weee

docs/security.md

@@ -21,8 +21,9 @@ authentication model in detail.
   comparison itself uses a constant-time compare
   (`crypto/subtle.ConstantTimeCompare`) to avoid a timing side-channel.
 - **API keys** are stored and looked up by hash, never in plaintext.
-- **Sessions** are random opaque tokens in an HTTP-only, `Secure`
-  (configurable via `VIBESONIC_COOKIE_SECURE`, on by default) cookie.
+- **Sessions** are random opaque tokens in an HTTP-only cookie. Set
+  `VIBESONIC_COOKIE_SECURE=true` for HTTPS deployments so browsers only send
+  session and CSRF cookies over secure connections.
 - **External (trusted-proxy) authentication** is off by default and,
   when enabled, trusts an identity-asserting header only from
   configured source IPs verified against the real TCP peer address —
@@ -90,6 +91,32 @@ before the full image is decoded into memory, rejecting anything over
 40 megapixels. This prevents a small, highly-compressed image file from
 forcing an out-of-proportion memory allocation ("decompression bomb").
 
+## Artist photos and manual metadata editing
+
+When `VIBESONIC_ENABLE_ARTIST_PHOTOS` is on, VibeSonic looks up an
+artist photo from fanart.tv (only for an artist with both a tagged
+MusicBrainz ID and `VIBESONIC_FANART_TV_API_KEY` set) or, failing
+that, by searching Wikidata directly by artist name and reading the
+matched entity's image from Wikimedia Commons — both
+externally-hosted services, same trust model as the existing
+MusicBrainz/Cover Art Archive lookups used elsewhere. This path
+deliberately never calls the MusicBrainz API itself (its public
+instance proved too rate-limited to depend on); a name-only match is
+necessarily less precise, so it requires an exact (case-insensitive)
+label match and only weakly prefers a music-flavored Wikidata
+description, rather than fabricating a stricter guarantee it can't
+actually make. The resulting image download, and any admin-supplied
+photo/cover-art URL entered on an artist or album's edit page, is
+fetched through the same `internal/netguard` SSRF-safe client described
+above (dial-time IP validation, capped redirects, size-limited
+response). Uploaded photo/cover files are validated by actually
+decoding them as an image before being written to disk.
+
+Editing artist/album/song metadata (`/admin/artists/{id}/edit`,
+`/admin/albums/{id}/edit`, `/admin/songs/{id}/edit`) and overriding a
+photo/cover are admin-only actions, gated the same way as every other
+`/admin/*` route.
+
 ## Transcoding
 
 `ffmpeg`/`ffprobe` are invoked with `exec.CommandContext` and an