weee

docs/configuration.md

@@ -16,8 +16,10 @@ except the session secret.
 | `VIBESONIC_MPV_PATH` | `mpv` (from `PATH`) | Path to the `mpv` binary, used as the Subsonic jukebox's playback backend. If not found, the jukebox is administratively unavailable and `jukeboxControl` returns a clear error instead of a fake success. |
 | `VIBESONIC_SCAN_INTERVAL` | `1h` | How often to rescan enabled music folders, as a Go duration (`30m`, `6h`, ...). A startup scan always runs regardless of this value. |
 | `VIBESONIC_SESSION_SECRET` | *(none)* | Reserved for future use hardening session cookies beyond their database-backed random IDs. Not required to run, but recommended to set (e.g. `openssl rand -hex 32`) — VibeSonic logs a warning at startup if it's empty. |
-| `VIBESONIC_COOKIE_SECURE` | `true` | Whether session/CSRF cookies get the `Secure` attribute. Set to `false` only for local development over plain HTTP. |
+| `VIBESONIC_COOKIE_SECURE` | `false` | Whether session/CSRF cookies get the `Secure` attribute. Set to `true` when VibeSonic is served over HTTPS (including through a TLS-terminating reverse proxy); leave it off for direct plain-HTTP access. |
 | `VIBESONIC_ENABLE_EXTERNAL_METADATA` | `false` | Enable optional MusicBrainz/Cover Art Archive lookups for songs/albums that already carry a locally-tagged MusicBrainz ID. VibeSonic works fully offline with this off; it's the only feature that makes outbound Internet requests. |
+| `VIBESONIC_ENABLE_ARTIST_PHOTOS` | `false` | Enable auto-fetching an artist photo for every artist with no manually-set one: fanart.tv (only when both `VIBESONIC_FANART_TV_API_KEY` is set and the artist has a tagged MusicBrainz ID), falling back to a direct name search against Wikidata/Wikimedia Commons — this never calls the MusicBrainz API itself. Off by default for the same offline-first reason as `VIBESONIC_ENABLE_EXTERNAL_METADATA`. An admin can always set a photo manually from an artist's edit page regardless of this setting, and can trigger a one-off bulk fetch (with per-artist results, including any errors) from Admin → System Settings regardless of this toggle. |
+| `VIBESONIC_FANART_TV_API_KEY` | *(none)* | Optional personal [fanart.tv](https://fanart.tv/) API key, tried first (for artists with a tagged MusicBrainz ID) when `VIBESONIC_ENABLE_ARTIST_PHOTOS` is on. Leave unset to go straight to the Wikidata name search. |
 | `VIBESONIC_PODCASTS_ALLOW_PRIVATE_NETWORKS` | `false` | Allow podcast feed/enclosure URLs to resolve to loopback/LAN/link-local addresses. Leave this off unless you intentionally host podcast feeds on a private network — see [`docs/security.md`](security.md#podcast-fetching-ssrf-protections). |
 
 ## External authentication

docs/security.md

@@ -21,8 +21,9 @@ authentication model in detail.
   comparison itself uses a constant-time compare
   (`crypto/subtle.ConstantTimeCompare`) to avoid a timing side-channel.
 - **API keys** are stored and looked up by hash, never in plaintext.
-- **Sessions** are random opaque tokens in an HTTP-only, `Secure`
-  (configurable via `VIBESONIC_COOKIE_SECURE`, on by default) cookie.
+- **Sessions** are random opaque tokens in an HTTP-only cookie. Set
+  `VIBESONIC_COOKIE_SECURE=true` for HTTPS deployments so browsers only send
+  session and CSRF cookies over secure connections.
 - **External (trusted-proxy) authentication** is off by default and,
   when enabled, trusts an identity-asserting header only from
   configured source IPs verified against the real TCP peer address —
@@ -90,6 +91,32 @@ before the full image is decoded into memory, rejecting anything over
 40 megapixels. This prevents a small, highly-compressed image file from
 forcing an out-of-proportion memory allocation ("decompression bomb").
 
+## Artist photos and manual metadata editing
+
+When `VIBESONIC_ENABLE_ARTIST_PHOTOS` is on, VibeSonic looks up an
+artist photo from fanart.tv (only for an artist with both a tagged
+MusicBrainz ID and `VIBESONIC_FANART_TV_API_KEY` set) or, failing
+that, by searching Wikidata directly by artist name and reading the
+matched entity's image from Wikimedia Commons — both
+externally-hosted services, same trust model as the existing
+MusicBrainz/Cover Art Archive lookups used elsewhere. This path
+deliberately never calls the MusicBrainz API itself (its public
+instance proved too rate-limited to depend on); a name-only match is
+necessarily less precise, so it requires an exact (case-insensitive)
+label match and only weakly prefers a music-flavored Wikidata
+description, rather than fabricating a stricter guarantee it can't
+actually make. The resulting image download, and any admin-supplied
+photo/cover-art URL entered on an artist or album's edit page, is
+fetched through the same `internal/netguard` SSRF-safe client described
+above (dial-time IP validation, capped redirects, size-limited
+response). Uploaded photo/cover files are validated by actually
+decoding them as an image before being written to disk.
+
+Editing artist/album/song metadata (`/admin/artists/{id}/edit`,
+`/admin/albums/{id}/edit`, `/admin/songs/{id}/edit`) and overriding a
+photo/cover are admin-only actions, gated the same way as every other
+`/admin/*` route.
+
 ## Transcoding
 
 `ffmpeg`/`ffprobe` are invoked with `exec.CommandContext` and an