feat: add subsonic token auth and starred endpoints

internal/db/db.go

@@ -43,6 +43,10 @@ func Open(ctx context.Context, cfg config.Config) (*sql.DB, error) {
 }
 
 func Migrate(ctx context.Context, database *sql.DB) error {
+	if _, err := database.ExecContext(ctx, `CREATE TABLE IF NOT EXISTS schema_migrations (name TEXT PRIMARY KEY, applied_at TEXT NOT NULL)`); err != nil {
+		return fmt.Errorf("create schema_migrations: %w", err)
+	}
+
 	entries, err := migrationFiles.ReadDir("migrations")
 	if err != nil {
 		return fmt.Errorf("read migrations: %w", err)
@@ -57,14 +61,37 @@ func Migrate(ctx context.Context, database *sql.DB) error {
 			continue
 		}
 
+		var alreadyApplied int
+		if err := database.QueryRowContext(ctx, `SELECT COUNT(*) FROM schema_migrations WHERE name = ?`, entry.Name()).Scan(&alreadyApplied); err != nil {
+			return fmt.Errorf("check migration %s: %w", entry.Name(), err)
+		}
+		if alreadyApplied > 0 {
+			continue
+		}
+
 		sqlBytes, err := migrationFiles.ReadFile("migrations/" + entry.Name())
 		if err != nil {
 			return fmt.Errorf("read migration %s: %w", entry.Name(), err)
 		}
 
-		if _, err := database.ExecContext(ctx, string(sqlBytes)); err != nil {
+		tx, err := database.BeginTx(ctx, nil)
+		if err != nil {
+			return fmt.Errorf("begin migration %s: %w", entry.Name(), err)
+		}
+
+		if _, err := tx.ExecContext(ctx, string(sqlBytes)); err != nil {
+			_ = tx.Rollback()
 			return fmt.Errorf("apply migration %s: %w", entry.Name(), err)
 		}
+
+		if _, err := tx.ExecContext(ctx, `INSERT INTO schema_migrations (name, applied_at) VALUES (?, ?)`, entry.Name(), time.Now().UTC().Format(time.RFC3339)); err != nil {
+			_ = tx.Rollback()
+			return fmt.Errorf("record migration %s: %w", entry.Name(), err)
+		}
+
+		if err := tx.Commit(); err != nil {
+			return fmt.Errorf("commit migration %s: %w", entry.Name(), err)
+		}
 	}
 
 	return nil

internal/db/migrations/0002_subsonic_auth_secret.sql

@@ -0,0 +1 @@
+ALTER TABLE users ADD COLUMN subsonic_auth_secret TEXT;

internal/db/seed.go

@@ -11,6 +11,7 @@ import (
 
 	"golang.org/x/crypto/bcrypt"
 
+	"github.com/benya/temporserv/internal/auth"
 	"github.com/benya/temporserv/internal/config"
 )
 
@@ -60,16 +61,21 @@ func seedAdmin(ctx context.Context, database *sql.DB, cfg config.Config) error {
 	if err != nil {
 		return fmt.Errorf("hash admin password: %w", err)
 	}
+	subsonicSecret, err := auth.EncryptSubsonicSecret(cfg.DefaultAdminPassword, cfg.EncryptionKey)
+	if err != nil {
+		return fmt.Errorf("encrypt admin subsonic secret: %w", err)
+	}
 
 	now := time.Now().UTC().Format(time.RFC3339)
 
 	_, err = database.ExecContext(
 		ctx,
-		`INSERT INTO users (id, username, password_hash, is_admin, created_at, last_login_at)
-		 VALUES (?, ?, ?, 1, ?, ?)`,
+		`INSERT INTO users (id, username, password_hash, subsonic_auth_secret, is_admin, created_at, last_login_at)
+		 VALUES (?, ?, ?, ?, 1, ?, ?)`,
 		"user-admin",
 		cfg.DefaultAdminUsername,
 		string(passwordHash),
+		subsonicSecret,
 		now,
 		now,
 	)