Phase 2: Subsonic REST API framework (auth, response formatting, error handling, routing) plus user permission model

internal/app/app.go

@@ -18,15 +18,17 @@ import (
 	"git.noroutes.net/NoRoutes/vibetunes/internal/database"
 	"git.noroutes.net/NoRoutes/vibetunes/internal/metadata"
 	"git.noroutes.net/NoRoutes/vibetunes/internal/scanner"
+	"git.noroutes.net/NoRoutes/vibetunes/internal/subsonic"
 	"git.noroutes.net/NoRoutes/vibetunes/internal/web"
 )
 
 type App struct {
-	Cfg     config.Config
-	DB      *sql.DB
-	Log     *slog.Logger
-	Scanner *scanner.Scanner
-	Web     *web.Web
+	Cfg      config.Config
+	DB       *sql.DB
+	Log      *slog.Logger
+	Scanner  *scanner.Scanner
+	Web      *web.Web
+	Subsonic *subsonic.Server
 }
 
 // Open initializes the database and every subsystem, and imports
@@ -61,18 +63,34 @@ func Open(cfg config.Config, log *slog.Logger) (*App, error) {
 	mw := &auth.Middleware{Sessions: sessions, ExtAuth: extauth}
 	csrf := &auth.CSRF{CookieSecure: cfg.CookieSecure}
 
-	webApp := &web.Web{
-		DB:         db,
-		Config:     cfg,
-		Sessions:   sessions,
-		CSRF:       csrf,
-		Middleware: mw,
-		Scanner:    sc,
-		CoverArt:   covers,
-		Log:        log,
+	encryptionKey, err := auth.EncryptionKey(db, cfg.SessionSecret)
+	if err != nil {
+		db.Close()
+		return nil, fmt.Errorf("deriving auth encryption key: %w", err)
 	}
 
-	return &App{Cfg: cfg, DB: db, Log: log, Scanner: sc, Web: webApp}, nil
+	webApp := &web.Web{
+		DB:            db,
+		Config:        cfg,
+		Sessions:      sessions,
+		CSRF:          csrf,
+		Middleware:    mw,
+		Scanner:       sc,
+		CoverArt:      covers,
+		EncryptionKey: encryptionKey,
+		Log:           log,
+	}
+
+	subsonicSrv := &subsonic.Server{
+		DB:            db,
+		Config:        cfg,
+		EncryptionKey: encryptionKey,
+		Scanner:       sc,
+		CoverArt:      covers,
+		Log:           log,
+	}
+
+	return &App{Cfg: cfg, DB: db, Log: log, Scanner: sc, Web: webApp, Subsonic: subsonicSrv}, nil
 }
 
 func (a *App) Close() error {
@@ -126,9 +144,13 @@ func (a *App) Run(ctx context.Context) error {
 		}
 	}()
 
+	mux := http.NewServeMux()
+	mux.Handle("/rest/", a.Subsonic.Router())
+	mux.Handle("/", a.Web.NewRouter())
+
 	srv := &http.Server{
 		Addr:    a.Cfg.ListenAddr,
-		Handler: a.Web.NewRouter(),
+		Handler: mux,
 	}
 
 	errCh := make(chan error, 1)