Phase 2: Subsonic REST API framework (auth, response formatting, error handling, routing) plus user permission model

internal/auth/userpassword.go

@@ -0,0 +1,26 @@
+package auth
+
+import (
+	"database/sql"
+
+	"git.noroutes.net/NoRoutes/vibetunes/internal/database"
+)
+
+// SetUserPassword hashes plaintext for native login and also stores the
+// encrypted copy legacy Subsonic token authentication needs (see
+// subsonic_secret.go), keeping both in sync. This is the only path that
+// should ever change a user's password.
+func SetUserPassword(db *sql.DB, encryptionKey []byte, userID, plaintext string) error {
+	hash, err := HashPassword(plaintext)
+	if err != nil {
+		return err
+	}
+	if err := database.SetUserPassword(db, userID, hash); err != nil {
+		return err
+	}
+	encrypted, err := EncryptPassword(encryptionKey, plaintext)
+	if err != nil {
+		return err
+	}
+	return database.SetUserSubsonicAuthSecret(db, userID, encrypted)
+}