package persistence
import (
"context"
"errors"
"github.com/deluan/rest"
"github.com/navidrome/navidrome/log"
"github.com/navidrome/navidrome/model"
"github.com/navidrome/navidrome/model/request"
. "github.com/onsi/ginkgo/v2"
. "github.com/onsi/gomega"
"github.com/pocketbase/dbx"
)
const testAPIKey = "nds_0123456789abcdefghijkl"
func expectAPIKeyError(err error, msg string) {
var verr *rest.ValidationError
ExpectWithOffset(1, errors.As(err, &verr)).To(BeTrue())
ExpectWithOffset(1, verr.Errors).To(HaveKeyWithValue("apiKey", msg))
}
var _ = Describe("PlayerRepository", func() {
var adminRepo *playerRepository
var database *dbx.DB
var ctx context.Context
var (
adminPlayer1 = model.Player{ID: "1", Name: "NavidromeUI [Firefox/Linux]", UserAgent: "Firefox/Linux", UserId: adminUser.ID, Username: adminUser.UserName, Client: "NavidromeUI", IP: "127.0.0.1", ReportRealPath: true, ScrobbleEnabled: true}
adminPlayer2 = model.Player{ID: "2", Name: "GenericClient [Chrome/Windows]", IP: "192.168.0.5", UserAgent: "Chrome/Windows", UserId: adminUser.ID, Username: adminUser.UserName, Client: "GenericClient", MaxBitRate: 128}
regularPlayer = model.Player{ID: "3", Name: "NavidromeUI [Safari/macOS]", UserAgent: "Safari/macOS", UserId: regularUser.ID, Username: regularUser.UserName, Client: "NavidromeUI", ReportRealPath: true, ScrobbleEnabled: false}
players = model.Players{adminPlayer1, adminPlayer2, regularPlayer}
)
BeforeEach(func() {
ctx = request.WithUser(log.NewContext(GinkgoT().Context()), adminUser)
database = GetDBXBuilder()
adminRepo = NewPlayerRepository(database).(*playerRepository)
for idx := range players {
err := adminRepo.Put(ctx, &players[idx])
Expect(err).To(BeNil())
}
})
AfterEach(func() {
players, err := adminRepo.ReadAll(ctx)
Expect(err).To(BeNil())
for i := range players {
err = adminRepo.Delete(ctx, players[i].ID)
Expect(err).To(BeNil())
}
})
Describe("FindMatch", func() {
It("finds existing match", func() {
player, err := adminRepo.FindMatch(ctx, adminUser.ID, "NavidromeUI", "Firefox/Linux")
Expect(err).To(BeNil())
Expect(*player).To(Equal(adminPlayer1))
})
It("doesn't find bad match", func() {
_, err := adminRepo.FindMatch(ctx, regularUser.ID, "NavidromeUI", "Firefox/Linux")
Expect(err).To(Equal(model.ErrNotFound))
})
})
Describe("Get", func() {
It("Gets an existing item from user", func() {
player, err := adminRepo.Get(ctx, adminPlayer1.ID)
Expect(err).To(BeNil())
Expect(*player).To(Equal(adminPlayer1))
})
It("Gets an existing item from another user", func() {
player, err := adminRepo.Get(ctx, regularPlayer.ID)
Expect(err).To(BeNil())
Expect(*player).To(Equal(regularPlayer))
})
It("does not get nonexistent item", func() {
_, err := adminRepo.Get(ctx, "i don't exist")
Expect(err).To(Equal(model.ErrNotFound))
})
})
DescribeTableSubtree("per context", func(admin bool, players model.Players, userPlayer model.Player, otherPlayer model.Player) {
var repo *playerRepository
var repoCtx context.Context
BeforeEach(func() {
repoCtx = ctx
if admin {
repo = adminRepo
} else {
repoCtx = request.WithUser(ctx, regularUser)
repo = NewPlayerRepository(database).(*playerRepository)
}
})
baseCount := int64(len(players))
Describe("Count", func() {
It("should return all", func() {
count, err := repo.Count(repoCtx)
Expect(err).To(BeNil())
Expect(count).To(Equal(baseCount))
})
})
Describe("Delete", func() {
It("deletes a player owned by the current user", func() {
err := repo.Delete(repoCtx, userPlayer.ID)
Expect(err).To(BeNil())
count, err := repo.Count(repoCtx)
Expect(err).To(BeNil())
Expect(count).To(Equal(baseCount - 1))
_, err = repo.Get(repoCtx, userPlayer.ID)
Expect(err).To(Equal(model.ErrNotFound))
})
It("does not delete another user's player when not admin", func() {
err := repo.Delete(repoCtx, otherPlayer.ID)
if admin {
Expect(err).To(BeNil())
Expect(repo.Count(repoCtx)).To(Equal(baseCount - 1))
_, err = repo.Get(repoCtx, otherPlayer.ID)
Expect(err).To(Equal(model.ErrNotFound))
} else {
Expect(err).To(Equal(rest.ErrPermissionDenied))
Expect(repo.Count(repoCtx)).To(Equal(baseCount))
item, err := repo.Get(repoCtx, otherPlayer.ID)
Expect(err).To(BeNil())
Expect(*item).To(Equal(otherPlayer))
}
})
It("returns not-found for a nonexistent player", func() {
err := repo.Delete(repoCtx, "i don't exist")
Expect(err).To(Equal(rest.ErrNotFound))
Expect(repo.Count(repoCtx)).To(Equal(baseCount))
})
})
Describe("Read", func() {
It("can read from current user", func() {
player, err := repo.Read(repoCtx, userPlayer.ID)
Expect(err).To(BeNil())
Expect(player).To(Equal(&userPlayer))
})
It("can read from other user or fail if not admin", func() {
player, err := repo.Read(repoCtx, otherPlayer.ID)
if admin {
Expect(err).To(BeNil())
Expect(player).To(Equal(&otherPlayer))
} else {
Expect(err).To(Equal(model.ErrNotFound))
}
})
It("does not get nonexistent item", func() {
_, err := repo.Read(repoCtx, "i don't exist")
Expect(err).To(Equal(model.ErrNotFound))
})
})
Describe("ReadAll", func() {
It("should get all items", func() {
data, err := repo.ReadAll(repoCtx)
Expect(err).To(BeNil())
Expect(model.Players(data)).To(Equal(players))
})
})
Describe("Save", func() {
DescribeTable("item type", func(player model.Player) {
clone := player
clone.ID = ""
clone.IP = "192.168.1.1"
clone.APIKey = new(testAPIKey)
id, err := repo.Save(repoCtx, &clone)
if clone.UserId == "" {
Expect(err).To(HaveOccurred())
} else if player.UserId != userPlayer.UserId {
Expect(err).To(Equal(rest.ErrPermissionDenied))
clone.UserId = ""
} else {
Expect(err).To(BeNil())
Expect(id).ToNot(BeEmpty())
}
count, err := repo.Count(repoCtx)
Expect(err).To(BeNil())
clone.ID = id
newItem, err := repo.Get(repoCtx, id)
if clone.UserId == "" {
Expect(count).To(Equal(baseCount))
Expect(err).To(Equal(model.ErrNotFound))
} else {
Expect(count).To(Equal(baseCount + 1))
Expect(err).To(BeNil())
clone.APIKey = nil
clone.HasAPIKey = true
Expect(*newItem).To(Equal(clone))
}
},
Entry("same user", userPlayer),
Entry("other item", otherPlayer),
)
})
Describe("Update", func() {
DescribeTable("item type", func(player model.Player) {
clone := player
clone.IP = "192.168.1.1"
clone.MaxBitRate = 10000
err := repo.Update(repoCtx, clone.ID, clone, "ip")
if player.UserId == "" {
Expect(err).To(HaveOccurred())
} else if !admin && player.Username == adminPlayer1.Username {
Expect(err).To(Equal(rest.ErrPermissionDenied))
clone.IP = player.IP
} else {
Expect(err).To(BeNil())
}
clone.MaxBitRate = player.MaxBitRate
newItem, err := repo.Get(repoCtx, clone.ID)
if player.UserId == "" {
Expect(err).To(Equal(model.ErrNotFound))
} else if !admin && player.UserId == adminUser.ID {
Expect(*newItem).To(Equal(player))
} else {
Expect(*newItem).To(Equal(clone))
}
},
Entry("same user", userPlayer),
Entry("other item", otherPlayer),
Entry("fake item", model.Player{}),
)
})
},
Entry("admin context", true, players, adminPlayer1, regularPlayer),
Entry("regular context", false, model.Players{regularPlayer}, regularPlayer, adminPlayer1),
)
Describe("API keys", func() {
const key = testAPIKey
const otherKey = "nds_ABCDEFGHIJKLMNOPQRSTUV"
var ownerCtx, otherCtx context.Context
BeforeEach(func() {
ownerCtx = request.WithUser(log.NewContext(GinkgoT().Context()), regularUser)
otherCtx = request.WithUser(log.NewContext(GinkgoT().Context()), thirdUser)
})
storedHash := func(id string) string {
var row struct {
Hash string `db:"api_key_hash"`
}
Expect(database.NewQuery("select coalesce(api_key_hash, '') as api_key_hash from player where id = {:id}").
Bind(dbx.Params{"id": id}).One(&row)).To(Succeed())
return row.Hash
}
Describe("SetAPIKey", func() {
It("stores only the hash and finds the player by the key", func() {
Expect(adminRepo.SetAPIKey(ownerCtx, regularPlayer.ID, key)).To(Succeed())
Expect(storedHash(regularPlayer.ID)).To(Equal(hashAPIKey(key)))
plr, err := adminRepo.FindByAPIKey(ctx, key)
Expect(err).ToNot(HaveOccurred())
Expect(plr.ID).To(Equal(regularPlayer.ID))
Expect(plr.HasAPIKey).To(BeTrue())
Expect(plr.APIKey).To(BeNil())
})
It("replaces the previous key", func() {
Expect(adminRepo.SetAPIKey(ownerCtx, regularPlayer.ID, key)).To(Succeed())
Expect(adminRepo.SetAPIKey(ownerCtx, regularPlayer.ID, otherKey)).To(Succeed())
_, err := adminRepo.FindByAPIKey(ctx, key)
Expect(err).To(MatchError(model.ErrNotFound))
_, err = adminRepo.FindByAPIKey(ctx, otherKey)
Expect(err).ToNot(HaveOccurred())
})
DescribeTable("rejects malformed keys",
func(bad string) {
err := adminRepo.SetAPIKey(ownerCtx, regularPlayer.ID, bad)
expectAPIKeyError(err, "resources.player.validation.apiKeyFormat")
Expect(storedHash(regularPlayer.ID)).To(BeEmpty())
},
Entry("no prefix", "0123456789abcdefghijklmn"),
Entry("too short", "nds_short"),
Entry("too long", key+"x"),
Entry("bad chars", "nds_0123456789abcdefghij-!"),
)
It("revokes with an empty key, by the owner or an admin", func() {
Expect(adminRepo.SetAPIKey(ownerCtx, regularPlayer.ID, key)).To(Succeed())
Expect(adminRepo.SetAPIKey(ownerCtx, regularPlayer.ID, "")).To(Succeed())
Expect(storedHash(regularPlayer.ID)).To(BeEmpty())
Expect(adminRepo.SetAPIKey(ownerCtx, regularPlayer.ID, key)).To(Succeed())
Expect(adminRepo.SetAPIKey(ctx, regularPlayer.ID, "")).To(Succeed())
Expect(storedHash(regularPlayer.ID)).To(BeEmpty())
})
It("accepts revoking a player that has no key", func() {
Expect(adminRepo.SetAPIKey(ownerCtx, regularPlayer.ID, "")).To(Succeed())
})
It("does not let an admin set a key on another user's player", func() {
Expect(adminRepo.SetAPIKey(ctx, regularPlayer.ID, key)).To(MatchError(rest.ErrPermissionDenied))
Expect(storedHash(regularPlayer.ID)).To(BeEmpty())
})
It("does not let another user set or revoke", func() {
Expect(adminRepo.SetAPIKey(ownerCtx, regularPlayer.ID, key)).To(Succeed())
Expect(adminRepo.SetAPIKey(otherCtx, regularPlayer.ID, otherKey)).To(MatchError(rest.ErrPermissionDenied))
Expect(adminRepo.SetAPIKey(otherCtx, regularPlayer.ID, "")).To(MatchError(rest.ErrPermissionDenied))
Expect(storedHash(regularPlayer.ID)).To(Equal(hashAPIKey(key)))
})
It("returns not found for a missing player", func() {
Expect(adminRepo.SetAPIKey(ownerCtx, "missing", key)).To(MatchError(rest.ErrNotFound))
Expect(adminRepo.SetAPIKey(ownerCtx, "missing", "")).To(MatchError(rest.ErrNotFound))
})
It("does not find unknown or empty keys", func() {
_, err := adminRepo.FindByAPIKey(ctx, otherKey)
Expect(err).To(MatchError(model.ErrNotFound))
_, err = adminRepo.FindByAPIKey(ctx, "")
Expect(err).To(MatchError(model.ErrNotFound))
})
It("drops the key with the player", func() {
Expect(adminRepo.SetAPIKey(ownerCtx, regularPlayer.ID, key)).To(Succeed())
Expect(adminRepo.Delete(ownerCtx, regularPlayer.ID)).To(Succeed())
_, err := adminRepo.FindByAPIKey(ctx, key)
Expect(err).To(MatchError(model.ErrNotFound))
})
})
Describe("hasApiKey filter", func() {
BeforeEach(func() {
Expect(adminRepo.SetAPIKey(ownerCtx, regularPlayer.ID, key)).To(Succeed())
})
filtered := func(value string) []string {
res, err := adminRepo.ReadAll(ctx, rest.QueryOptions{Filters: map[string]any{"hasApiKey": value}})
Expect(err).ToNot(HaveOccurred())
var ids []string
for _, p := range res {
ids = append(ids, p.ID)
}
return ids
}
It("lists only players with a key", func() {
Expect(filtered("true")).To(ConsistOf(regularPlayer.ID))
count, err := adminRepo.Count(ctx, rest.QueryOptions{Filters: map[string]any{"hasApiKey": "true"}})
Expect(err).ToNot(HaveOccurred())
Expect(count).To(Equal(int64(1)))
})
It("lists only players without a key", func() {
Expect(filtered("false")).To(ConsistOf(adminPlayer1.ID, adminPlayer2.ID))
})
})
Describe("Save (create)", func() {
It("creates the player with the key, owned by the logged-in user", func() {
id, err := adminRepo.Save(ownerCtx, &model.Player{Name: "Manual player", APIKey: new(key)})
Expect(err).ToNot(HaveOccurred())
plr, err := adminRepo.FindByAPIKey(ctx, key)
Expect(err).ToNot(HaveOccurred())
Expect(plr.ID).To(Equal(id))
Expect(plr.UserId).To(Equal(regularUser.ID))
})
It("requires a key", func() {
count, _ := adminRepo.CountAll(ctx)
_, err := adminRepo.Save(ownerCtx, &model.Player{Name: "No key"})
expectAPIKeyError(err, "ra.validation.required")
_, err = adminRepo.Save(ownerCtx, &model.Player{Name: "Empty key", APIKey: new("")})
expectAPIKeyError(err, "ra.validation.required")
Expect(adminRepo.CountAll(ctx)).To(Equal(count))
})
It("rejects a malformed key without creating the player", func() {
count, _ := adminRepo.CountAll(ctx)
_, err := adminRepo.Save(ownerCtx, &model.Player{Name: "Bad", APIKey: new("nds_bad")})
expectAPIKeyError(err, "resources.player.validation.apiKeyFormat")
Expect(adminRepo.CountAll(ctx)).To(Equal(count))
})
It("does not let an admin create a keyed player for another user", func() {
count, _ := adminRepo.CountAll(ctx)
_, err := adminRepo.Save(ctx, &model.Player{Name: "For someone", UserId: regularUser.ID, APIKey: new(key)})
Expect(err).To(MatchError(rest.ErrPermissionDenied))
_, err = adminRepo.Save(ctx, &model.Player{Name: "For someone", UserId: regularUser.ID})
Expect(err).To(MatchError(rest.ErrPermissionDenied))
Expect(adminRepo.CountAll(ctx)).To(Equal(count))
})
It("rejects a key already used by another player without creating the player", func() {
Expect(adminRepo.SetAPIKey(ctx, adminPlayer1.ID, key)).To(Succeed())
count, _ := adminRepo.CountAll(ctx)
_, err := adminRepo.Save(ownerCtx, &model.Player{Name: "Duplicate", APIKey: new(key)})
expectAPIKeyError(err, "ra.validation.unique")
Expect(adminRepo.CountAll(ctx)).To(Equal(count))
})
})
Describe("Update (edit)", func() {
It("rolls back the key change when the rest of the edit fails", func() {
_, err := database.NewQuery(`create trigger fail_player_rename before update of name on player
when new.name = 'boom' begin select raise(abort, 'boom'); end`).Execute()
Expect(err).ToNot(HaveOccurred())
DeferCleanup(func() {
_, _ = database.NewQuery("drop trigger if exists fail_player_rename").Execute()
})
plr := regularPlayer
plr.Name = "boom"
plr.APIKey = new(key)
Expect(adminRepo.Update(ownerCtx, plr.ID, plr, "name", "apiKey")).ToNot(Succeed())
Expect(storedHash(regularPlayer.ID)).To(BeEmpty())
})
It("keeps the key when apiKey is absent (a normal edit)", func() {
Expect(adminRepo.SetAPIKey(ownerCtx, regularPlayer.ID, key)).To(Succeed())
plr := regularPlayer
plr.Name = "Renamed"
Expect(adminRepo.Update(ownerCtx, plr.ID, plr, "name", "hasApiKey")).To(Succeed())
Expect(adminRepo.Update(ownerCtx, plr.ID, plr)).To(Succeed())
found, err := adminRepo.FindByAPIKey(ctx, key)
Expect(err).ToNot(HaveOccurred())
Expect(found.Name).To(Equal("Renamed"))
})
It("sets a new key when apiKey has a value", func() {
plr := regularPlayer
plr.APIKey = new(key)
Expect(adminRepo.Update(ownerCtx, plr.ID, plr, "name", "apiKey")).To(Succeed())
Expect(storedHash(regularPlayer.ID)).To(Equal(hashAPIKey(key)))
})
It("revokes the key when apiKey is empty", func() {
Expect(adminRepo.SetAPIKey(ownerCtx, regularPlayer.ID, key)).To(Succeed())
plr := regularPlayer
plr.APIKey = new("")
Expect(adminRepo.Update(ownerCtx, plr.ID, plr, "apiKey")).To(Succeed())
Expect(storedHash(regularPlayer.ID)).To(BeEmpty())
})
It("lets an admin edit another user's keyed player without touching the key", func() {
Expect(adminRepo.SetAPIKey(ownerCtx, regularPlayer.ID, key)).To(Succeed())
plr := regularPlayer
plr.MaxBitRate = 192
Expect(adminRepo.Update(ctx, plr.ID, plr, "maxBitRate", "hasApiKey")).To(Succeed())
Expect(storedHash(regularPlayer.ID)).To(Equal(hashAPIKey(key)))
})
It("refuses an admin setting a key on another user's player and leaves other columns alone", func() {
plr := regularPlayer
plr.Name = "Hijacked"
plr.APIKey = new(key)
Expect(adminRepo.Update(ctx, plr.ID, plr, "name", "apiKey")).To(MatchError(rest.ErrPermissionDenied))
got, err := adminRepo.Get(ctx, regularPlayer.ID)
Expect(err).ToNot(HaveOccurred())
Expect(got.Name).To(Equal(regularPlayer.Name))
Expect(storedHash(regularPlayer.ID)).To(BeEmpty())
})
It("refuses a key already used by another player and leaves other columns alone", func() {
Expect(adminRepo.SetAPIKey(ctx, adminPlayer1.ID, key)).To(Succeed())
plr := regularPlayer
plr.Name = "Renamed"
plr.APIKey = new(key)
err := adminRepo.Update(ownerCtx, plr.ID, plr, "name", "apiKey")
expectAPIKeyError(err, "ra.validation.unique")
got, err := adminRepo.Get(ctx, regularPlayer.ID)
Expect(err).ToNot(HaveOccurred())
Expect(got.Name).To(Equal(regularPlayer.Name))
Expect(storedHash(regularPlayer.ID)).To(BeEmpty())
Expect(storedHash(adminPlayer1.ID)).To(Equal(hashAPIKey(key)))
})
})
})
Describe("Ownership enforcement (cross-tenant write protection)", func() {
var regularRepo *playerRepository
var regularCtx context.Context
BeforeEach(func() {
regularCtx = request.WithUser(ctx, regularUser)
regularRepo = NewPlayerRepository(database).(*playerRepository)
})
It("does not let a regular user hijack another user's player by spoofing userId in the body", func() {
spoofed := model.Player{
ID: adminPlayer1.ID,
Name: "HIJACKED",
UserId: regularUser.ID,
MaxBitRate: 1,
}
err := regularRepo.Update(regularCtx, adminPlayer1.ID, spoofed, "name", "user_id", "max_bit_rate")
Expect(err).To(Equal(rest.ErrPermissionDenied))
stored, err := adminRepo.Get(ctx, adminPlayer1.ID)
Expect(err).To(BeNil())
Expect(*stored).To(Equal(adminPlayer1))
})
It("does not let a regular user overwrite another user's player via Save with a spoofed id", func() {
spoofed := model.Player{
ID: adminPlayer1.ID,
Name: "HIJACKED",
UserId: regularUser.ID,
ReportRealPath: true,
APIKey: new(testAPIKey),
}
id, err := regularRepo.Save(regularCtx, &spoofed)
Expect(err).To(BeNil())
Expect(id).ToNot(Equal(adminPlayer1.ID))
stored, err := adminRepo.Get(ctx, adminPlayer1.ID)
Expect(err).To(BeNil())
Expect(*stored).To(Equal(adminPlayer1))
created, err := adminRepo.Get(ctx, id)
Expect(err).To(BeNil())
Expect(created.UserId).To(Equal(regularUser.ID))
})
It("does not let a regular user reassign their own player to another user", func() {
reassign := regularPlayer
reassign.UserId = adminUser.ID
reassign.Name = "given-away"
err := regularRepo.Update(regularCtx, regularPlayer.ID, reassign, "name", "user_id")
Expect(err).To(BeNil())
stored, err := adminRepo.Get(ctx, regularPlayer.ID)
Expect(err).To(BeNil())
Expect(stored.UserId).To(Equal(regularUser.ID))
})
It("does not let an admin reassign a player to another user", func() {
reassign := regularPlayer
reassign.UserId = adminUser.ID
reassign.Name = "admin-renamed"
err := adminRepo.Update(regularCtx, regularPlayer.ID, reassign, "name", "user_id")
Expect(err).To(BeNil())
stored, err := adminRepo.Get(ctx, regularPlayer.ID)
Expect(err).To(BeNil())
Expect(stored.Name).To(Equal("admin-renamed"))
Expect(stored.UserId).To(Equal(regularUser.ID))
})
It("lets the owner update their own player", func() {
update := regularPlayer
update.Name = "renamed-by-owner"
err := regularRepo.Update(regularCtx, regularPlayer.ID, update, "name")
Expect(err).To(BeNil())
stored, err := adminRepo.Get(ctx, regularPlayer.ID)
Expect(err).To(BeNil())
Expect(stored.Name).To(Equal("renamed-by-owner"))
Expect(stored.UserId).To(Equal(regularUser.ID))
})
It("returns not found when updating a nonexistent player", func() {
ghost := model.Player{ID: "does-not-exist", Name: "ghost", UserId: regularUser.ID}
err := regularRepo.Update(regularCtx, "does-not-exist", ghost, "name")
Expect(err).To(Equal(rest.ErrNotFound))
})
})
})
