From c7170c350172d109d6e300a36abdd96ff2f3ceeb Mon Sep 17 00:00:00 2001
From: emeric <emeric.poupon@laposte.net>
Date: Sun, 24 Nov 2024 16:23:37 +0100
Subject: [PATCH] Subsonic API: added a way to disable the user/password
 authentication method (enabled by default)

---
 approot/settings.xml                        | 4 +++-
 conf/lms.conf                               | 4 ++++
 src/libs/subsonic/impl/SubsonicResource.cpp | 4 ++++
 src/libs/subsonic/impl/SubsonicResource.hpp | 1 +
 src/lms/ui/SettingsView.cpp                 | 1 +
 5 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/approot/settings.xml b/approot/settings.xml
index d197b3f3..e839a8e1 100644
--- a/approot/settings.xml
+++ b/approot/settings.xml
@@ -88,9 +88,11 @@
 			<div class="col-lg-12">
 				<label class="form-label" for="${id:subsonic-token}">
 					${tr:Lms.Settings.subsonic-token}
-					<button type="button" class="btn btn-sm p-0" data-bs-toggle="tooltip" data-bs-placement="right" title="${block:Lms.Settings.subsonic-token-usage}">
+					${<if-has-subsonic-token-usage>}
+					<button type="button" class="btn btn-sm p-0" data-bs-toggle="tooltip" data-bs-placement="right" title="${tr:Lms.Settings.subsonic-token-usage}">
         				<i class="fa fa-fw fa-info-circle" aria-hidden="true"></i>
 					</button>
+					${</if-has-subsonic-token-usage>}
 				</label>
 				<div class="input-group mb-3">
 					${subsonic-token-regen-btn class="btn btn-outline-secondary"}
diff --git a/conf/lms.conf b/conf/lms.conf
index ea9744dc..3da3e6cc 100644
--- a/conf/lms.conf
+++ b/conf/lms.conf
@@ -68,6 +68,10 @@ login-throttler-max-entries = 10000;
 # API
 api-subsonic = true;
 
+# Enable or disable user/password authentication for the Subsonic API.  
+# Note: Since token/salt authentication is always disabled, setting this to 'false' means only API keys can be used to access the Subsonic API.
+api-subsonic-support-user-password-auth = true;
+
 # Use this list to make the reported server version to 1.12.0 depending on the client's name
 # Main usage is to make auto detections for the 'p' (password) parameter work
 api-subsonic-old-server-protocol-clients = ("DSub");
diff --git a/src/libs/subsonic/impl/SubsonicResource.cpp b/src/libs/subsonic/impl/SubsonicResource.cpp
index 40ae3f9e..455a1fa5 100644
--- a/src/libs/subsonic/impl/SubsonicResource.cpp
+++ b/src/libs/subsonic/impl/SubsonicResource.cpp
@@ -298,6 +298,7 @@ namespace lms::api::subsonic
         : _serverProtocolVersionsByClient{ readConfigProtocolVersions() }
         , _openSubsonicDisabledClients{ readOpenSubsonicDisabledClients() }
         , _defaultReleaseCoverClients{ readDefaultCoverClients() }
+        , _supportUserPasswordAuthentication{ core::Service<core::IConfig>::get()->getBool("api-subsonic-support-user-password-auth", true) }
         , _db{ db }
     {
     }
@@ -451,6 +452,9 @@ namespace lms::api::subsonic
 
         const auto user{ getParameterAs<std::string>(parameters, "u") };
         const auto password{ getParameterAs<std::string>(parameters, "p") };
+        if (!_supportUserPasswordAuthentication && (password || user))
+            throw ProvidedAuthenticationMechanismNotSupportedError{};
+
         const auto apiKey{ getParameterAs<std::string>(parameters, "apiKey") };
 
         if (user && !password)
diff --git a/src/libs/subsonic/impl/SubsonicResource.hpp b/src/libs/subsonic/impl/SubsonicResource.hpp
index 194db761..f6bd7417 100644
--- a/src/libs/subsonic/impl/SubsonicResource.hpp
+++ b/src/libs/subsonic/impl/SubsonicResource.hpp
@@ -55,6 +55,7 @@ namespace lms::api::subsonic
         const std::unordered_map<std::string, ProtocolVersion> _serverProtocolVersionsByClient;
         const std::unordered_set<std::string> _openSubsonicDisabledClients;
         const std::unordered_set<std::string> _defaultReleaseCoverClients;
+        const bool _supportUserPasswordAuthentication;
 
         db::Db& _db;
     };
diff --git a/src/lms/ui/SettingsView.cpp b/src/lms/ui/SettingsView.cpp
index d7261e33..73d70f58 100644
--- a/src/lms/ui/SettingsView.cpp
+++ b/src/lms/ui/SettingsView.cpp
@@ -557,6 +557,7 @@ namespace lms::ui
         // Subsonic
         {
             t->setCondition("if-has-subsonic-api", core::Service<core::IConfig>::get()->getBool("api-subsonic", true));
+            t->setCondition("if-has-subsonic-token-usage", core::Service<core::IConfig>::get()->getBool("api-subsonic-support-user-password-auth", true));
 
             auto subsonicToken{ std::make_unique<Wt::WLineEdit>() };
             Wt::WLineEdit* subsonicTokenPtr{ subsonicToken.get() };