owenandClaude Sonnet 5
789bf91eed
Security: - New internal/netguard package: podcast feed/enclosure fetching now refuses to dial non-public IPs (loopback/RFC1918/link-local/cloud metadata/CGNAT), validated per-connection including across redirects, closing an SSRF gap where a malicious or compromised feed URL could probe the server's internal network. Configurable via VIBESONIC_PODCASTS_ALLOW_PRIVATE_NETWORKS for intentional LAN feeds. - Podcast episode downloads capped at 4GB (was unbounded, disk-exhaustion risk) - Cover art decoding now rejects images above a 40-megapixel budget before full decode (decompression-bomb guard) - HTTP server sets ReadHeaderTimeout (slowloris hardening) - Admin folder-scan redirect now validated as same-site instead of trusting the raw Referer header (open-redirect fix) - Legacy Subsonic token/salt auth now uses a constant-time comparison Web UI completion: - Persistent player: shuffle and repeat (off/all/one) controls, wired into queue advance/prev logic and persisted like other player state - Admin user-permissions form: adminRole toggle (with a guard against demoting the last remaining admin) and per-user music-folder access checkboxes, backed by existing schema/enforcement that was previously unreachable from the UI - Playlist M3U8 import/export Docs: added docs/client-compatibility.md (honest tracking template — no client testing has been performed), docs/deployment.md, docs/security.md, docs/backup.md; refreshed README and cross-links; added a footnote in docs/subsonic-compatibility.md distinguishing spec-standard from VibeSonic-original OpenSubsonic extensions. Also added Go fuzz tests for the external-auth CIDR/IP parser and the LRC lyrics parser. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014r98AtcBbevpscWLsfwVvv
70 lines
4.7 KiB
Markdown
70 lines
4.7 KiB
Markdown
# Client compatibility
|
|
|
|
This is a **tracking template**, not a report of testing that has
|
|
already happened. As of this phase, no real Subsonic/OpenSubsonic
|
|
client apps have been run against VibeSonic in this development
|
|
environment — every row below is unfilled and marked accordingly. Please
|
|
do not read the table as evidence of compatibility; read
|
|
[`docs/subsonic-compatibility.md`](subsonic-compatibility.md) for that —
|
|
it documents endpoint-by-endpoint protocol conformance validated by
|
|
VibeSonic's own automated HTTP-level test suite (`internal/subsonic/*_test.go`),
|
|
which is real evidence, exercised on every change. This document exists
|
|
to capture *real device/app* testing once someone actually does it.
|
|
|
|
## How to test a client and fill in a row
|
|
|
|
1. Point the client at your VibeSonic server URL, e.g.
|
|
`https://music.example.com` or `http://<host>:8080` for a direct,
|
|
un-proxied connection. Most Subsonic clients want the base URL only
|
|
(no `/rest` suffix) plus a username/password — they construct
|
|
`/rest/*` requests themselves.
|
|
2. **Authentication**: try native username/password first (works whether
|
|
or not external auth is enabled, as long as the account has a local
|
|
password — see [`external-auth.md`](external-auth.md)). If the client
|
|
supports OpenSubsonic API keys (the `apiKeyAuthentication` extension —
|
|
see [`subsonic-compatibility.md`](subsonic-compatibility.md#opensubsonic-extensions)),
|
|
generate one from the web UI's account settings and test that path
|
|
too, noting which the client actually used.
|
|
3. Work through: server discovery/ping, browsing (artists/albums/songs,
|
|
both filesystem and ID3 modes if the client exposes both), search,
|
|
cover art, direct streaming, forced transcoding (pick a bitrate/format
|
|
the source file doesn't already match), playlists (create/edit/
|
|
delete/reorder), favorites/star, scrobbling, lyrics (plain and
|
|
synced, if the client supports OpenSubsonic's `songLyrics`), the play
|
|
queue, downloads, podcasts (if the client has podcast support), and
|
|
any OpenSubsonic-specific features the client advertises.
|
|
4. Fill in the row below with what actually worked, partially worked, or
|
|
didn't — and describe **Known Issues** concretely (not "broken", but
|
|
"album art doesn't load for tracks with only embedded art, HTTP 404"
|
|
or similar) so someone else can reproduce or fix it.
|
|
5. If a client needs a compatibility workaround (bending strict protocol
|
|
behavior to accommodate something the client gets wrong), that
|
|
exception must be documented here **and** in
|
|
[`subsonic-compatibility.md`](subsonic-compatibility.md) next to the
|
|
affected endpoint — don't silently special-case a client in code
|
|
without a paper trail.
|
|
|
|
## Tracking table
|
|
|
|
| Client | Version | Platform | Authentication | Browsing | Streaming | Transcoding | Playlists | Lyrics | OpenSubsonic | Known Issues |
|
|
|---|---|---|---|---|---|---|---|---|---|---|
|
|
| Symfonium | — | Android | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
|
|
| Ultrasonic | — | Android | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
|
|
| Tempo | — | iOS | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
|
|
| Amperfy | — | iOS/macOS | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
|
|
| play:Sub | — | iOS | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
|
|
| Subtracks | — | Android | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
|
|
| DSub | — | Android | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
|
|
| Supersonic | — | Desktop (Linux/macOS/Windows) | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
|
|
| Feishin | — | Desktop/Web | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | Not yet tested | — |
|
|
|
|
Add new rows for any other client you test — this list isn't exhaustive,
|
|
just a reasonable starting set across ecosystems (Android, iOS, desktop).
|
|
|
|
## Compatibility exceptions
|
|
|
|
None recorded yet. If a real client requires bending protocol behavior
|
|
to work correctly, document the exception here: which client/version,
|
|
what VibeSonic does differently and why, and a link to the affected
|
|
endpoint in [`subsonic-compatibility.md`](subsonic-compatibility.md).
|