Restructure backend into services and fix security, crash and sync issues

Security
- Serve character images through os.Root so names like ../ can't escape
  the characters folder
- Sync start and /sync/reset are POST only (legacy and /api/v1)
- /api/v1/token/cleanup requires a token, password compared in constant
  time, tokens no longer logged
- Echo's rate limiter replaces the custom one; TRUSTED_PROXIES enables
  X-Forwarded-For for reverse proxies

Crashes and races
- Sync state lives in SyncService with atomics and a mutex instead of
  unsynchronised globals (fixes concurrent map writes during full sync)
- Only one sync can run; /api/v1 sync and music routes are locked during
  sync like the legacy ones
- No log.Fatal outside startup: errors become 4xx/5xx responses
- Search uses an in-order character match instead of unescaped regexes
- Empty queue / no songs return 404 instead of panicking or looping

Behaviour
- Sync result is computed once and stays the same between polls
- Swagger and /openapi serve the embedded spec
- Shutdown stops HTTP before closing the database
- Expired tokens are deleted with a context that outlives the request
- Files are served with Range support and correct content types; audio
  has no write deadline

Performance
- Migration 000006 adds soundtrack.fingerprint (names, sizes, mtimes) so
  unchanged folders are skipped without reading any files
- Songs are reconciled per soundtrack with one query plus needed writes;
  renames keep play counts
- Moved MUSIC_PATH updates soundtrack and song paths
- .id cleanup only runs for changed soundtracks or a full sync
- Classic random uses one SQL query; Gitea release lookups are cached
  with a timeout

Structure
- internal/config reads all environment variables once
- sqlc emits a Querier interface; backend globals become services
  injected into handlers
- One route registration shared by legacy and /api/v1
- Removed dead code (dbHelper.go, unused middleware, duplicate Gitea
  functions, embedded Swagger UI copy) and lib/pq
- templ and swag pinned as go tools
This commit is contained in:
Sansan committed 2026-10-06 15:20:14 +02:00
1 parent 75b6f0c1cf
commit 090e794460
78 files changed
+2919 -6303

No files matched your search

+285 -247
View File
@@ -1,16 +1,25 @@
package backend
import (
"math/rand"
"context"
"errors"
"math/rand/v2"
"os"
"path/filepath"
"slices"
"strings"
"sync"
"music-server/internal/db/repository"
"music-server/internal/logging"
"os"
"strconv"
"strings"
"github.com/jackc/pgx/v5"
"go.uber.org/zap"
)
// maxPickAttempts bounds how many broken songs are skipped before giving up.
const maxPickAttempts = 100
type SongInfo struct {
Soundtrack string `json:"Soundtrack"`
SoundtrackPlayed int32 `json:"SoundtrackPlayed"`
@@ -20,303 +29,332 @@ type SongInfo struct {
SongNo int `json:"SongNo"`
}
var currentSong = -1
// MusicService picks songs and keeps track of the shared play queue.
type MusicService struct {
q repository.Querier
soundCheckPath string
var soundtracksNew []repository.Soundtrack
cacheMu sync.Mutex
soundtracks []repository.Soundtrack
var songQueNew []repository.Song
var lastFetchedNew repository.Song
func initRepo() {
// This function is kept for backward compatibility
// but now uses the backend package's initialized repo
// If not initialized, this will panic intentionally
if BackendRepo() == nil {
panic("backend not initialized - call backend.InitBackend() first")
}
// Queue state is shared by all clients and intentionally not locked.
queue []repository.Song
currentSong int
lastFetched repository.Song
}
func getAllSoundtracks() []repository.Soundtrack {
if len(soundtracksNew) == 0 {
initRepo()
soundtracksNew, _ = BackendRepo().FindAllSoundtracks(BackendCtx())
}
return soundtracksNew
// NewMusicService creates a MusicService. soundCheckPath is the directory holding sound check songs.
func NewMusicService(q repository.Querier, soundCheckPath string) *MusicService {
return &MusicService{q: q, soundCheckPath: soundCheckPath, currentSong: -1}
}
func GetSoundCheckSong() string {
files, err := os.ReadDir("songs")
if err != nil {
logging.GetLogger().Fatal("Failed to read songs directory", zap.String("error", err.Error()))
}
fileInfo := files[rand.Intn(len(files))]
return "songs/" + fileInfo.Name()
}
func Reset() {
songQueNew = nil
currentSong = -1
initRepo()
soundtracksNew, _ = BackendRepo().FindAllSoundtracks(BackendCtx())
}
func AddLatestToQue() {
if lastFetchedNew.Path != "" {
currentSong = len(songQueNew)
songQueNew = append(songQueNew, lastFetchedNew)
lastFetchedNew = repository.Song{}
}
}
func AddLatestPlayed() {
if len(songQueNew) == 0 {
return
}
currentSongData := songQueNew[currentSong]
initRepo()
BackendRepo().AddSoundtrackPlayed(BackendCtx(), currentSongData.SoundtrackID)
BackendRepo().AddSongPlayed(BackendCtx(), repository.AddSongPlayedParams{SoundtrackID: currentSongData.SoundtrackID, SongName: currentSongData.SongName})
}
func SetPlayed(songNumber int) {
if len(songQueNew) == 0 || songNumber >= len(songQueNew) {
return
}
songData := songQueNew[songNumber]
initRepo()
BackendRepo().AddSoundtrackPlayed(BackendCtx(), songData.SoundtrackID)
BackendRepo().AddSongPlayed(BackendCtx(), repository.AddSongPlayedParams{SoundtrackID: songData.SoundtrackID, SongName: songData.SongName})
}
func GetRandomSong() string {
getAllSoundtracks()
if len(soundtracksNew) == 0 {
return ""
}
song := getSongFromList(soundtracksNew)
lastFetchedNew = song
return song.Path
}
func GetRandomSongLowChance() string {
getAllSoundtracks()
var listOfSoundtracks []repository.Soundtrack
var averagePlayed = getAveragePlayed()
for _, data := range soundtracksNew {
timesToAdd := averagePlayed - data.TimesPlayed
if timesToAdd <= 0 {
listOfSoundtracks = append(listOfSoundtracks, data)
} else {
for i := int32(0); i < timesToAdd; i++ {
listOfSoundtracks = append(listOfSoundtracks, data)
}
}
}
song := getSongFromList(listOfSoundtracks)
lastFetchedNew = song
return song.Path
}
func GetRandomSongClassic() string {
getAllSoundtracks()
var listOfAllSongs []repository.Song
for _, soundtrack := range soundtracksNew {
songList, _ := BackendRepo().FindSongsFromSoundtrack(BackendCtx(), soundtrack.ID)
listOfAllSongs = append(listOfAllSongs, songList...)
}
songFound := false
var song repository.Song
for !songFound {
song = listOfAllSongs[rand.Intn(len(listOfAllSongs))]
soundtrackData, err := BackendRepo().GetSoundtrackById(BackendCtx(), song.SoundtrackID)
func (m *MusicService) allSoundtracks(ctx context.Context) ([]repository.Soundtrack, error) {
m.cacheMu.Lock()
defer m.cacheMu.Unlock()
if len(m.soundtracks) == 0 {
soundtracks, err := m.q.FindAllSoundtracks(ctx)
if err != nil {
BackendRepo().RemoveBrokenSong(BackendCtx(), repository.RemoveBrokenSongParams{SoundtrackID: song.SoundtrackID, Path: song.Path})
logging.GetLogger().Warn("Song not found, removed from database",
zap.String("song", song.SongName),
zap.String("soundtrack", soundtrackData.SoundtrackName),
zap.String("filename", *song.FileName))
return nil, err
}
m.soundtracks = soundtracks
}
return m.soundtracks, nil
}
// Reset clears the play queue and reloads the soundtrack list.
func (m *MusicService) Reset(ctx context.Context) error {
m.queue = nil
m.currentSong = -1
m.cacheMu.Lock()
m.soundtracks = nil
m.cacheMu.Unlock()
_, err := m.allSoundtracks(ctx)
return err
}
// SoundCheckSong returns the path of a random sound check song.
func (m *MusicService) SoundCheckSong() (string, error) {
files, err := os.ReadDir(m.soundCheckPath)
if err != nil {
return "", err
}
files = slices.DeleteFunc(files, func(f os.DirEntry) bool { return f.IsDir() })
if len(files) == 0 {
return "", ErrNoSongs
}
return filepath.Join(m.soundCheckPath, files[rand.IntN(len(files))].Name()), nil
}
// AddLatestToQueue appends the last fetched random song to the queue.
func (m *MusicService) AddLatestToQueue() {
if m.lastFetched.Path != "" {
m.currentSong = len(m.queue)
m.queue = append(m.queue, m.lastFetched)
m.lastFetched = repository.Song{}
}
}
// AddLatestPlayed increments the play counters of the current song.
func (m *MusicService) AddLatestPlayed(ctx context.Context) error {
if !m.validIndex(m.currentSong) {
return nil
}
return m.markPlayed(ctx, m.queue[m.currentSong])
}
// SetPlayed increments the play counters of the song at the given queue position.
func (m *MusicService) SetPlayed(ctx context.Context, songNumber int) error {
if !m.validIndex(songNumber) {
return nil
}
return m.markPlayed(ctx, m.queue[songNumber])
}
func (m *MusicService) markPlayed(ctx context.Context, song repository.Song) error {
if err := m.q.AddSoundtrackPlayed(ctx, song.SoundtrackID); err != nil {
return err
}
return m.q.AddSongPlayed(ctx, repository.AddSongPlayedParams{SoundtrackID: song.SoundtrackID, SongName: song.SongName})
}
func (m *MusicService) validIndex(i int) bool {
return i >= 0 && i < len(m.queue)
}
// RandomSong picks a random song from a random soundtrack.
func (m *MusicService) RandomSong(ctx context.Context) (string, error) {
soundtracks, err := m.allSoundtracks(ctx)
if err != nil {
return "", err
}
candidates := make([]weightedSoundtrack, len(soundtracks))
for i, s := range soundtracks {
candidates[i] = weightedSoundtrack{soundtrack: s, weight: 1}
}
return m.pickAndRemember(ctx, candidates)
}
// RandomSongLowChance picks a random song, favouring soundtracks played less than average.
func (m *MusicService) RandomSongLowChance(ctx context.Context) (string, error) {
soundtracks, err := m.allSoundtracks(ctx)
if err != nil {
return "", err
}
return m.pickAndRemember(ctx, lowChanceWeights(soundtracks))
}
func (m *MusicService) pickAndRemember(ctx context.Context, candidates []weightedSoundtrack) (string, error) {
song, err := m.pickSong(ctx, candidates)
if err != nil {
return "", err
}
m.lastFetched = song
return song.Path, nil
}
// RandomSongClassic picks a random song where every song has the same chance.
func (m *MusicService) RandomSongClassic(ctx context.Context) (string, error) {
for range maxPickAttempts {
row, err := m.q.GetRandomActiveSong(ctx)
if errors.Is(err, pgx.ErrNoRows) {
return "", ErrNoSongs
}
if err != nil {
return "", err
}
if !songIsPlayable(row.Song, row.SoundtrackPath) {
if err := m.removeBrokenSong(ctx, row.Song); err != nil {
return "", err
}
continue
}
//Check if file exists and open
openFile, err := os.Open(song.Path)
if err != nil || (song.FileName != nil && soundtrackData.Path+*song.FileName != song.Path) {
//File not found
BackendRepo().RemoveBrokenSong(BackendCtx(), repository.RemoveBrokenSongParams{SoundtrackID: song.SoundtrackID, Path: song.Path})
logging.GetLogger().Warn("Song not found, removed from database",
zap.String("song", song.SongName),
zap.String("soundtrack", soundtrackData.SoundtrackName),
zap.String("filename", *song.FileName))
} else {
songFound = true
}
err = openFile.Close()
if err != nil {
logging.GetLogger().Error("Failed to close file", zap.String("error", err.Error()))
}
m.lastFetched = row.Song
return row.Song.Path, nil
}
lastFetchedNew = song
return song.Path
return "", ErrNoSongs
}
func GetSongInfo() SongInfo {
if songQueNew == nil {
// SongInfo returns information about the current song in the queue.
func (m *MusicService) SongInfo(ctx context.Context) SongInfo {
if !m.validIndex(m.currentSong) {
return SongInfo{}
}
var currentSongData = songQueNew[currentSong]
currentSoundtrackData := getCurrentSoundtrack(currentSongData)
song := m.queue[m.currentSong]
soundtrack := m.soundtrackFor(ctx, song)
return SongInfo{
Soundtrack: currentSoundtrackData.SoundtrackName,
SoundtrackPlayed: currentSoundtrackData.TimesPlayed,
Song: currentSongData.SongName,
SongPlayed: currentSongData.TimesPlayed,
Soundtrack: soundtrack.SoundtrackName,
SoundtrackPlayed: soundtrack.TimesPlayed,
Song: song.SongName,
SongPlayed: song.TimesPlayed,
CurrentlyPlaying: true,
SongNo: currentSong,
SongNo: m.currentSong,
}
}
func GetPlayedSongs() []SongInfo {
// PlayedSongs returns all songs in the queue.
func (m *MusicService) PlayedSongs(ctx context.Context) []SongInfo {
var songList []SongInfo
for i, song := range songQueNew {
soundtrackData := getCurrentSoundtrack(song)
for i, song := range m.queue {
soundtrack := m.soundtrackFor(ctx, song)
songList = append(songList, SongInfo{
Soundtrack: soundtrackData.SoundtrackName,
SoundtrackPlayed: soundtrackData.TimesPlayed,
Soundtrack: soundtrack.SoundtrackName,
SoundtrackPlayed: soundtrack.TimesPlayed,
Song: song.SongName,
SongPlayed: song.TimesPlayed,
CurrentlyPlaying: i == currentSong,
CurrentlyPlaying: i == m.currentSong,
SongNo: i,
})
}
return songList
}
func GetSong(song string) string {
currentSong, _ = strconv.Atoi(song)
if currentSong >= len(songQueNew) {
currentSong = len(songQueNew) - 1
} else if currentSong < 0 {
currentSong = 0
// Song jumps to the given queue position (clamped to the queue) and returns its path.
func (m *MusicService) Song(songNumber int) (string, error) {
if len(m.queue) == 0 {
return "", ErrQueueEmpty
}
songData := songQueNew[currentSong]
return songData.Path
m.currentSong = max(0, min(songNumber, len(m.queue)-1))
return m.queue[m.currentSong].Path, nil
}
func GetAllSoundtracks() []string {
getAllSoundtracks()
var jsonArray []string
for _, soundtrack := range soundtracksNew {
jsonArray = append(jsonArray, soundtrack.SoundtrackName)
// NextSong moves to the next song in the queue, staying on the last one at the end.
func (m *MusicService) NextSong() (string, error) {
if len(m.queue) == 0 {
return "", ErrQueueEmpty
}
return jsonArray
return m.Song(m.currentSong + 1)
}
func GetAllSoundtracksRandom() []string {
getAllSoundtracks()
var jsonArray []string
for _, soundtrack := range soundtracksNew {
jsonArray = append(jsonArray, soundtrack.SoundtrackName)
// PreviousSong moves to the previous song in the queue, staying on the first one at the start.
func (m *MusicService) PreviousSong() (string, error) {
if len(m.queue) == 0 {
return "", ErrQueueEmpty
}
rand.Shuffle(len(jsonArray), func(i, j int) { jsonArray[i], jsonArray[j] = jsonArray[j], jsonArray[i] })
return jsonArray
return m.Song(m.currentSong - 1)
}
func GetNextSong() string {
if songQueNew == nil {
return ""
// SoundtrackNames returns all soundtrack names in alphabetical order.
func (m *MusicService) SoundtrackNames(ctx context.Context) ([]string, error) {
soundtracks, err := m.allSoundtracks(ctx)
if err != nil {
return nil, err
}
if currentSong == len(songQueNew)-1 || currentSong == -1 {
songData := songQueNew[currentSong]
return songData.Path
} else {
currentSong = currentSong + 1
songData := songQueNew[currentSong]
return songData.Path
names := make([]string, len(soundtracks))
for i, s := range soundtracks {
names[i] = s.SoundtrackName
}
return names, nil
}
func GetPreviousSong() string {
if songQueNew == nil {
return ""
}
if currentSong == -1 || currentSong == 0 {
songData := songQueNew[0]
return songData.Path
} else {
currentSong = currentSong - 1
songData := songQueNew[currentSong]
return songData.Path
}
// SoundtrackNamesRandom returns all soundtrack names in random order.
func (m *MusicService) SoundtrackNamesRandom(ctx context.Context) ([]string, error) {
names, err := m.SoundtrackNames(ctx)
rand.Shuffle(len(names), func(i, j int) { names[i], names[j] = names[j], names[i] })
return names, err
}
func getSongFromList(soundtracks []repository.Soundtrack) repository.Song {
songFound := false
var song repository.Song
for !songFound {
soundtrack := getRandomSoundtrack(soundtracks)
songs, _ := BackendRepo().FindSongsFromSoundtrack(BackendCtx(), soundtrack.ID)
type weightedSoundtrack struct {
soundtrack repository.Soundtrack
weight int
}
// lowChanceWeights gives each soundtrack a weight of how far it is below the average play count (at least 1).
func lowChanceWeights(soundtracks []repository.Soundtrack) []weightedSoundtrack {
average := averagePlayed(soundtracks)
weighted := make([]weightedSoundtrack, len(soundtracks))
for i, s := range soundtracks {
weighted[i] = weightedSoundtrack{soundtrack: s, weight: max(1, int(average-s.TimesPlayed))}
}
return weighted
}
func averagePlayed(soundtracks []repository.Soundtrack) int32 {
if len(soundtracks) == 0 {
return 0
}
var sum int64
for _, s := range soundtracks {
sum += int64(s.TimesPlayed)
}
return int32(sum / int64(len(soundtracks)))
}
func pickWeighted(candidates []weightedSoundtrack) int {
total := 0
for _, c := range candidates {
total += c.weight
}
n := rand.IntN(total)
for i, c := range candidates {
if n < c.weight {
return i
}
n -= c.weight
}
return len(candidates) - 1
}
// pickSong picks a random playable song. Soundtracks without songs are dropped from the candidates
// and broken songs are removed from the database.
func (m *MusicService) pickSong(ctx context.Context, candidates []weightedSoundtrack) (repository.Song, error) {
candidates = slices.Clone(candidates)
for range maxPickAttempts {
if len(candidates) == 0 {
return repository.Song{}, ErrNoSongs
}
i := pickWeighted(candidates)
soundtrack := candidates[i].soundtrack
songs, err := m.q.FindSongsFromSoundtrack(ctx, soundtrack.ID)
if err != nil {
return repository.Song{}, err
}
if len(songs) == 0 {
candidates = slices.Delete(candidates, i, i+1)
continue
}
song = songs[rand.Intn(len(songs))]
song := songs[rand.IntN(len(songs))]
logging.GetLogger().Debug("Selected song", zap.String("song", song.SongName), zap.String("path", song.Path))
//Check if file exists and open
openFile, err := os.Open(song.Path)
if err != nil || (song.FileName != nil && soundtrack.Path+*song.FileName != song.Path) || (song.FileName != nil && strings.HasSuffix(*song.FileName, ".wav")) {
//File not found
BackendRepo().RemoveBrokenSong(BackendCtx(), repository.RemoveBrokenSongParams{SoundtrackID: song.SoundtrackID, Path: song.Path})
logging.GetLogger().Warn("Song not found, removed from database",
zap.String("song", song.SongName),
zap.String("soundtrack", soundtrack.SoundtrackName),
zap.Any("filename", song.FileName))
} else {
songFound = true
}
err = openFile.Close()
if err != nil {
logging.GetLogger().Error("Failed to close file", zap.String("path", song.Path), zap.String("error", err.Error()))
if !songIsPlayable(song, soundtrack.Path) {
if err := m.removeBrokenSong(ctx, song); err != nil {
return repository.Song{}, err
}
continue
}
return song, nil
}
return song
return repository.Song{}, ErrNoSongs
}
func getCurrentSoundtrack(currentSongData repository.Song) repository.Soundtrack {
for _, soundtrack := range soundtracksNew {
if soundtrack.ID == currentSongData.SoundtrackID {
func (m *MusicService) removeBrokenSong(ctx context.Context, song repository.Song) error {
logging.GetLogger().Warn("Song not found, removing from database",
zap.String("song", song.SongName),
zap.String("path", song.Path))
return m.q.RemoveBrokenSong(ctx, repository.RemoveBrokenSongParams{SoundtrackID: song.SoundtrackID, Path: song.Path})
}
// songIsPlayable reports whether the song file exists and its stored path is consistent.
func songIsPlayable(song repository.Song, soundtrackPath string) bool {
if song.FileName != nil {
if soundtrackPath+*song.FileName != song.Path || strings.HasSuffix(strings.ToLower(*song.FileName), ".wav") {
return false
}
}
info, err := os.Stat(song.Path)
return err == nil && !info.IsDir()
}
func (m *MusicService) soundtrackFor(ctx context.Context, song repository.Song) repository.Soundtrack {
soundtracks, err := m.allSoundtracks(ctx)
if err != nil {
logging.GetLogger().Error("Failed to load soundtracks", zap.Error(err))
return repository.Soundtrack{}
}
for _, soundtrack := range soundtracks {
if soundtrack.ID == song.SoundtrackID {
return soundtrack
}
}
return repository.Soundtrack{}
}
func getAveragePlayed() int32 {
getAllSoundtracks()
var sum int32
for _, data := range soundtracksNew {
sum += data.TimesPlayed
}
return sum / int32(len(soundtracksNew))
}
func getRandomSoundtrack(listOfSoundtracks []repository.Soundtrack) repository.Soundtrack {
return listOfSoundtracks[rand.Intn(len(listOfSoundtracks))]
}