the request; expired sessions swept by a job.
• handler.go (947 lines) split by concern.

playback

• playing on a second device never stopped the first — two devices played at once and nothing referenced the orphan any more.
• a failed auto-advance wedged playback forever, logged at Debug.
• session read-modify-write had no serialization: a volume change raced the 1 Hz poller and lost, then got broadcast back so the slider snapped. Per-user locking, ordered user→device.
• the resolver held one global lock across MPD I/O with no timeouts, so one vanished host wedged playback for every user. Per-device locking + dial/command timeouts.
• transfer-while-paused validated nothing; Previous ignored session state; Next never stopped the device at end of queue; connections and poller entries leaked; supportsVolume raced.
• status codes were wrong across the board (everything 404, so "MPD down" read as "no session") and wrapped errors echoed MPD host addresses to clients.

scanner

• a failed job update spun processPendingScans forever with no backoff and no stop check — and since the SQLite pool is pinned to one connection, that starved every HTTP request. Reproduced at ~69k calls in 1.5s.
• one corrupt audio file panicked the worker goroutine and killed the process, which then crash-looped on the same file. Nothing in the server recovered.
• Stop() could return while the next job was starting, letting main close the DB mid-scan.
• resumed scans double-counted (a progress bar reading 186%).
• deleted files were never removed from the library or the FTS index. Removal is skipped when the walk couldn't read every path — an unmounted share is indistinguishable from a mass delete, and that mistake is unrecoverable.

websocket

• a full send buffer disconnected the client, so backgrounded tabs and phones on weak links were kicked and reconnected for the length of every scan. Slow readers now drop messages, not connections, and the progress throttle at the source is time-bounded instead of firing every 10 files.
• targeted sends were dropped silently, so a playback handoff could report success while the target never got it.
• no SetReadLimit (unbounded allocation from any peer); handler callbacks raced; a panic in a scheduled job or WS handler killed the process.

dead code and duplication

• deleted ~750 lines: library/scanner.go (a drifted duplicate of the real scanner, and the only reason library depended on websocket), ffmpeg/extractor.go, playback/repository.go, and a ScanLibrary stub whose tests asserted the no-op.
• library scan --follow never followed — the loop broke unconditionally with the sleep commented out.
• album sort fields had four definitions, library name/path rules five. One source each now.
• the two library forms hardcoded English while every other form used paraglide.
• gofmt across the tree (15 files were dirty).

verification

gofmt -l .        clean          npm run check   0 errors
go vet ./...      clean          npm run lint    pass
go test ./...     all pass       npm test        113 pass
go test -race     all pass       npm run build   pass

Behaviour changes worth knowing: playback status codes moved off blanket-404, and the password-reset response no longer returns filePath (the UI now points at the data dir instead of printing the absolute path). Neither breaks the E2E suite — it reads reset codes off disk. Two orphaned step definitions that parsed the code out of the server log were removed, since the code is no longer logged.

🤖 Generated with Claude Code

---

follow-ups in this branch

Rate limits are asymmetric, on purpose. 10 failures / 15 min is right for one account, but the per-IP bucket aggregates every account behind one address — a household NAT, a reverse proxy — so holding it to the same number locks out a whole house because one person mistyped. Per-account stays at 10; per-IP goes to 50 (still 200/hour against an unknown password). Reset-code confirmation keeps the tight bound in its own scope, since it has no username to key on and the code is the credential.

This also matters for E2E: three device passes run against one server from one address and accumulate ~12 credential failures across the login, change-password and sudo scenarios. Acceptance only runs post-merge, so the old shared limit would have broken main, not this PR.

CreateFirstAdmin is on the Repository interface, not an optional one behind a type assertion. As written, a store that didn't implement it silently fell back to the check-then-insert the atomic version exists to replace — the vulnerable path stayed in the tree with nothing indicating which one you were on. Now it either implements it or doesn't compile.