5 Commits

Include renames

Author	SHA1	Message	Date
Sansan	d31bf3551c	Allow CORS origins from CORS_ALLOWED_ORIGINS ... Echo compares allowed origins literally, so "https://*" and "http://*" never matched a real origin and no CORS headers were sent. The allowed origins now come from CORS_ALLOWED_ORIGINS (comma-separated, checked at startup). When it is empty, only same-origin requests work, which is enough for the bundled frontend. Credentials are no longer allowed since the API uses Bearer tokens. Browsers may now send Range and X-Queue-Id and read X-Queue-Id and Content-Range.	2026-10-07 20:03:13 +02:00
Sansan	a705d7b476	Store each client's play queue in the database ... The queue lived in memory and was shared by all clients, so a restart or a finished sync cleared it. Every client now has its own queue in the new queue and queue_song tables (added to the undeployed migration 000006). The music endpoints return the queue ID in the X-Queue-Id header and expect it back. A request without an ID, or with an ended one, starts a new queue. /music/reset ends the queue and returns a new ID, and a sync ends all running queues. Ended queues are kept as history. The deprecated legacy routes without the /api/v1 prefix are removed.	2026-10-07 20:03:03 +02:00
Sansan	fc7d787014	Serve the frontend's config.js with the API password ... The bundled frontend gets a token with API_PASSWORD from config.js. The server now generates config.js from its own config, so setting API_PASSWORD on the server container is enough.	2026-10-06 19:01:17 +02:00
Sansan	973ebf224b	Generate the OpenAPI spec with Huma instead of swag ... The spec is now built from the same calls that register the routes, so it can't drift from the router like the swag comments did (all /api/v1 routes were missing). - /api/v1 endpoints are typed Huma operations; the spec is OpenAPI 3.1 at /openapi.json (3.0 at /openapi-3.0.json, YAML too), docs at /docs. /openapi and /swagger/* redirect there - Bearer token security is declared per operation; token creation and the new GET /api/v1/health are public - Legacy routes use the same handlers, are hidden from the spec and keep the Deprecation header - /sync/reset is hidden (debug only); the /sync/new, /sync/quick and /sync/new/full aliases are removed (use /sync and /sync/full) - Invalid parameters return 422 (validation); every error is {"error": "..."}; empty lists are [] instead of null - /sync/progress is documented as progress or result (oneOf) - Tests validate the spec and check real responses of every documented operation against it (kin-openapi) - Removed swag annotations, cmd/docs, echo-swagger and the swag tool	2026-10-06 16:31:06 +02:00
Sansan	7b144ae419	Rewrite tests to run without a database ... - Unit tests use an in-memory fake database (internal/testutil/fakedb), temp folders and httptest; `go test ./...` needs no Docker or env vars - Integration tests (build tag "integration") start PostgreSQL with testcontainers: migrations step by step, SQL dumps (skipped if missing) and a full sync against a real database - Removed tests that only checked copies of the logic or had empty bodies, the broken root integration_test.go, compose.test.yaml and .env.test with hardcoded paths - testMusic MP3s replaced with tiny placeholders (sync never decodes audio), 194 MB -> 168 KB	2026-10-06 15:20:31 +02:00