owenandClaude Sonnet 5
789bf91eed
Security: - New internal/netguard package: podcast feed/enclosure fetching now refuses to dial non-public IPs (loopback/RFC1918/link-local/cloud metadata/CGNAT), validated per-connection including across redirects, closing an SSRF gap where a malicious or compromised feed URL could probe the server's internal network. Configurable via VIBESONIC_PODCASTS_ALLOW_PRIVATE_NETWORKS for intentional LAN feeds. - Podcast episode downloads capped at 4GB (was unbounded, disk-exhaustion risk) - Cover art decoding now rejects images above a 40-megapixel budget before full decode (decompression-bomb guard) - HTTP server sets ReadHeaderTimeout (slowloris hardening) - Admin folder-scan redirect now validated as same-site instead of trusting the raw Referer header (open-redirect fix) - Legacy Subsonic token/salt auth now uses a constant-time comparison Web UI completion: - Persistent player: shuffle and repeat (off/all/one) controls, wired into queue advance/prev logic and persisted like other player state - Admin user-permissions form: adminRole toggle (with a guard against demoting the last remaining admin) and per-user music-folder access checkboxes, backed by existing schema/enforcement that was previously unreachable from the UI - Playlist M3U8 import/export Docs: added docs/client-compatibility.md (honest tracking template — no client testing has been performed), docs/deployment.md, docs/security.md, docs/backup.md; refreshed README and cross-links; added a footnote in docs/subsonic-compatibility.md distinguishing spec-standard from VibeSonic-original OpenSubsonic extensions. Also added Go fuzz tests for the external-auth CIDR/IP parser and the LRC lyrics parser. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014r98AtcBbevpscWLsfwVvv
4.7 KiB
4.7 KiB
Client compatibility
This is a tracking template, not a report of testing that has
already happened. As of this phase, no real Subsonic/OpenSubsonic
client apps have been run against VibeSonic in this development
environment — every row below is unfilled and marked accordingly. Please
do not read the table as evidence of compatibility; read
docs/subsonic-compatibility.md for that —
it documents endpoint-by-endpoint protocol conformance validated by
VibeSonic's own automated HTTP-level test suite (internal/subsonic/*_test.go),
which is real evidence, exercised on every change. This document exists
to capture real device/app testing once someone actually does it.
How to test a client and fill in a row
- Point the client at your VibeSonic server URL, e.g.
https://music.example.comorhttp://<host>:8080for a direct, un-proxied connection. Most Subsonic clients want the base URL only (no/restsuffix) plus a username/password — they construct/rest/*requests themselves. - Authentication: try native username/password first (works whether
or not external auth is enabled, as long as the account has a local
password — see
external-auth.md). If the client supports OpenSubsonic API keys (theapiKeyAuthenticationextension — seesubsonic-compatibility.md), generate one from the web UI's account settings and test that path too, noting which the client actually used. - Work through: server discovery/ping, browsing (artists/albums/songs,
both filesystem and ID3 modes if the client exposes both), search,
cover art, direct streaming, forced transcoding (pick a bitrate/format
the source file doesn't already match), playlists (create/edit/
delete/reorder), favorites/star, scrobbling, lyrics (plain and
synced, if the client supports OpenSubsonic's
songLyrics), the play queue, downloads, podcasts (if the client has podcast support), and any OpenSubsonic-specific features the client advertises. - Fill in the row below with what actually worked, partially worked, or didn't — and describe Known Issues concretely (not "broken", but "album art doesn't load for tracks with only embedded art, HTTP 404" or similar) so someone else can reproduce or fix it.
- If a client needs a compatibility workaround (bending strict protocol
behavior to accommodate something the client gets wrong), that
exception must be documented here and in
subsonic-compatibility.mdnext to the affected endpoint — don't silently special-case a client in code without a paper trail.
Tracking table
| Client | Version | Platform | Authentication | Browsing | Streaming | Transcoding | Playlists | Lyrics | OpenSubsonic | Known Issues |
|---|---|---|---|---|---|---|---|---|---|---|
| Symfonium | — | Android | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
| Ultrasonic | — | Android | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
| Tempo | — | iOS | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
| Amperfy | — | iOS/macOS | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
| play:Sub | — | iOS | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
| Subtracks | — | Android | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
| DSub | — | Android | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
| Supersonic | — | Desktop (Linux/macOS/Windows) | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
| Feishin | — | Desktop/Web | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
Add new rows for any other client you test — this list isn't exhaustive, just a reasonable starting set across ecosystems (Android, iOS, desktop).
Compatibility exceptions
None recorded yet. If a real client requires bending protocol behavior
to work correctly, document the exception here: which client/version,
what VibeSonic does differently and why, and a link to the affected
endpoint in subsonic-compatibility.md.