Phase 2: Subsonic REST API framework (auth, response formatting, error handling, routing) plus user permission model

internal/subsonic/errors.go

@@ -0,0 +1,48 @@
+package subsonic
+
+// Error codes from the Subsonic REST API specification.
+const (
+	ErrGeneric               = 0
+	ErrMissingParameter      = 10
+	ErrClientMustUpgrade     = 20 // client's protocol version is newer than this server supports
+	ErrServerMustUpgrade     = 30 // server requires a newer client
+	ErrWrongCredentials      = 40
+	ErrTokenAuthNotSupported = 41 // e.g. LDAP-backed accounts with no local password
+	ErrUnauthorized          = 50 // authenticated, but not permitted to perform this action
+	ErrTrialExpired          = 60 // VibeSonic never returns this: no license is required
+	ErrNotFound              = 70
+)
+
+// apiError is a Subsonic protocol error carrying an HTTP-agnostic code
+// and message. Handlers return one instead of writing to the response
+// directly, so the router can format it consistently in whatever
+// wire format the caller asked for and it never leaks a raw Go error
+// (which could expose internal paths/state) to the client.
+type apiError struct {
+	Code    int
+	Message string
+}
+
+func (e *apiError) Error() string { return e.Message }
+
+func newError(code int, message string) *apiError {
+	return &apiError{Code: code, Message: message}
+}
+
+func errMissingParameter(name string) *apiError {
+	return newError(ErrMissingParameter, "Required parameter '"+name+"' is missing")
+}
+
+func errNotFound(what string) *apiError {
+	return newError(ErrNotFound, what+" not found")
+}
+
+func errUnauthorized(action string) *apiError {
+	return newError(ErrUnauthorized, "User is not authorized for the requested "+action)
+}
+
+var (
+	errWrongCredentials      = newError(ErrWrongCredentials, "Wrong username or password")
+	errClientMustUpgrade     = newError(ErrClientMustUpgrade, "Incompatible Subsonic REST protocol version. Client must upgrade.")
+	errTokenAuthNotSupported = newError(ErrTokenAuthNotSupported, "Token authentication is not supported for this account; use password authentication")
+)