4 Commits

Include renames

Author	SHA1	Message	Date
Sansan	a705d7b476	Store each client's play queue in the database ... The queue lived in memory and was shared by all clients, so a restart or a finished sync cleared it. Every client now has its own queue in the new queue and queue_song tables (added to the undeployed migration 000006). The music endpoints return the queue ID in the X-Queue-Id header and expect it back. A request without an ID, or with an ended one, starts a new queue. /music/reset ends the queue and returns a new ID, and a sync ends all running queues. Ended queues are kept as history. The deprecated legacy routes without the /api/v1 prefix are removed.	2026-10-07 20:03:03 +02:00
Sansan	080bacae80	Add GET /api/v1/statistics/soundtracks with every soundtrack and its songs ... The other soundtrack statistics are capped at 100, so a client that shows every soundtrack (the MusicPlayer statistics tab) had no way to get them all. This one has no limit and is sorted by name.	2026-10-06 23:14:49 +02:00
Sansan	2c3e97190d	Prefer UUIDs in the API (Phase 3 of the UUID migration) ... - New /api/v1 endpoints: GET /soundtracks, /soundtracks/{uuid}, /songs/{uuid} and /songs/{uuid}/file (streams the song, Range support, locked during sync) - UUIDs added to every response with soundtracks or songs: queue info and list (SoundtrackUuid, SongUuid) and statistics (soundtrack_uuid, song_uuid). Existing fields stay for backward compatibility - Play counts and broken-song removal use song UUIDs instead of soundtrack ID + song name, so songs with the same name are counted separately - Statistics return an empty song list for soundtracks without songs instead of a single empty entry - The legacy .id file cleanup stays until Phase 4 (#31) Closes #29	2026-10-06 15:54:41 +02:00
Sansan	090e794460	Restructure backend into services and fix security, crash and sync issues ... Security - Serve character images through os.Root so names like ../ can't escape the characters folder - Sync start and /sync/reset are POST only (legacy and /api/v1) - /api/v1/token/cleanup requires a token, password compared in constant time, tokens no longer logged - Echo's rate limiter replaces the custom one; TRUSTED_PROXIES enables X-Forwarded-For for reverse proxies Crashes and races - Sync state lives in SyncService with atomics and a mutex instead of unsynchronised globals (fixes concurrent map writes during full sync) - Only one sync can run; /api/v1 sync and music routes are locked during sync like the legacy ones - No log.Fatal outside startup: errors become 4xx/5xx responses - Search uses an in-order character match instead of unescaped regexes - Empty queue / no songs return 404 instead of panicking or looping Behaviour - Sync result is computed once and stays the same between polls - Swagger and /openapi serve the embedded spec - Shutdown stops HTTP before closing the database - Expired tokens are deleted with a context that outlives the request - Files are served with Range support and correct content types; audio has no write deadline Performance - Migration 000006 adds soundtrack.fingerprint (names, sizes, mtimes) so unchanged folders are skipped without reading any files - Songs are reconciled per soundtrack with one query plus needed writes; renames keep play counts - Moved MUSIC_PATH updates soundtrack and song paths - .id cleanup only runs for changed soundtracks or a full sync - Classic random uses one SQL query; Gitea release lookups are cached with a timeout Structure - internal/config reads all environment variables once - sqlc emits a Querier interface; backend globals become services injected into handlers - One route registration shared by legacy and /api/v1 - Removed dead code (dbHelper.go, unused middleware, duplicate Gitea functions, embedded Swagger UI copy) and lib/pq - templ and swag pinned as go tools	2026-10-06 15:20:14 +02:00