Merge branch 'master' into codex/ttml-lrc-lyrics

cmd/inspect.go

@@ -32,17 +32,17 @@ var inspectCmd = &cobra.Command{
 	},
 }
 
-var marshalers = map[string]func(interface{}) ([]byte, error){
+var marshalers = map[string]func(any) ([]byte, error){
 	"pretty": prettyMarshal,
 	"toml":   toml.Marshal,
 	"yaml":   yaml.Marshal,
 	"json":   json.Marshal,
-	"jsonindent": func(v interface{}) ([]byte, error) {
+	"jsonindent": func(v any) ([]byte, error) {
 		return json.MarshalIndent(v, "", "  ")
 	},
 }
 
-func prettyMarshal(v interface{}) ([]byte, error) {
+func prettyMarshal(v any) ([]byte, error) {
 	out := v.([]core.InspectOutput)
 	var res strings.Builder
 	for i := range out {

conf/dir.go

@@ -1,20 +1,20 @@
 package conf
 
 import (
+	"cmp"
 	"fmt"
 	"os"
-	"sync"
 )
 
-// Dir wraps a directory path and lazily creates the directory on first use.
-// The directory is created at most once; if creation fails, the error is
-// permanently cached (sync.Once semantics). Dir is not safe for mutation
-// after Path() has been called.
+// Dir wraps a directory path and creates the directory on demand. Dir is a
+// plain value type — safe to copy, compare, and print via reflection-based
+// formatters (pretty.Sprintf("%# v", ...)) without any concurrency hazards.
+// Directory creation is delegated to os.MkdirAll on every Path() call;
+// MkdirAll is idempotent, so repeated calls cost one stat syscall when the
+// directory already exists.
 type Dir struct {
 	path string
 	perm os.FileMode
-	once sync.Once
-	err  error
 }
 
 // NewDir creates a new Dir with the given path and default permissions (os.ModePerm).
@@ -23,31 +23,32 @@ func NewDir(path string) Dir {
 }
 
 // NewDirWithPerm creates a new Dir with the given path and permissions.
+// A perm of 0 is treated as "default" and resolves to os.ModePerm at
+// directory-creation time; pass an explicit non-zero mode to constrain the
+// permissions.
 func NewDirWithPerm(path string, perm os.FileMode) Dir {
 	return Dir{path: path, perm: perm}
 }
 
 // String returns the raw path without creating the directory. Satisfies fmt.Stringer.
-func (d *Dir) String() string {
+func (d Dir) String() string {
 	return d.path
 }
 
-// Path creates the directory on first call (via sync.Once) and returns the path.
-func (d *Dir) Path() (string, error) {
-	d.once.Do(func() {
-		if d.path == "" {
-			return
-		}
-		d.err = os.MkdirAll(d.path, d.perm)
-		if d.err != nil {
-			d.err = fmt.Errorf("creating directory %q: %w", d.path, d.err)
-		}
-	})
-	return d.path, d.err
+// Path ensures the directory exists and returns its path. Safe to call
+// repeatedly; an empty path is returned as-is with no error.
+func (d Dir) Path() (string, error) {
+	if d.path == "" {
+		return "", nil
+	}
+	if err := os.MkdirAll(d.path, cmp.Or(d.perm, os.ModePerm)); err != nil {
+		return d.path, fmt.Errorf("creating directory %q: %w", d.path, err)
+	}
+	return d.path, nil
 }
 
 // MustPath calls Path() and calls logFatal on error.
-func (d *Dir) MustPath() string {
+func (d Dir) MustPath() string {
 	path, err := d.Path()
 	if err != nil {
 		logFatal("creating directory:", err)
@@ -57,12 +58,12 @@ func (d *Dir) MustPath() string {
 
 // GoString implements fmt.GoStringer so that %#v (used by pretty.Sprintf)
 // prints the path string instead of the internal struct fields.
-func (d Dir) GoString() string { //nolint:govet // uses a value receiver so Dir values satisfy GoStringer
+func (d Dir) GoString() string {
 	return fmt.Sprintf("%q", d.path)
 }
 
 // MarshalText returns the raw path bytes. No side effects.
-func (d *Dir) MarshalText() ([]byte, error) {
+func (d Dir) MarshalText() ([]byte, error) {
 	return []byte(d.path), nil
 }
 

conf/dir_test.go

@@ -2,7 +2,9 @@ package conf_test
 
 import (
 	"os"
+	"sync"
 
+	"github.com/kr/pretty"
 	"github.com/navidrome/navidrome/conf"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -35,9 +37,9 @@ var _ = Describe("Dir", func() {
 			Expect(target).To(BeADirectory())
 		})
 
-		It("returns the same result on subsequent calls (sync.Once)", func() {
+		It("is idempotent on subsequent calls", func() {
 			dir := GinkgoT().TempDir()
-			target := dir + "/once"
+			target := dir + "/idempotent"
 			d := conf.NewDir(target)
 
 			path1, err1 := d.Path()
@@ -45,6 +47,7 @@ var _ = Describe("Dir", func() {
 			Expect(err1).ToNot(HaveOccurred())
 			Expect(err2).ToNot(HaveOccurred())
 			Expect(path1).To(Equal(path2))
+			Expect(target).To(BeADirectory())
 		})
 
 		It("returns an error when directory cannot be created", func() {
@@ -124,4 +127,38 @@ var _ = Describe("Dir", func() {
 			Expect(d2.String()).To(Equal(d1.String()))
 		})
 	})
+
+	Describe("GoString", func() {
+		// Regression: pretty.Sprintf("%# v", ...) is used by the
+		// configuration dump. It must render Dir as a quoted path via
+		// GoString, not dump the internal struct fields.
+		It("renders Dir as a quoted path under pretty.Sprintf", func() {
+			type host struct {
+				DataFolder conf.Dir
+			}
+			h := host{DataFolder: conf.NewDir("./data")}
+			out := pretty.Sprintf("%# v", h)
+			Expect(out).To(ContainSubstring(`DataFolder: "./data"`))
+			Expect(out).ToNot(ContainSubstring("perm:"))
+			Expect(out).ToNot(ContainSubstring("path:"))
+		})
+
+		It("is safe to copy and use concurrently", func() {
+			// Regression for the Windows "sync: unlock of unlocked mutex"
+			// crash that was caused by copying a Dir embedding sync.Once.
+			// Dir is a plain value type now, but keep the concurrent stress
+			// test to lock in the property.
+			dir := GinkgoT().TempDir()
+			d := conf.NewDir(dir + "/race")
+			var wg sync.WaitGroup
+			for range 10 {
+				wg.Go(func() {
+					copy1 := d
+					_ = pretty.Sprintf("%# v", copy1)
+					_, _ = copy1.Path()
+				})
+			}
+			wg.Wait()
+		})
+	})
 })

core/artwork/benchmark_e2e_test.go

@@ -169,7 +169,7 @@ func BenchmarkArtworkGetE2EConcurrent(b *testing.B) {
 				for i := 0; i < b.N; i++ {
 					var wg sync.WaitGroup
 					wg.Add(n)
-					for g := 0; g < n; g++ {
+					for range n {
 						go func() {
 							defer wg.Done()
 							r, _, err := aw.Get(context.Background(), artID, 300, true)

core/artwork/benchmark_helpers_test.go

@@ -35,8 +35,8 @@ func generatePNG(t testing.TB, width, height int) []byte {
 // generateGradientImage creates an RGBA image with a diagonal gradient pattern.
 func generateGradientImage(width, height int) *image.RGBA {
 	img := image.NewRGBA(image.Rect(0, 0, width, height))
-	for y := 0; y < height; y++ {
-		for x := 0; x < width; x++ {
+	for y := range height {
+		for x := range width {
 			r := uint8((x * 255) / width)
 			g := uint8((y * 255) / height)
 			b := uint8(((x + y) * 255) / (width + height))

core/ffmpeg/ffmpeg.go

@@ -496,8 +496,8 @@ func createFFmpegCommand(cmd, path string, maxBitRate, offset int) []string {
 				// Pre-input seeking: ffmpeg seeks at the demuxer level (fast)
 				// instead of decoding all frames up to the offset (slow).
 				insertAt := len(args)
-				for i := len(args) - 1; i >= 0; i-- {
-					if args[i] == "-i" {
+				for i, arg := range slices.Backward(args) {
+					if arg == "-i" {
 						insertAt = i
 						break
 					}

core/playlists/rest_adapter.go

@@ -4,11 +4,13 @@ import (
 	"context"
 	"errors"
 	"reflect"
+	"strings"
 
 	"github.com/deluan/rest"
 	"github.com/navidrome/navidrome/model"
 	"github.com/navidrome/navidrome/model/criteria"
 	"github.com/navidrome/navidrome/model/request"
+	"github.com/navidrome/navidrome/utils/slice"
 )
 
 // --- REST adapter (follows Share/Library pattern) ---
@@ -34,8 +36,8 @@ func (r *playlistRepositoryWrapper) Save(entity any) (string, error) {
 	return r.service.savePlaylist(r.ctx, entity.(*model.Playlist))
 }
 
-func (r *playlistRepositoryWrapper) Update(id string, entity any, _ ...string) error {
-	return r.service.updatePlaylistEntity(r.ctx, id, entity.(*model.Playlist))
+func (r *playlistRepositoryWrapper) Update(id string, entity any, cols ...string) error {
+	return r.service.updatePlaylistEntity(r.ctx, id, entity.(*model.Playlist), cols...)
 }
 
 func (r *playlistRepositoryWrapper) Delete(id string) error {
@@ -79,7 +81,15 @@ func (s *playlists) savePlaylist(ctx context.Context, pls *model.Playlist) (stri
 
 // updatePlaylistEntity updates playlist metadata with permission checks.
 // Used by the REST API wrapper.
-func (s *playlists) updatePlaylistEntity(ctx context.Context, id string, entity *model.Playlist) error {
+//
+// cols names the fields the client actually sent in the JSON body (extracted by
+// rest.Put). When non-empty, fields outside cols are not considered changed and
+// are left untouched — this prevents partial requests like bulk "Make Public"
+// (body: {"public": true}) from wiping fields that just happen to be zero in
+// the deserialized entity (see issue #5541). An empty cols means "treat the
+// entity as a complete record" — preserved for callers that don't use the REST
+// wrapper.
+func (s *playlists) updatePlaylistEntity(ctx context.Context, id string, entity *model.Playlist, cols ...string) error {
 	current, err := s.checkWritable(ctx, id)
 	if err != nil {
 		switch {
@@ -91,41 +101,92 @@ func (s *playlists) updatePlaylistEntity(ctx context.Context, id string, entity
 			return err
 		}
 	}
+
+	sent := sentFields(cols)
+
 	usr, _ := request.UserFrom(ctx)
-	if !usr.IsAdmin && entity.OwnerID != "" && entity.OwnerID != current.OwnerID {
+	ownerChanged := sent("ownerId") && entity.OwnerID != "" && entity.OwnerID != current.OwnerID
+	if !usr.IsAdmin && ownerChanged {
 		return rest.ErrPermissionDenied
 	}
 
-	contentChanged := entity.Name != current.Name ||
-		entity.Comment != current.Comment ||
-		(entity.OwnerID != "" && entity.OwnerID != current.OwnerID) ||
-		!rulesEqual(current.Rules, entity.Rules)
+	nameChanged := sent("name") && entity.Name != current.Name
+	commentChanged := sent("comment") && entity.Comment != current.Comment
+	rulesChanged := sent("rules") && !rulesEqual(current.Rules, entity.Rules)
 
-	if contentChanged {
-		if entity.OwnerID != "" {
-			current.OwnerID = entity.OwnerID
-		}
+	if nameChanged || commentChanged || ownerChanged || rulesChanged {
+		return s.applyContentUpdate(ctx, current, entity, sent,
+			nameChanged, commentChanged, ownerChanged, rulesChanged)
+	}
+	return s.applyFlagsOnly(ctx, current, entity, sent)
+}
+
+// applyContentUpdate handles updates that change at least one of name/comment/
+// owner/rules. It goes through updateMetadata, which always bumps updatedAt
+// (invalidating cached cover-art URLs). namePtr/commentPtr are nil when the
+// field is absent from the request OR present-but-unchanged (so updateMetadata
+// skips them); publicPtr is nil only when public is absent from the request
+// (an idempotent public value is still forwarded).
+func (s *playlists) applyContentUpdate(ctx context.Context, current, entity *model.Playlist,
+	sent func(string) bool, nameChanged, commentChanged, ownerChanged, rulesChanged bool,
+) error {
+	if ownerChanged {
+		current.OwnerID = entity.OwnerID
+	}
+	if rulesChanged {
 		current.Rules = entity.Rules
-		if current.Path != "" && current.Sync != entity.Sync {
-			current.Sync = entity.Sync
-		}
-		return s.updateMetadata(ctx, s.ds, current, &entity.Name, &entity.Comment, &entity.Public)
 	}
-
-	// Only sync/public changed — skip updatedAt so cover art URLs stay stable
-	var cols []string
-	if current.Path != "" && current.Sync != entity.Sync {
+	if sent("sync") && current.Path != "" && current.Sync != entity.Sync {
 		current.Sync = entity.Sync
-		cols = append(cols, "sync")
 	}
-	if current.Public != entity.Public {
+	var namePtr, commentPtr *string
+	var publicPtr *bool
+	if nameChanged {
+		namePtr = &entity.Name
+	}
+	if commentChanged {
+		commentPtr = &entity.Comment
+	}
+	if sent("public") {
+		publicPtr = &entity.Public
+	}
+	return s.updateMetadata(ctx, s.ds, current, namePtr, commentPtr, publicPtr)
+}
+
+// applyFlagsOnly handles updates that only toggle sync/public — skips
+// updatedAt so cover art URLs stay stable.
+func (s *playlists) applyFlagsOnly(ctx context.Context, current, entity *model.Playlist,
+	sent func(string) bool,
+) error {
+	var updateCols []string
+	if sent("sync") && current.Path != "" && current.Sync != entity.Sync {
+		current.Sync = entity.Sync
+		updateCols = append(updateCols, "sync")
+	}
+	if sent("public") && current.Public != entity.Public {
 		current.Public = entity.Public
-		cols = append(cols, "public")
+		updateCols = append(updateCols, "public")
 	}
-	if len(cols) == 0 {
+	if len(updateCols) == 0 {
 		return nil
 	}
-	return s.ds.Playlist(ctx).Put(current, cols...)
+	return s.ds.Playlist(ctx).Put(current, updateCols...)
+}
+
+// sentFields returns a predicate that reports whether a JSON field was present
+// in the request body. Matching is case-insensitive to mirror Go's json
+// decoder, which populates struct fields from case-variant keys like
+// {"Name":"x"} or {"OWNERID":"y"}. An empty cols list means "treat the entity
+// as a full record" — every field is considered sent.
+func sentFields(cols []string) func(string) bool {
+	if len(cols) == 0 {
+		return func(string) bool { return true }
+	}
+	set := slice.ToMap(cols, func(c string) (string, struct{}) { return strings.ToLower(c), struct{}{} })
+	return func(field string) bool {
+		_, ok := set[strings.ToLower(field)]
+		return ok
+	}
 }
 
 func rulesEqual(a, b *criteria.Criteria) bool {

core/playlists/rest_adapter_test.go

@@ -125,6 +125,25 @@ var _ = Describe("REST Adapter", func() {
 				Expect(err).To(Equal(rest.ErrPermissionDenied))
 			})
 
+			DescribeTable("denies regular user from changing ownership under any case-variant JSON key",
+				func(colName string) {
+					// rest.Put's field-name extraction is case-sensitive, but Go's
+					// json decoder is case-insensitive on struct fields, so any
+					// {"OwnerId":"x"} / {"OWNERID":"x"} / {"ownerid":"x"} populates
+					// entity.OwnerID. sentFields normalizes both sides so the
+					// permission gate fires regardless of casing.
+					ctx = request.WithUser(ctx, model.User{ID: "user-1", IsAdmin: false})
+					repo = ps.NewRepository(ctx).(rest.Persistable)
+					pls := &model.Playlist{OwnerID: "other-user"}
+					err := repo.Update("pls-1", pls, colName)
+					Expect(err).To(Equal(rest.ErrPermissionDenied))
+				},
+				Entry("canonical camelCase", "ownerId"),
+				Entry("PascalCase", "OwnerId"),
+				Entry("all upper", "OWNERID"),
+				Entry("all lower", "ownerid"),
+			)
+
 			It("updates smart playlist rules", func() {
 				mockPlsRepo.Data["smart-1"] = &model.Playlist{
 					ID:      "smart-1",
@@ -218,6 +237,156 @@ var _ = Describe("REST Adapter", func() {
 				err := repo.Update("nonexistent", pls)
 				Expect(err).To(Equal(rest.ErrNotFound))
 			})
+
+			// Regression tests for #5541: partial REST updates (e.g. bulk "Make Public")
+			// must only touch the fields the client actually sent. The cols list from
+			// rest.Put names those fields; fields outside it must be left alone, even
+			// when the deserialized entity has zero values for them.
+			Context("with partial updates (cols)", func() {
+				BeforeEach(func() {
+					ctx = request.WithUser(ctx, model.User{ID: "user-1", IsAdmin: false})
+					mockPlsRepo.Data["partial"] = &model.Playlist{
+						ID:      "partial",
+						Name:    "Original Name",
+						Comment: "Original comment",
+						OwnerID: "user-1",
+						Public:  false,
+					}
+				})
+
+				It("preserves name and comment when only public is sent (bulk Make Public)", func() {
+					repo = ps.NewRepository(ctx).(rest.Persistable)
+					err := repo.Update("partial", &model.Playlist{Public: true}, "public")
+					Expect(err).ToNot(HaveOccurred())
+					Expect(mockPlsRepo.Last.Name).To(Equal("Original Name"))
+					Expect(mockPlsRepo.Last.Comment).To(Equal("Original comment"))
+					Expect(mockPlsRepo.Last.Public).To(BeTrue())
+				})
+
+				It("preserves name when only sync is sent for a file-backed playlist", func() {
+					mockPlsRepo.Data["file-partial"] = &model.Playlist{
+						ID:      "file-partial",
+						Name:    "Keep Me",
+						OwnerID: "user-1",
+						Path:    "/music/p.m3u",
+						Sync:    true,
+					}
+					repo = ps.NewRepository(ctx).(rest.Persistable)
+					err := repo.Update("file-partial", &model.Playlist{Sync: false}, "sync")
+					Expect(err).ToNot(HaveOccurred())
+					Expect(mockPlsRepo.Last.Name).To(Equal("Keep Me"))
+					Expect(mockPlsRepo.Last.Sync).To(BeFalse())
+				})
+
+				It("renames the playlist when only name is sent", func() {
+					repo = ps.NewRepository(ctx).(rest.Persistable)
+					err := repo.Update("partial", &model.Playlist{Name: "Renamed"}, "name")
+					Expect(err).ToNot(HaveOccurred())
+					Expect(mockPlsRepo.Last.Name).To(Equal("Renamed"))
+					Expect(mockPlsRepo.Last.Comment).To(Equal("Original comment"))
+					Expect(mockPlsRepo.Last.Public).To(BeFalse())
+				})
+
+				It("clears the comment when an empty comment is sent explicitly", func() {
+					repo = ps.NewRepository(ctx).(rest.Persistable)
+					err := repo.Update("partial", &model.Playlist{Comment: ""}, "comment")
+					Expect(err).ToNot(HaveOccurred())
+					Expect(mockPlsRepo.Last.Comment).To(BeEmpty())
+					Expect(mockPlsRepo.Last.Name).To(Equal("Original Name"))
+				})
+
+				It("updates rules-only on a smart playlist (Feishin-style edit)", func() {
+					mockPlsRepo.Data["smart-partial"] = &model.Playlist{
+						ID:      "smart-partial",
+						Name:    "Smart Original",
+						Comment: "smart comment",
+						OwnerID: "user-1",
+						Public:  true,
+						Rules:   &criteria.Criteria{Expression: criteria.Is{"genre": "Rock"}},
+					}
+					repo = ps.NewRepository(ctx).(rest.Persistable)
+					newRules := &criteria.Criteria{Expression: criteria.Is{"genre": "Jazz"}, Sort: "year DESC"}
+					err := repo.Update("smart-partial", &model.Playlist{Rules: newRules}, "rules")
+					Expect(err).ToNot(HaveOccurred())
+					Expect(mockPlsRepo.Last.Rules).To(Equal(newRules))
+					Expect(mockPlsRepo.Last.Name).To(Equal("Smart Original"))
+					Expect(mockPlsRepo.Last.Comment).To(Equal("smart comment"))
+					Expect(mockPlsRepo.Last.Public).To(BeTrue())
+				})
+
+				It("updates name and rules together (smart-playlist Edit form)", func() {
+					mockPlsRepo.Data["smart-edit"] = &model.Playlist{
+						ID:      "smart-edit",
+						Name:    "Smart Original",
+						Comment: "smart comment",
+						OwnerID: "user-1",
+						Rules:   &criteria.Criteria{Expression: criteria.Is{"genre": "Rock"}},
+					}
+					repo = ps.NewRepository(ctx).(rest.Persistable)
+					newRules := &criteria.Criteria{Expression: criteria.Is{"artist": "Miles Davis"}, Sort: "album"}
+					err := repo.Update("smart-edit",
+						&model.Playlist{Name: "Smart Renamed", Rules: newRules},
+						"name", "rules")
+					Expect(err).ToNot(HaveOccurred())
+					Expect(mockPlsRepo.Last.Name).To(Equal("Smart Renamed"))
+					Expect(mockPlsRepo.Last.Rules).To(Equal(newRules))
+					Expect(mockPlsRepo.Last.Comment).To(Equal("smart comment"))
+				})
+
+				It("does not bump the saved rules on an idempotent rules-only PUT", func() {
+					rules := &criteria.Criteria{Expression: criteria.Is{"genre": "Rock"}}
+					mockPlsRepo.Data["smart-idempotent"] = &model.Playlist{
+						ID:      "smart-idempotent",
+						Name:    "Smart Idempotent",
+						OwnerID: "user-1",
+						Rules:   rules,
+					}
+					repo = ps.NewRepository(ctx).(rest.Persistable)
+					// Same rules sent back — rulesEqual should report no change and
+					// the request should no-op (no Put call).
+					sameRules := &criteria.Criteria{Expression: criteria.Is{"genre": "Rock"}}
+					err := repo.Update("smart-idempotent", &model.Playlist{Rules: sameRules}, "rules")
+					Expect(err).ToNot(HaveOccurred())
+					Expect(mockPlsRepo.Last).To(BeNil()) // no Put happened
+				})
+
+				It("preserves rules when only public is sent (smart playlist + bulk Make Public)", func() {
+					rules := &criteria.Criteria{Expression: criteria.Is{"genre": "Rock"}}
+					mockPlsRepo.Data["smart-public"] = &model.Playlist{
+						ID:      "smart-public",
+						Name:    "Smart Public",
+						OwnerID: "user-1",
+						Public:  false,
+						Rules:   rules,
+					}
+					repo = ps.NewRepository(ctx).(rest.Persistable)
+					err := repo.Update("smart-public", &model.Playlist{Public: true}, "public")
+					Expect(err).ToNot(HaveOccurred())
+					Expect(mockPlsRepo.Last.Public).To(BeTrue())
+					Expect(mockPlsRepo.Last.Rules).To(Equal(rules))
+					Expect(mockPlsRepo.Last.Name).To(Equal("Smart Public"))
+				})
+
+				It("does not treat a missing ownerId as an ownership transfer attempt", func() {
+					// A non-admin user sending only {public:true} should not be blocked
+					// just because OwnerID is the zero value in the deserialized entity.
+					repo = ps.NewRepository(ctx).(rest.Persistable)
+					err := repo.Update("partial", &model.Playlist{Public: true}, "public")
+					Expect(err).ToNot(HaveOccurred())
+				})
+
+				It("matches cols case-insensitively (mirrors json decoder behavior)", func() {
+					// Go's json decoder populates struct fields from case-variant keys
+					// like {"Name":"x"}, but rest.Put's field-name extraction is
+					// case-sensitive. sentFields normalizes both sides so a request
+					// with {"Name":"Renamed"} is honored, not silently ignored.
+					repo = ps.NewRepository(ctx).(rest.Persistable)
+					err := repo.Update("partial", &model.Playlist{Name: "Renamed"}, "Name")
+					Expect(err).ToNot(HaveOccurred())
+					Expect(mockPlsRepo.Last.Name).To(Equal("Renamed"))
+					Expect(mockPlsRepo.Last.Comment).To(Equal("Original comment"))
+				})
+			})
 		})
 
 		Describe("Delete", func() {

core/scrobbler/play_tracker.go

@@ -371,7 +371,14 @@ func (p *playTracker) ReportPlayback(ctx context.Context, params ReportPlaybackP
 		p.broker.SendBroadcastMessage(ctx, &events.NowPlayingCount{Count: p.playMap.Len()})
 	}
 
-	if !params.IgnoreScrobble && player.ScrobbleEnabled &&
+	// NowPlaying gating, by design distinct from scrobble submission:
+	//   - IgnoreScrobble=true   -> still send NowPlaying (suppresses only the
+	//     scrobble submission/play-count above), mirroring the legacy scrobble
+	//     endpoint's submission=false behavior.
+	//   - player.ScrobbleEnabled=false -> never send NowPlaying.
+	// External agents here are the active scrobblers (Last.fm, ListenBrainz, and
+	// scrobbler plugins) returned by getActiveScrobblers; see dispatchNowPlaying.
+	if player.ScrobbleEnabled &&
 		(params.State == StateStarting || params.State == StatePlaying) {
 		if info, err := p.playMap.Get(clientId); err == nil {
 			p.enqueueNowPlaying(ctx, clientId, user.ID, &info.MediaFile, int(params.PositionMs/1000))

core/scrobbler/play_tracker_test.go

@@ -521,6 +521,7 @@ var _ = Describe("PlayTracker", func() {
 			})
 
 			It("does NOT scrobble when ignoreScrobble=true even if threshold met", func() {
+				fake.ScrobbleCalled.Store(false)
 				err := tracker.ReportPlayback(ctx, ReportPlaybackParams{
 					MediaId: "123", PositionMs: 0, State: "starting", PlaybackRate: 1.0, ClientId: defaultClientId,
 				})
@@ -531,6 +532,7 @@ var _ = Describe("PlayTracker", func() {
 				})
 				Expect(err).ToNot(HaveOccurred())
 				Expect(track.PlayCount).To(Equal(int64(0)))
+				Consistently(func() bool { return fake.ScrobbleCalled.Load() }).Should(BeFalse())
 			})
 
 			It("does NOT scrobble when player ScrobbleEnabled=false even if threshold met", func() {
@@ -715,14 +717,14 @@ var _ = Describe("PlayTracker", func() {
 				Consistently(func() bool { return fake.GetNowPlayingCalled() }).Should(BeFalse())
 			})
 
-			It("does NOT dispatch when ignoreScrobble=true", func() {
+			It("still dispatches NowPlaying when ignoreScrobble=true", func() {
 				fake.nowPlayingCalled.Store(false)
 				err := tracker.ReportPlayback(ctx, ReportPlaybackParams{
 					MediaId: "123", PositionMs: 0, State: "starting", PlaybackRate: 1.0, ClientId: defaultClientId,
 					IgnoreScrobble: true,
 				})
 				Expect(err).ToNot(HaveOccurred())
-				Consistently(func() bool { return fake.GetNowPlayingCalled() }).Should(BeFalse())
+				Eventually(func() bool { return fake.GetNowPlayingCalled() }).Should(BeTrue())
 			})
 
 			It("does NOT dispatch when ScrobbleEnabled=false", func() {

core/share.go

@@ -98,7 +98,7 @@ func (r *shareRepositoryWrapper) Save(entity any) (string, error) {
 		s.ExpiresAt = new(time.Now().Add(conf.Server.DefaultShareExpiration))
 	}
 
-	firstId := strings.SplitN(s.ResourceIDs, ",", 2)[0]
+	firstId, _, _ := strings.Cut(s.ResourceIDs, ",")
 	v, err := model.GetEntityByID(r.ctx, r.ds, firstId)
 	if err != nil {
 		return "", err

core/stream/media_streamer_test.go

@@ -64,11 +64,19 @@ var _ = Describe("MediaStreamer", func() {
 			Expect(s.Duration()).To(Equal(float32(257.0)))
 		})
 		It("rejects transcode requests beyond MaxConcurrent with ErrTooManyTranscodes", func() {
-			// Rebuild the streamer with a tight cap. The first request will hold the
-			// ffmpeg reader open (we don't read/close it), saturating the single slot.
+			// Use an ffmpeg whose Read blocks indefinitely so the cache's
+			// background copy can't drain the source and release the slot —
+			// keeping the single transcode slot pinned for this test.
+			pr, pw := io.Pipe()
+			DeferCleanup(func() { _ = pw.Close() })
+			blockingFFmpeg := tests.NewMockFFmpeg("")
+			blockingFFmpeg.Reader = pr
+
 			conf.Server.Transcoding.MaxConcurrent = 1
 			conf.Server.Transcoding.MaxConcurrentPerUser = 0
-			tightStreamer := stream.NewMediaStreamer(ds, ffmpeg, stream.NewTranscodingCache())
+			tightCache := stream.NewTranscodingCache()
+			Eventually(func() bool { return tightCache.Available(context.TODO()) }).Should(BeTrue())
+			tightStreamer := stream.NewMediaStreamer(ds, blockingFFmpeg, tightCache)
 
 			userCtx := request.WithUsername(ctx, "alice")
 			s1, err := tightStreamer.NewStream(userCtx, mf, stream.Request{Format: "mp3", BitRate: 64})
@@ -83,7 +91,9 @@ var _ = Describe("MediaStreamer", func() {
 		It("releases the slot once the stream is closed", func() {
 			conf.Server.Transcoding.MaxConcurrent = 1
 			conf.Server.Transcoding.MaxConcurrentPerUser = 0
-			tightStreamer := stream.NewMediaStreamer(ds, ffmpeg, stream.NewTranscodingCache())
+			tightCache := stream.NewTranscodingCache()
+			Eventually(func() bool { return tightCache.Available(context.TODO()) }).Should(BeTrue())
+			tightStreamer := stream.NewMediaStreamer(ds, ffmpeg, tightCache)
 
 			userCtx := request.WithUsername(ctx, "alice")
 			s1, err := tightStreamer.NewStream(userCtx, mf, stream.Request{Format: "mp3", BitRate: 64})
@@ -101,7 +111,9 @@ var _ = Describe("MediaStreamer", func() {
 		It("does not consume a slot for raw streams", func() {
 			conf.Server.Transcoding.MaxConcurrent = 1
 			conf.Server.Transcoding.MaxConcurrentPerUser = 0
-			tightStreamer := stream.NewMediaStreamer(ds, ffmpeg, stream.NewTranscodingCache())
+			tightCache := stream.NewTranscodingCache()
+			Eventually(func() bool { return tightCache.Available(context.TODO()) }).Should(BeTrue())
+			tightStreamer := stream.NewMediaStreamer(ds, ffmpeg, tightCache)
 
 			userCtx := request.WithUsername(ctx, "alice")
 			// First, saturate the single transcode slot.

go.mod

@@ -20,7 +20,7 @@ require (
 	github.com/extism/go-sdk v1.7.1
 	github.com/fatih/structs v1.1.0
 	github.com/gen2brain/webp v0.5.5
-	github.com/go-chi/chi/v5 v5.2.5
+	github.com/go-chi/chi/v5 v5.3.0
 	github.com/go-chi/cors v1.2.2
 	github.com/go-chi/httprate v0.15.0
 	github.com/go-chi/jwtauth/v5 v5.4.0
@@ -39,8 +39,8 @@ require (
 	github.com/mattn/go-sqlite3 v1.14.44
 	github.com/microcosm-cc/bluemonday v1.0.27
 	github.com/mileusna/useragent v1.3.5
-	github.com/onsi/ginkgo/v2 v2.28.3
-	github.com/onsi/gomega v1.40.0
+	github.com/onsi/ginkgo/v2 v2.29.0
+	github.com/onsi/gomega v1.41.0
 	github.com/pelletier/go-toml/v2 v2.3.1
 	github.com/pmezard/go-difflib v1.0.0
 	github.com/pocketbase/dbx v1.12.0
@@ -59,10 +59,10 @@ require (
 	github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342
 	go.senan.xyz/taglib v0.11.1
 	go.uber.org/goleak v1.3.0
-	golang.org/x/image v0.40.0
-	golang.org/x/net v0.54.0
+	golang.org/x/image v0.41.0
+	golang.org/x/net v0.55.0
 	golang.org/x/sync v0.20.0
-	golang.org/x/sys v0.44.0
+	golang.org/x/sys v0.45.0
 	golang.org/x/term v0.43.0
 	golang.org/x/text v0.37.0
 	golang.org/x/time v0.15.0
@@ -81,7 +81,7 @@ require (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect
 	github.com/dylibso/observe-sdk/go v0.0.0-20240828172851-9145d8ad07e1 // indirect
-	github.com/ebitengine/purego v0.10.0 // indirect
+	github.com/ebitengine/purego v0.10.1 // indirect
 	github.com/fsnotify/fsnotify v1.10.1 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
@@ -115,7 +115,7 @@ require (
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.67.5 // indirect
 	github.com/prometheus/procfs v0.20.1 // indirect
-	github.com/rogpeppe/go-internal v1.14.1 // indirect
+	github.com/rogpeppe/go-internal v1.15.0 // indirect
 	github.com/sagikazarmark/locafero v0.12.0 // indirect
 	github.com/sanity-io/litter v1.5.8 // indirect
 	github.com/segmentio/asm v1.2.1 // indirect
@@ -133,7 +133,7 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.51.0 // indirect
+	golang.org/x/crypto v0.52.0 // indirect
 	golang.org/x/mod v0.36.0 // indirect
 	golang.org/x/telemetry v0.0.0-20260508192327-42602be52be6 // indirect
 	golang.org/x/tools v0.45.0 // indirect

go.sum

@@ -54,8 +54,8 @@ github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkp
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/dylibso/observe-sdk/go v0.0.0-20240828172851-9145d8ad07e1 h1:idfl8M8rPW93NehFw5H1qqH8yG158t5POr+LX9avbJY=
 github.com/dylibso/observe-sdk/go v0.0.0-20240828172851-9145d8ad07e1/go.mod h1:C8DzXehI4zAbrdlbtOByKX6pfivJTBiV9Jjqv56Yd9Q=
-github.com/ebitengine/purego v0.10.0 h1:QIw4xfpWT6GWTzaW5XEKy3HXoqrJGx1ijYHzTF0/ISU=
-github.com/ebitengine/purego v0.10.0/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/ebitengine/purego v0.10.1 h1:dewVBCBT2GaMu1SrNTYxQhgQBethzfhiwvZiLGP/qyY=
+github.com/ebitengine/purego v0.10.1/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/extism/go-sdk v1.7.1 h1:lWJos6uY+tRFdlIHR+SJjwFDApY7OypS/2nMhiVQ9Sw=
 github.com/extism/go-sdk v1.7.1/go.mod h1:IT+Xdg5AZM9hVtpFUA+uZCJMge/hbvshl8bwzLtFyKA=
 github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=
@@ -73,8 +73,8 @@ github.com/gkampitakis/go-diff v1.3.2 h1:Qyn0J9XJSDTgnsgHRdz9Zp24RaJeKMUHg2+PDZZ
 github.com/gkampitakis/go-diff v1.3.2/go.mod h1:LLgOrpqleQe26cte8s36HTWcTmMEur6OPYerdAAS9tk=
 github.com/gkampitakis/go-snaps v0.5.15 h1:amyJrvM1D33cPHwVrjo9jQxX8g/7E2wYdZ+01KS3zGE=
 github.com/gkampitakis/go-snaps v0.5.15/go.mod h1:HNpx/9GoKisdhw9AFOBT1N7DBs9DiHo/hGheFGBZ+mc=
-github.com/go-chi/chi/v5 v5.2.5 h1:Eg4myHZBjyvJmAFjFvWgrqDTXFyOzjj7YIm3L3mu6Ug=
-github.com/go-chi/chi/v5 v5.2.5/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0=
+github.com/go-chi/chi/v5 v5.3.0 h1:halUjDxhshgXHMrao5bB8eNBXo/rnzwr8m5m36glehM=
+github.com/go-chi/chi/v5 v5.3.0/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
 github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE=
 github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
 github.com/go-chi/httprate v0.15.0 h1:j54xcWV9KGmPf/X4H32/aTH+wBlrvxL7P+SdnRqxh5g=
@@ -193,10 +193,10 @@ github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOF
 github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/ogier/pflag v0.0.1 h1:RW6JSWSu/RkSatfcLtogGfFgpim5p7ARQ10ECk5O750=
 github.com/ogier/pflag v0.0.1/go.mod h1:zkFki7tvTa0tafRvTBIZTvzYyAu6kQhPZFnshFFPE+g=
-github.com/onsi/ginkgo/v2 v2.28.3 h1:4JvMdwtFU0imd8fHx25OJXoDMRexnf8v5NHKYSTTji4=
-github.com/onsi/ginkgo/v2 v2.28.3/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
-github.com/onsi/gomega v1.40.0 h1:Vtol0e1MghCD2ZVIilPDIg44XSL9l2QAn8ZNaljWcJc=
-github.com/onsi/gomega v1.40.0/go.mod h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A=
+github.com/onsi/ginkgo/v2 v2.29.0 h1:rfh+ZFjgJhYWRoIqVf3Uwx/W20yLrcrE2h2GmYVRaag=
+github.com/onsi/ginkgo/v2 v2.29.0/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
+github.com/onsi/gomega v1.41.0 h1:OwKp4pXNgVxf6sCplzYo794OFNuoL2q2SBMU5NSWOjA=
+github.com/onsi/gomega v1.41.0/go.mod h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A=
 github.com/pelletier/go-toml/v2 v2.3.1 h1:MYEvvGnQjeNkRF1qUuGolNtNExTDwct51yp7olPtrEc=
 github.com/pelletier/go-toml/v2 v2.3.1/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
@@ -224,8 +224,8 @@ github.com/rjeczalik/notify v0.9.3/go.mod h1:gF3zSOrafR9DQEWSE8TjfI9NkooDxbyT4Ug
 github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
 github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY7EJ6hc=
+github.com/rogpeppe/go-internal v1.15.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 h1:OkMGxebDjyw0ULyrTYWeN0UNCCkmCWfjPnIA2W6oviI=
 github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06/go.mod h1:+ePHsJ1keEjQtpvf9HHw0f4ZeJ0TLRsxhunSI2hYJSs=
@@ -316,10 +316,10 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
-golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
-golang.org/x/image v0.40.0 h1:Tw4GyDXMo+daZN1znreBRC3VayR1aLFUyUEOLUdW1a8=
-golang.org/x/image v0.40.0/go.mod h1:uIc348UZMSvS5Z65CVZ7iDPaNobNFEPeJ4kbqTOszmA=
+golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
+golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
+golang.org/x/image v0.41.0 h1:8wS72eGJMJaBxK6okTzd4WaXumUlTVlb753MlsSvTCo=
+golang.org/x/image v0.41.0/go.mod h1:uIc348UZMSvS5Z65CVZ7iDPaNobNFEPeJ4kbqTOszmA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
@@ -338,8 +338,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
-golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -364,8 +364,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
-golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/telemetry v0.0.0-20260508192327-42602be52be6 h1:HjU6IWBiAgRIdAJ9/y1rwCn+UELEmwV+VsTLzj/W4sE=
 golang.org/x/telemetry v0.0.0-20260508192327-42602be52be6/go.mod h1:Eqhaxk/wZsWEH8CRxLwj6xzEJbz7k1EFGqx7nyCoabE=

log/journal.go

@@ -36,6 +36,6 @@ func (f *journalFormatter) Format(entry *logrus.Entry) ([]byte, error) {
 	if !ok {
 		priority = 6 // default to info for unknown levels
 	}
-	prefix := []byte(fmt.Sprintf("<%d>", priority))
+	prefix := fmt.Appendf(nil, "<%d>", priority)
 	return append(prefix, formatted...), nil
 }

model/tag_mappings.go

@@ -47,8 +47,8 @@ func (c TagConf) SplitTagValue(values []string) []string {
 		tag = c.SplitRx.ReplaceAllString(tag, consts.Zwsp)
 
 		// Split by the zero-width space and trim each substring.
-		parts := strings.Split(tag, consts.Zwsp)
-		for _, part := range parts {
+		parts := strings.SplitSeq(tag, consts.Zwsp)
+		for part := range parts {
 			result = append(result, strings.TrimSpace(part))
 		}
 	}

persistence/mediafile_repository.go

@@ -104,6 +104,7 @@ var mediaFileFilter = sync.OnceValue(func() map[string]filterFunc {
 		"missing":    booleanFilter,
 		"artists_id": artistFilter,
 		"library_id": libraryIdFilter,
+		"path":       startsWithFilter("media_file.path"),
 	}
 	// Add all album tags as filters
 	for tag := range model.TagMappings() {

persistence/mediafile_repository_test.go

@@ -524,6 +524,34 @@ var _ = Describe("MediaRepository", func() {
 				}
 			})
 		})
+
+		Describe("path", func() {
+			It("matches files whose path starts with the given prefix", func() {
+				res, err := mr.(model.ResourceRepository).ReadAll(rest.QueryOptions{
+					Filters: map[string]any{"path": "test/"},
+				})
+				Expect(err).ToNot(HaveOccurred())
+				files := res.(model.MediaFiles)
+
+				var found bool
+				for _, f := range files {
+					Expect(f.Path).To(HavePrefix("test/"))
+					if f.ID == mfWithoutAnnotation.ID {
+						found = true
+					}
+				}
+				Expect(found).To(BeTrue(), "MediaFile with matching path prefix should be included")
+			})
+
+			It("excludes files whose path does not start with the given prefix", func() {
+				res, err := mr.(model.ResourceRepository).ReadAll(rest.QueryOptions{
+					Filters: map[string]any{"path": "no-such-prefix/"},
+				})
+				Expect(err).ToNot(HaveOccurred())
+				files := res.(model.MediaFiles)
+				Expect(files).To(BeEmpty())
+			})
+		})
 	})
 
 	Describe("Search", func() {

persistence/player_repository.go

@@ -62,18 +62,6 @@ func (r *playerRepository) newRestSelect(options ...model.QueryOptions) SelectBu
 	return s.Where(r.addRestriction())
 }
 
-func (r *playerRepository) addRestriction(sql ...Sqlizer) Sqlizer {
-	s := And{}
-	if len(sql) > 0 {
-		s = append(s, sql[0])
-	}
-	u := loggedUser(r.ctx)
-	if u.IsAdmin {
-		return s
-	}
-	return append(s, Eq{"user_id": u.ID})
-}
-
 func (r *playerRepository) CountByClient(options ...model.QueryOptions) (map[string]int64, error) {
 	sel := r.newSelect(options...).
 		Columns(
@@ -125,6 +113,10 @@ func (r *playerRepository) NewInstance() any {
 	return &model.Player{}
 }
 
+// isPermitted authorizes creating a new record, based on the owner declared in the request body.
+// This is only safe for inserts: there is no stored row yet, and a non-admin may only create a
+// player they own. Updates must not use this (the body owner is attacker-controlled); they go
+// through updateOwned, which authorizes against the persisted user_id in the WHERE clause.
 func (r *playerRepository) isPermitted(p *model.Player) bool {
 	u := loggedUser(r.ctx)
 	return u.IsAdmin || p.UserId == u.ID
@@ -145,23 +137,11 @@ func (r *playerRepository) Save(entity any) (string, error) {
 func (r *playerRepository) Update(id string, entity any, cols ...string) error {
 	t := entity.(*model.Player)
 	t.ID = id
-	if !r.isPermitted(t) {
-		return rest.ErrPermissionDenied
-	}
-	_, err := r.put(id, t, cols...)
-	if errors.Is(err, model.ErrNotFound) {
-		return rest.ErrNotFound
-	}
-	return err
+	return r.updateOwned(id, t, cols...)
 }
 
 func (r *playerRepository) Delete(id string) error {
-	filter := r.addRestriction(And{Eq{"player.id": id}})
-	err := r.delete(filter)
-	if errors.Is(err, model.ErrNotFound) {
-		return rest.ErrNotFound
-	}
-	return err
+	return r.deleteOwned(id)
 }
 
 var _ model.PlayerRepository = (*playerRepository)(nil)

persistence/player_repository_test.go

@@ -110,33 +110,43 @@ var _ = Describe("PlayerRepository", func() {
 		})
 
 		Describe("Delete", func() {
-			DescribeTable("item type", func(player model.Player) {
-				err := repo.Delete(player.ID)
+			It("deletes a player owned by the current user", func() {
+				err := repo.Delete(userPlayer.ID)
 				Expect(err).To(BeNil())
 
-				isReal := player.UserId != ""
-				canDelete := admin || player.UserId == userPlayer.UserId
-
 				count, err := repo.Count()
 				Expect(err).To(BeNil())
+				Expect(count).To(Equal(baseCount - 1))
 
-				if isReal && canDelete {
-					Expect(count).To(Equal(baseCount - 1))
-				} else {
-					Expect(count).To(Equal(baseCount))
-				}
+				_, err = repo.Get(userPlayer.ID)
+				Expect(err).To(Equal(model.ErrNotFound))
+			})
 
-				item, err := repo.Get(player.ID)
-				if !isReal || canDelete {
+			It("does not delete another user's player when not admin", func() {
+				err := repo.Delete(otherPlayer.ID)
+
+				if admin {
+					// Admins may delete any player.
+					Expect(err).To(BeNil())
+					Expect(repo.Count()).To(Equal(baseCount - 1))
+					_, err = repo.Get(otherPlayer.ID)
 					Expect(err).To(Equal(model.ErrNotFound))
 				} else {
-					Expect(*item).To(Equal(player))
+					// The ownership-restricted delete matches no owned row, so it reports
+					// permission-denied and leaves the other user's player untouched.
+					Expect(err).To(Equal(rest.ErrPermissionDenied))
+					Expect(repo.Count()).To(Equal(baseCount))
+					item, err := repo.Get(otherPlayer.ID)
+					Expect(err).To(BeNil())
+					Expect(*item).To(Equal(otherPlayer))
 				}
-			},
-				Entry("same user", userPlayer),
-				Entry("other item", otherPlayer),
-				Entry("fake item", model.Player{}),
-			)
+			})
+
+			It("returns not-found for a nonexistent player", func() {
+				err := repo.Delete("i don't exist")
+				Expect(err).To(Equal(rest.ErrNotFound))
+				Expect(repo.Count()).To(Equal(baseCount))
+			})
 		})
 
 		Describe("Read", func() {
@@ -215,9 +225,12 @@ var _ = Describe("PlayerRepository", func() {
 				clone.MaxBitRate = 10000
 				err := repo.Update(clone.ID, &clone, "ip")
 
-				if clone.UserId == "" {
+				if player.UserId == "" {
 					Expect(err).To(HaveOccurred())
 				} else if !admin && player.Username == adminPlayer1.Username {
+					// A non-admin cannot target another user's player: the ownership-restricted
+					// update matches no owned row, so it reports permission-denied rather than
+					// touching it.
 					Expect(err).To(Equal(rest.ErrPermissionDenied))
 					clone.IP = player.IP
 				} else {
@@ -244,4 +257,86 @@ var _ = Describe("PlayerRepository", func() {
 		Entry("admin context", true, players, adminPlayer1, regularPlayer),
 		Entry("regular context", false, model.Players{regularPlayer}, regularPlayer, adminPlayer1),
 	)
+
+	Describe("Ownership enforcement (cross-tenant write protection)", func() {
+		var regularRepo *playerRepository
+
+		BeforeEach(func() {
+			ctx := log.NewContext(context.TODO())
+			ctx = request.WithUser(ctx, regularUser)
+			regularRepo = NewPlayerRepository(ctx, database).(*playerRepository)
+		})
+
+		It("does not let a regular user hijack another user's player by spoofing userId in the body", func() {
+			// Attacker (regularUser) targets the victim's (adminUser) player by URL id,
+			// but sets userId in the body to their own id to try to pass the permission check.
+			spoofed := model.Player{
+				ID:         adminPlayer1.ID,
+				Name:       "HIJACKED",
+				UserId:     regularUser.ID, // attacker's own id, spoofed in the body
+				MaxBitRate: 1,
+			}
+
+			// The ownership-restricted update matches no row owned by the attacker, so the write
+			// targets nothing and reports permission-denied rather than overwriting the victim's row.
+			err := regularRepo.Update(adminPlayer1.ID, &spoofed, "name", "user_id", "max_bit_rate")
+			Expect(err).To(Equal(rest.ErrPermissionDenied))
+
+			// The victim's player must remain untouched.
+			stored, err := adminRepo.Get(adminPlayer1.ID)
+			Expect(err).To(BeNil())
+			Expect(*stored).To(Equal(adminPlayer1))
+		})
+
+		It("does not let a regular user reassign their own player to another user", func() {
+			// Owner updates their own player but tries to give it away to the admin. The update
+			// succeeds for the other fields, but user_id is never written, so ownership stays put.
+			reassign := regularPlayer
+			reassign.UserId = adminUser.ID
+			reassign.Name = "given-away"
+
+			err := regularRepo.Update(regularPlayer.ID, &reassign, "name", "user_id")
+			Expect(err).To(BeNil())
+
+			// Ownership must not have changed.
+			stored, err := adminRepo.Get(regularPlayer.ID)
+			Expect(err).To(BeNil())
+			Expect(stored.UserId).To(Equal(regularUser.ID))
+		})
+
+		It("does not let an admin reassign a player to another user", func() {
+			// Even an admin cannot change a player's owner via update.
+			reassign := regularPlayer
+			reassign.UserId = adminUser.ID
+			reassign.Name = "admin-renamed"
+
+			err := adminRepo.Update(regularPlayer.ID, &reassign, "name", "user_id")
+			Expect(err).To(BeNil())
+
+			// The name change applies, but ownership must not have moved.
+			stored, err := adminRepo.Get(regularPlayer.ID)
+			Expect(err).To(BeNil())
+			Expect(stored.Name).To(Equal("admin-renamed"))
+			Expect(stored.UserId).To(Equal(regularUser.ID))
+		})
+
+		It("lets the owner update their own player", func() {
+			update := regularPlayer
+			update.Name = "renamed-by-owner"
+
+			err := regularRepo.Update(regularPlayer.ID, &update, "name")
+			Expect(err).To(BeNil())
+
+			stored, err := adminRepo.Get(regularPlayer.ID)
+			Expect(err).To(BeNil())
+			Expect(stored.Name).To(Equal("renamed-by-owner"))
+			Expect(stored.UserId).To(Equal(regularUser.ID))
+		})
+
+		It("returns not found when updating a nonexistent player", func() {
+			ghost := model.Player{ID: "does-not-exist", Name: "ghost", UserId: regularUser.ID}
+			err := regularRepo.Update("does-not-exist", &ghost, "name")
+			Expect(err).To(Equal(rest.ErrNotFound))
+		})
+	})
 })

persistence/share_repository.go

@@ -30,47 +30,18 @@ func NewShareRepository(ctx context.Context, db dbx.Builder) model.ShareReposito
 	return r
 }
 
-// TODO: Ownership checks should be moved to the service layer (core/share.go)
-func (r *shareRepository) checkOwnership(id string) error {
-	usr := loggedUser(r.ctx)
-	if usr.IsAdmin || usr.ID == invalidUserId {
-		return nil
-	}
-	sel := r.newSelect().Columns("user_id").Where(Eq{"id": id})
-	var share struct {
-		UserID string `db:"user_id"`
-	}
-	err := r.queryOne(sel, &share)
-	if err != nil {
-		if errors.Is(err, model.ErrNotFound) {
-			return rest.ErrNotFound
-		}
-		return err
-	}
-	if share.UserID != usr.ID {
-		return rest.ErrPermissionDenied
-	}
-	return nil
-}
-
 func (r *shareRepository) Delete(id string) error {
-	if err := r.checkOwnership(id); err != nil {
-		return err
-	}
-	err := r.delete(Eq{"id": id})
-	if errors.Is(err, model.ErrNotFound) {
-		return rest.ErrNotFound
-	}
-	return err
+	return r.deleteOwned(id)
 }
 
 func (r *shareRepository) selectShare(options ...model.QueryOptions) SelectBuilder {
 	return r.newSelect(options...).Join("user u on u.id = share.user_id").
-		Columns("share.*", "user_name as username")
+		Columns("share.*", "user_name as username").
+		Where(r.addRestriction())
 }
 
 func (r *shareRepository) Exists(id string) (bool, error) {
-	return r.exists(Eq{"id": id})
+	return r.exists(r.addRestriction(And{Eq{"id": id}}))
 }
 
 func (r *shareRepository) Get(id string) (*model.Share, error) {
@@ -166,17 +137,12 @@ func sortByIdPosition(mfs model.MediaFiles, ids []string) model.MediaFiles {
 
 func (r *shareRepository) Update(id string, entity any, cols ...string) error {
 	s := entity.(*model.Share)
-	if err := r.checkOwnership(id); err != nil {
-		return err
-	}
 	s.ID = id
 	s.UpdatedAt = time.Now()
-	cols = append(cols, "updated_at")
-	_, err := r.put(id, s, cols...)
-	if errors.Is(err, model.ErrNotFound) {
-		return rest.ErrNotFound
+	if len(cols) > 0 {
+		cols = append(cols, "updated_at")
 	}
-	return err
+	return r.updateOwned(id, s, cols...)
 }
 
 func (r *shareRepository) Save(entity any) (string, error) {

persistence/share_repository_test.go

@@ -20,7 +20,7 @@ var _ = Describe("ShareRepository", func() {
 
 	BeforeEach(func() {
 		DeferCleanup(configtest.SetupConfig())
-		ctx = request.WithUser(log.NewContext(context.TODO()), adminUser)
+		ctx = request.WithUser(log.NewContext(GinkgoT().Context()), adminUser)
 		repo = NewShareRepository(ctx, GetDBXBuilder())
 
 		// Insert the admin user into the database (required for foreign key constraint)
@@ -38,7 +38,7 @@ var _ = Describe("ShareRepository", func() {
 		Context("Repository creation and basic operations", func() {
 			It("should create repository successfully with no user context", func() {
 				// Create repository with no user context (headless)
-				headlessRepo := NewShareRepository(context.Background(), GetDBXBuilder())
+				headlessRepo := NewShareRepository(GinkgoT().Context(), GetDBXBuilder())
 				Expect(headlessRepo).ToNot(BeNil())
 			})
 
@@ -60,7 +60,7 @@ var _ = Describe("ShareRepository", func() {
 				Expect(err).ToNot(HaveOccurred())
 
 				// Headless process should see all shares
-				headlessRepo := NewShareRepository(context.Background(), GetDBXBuilder())
+				headlessRepo := NewShareRepository(GinkgoT().Context(), GetDBXBuilder())
 				shares, err := headlessRepo.GetAll()
 				Expect(err).ToNot(HaveOccurred())
 
@@ -92,7 +92,7 @@ var _ = Describe("ShareRepository", func() {
 				Expect(err).ToNot(HaveOccurred())
 
 				// Headless process should be able to get the share
-				headlessRepo := NewShareRepository(context.Background(), GetDBXBuilder())
+				headlessRepo := NewShareRepository(GinkgoT().Context(), GetDBXBuilder())
 				share, err := headlessRepo.Get(shareID)
 				Expect(err).ToNot(HaveOccurred())
 				Expect(share.ID).To(Equal(shareID))
@@ -155,7 +155,7 @@ var _ = Describe("ShareRepository", func() {
 		Describe("Delete", func() {
 			It("allows a non-admin user to delete their own share", func() {
 				insertShare("own-share-del", ownerUser.ID)
-				ctx := request.WithUser(log.NewContext(context.TODO()), ownerUser)
+				ctx := request.WithUser(log.NewContext(GinkgoT().Context()), ownerUser)
 				repo := NewShareRepository(ctx, GetDBXBuilder())
 				err := repo.(rest.Persistable).Delete("own-share-del")
 				Expect(err).ToNot(HaveOccurred())
@@ -163,15 +163,21 @@ var _ = Describe("ShareRepository", func() {
 
 			It("denies a non-admin user from deleting another user's share", func() {
 				insertShare("other-share-del", ownerUser.ID)
-				ctx := request.WithUser(log.NewContext(context.TODO()), otherUser)
+				ctx := request.WithUser(log.NewContext(GinkgoT().Context()), otherUser)
 				repo := NewShareRepository(ctx, GetDBXBuilder())
 				err := repo.(rest.Persistable).Delete("other-share-del")
 				Expect(err).To(Equal(rest.ErrPermissionDenied))
+
+				// The share was not deleted: the owner can still read it.
+				ownerCtx := request.WithUser(log.NewContext(GinkgoT().Context()), ownerUser)
+				ownerRepo := NewShareRepository(ownerCtx, GetDBXBuilder())
+				_, err = ownerRepo.(rest.Repository).Read("other-share-del")
+				Expect(err).ToNot(HaveOccurred())
 			})
 
 			It("allows an admin to delete any user's share", func() {
 				insertShare("admin-del-share", ownerUser.ID)
-				ctx := request.WithUser(log.NewContext(context.TODO()), adminUser)
+				ctx := request.WithUser(log.NewContext(GinkgoT().Context()), adminUser)
 				repo := NewShareRepository(ctx, GetDBXBuilder())
 				err := repo.(rest.Persistable).Delete("admin-del-share")
 				Expect(err).ToNot(HaveOccurred())
@@ -179,7 +185,7 @@ var _ = Describe("ShareRepository", func() {
 
 			It("allows headless context (no user) to delete a share", func() {
 				insertShare("headless-del-share", ownerUser.ID)
-				repo := NewShareRepository(context.Background(), GetDBXBuilder())
+				repo := NewShareRepository(GinkgoT().Context(), GetDBXBuilder())
 				err := repo.(rest.Persistable).Delete("headless-del-share")
 				Expect(err).ToNot(HaveOccurred())
 			})
@@ -188,7 +194,7 @@ var _ = Describe("ShareRepository", func() {
 		Describe("Update", func() {
 			It("allows a non-admin user to update their own share", func() {
 				insertShare("own-share-upd", ownerUser.ID)
-				ctx := request.WithUser(log.NewContext(context.TODO()), ownerUser)
+				ctx := request.WithUser(log.NewContext(GinkgoT().Context()), ownerUser)
 				repo := NewShareRepository(ctx, GetDBXBuilder())
 				err := repo.(rest.Persistable).Update("own-share-upd", &model.Share{Description: "Updated"}, "description")
 				Expect(err).ToNot(HaveOccurred())
@@ -196,7 +202,7 @@ var _ = Describe("ShareRepository", func() {
 
 			It("denies a non-admin user from updating another user's share", func() {
 				insertShare("other-share-upd", ownerUser.ID)
-				ctx := request.WithUser(log.NewContext(context.TODO()), otherUser)
+				ctx := request.WithUser(log.NewContext(GinkgoT().Context()), otherUser)
 				repo := NewShareRepository(ctx, GetDBXBuilder())
 				err := repo.(rest.Persistable).Update("other-share-upd", &model.Share{Description: "Hacked"}, "description")
 				Expect(err).To(Equal(rest.ErrPermissionDenied))
@@ -204,7 +210,7 @@ var _ = Describe("ShareRepository", func() {
 
 			It("allows an admin to update any user's share", func() {
 				insertShare("admin-upd-share", ownerUser.ID)
-				ctx := request.WithUser(log.NewContext(context.TODO()), adminUser)
+				ctx := request.WithUser(log.NewContext(GinkgoT().Context()), adminUser)
 				repo := NewShareRepository(ctx, GetDBXBuilder())
 				err := repo.(rest.Persistable).Update("admin-upd-share", &model.Share{Description: "Admin Updated"}, "description")
 				Expect(err).ToNot(HaveOccurred())
@@ -212,10 +218,178 @@ var _ = Describe("ShareRepository", func() {
 
 			It("allows headless context (no user) to update a share", func() {
 				insertShare("headless-upd-share", ownerUser.ID)
-				repo := NewShareRepository(context.Background(), GetDBXBuilder())
+				repo := NewShareRepository(GinkgoT().Context(), GetDBXBuilder())
 				err := repo.(rest.Persistable).Update("headless-upd-share", &model.Share{Description: "Headless"}, "description")
 				Expect(err).ToNot(HaveOccurred())
 			})
+
+			It("returns not found when updating a nonexistent share", func() {
+				ctx := request.WithUser(log.NewContext(context.TODO()), ownerUser)
+				repo := NewShareRepository(ctx, GetDBXBuilder())
+				err := repo.(rest.Persistable).Update("does-not-exist", &model.Share{Description: "Ghost"}, "description")
+				Expect(err).To(Equal(rest.ErrNotFound))
+			})
+
+			It("updates all columns when no specific columns are given", func() {
+				insertShare("all-cols-share", ownerUser.ID)
+				ctx := request.WithUser(log.NewContext(context.TODO()), ownerUser)
+				repo := NewShareRepository(ctx, GetDBXBuilder())
+				// No cols: the update must write every column, not just updated_at.
+				err := repo.(rest.Persistable).Update("all-cols-share",
+					&model.Share{Description: "All Updated", MaxBitRate: 192, ResourceType: "album", ResourceIDs: "2002"})
+				Expect(err).ToNot(HaveOccurred())
+
+				got, err := repo.(rest.Repository).Read("all-cols-share")
+				Expect(err).ToNot(HaveOccurred())
+				share := got.(*model.Share)
+				Expect(share.Description).To(Equal("All Updated"))
+				Expect(share.MaxBitRate).To(Equal(192))
+				Expect(share.ResourceType).To(Equal("album"))
+			})
+
+			It("does not let an owner reassign their share to another user", func() {
+				insertShare("reassign-share", ownerUser.ID)
+				ctx := request.WithUser(log.NewContext(context.TODO()), ownerUser)
+				repo := NewShareRepository(ctx, GetDBXBuilder())
+				err := repo.(rest.Persistable).Update("reassign-share",
+					&model.Share{UserID: otherUser.ID, Description: "Given away"}, "user_id", "description")
+				Expect(err).ToNot(HaveOccurred())
+
+				// Ownership must not have moved, even though user_id was passed in the body and cols.
+				got, err := repo.(rest.Repository).Read("reassign-share")
+				Expect(err).ToNot(HaveOccurred())
+				Expect(got.(*model.Share).UserID).To(Equal(ownerUser.ID))
+			})
+		})
+
+		Describe("Read scoping", func() {
+			BeforeEach(func() {
+				// Persist owner/other users so the JOIN in selectShare resolves.
+				ur := NewUserRepository(ctx, GetDBXBuilder())
+				Expect(ur.Put(&ownerUser)).To(Succeed())
+				Expect(ur.Put(&otherUser)).To(Succeed())
+
+				insertShare("share-owner-1", ownerUser.ID)
+				insertShare("share-owner-2", ownerUser.ID)
+				insertShare("share-other-1", otherUser.ID)
+			})
+
+			Context("non-admin user", func() {
+				var nonAdminRepo model.ShareRepository
+				var nonAdminRest rest.Repository
+
+				BeforeEach(func() {
+					nonAdminCtx := request.WithUser(log.NewContext(GinkgoT().Context()), ownerUser)
+					nonAdminRepo = NewShareRepository(nonAdminCtx, GetDBXBuilder())
+					nonAdminRest = nonAdminRepo.(rest.Repository)
+				})
+
+				It("GetAll returns only own shares", func() {
+					shares, err := nonAdminRepo.GetAll()
+					Expect(err).ToNot(HaveOccurred())
+					ids := make([]string, len(shares))
+					for i, s := range shares {
+						ids[i] = s.ID
+					}
+					Expect(ids).To(ConsistOf("share-owner-1", "share-owner-2"))
+				})
+
+				It("ReadAll returns only own shares", func() {
+					res, err := nonAdminRest.ReadAll()
+					Expect(err).ToNot(HaveOccurred())
+					shares := res.(model.Shares)
+					ids := make([]string, len(shares))
+					for i, s := range shares {
+						ids[i] = s.ID
+					}
+					Expect(ids).To(ConsistOf("share-owner-1", "share-owner-2"))
+				})
+
+				It("Get returns own share", func() {
+					s, err := nonAdminRepo.Get("share-owner-1")
+					Expect(err).ToNot(HaveOccurred())
+					Expect(s.ID).To(Equal("share-owner-1"))
+				})
+
+				It("Get returns ErrNotFound for another user's share", func() {
+					_, err := nonAdminRepo.Get("share-other-1")
+					Expect(err).To(MatchError(model.ErrNotFound))
+				})
+
+				It("Read returns ErrNotFound for another user's share", func() {
+					_, err := nonAdminRest.Read("share-other-1")
+					Expect(err).To(MatchError(model.ErrNotFound))
+				})
+
+				It("Exists returns true for own share", func() {
+					exists, err := nonAdminRepo.Exists("share-owner-1")
+					Expect(err).ToNot(HaveOccurred())
+					Expect(exists).To(BeTrue())
+				})
+
+				It("Exists returns false for another user's share", func() {
+					exists, err := nonAdminRepo.Exists("share-other-1")
+					Expect(err).ToNot(HaveOccurred())
+					Expect(exists).To(BeFalse())
+				})
+
+				It("CountAll counts only own shares", func() {
+					count, err := nonAdminRepo.CountAll()
+					Expect(err).ToNot(HaveOccurred())
+					Expect(count).To(BeNumerically("==", 2))
+				})
+
+				It("Count (rest) counts only own shares", func() {
+					count, err := nonAdminRest.Count()
+					Expect(err).ToNot(HaveOccurred())
+					Expect(count).To(BeNumerically("==", 2))
+				})
+			})
+
+			Context("admin user", func() {
+				It("GetAll returns all shares", func() {
+					adminCtx := request.WithUser(log.NewContext(GinkgoT().Context()), adminUser)
+					adminRepo := NewShareRepository(adminCtx, GetDBXBuilder())
+					shares, err := adminRepo.GetAll()
+					Expect(err).ToNot(HaveOccurred())
+					ids := make([]string, len(shares))
+					for i, s := range shares {
+						ids[i] = s.ID
+					}
+					Expect(ids).To(ConsistOf("share-owner-1", "share-owner-2", "share-other-1"))
+				})
+
+				It("CountAll counts all shares", func() {
+					adminCtx := request.WithUser(log.NewContext(GinkgoT().Context()), adminUser)
+					adminRepo := NewShareRepository(adminCtx, GetDBXBuilder())
+					count, err := adminRepo.CountAll()
+					Expect(err).ToNot(HaveOccurred())
+					Expect(count).To(BeNumerically("==", 3))
+				})
+			})
+
+			Context("headless context (public share route)", func() {
+				It("GetAll returns all shares", func() {
+					headlessRepo := NewShareRepository(GinkgoT().Context(), GetDBXBuilder())
+					shares, err := headlessRepo.GetAll()
+					Expect(err).ToNot(HaveOccurred())
+					Expect(shares).To(HaveLen(3))
+				})
+
+				It("Get returns another user's share", func() {
+					headlessRepo := NewShareRepository(GinkgoT().Context(), GetDBXBuilder())
+					s, err := headlessRepo.Get("share-other-1")
+					Expect(err).ToNot(HaveOccurred())
+					Expect(s.ID).To(Equal("share-other-1"))
+				})
+
+				It("Exists returns true for any share", func() {
+					headlessRepo := NewShareRepository(GinkgoT().Context(), GetDBXBuilder())
+					exists, err := headlessRepo.Exists("share-other-1")
+					Expect(err).ToNot(HaveOccurred())
+					Expect(exists).To(BeTrue())
+				})
+			})
 		})
 	})
 })

persistence/sql_base_repository.go

@@ -13,6 +13,7 @@ import (
 	"time"
 
 	. "github.com/Masterminds/squirrel"
+	"github.com/deluan/rest"
 	"github.com/navidrome/navidrome/conf"
 	"github.com/navidrome/navidrome/log"
 	"github.com/navidrome/navidrome/model"
@@ -57,6 +58,33 @@ func loggedUser(ctx context.Context) *model.User {
 	}
 }
 
+// ownerFilter returns the predicate restricting access to rows owned by the logged-in user, for
+// tables with a user_id column. It returns nil for admins and for headless/system contexts (invalid
+// user), meaning "no ownership restriction". Callers should skip the WHERE clause when it is nil.
+//
+// The predicate uses an unqualified user_id, so it only works on queries where that column is
+// unambiguous (no join introducing a second user_id).
+func (r sqlRepository) ownerFilter() Sqlizer {
+	if usr := loggedUser(r.ctx); !usr.IsAdmin && usr.ID != invalidUserId {
+		return Eq{"user_id": usr.ID}
+	}
+	return nil
+}
+
+// addRestriction combines an optional caller predicate with the ownership filter, producing the
+// WHERE clause for owner-scoped reads. For admins and headless contexts ownerFilter() is nil and
+// only the caller's predicate (if any) remains.
+func (r sqlRepository) addRestriction(sql ...Sqlizer) Sqlizer {
+	s := And{}
+	if len(sql) > 0 {
+		s = append(s, sql[0])
+	}
+	if owner := r.ownerFilter(); owner != nil {
+		s = append(s, owner)
+	}
+	return s
+}
+
 func (r *sqlRepository) registerModel(instance any, filters map[string]filterFunc) {
 	if r.tableName == "" {
 		r.tableName = strings.TrimPrefix(reflect.TypeOf(instance).String(), "*model.")
@@ -186,15 +214,6 @@ func (r sqlRepository) applyFilters(sq SelectBuilder, options ...model.QueryOpti
 	return sq
 }
 
-func (r *sqlRepository) withTableName(filter filterFunc) filterFunc {
-	return func(field string, value any) Sqlizer {
-		if r.tableName != "" {
-			field = r.tableName + "." + field
-		}
-		return filter(field, value)
-	}
-}
-
 // libraryIdFilter is a filter function to be added to resources that have a library_id column.
 func libraryIdFilter(_ string, value any) Sqlizer {
 	return Eq{"library_id": value}
@@ -382,6 +401,65 @@ func (r sqlRepository) exists(cond Sqlizer) (bool, error) {
 	return res.Exist > 0, err
 }
 
+// updateOwned performs an atomic, ownership-restricted update of the row identified by id, for
+// repositories whose table has a user_id column. Non-admins can only update rows they own: the
+// ownership predicate is part of the UPDATE's WHERE clause, so a row owned by another user simply
+// does not match and no write happens. Ownership itself is immutable here: user_id is never written,
+// so no caller (admin included) can reassign a row to a different owner via an update. Unlike put,
+// it never falls through to an INSERT, so a non-matching id never creates a row.
+//
+// When the update matches no row it classifies the failure: if the row exists but is owned by
+// another user it returns rest.ErrPermissionDenied, otherwise rest.ErrNotFound. The write itself is
+// still atomic; the extra lookup happens only on the failure path (count == 0), where no write
+// occurred, so there is no TOCTOU on the update.
+func (r sqlRepository) updateOwned(id string, m any, colsToUpdate ...string) error {
+	values, err := toSQLArgs(m)
+	if err != nil {
+		return fmt.Errorf("error preparing values to write to DB: %w", err)
+	}
+	updateValues := filterUpdateValues(values, id, colsToUpdate...)
+	delete(updateValues, "user_id") // ownership is immutable on update
+	update := Update(r.tableName).Where(r.addRestriction(Eq{"id": id})).SetMap(updateValues)
+	count, err := r.executeSQL(update)
+	if err != nil {
+		return err
+	}
+	if count == 0 {
+		return r.classifyOwnedWriteMiss(id)
+	}
+	return nil
+}
+
+// deleteOwned performs an atomic, ownership-restricted delete of the row identified by id, for
+// repositories whose table has a user_id column. Non-admins can only delete rows they own: the
+// ownership predicate is part of the DELETE's WHERE clause, so a row owned by another user simply
+// does not match and is left untouched. The failure path mirrors updateOwned (see
+// classifyOwnedWriteMiss), so there is no TOCTOU on the delete.
+func (r sqlRepository) deleteOwned(id string) error {
+	count, err := r.executeSQL(Delete(r.tableName).Where(r.addRestriction(Eq{"id": id})))
+	if err != nil {
+		return err
+	}
+	if count == 0 {
+		return r.classifyOwnedWriteMiss(id)
+	}
+	return nil
+}
+
+// classifyOwnedWriteMiss explains why an ownership-filtered write (updateOwned/deleteOwned) matched
+// no row: rest.ErrPermissionDenied if the row exists but is owned by another user, otherwise
+// rest.ErrNotFound. It runs only on the failure path (count == 0), where no write occurred.
+func (r sqlRepository) classifyOwnedWriteMiss(id string) error {
+	exists, err := r.exists(Eq{"id": id})
+	if err != nil {
+		return err
+	}
+	if exists {
+		return rest.ErrPermissionDenied
+	}
+	return rest.ErrNotFound
+}
+
 func (r sqlRepository) count(countQuery SelectBuilder, options ...model.QueryOptions) (int64, error) {
 	countQuery = countQuery.
 		RemoveColumns().Columns("count(distinct " + r.tableName + ".id) as count").
@@ -408,6 +486,30 @@ func (r sqlRepository) putByMatch(filter Sqlizer, id string, m any, colsToUpdate
 	return r.put(res.ID, m, colsToUpdate...)
 }
 
+// filterUpdateValues selects, from a marshaled column map, the values to write in an UPDATE on the
+// row identified by id: only the requested colsToUpdate (or all columns when none are specified),
+// dropping columns that must never be overwritten on update (created_at, birth_time).
+func filterUpdateValues(values map[string]any, id string, colsToUpdate ...string) map[string]any {
+	updateValues := map[string]any{}
+
+	// This is a map of the columns that need to be updated, if specified
+	c2upd := slice.ToMap(colsToUpdate, func(s string) (string, struct{}) {
+		return toSnakeCase(s), struct{}{}
+	})
+	for k, v := range values {
+		if _, found := c2upd[k]; len(c2upd) == 0 || found {
+			updateValues[k] = v
+		}
+	}
+
+	updateValues["id"] = id
+	delete(updateValues, "created_at")
+	// To avoid updating the media_file birth_time on each scan. Not the best solution, but it works for now
+	// TODO move to mediafile_repository when each repo has its own upsert method
+	delete(updateValues, "birth_time")
+	return updateValues
+}
+
 func (r sqlRepository) put(id string, m any, colsToUpdate ...string) (newId string, err error) {
 	values, err := toSQLArgs(m)
 	if err != nil {
@@ -415,24 +517,7 @@ func (r sqlRepository) put(id string, m any, colsToUpdate ...string) (newId stri
 	}
 	// If there's an ID, try to update first
 	if id != "" {
-		updateValues := map[string]any{}
-
-		// This is a map of the columns that need to be updated, if specified
-		c2upd := slice.ToMap(colsToUpdate, func(s string) (string, struct{}) {
-			return toSnakeCase(s), struct{}{}
-		})
-		for k, v := range values {
-			if _, found := c2upd[k]; len(c2upd) == 0 || found {
-				updateValues[k] = v
-			}
-		}
-
-		updateValues["id"] = id
-		delete(updateValues, "created_at")
-		// To avoid updating the media_file birth_time on each scan. Not the best solution, but it works for now
-		// TODO move to mediafile_repository when each repo has its own upsert method
-		delete(updateValues, "birth_time")
-		update := Update(r.tableName).Where(Eq{"id": id}).SetMap(updateValues)
+		update := Update(r.tableName).Where(Eq{"id": id}).SetMap(filterUpdateValues(values, id, colsToUpdate...))
 		count, err := r.executeSQL(update)
 		if err != nil {
 			return "", err

persistence/sql_restful.go

@@ -46,7 +46,7 @@ func (r *sqlRepository) parseRestFilters(ctx context.Context, options rest.Query
 			continue
 		}
 		// Default to a "starts with" filter
-		filters = append(filters, startsWithFilter(f, v))
+		filters = append(filters, Like{f: fmt.Sprintf("%s%%", v)})
 	}
 	return filters
 }
@@ -91,8 +91,10 @@ func eqFilter(field string, value any) Sqlizer {
 	return Eq{field: value}
 }
 
-func startsWithFilter(field string, value any) Sqlizer {
-	return Like{field: fmt.Sprintf("%s%%", value)}
+func startsWithFilter(field string) func(string, any) Sqlizer {
+	return func(_ string, value any) Sqlizer {
+		return Like{field: fmt.Sprintf("%s%%", value)}
+	}
 }
 
 func containsFilter(field string) func(string, any) Sqlizer {

persistence/sql_search_fts.go

@@ -66,7 +66,7 @@ func normalizeForFTS(values ...string) string {
 		result = append(result, variant)
 	}
 	for _, v := range values {
-		for _, word := range strings.Fields(v) {
+		for word := range strings.FieldsSeq(v) {
 			transliterated := sanitize.Accents(word)
 			// Concatenated ASCII form: R.E.M. → REM, AC/DC → ACDC, St-Étienne → StEtienne.
 			add(word, fts5PunctStrip.ReplaceAllString(transliterated, ""))
@@ -279,9 +279,9 @@ type ftsSearch struct {
 }
 
 // ToSql returns a single-query fallback for the REST filter path (no two-phase split).
-func (s *ftsSearch) ToSql() (string, []interface{}, error) {
+func (s *ftsSearch) ToSql() (string, []any, error) {
 	sql := s.tableName + ".rowid IN (SELECT rowid FROM " + s.ftsTable + " WHERE " + s.ftsTable + " MATCH ?)"
-	return sql, []interface{}{s.matchExpr}, nil
+	return sql, []any{s.matchExpr}, nil
 }
 
 // execute runs a two-phase FTS5 search:
@@ -373,8 +373,8 @@ func ftsQueryDegraded(original, ftsQuery string) bool {
 	// Check if all effective FTS tokens are very short (≤2 chars).
 	// Short tokens with prefix matching are too broad when special chars were stripped.
 	// For quoted phrases, extract the content and check the tokens inside.
-	tokens := strings.Fields(ftsQuery)
-	for _, t := range tokens {
+	tokens := strings.FieldsSeq(ftsQuery)
+	for t := range tokens {
 		t = strings.TrimSuffix(t, "*")
 		// Skip internal phrase placeholders
 		if strings.HasPrefix(t, "\x00") {
@@ -390,7 +390,7 @@ func ftsQueryDegraded(original, ftsQuery string) bool {
 			// Extract content between quotes
 			inner := strings.Trim(t, `"`)
 			innerAlpha := fts5PunctStrip.ReplaceAllString(inner, " ")
-			for _, it := range strings.Fields(innerAlpha) {
+			for it := range strings.FieldsSeq(innerAlpha) {
 				if len(it) > 2 {
 					return false
 				}

persistence/sql_search_like.go

@@ -16,7 +16,7 @@ type likeSearch struct {
 	filter Sqlizer
 }
 
-func (s *likeSearch) ToSql() (string, []interface{}, error) {
+func (s *likeSearch) ToSql() (string, []any, error) {
 	return s.filter.ToSql()
 }
 

persistence/transcoding_repository.go

@@ -53,14 +53,29 @@ func (r *transcodingRepository) Count(options ...rest.QueryOptions) (int64, erro
 }
 
 func (r *transcodingRepository) Read(id string) (any, error) {
-	return r.Get(id)
+	res, err := r.Get(id)
+	if err != nil {
+		return nil, err
+	}
+	if !loggedUser(r.ctx).IsAdmin {
+		res.Command = ""
+	}
+	return res, nil
 }
 
 func (r *transcodingRepository) ReadAll(options ...rest.QueryOptions) (any, error) {
 	sel := r.newSelect(r.parseRestOptions(r.ctx, options...)).Columns("*")
 	res := model.Transcodings{}
 	err := r.queryAll(sel, &res)
-	return res, err
+	if err != nil {
+		return nil, err
+	}
+	if !loggedUser(r.ctx).IsAdmin {
+		for i := range res {
+			res[i].Command = ""
+		}
+	}
+	return res, nil
 }
 
 func (r *transcodingRepository) EntityName() string {

persistence/transcoding_repository_test.go

@@ -64,9 +64,69 @@ var _ = Describe("TranscodingRepository", func() {
 			_, err = adminRepo.Get("to-delete")
 			Expect(err).To(MatchError(model.ErrNotFound))
 		})
+
+		It("reads the Command field via the REST Read method", func() {
+			tr := &model.Transcoding{ID: "adminread", Name: "temp", TargetFormat: "test_format", DefaultBitRate: 64, Command: "ffmpeg -secret"}
+			Expect(adminRepo.Put(tr)).To(Succeed())
+
+			res, err := adminRepo.(*transcodingRepository).Read("adminread")
+			Expect(err).ToNot(HaveOccurred())
+			Expect(res.(*model.Transcoding).Command).To(Equal("ffmpeg -secret"))
+		})
 	})
 
 	Describe("Regular User", func() {
+		It("reads a transcoding but with the Command field redacted", func() {
+			tr := &model.Transcoding{ID: "readreg", Name: "temp", TargetFormat: "test_format", DefaultBitRate: 64, Command: "ffmpeg -secret"}
+			Expect(adminRepo.Put(tr)).To(Succeed())
+
+			res, err := repo.(*transcodingRepository).Read("readreg")
+			Expect(err).ToNot(HaveOccurred())
+			t := res.(*model.Transcoding)
+			Expect(t.Name).To(Equal("temp"))
+			Expect(t.TargetFormat).To(Equal("test_format"))
+			Expect(t.Command).To(BeEmpty())
+		})
+
+		It("lists transcodings but with the Command field redacted", func() {
+			tr := &model.Transcoding{ID: "listreg", Name: "temp", TargetFormat: "test_format", DefaultBitRate: 64, Command: "ffmpeg -secret"}
+			Expect(adminRepo.Put(tr)).To(Succeed())
+
+			res, err := repo.(*transcodingRepository).ReadAll()
+			Expect(err).ToNot(HaveOccurred())
+			list := res.(model.Transcodings)
+			Expect(list).ToNot(BeEmpty())
+			for _, t := range list {
+				Expect(t.Command).To(BeEmpty())
+			}
+		})
+
+		It("counts transcodings", func() {
+			count, err := repo.(*transcodingRepository).Count()
+			Expect(err).ToNot(HaveOccurred())
+			Expect(count).To(BeNumerically(">=", 0))
+		})
+
+		It("can still resolve a transcoding for streaming via Get (Command not redacted)", func() {
+			tr := &model.Transcoding{ID: "streamreg", Name: "temp", TargetFormat: "test_format", DefaultBitRate: 64, Command: "ffmpeg -secret"}
+			Expect(adminRepo.Put(tr)).To(Succeed())
+
+			res, err := repo.Get("streamreg")
+			Expect(err).ToNot(HaveOccurred())
+			Expect(res.ID).To(Equal("streamreg"))
+			Expect(res.Command).To(Equal("ffmpeg -secret"))
+		})
+
+		It("can still resolve a transcoding for streaming via FindByFormat (Command not redacted)", func() {
+			tr := &model.Transcoding{ID: "fmtreg", Name: "temp", TargetFormat: "test_format", DefaultBitRate: 64, Command: "ffmpeg -secret"}
+			Expect(adminRepo.Put(tr)).To(Succeed())
+
+			res, err := repo.FindByFormat("test_format")
+			Expect(err).ToNot(HaveOccurred())
+			Expect(res.ID).To(Equal("fmtreg"))
+			Expect(res.Command).To(Equal("ffmpeg -secret"))
+		})
+
 		It("fails to create", func() {
 			err := repo.Put(&model.Transcoding{ID: "bad", Name: "bad", TargetFormat: "test_format", DefaultBitRate: 64, Command: "ffmpeg"})
 			Expect(err).To(Equal(rest.ErrPermissionDenied))

persistence/user_repository.go

@@ -59,7 +59,7 @@ func NewUserRepository(ctx context.Context, db dbx.Builder) model.UserRepository
 	r.registerModel(&model.User{}, map[string]filterFunc{
 		"id":       idFilter(r.tableName),
 		"password": invalidFilter(ctx),
-		"name":     r.withTableName(startsWithFilter),
+		"name":     startsWithFilter(r.tableName + ".name"),
 	})
 	once.Do(func() {
 		_ = r.initPasswordEncryptionKey()

persistence/user_repository_test.go

@@ -11,6 +11,7 @@ import (
 	"github.com/navidrome/navidrome/log"
 	"github.com/navidrome/navidrome/model"
 	"github.com/navidrome/navidrome/model/id"
+	"github.com/navidrome/navidrome/model/request"
 	"github.com/navidrome/navidrome/tests"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -207,6 +208,52 @@ var _ = Describe("UserRepository", func() {
 		})
 	})
 
+	Describe("ReadAll name filter", func() {
+		var adminRepo model.ResourceRepository
+
+		BeforeEach(func() {
+			adminCtx := request.WithUser(GinkgoT().Context(), model.User{ID: "admin-id", UserName: "admin", IsAdmin: true})
+			adminRepo = NewUserRepository(adminCtx, GetDBXBuilder()).(model.ResourceRepository)
+
+			for _, u := range []model.User{
+				{ID: "filter-alice", UserName: "alice_filter", Name: "Alice Filter", NewPassword: "x"},
+				{ID: "filter-bob", UserName: "bob_filter", Name: "Bob Filter", NewPassword: "x"},
+			} {
+				Expect(adminRepo.(model.UserRepository).Put(&u)).To(Succeed())
+			}
+		})
+
+		AfterEach(func() {
+			ur := adminRepo.(model.UserRepository)
+			_ = ur.Delete("filter-alice")
+			_ = ur.Delete("filter-bob")
+		})
+
+		It("matches users whose name starts with the given prefix", func() {
+			res, err := adminRepo.ReadAll(rest.QueryOptions{Filters: map[string]any{"name": "Alice"}})
+			Expect(err).ToNot(HaveOccurred())
+			users := res.(model.Users)
+
+			var names []string
+			for _, u := range users {
+				names = append(names, u.Name)
+			}
+			Expect(names).To(ContainElement("Alice Filter"))
+			Expect(names).ToNot(ContainElement("Bob Filter"))
+		})
+
+		It("does not match names by mid-string substring (startsWith, not contains)", func() {
+			res, err := adminRepo.ReadAll(rest.QueryOptions{Filters: map[string]any{"name": "Filter"}})
+			Expect(err).ToNot(HaveOccurred())
+			users := res.(model.Users)
+
+			for _, u := range users {
+				Expect(u.ID).ToNot(Or(Equal("filter-alice"), Equal("filter-bob")),
+					"a mid-string substring should not match a startsWith filter")
+			}
+		})
+	})
+
 	Describe("validateUsernameUnique", func() {
 		var repo *tests.MockedUserRepo
 		var existingUser *model.User

plugins/host_taskqueue.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"maps"
 	"os"
 	"path/filepath"
 	"sync"
@@ -540,9 +541,7 @@ func (s *taskQueueServiceImpl) cleanupLoop() {
 func (s *taskQueueServiceImpl) runCleanup() {
 	s.mu.Lock()
 	queues := make(map[string]*queueState, len(s.queues))
-	for k, v := range s.queues {
-		queues[k] = v
-	}
+	maps.Copy(queues, s.queues)
 	s.mu.Unlock()
 
 	now := time.Now().UnixMilli()

plugins/host_taskqueue_test.go

@@ -367,8 +367,8 @@ var _ = Describe("TaskQueueService", func() {
 
 			// Enqueue several more tasks — they stay pending since the worker is busy
 			var pendingIDs []string
-			for i := 0; i < 3; i++ {
-				taskID, err := service.Enqueue(ctx, "clear-test", []byte(fmt.Sprintf("task-%d", i)))
+			for i := range 3 {
+				taskID, err := service.Enqueue(ctx, "clear-test", fmt.Appendf(nil, "task-%d", i))
 				Expect(err).ToNot(HaveOccurred())
 				pendingIDs = append(pendingIDs, taskID)
 			}
@@ -674,8 +674,8 @@ var _ = Describe("TaskQueueService", func() {
 			Expect(err).ToNot(HaveOccurred())
 
 			// Enqueue 5 tasks
-			for i := 0; i < 5; i++ {
-				_, err := service.Enqueue(ctx, "delay-concurrent", []byte(fmt.Sprintf("task-%d", i)))
+			for i := range 5 {
+				_, err := service.Enqueue(ctx, "delay-concurrent", fmt.Appendf(nil, "task-%d", i))
 				Expect(err).ToNot(HaveOccurred())
 			}
 
@@ -1112,7 +1112,7 @@ var _ = Describe("TaskQueueService Integration", Ordered, func() {
 			// the second will be dequeued but block on the rate limiter (status=running),
 			// the rest will stay pending.
 			var taskIDs []string
-			for i := 0; i < 5; i++ {
+			for range 5 {
 				output, err := callTestTaskQueue(ctx, testTaskQueueInput{
 					Operation: "enqueue",
 					QueueName: "test-cancel",
@@ -1186,11 +1186,11 @@ var _ = Describe("TaskQueueService Integration", Ordered, func() {
 			Expect(err).ToNot(HaveOccurred())
 
 			// Enqueue several tasks
-			for i := 0; i < 4; i++ {
+			for i := range 4 {
 				_, err := callTestTaskQueue(ctx, testTaskQueueInput{
 					Operation: "enqueue",
 					QueueName: "test-clear",
-					Payload:   []byte(fmt.Sprintf("task-%d", i)),
+					Payload:   fmt.Appendf(nil, "task-%d", i),
 				})
 				Expect(err).ToNot(HaveOccurred())
 			}

resources/i18n/de.json

@@ -38,7 +38,9 @@
         "missing": "Fehlend",
         "libraryName": "Bibliothek",
         "composer": "Komponist",
-        "disc": "Disc %{discNumber}"
+        "disc": "Disc %{discNumber}",
+        "albumGain": "Album Gain",
+        "trackGain": "Titel Gain"
       },
       "actions": {
         "addToQueue": "Später abspielen",

resources/i18n/es.json

@@ -35,6 +35,8 @@
         "rawTags": "Etiquetas sin procesar",
         "bitDepth": "Profundidad de bits",
         "sampleRate": "Frecuencia de muestreo",
+        "albumGain": "Ganancia del álbum",
+        "trackGain": "Ganancia de pista",
         "missing": "Faltante",
         "libraryName": "Biblioteca",
         "composer": "Compositor",
@@ -693,7 +695,7 @@
     "quickScan": "Escaneo rápido",
     "fullScan": "Escaneo completo",
     "serverUptime": "Uptime del servidor",
-    "serverDown": "OFFLINE",
+    "serverDown": "DESCONECTADO",
     "scanType": "Tipo",
     "status": "Error de escaneo",
     "elapsedTime": "Tiempo transcurrido",

resources/i18n/eu.json

@@ -2,7 +2,7 @@
   "languageName": "Euskara",
   "resources": {
     "song": {
-      "name": "Abestia |||| Abesti",
+      "name": "Abestia |||| Abestiak",
       "fields": {
         "albumArtist": "Albumaren artista",
         "duration": "Iraupena",
@@ -22,6 +22,8 @@
         "bitRate": "Bit-tasa",
         "bitDepth": "Bit-sakonera",
         "sampleRate": "Lagin-tasa",
+        "albumGain": "Album-irabazia",
+        "trackGain": "Pista-irabazia",
         "channels": "Kanalak",
         "disc": "%{discNumber}. diskoa",
         "discSubtitle": "Diskoaren azpititulua",
@@ -53,7 +55,7 @@
       }
     },
     "album": {
-      "name": "Albuma |||| Album",
+      "name": "Albuma |||| Albumak",
       "fields": {
         "albumArtist": "Albumaren artista",
         "artist": "Artista",
@@ -104,7 +106,7 @@
       }
     },
     "artist": {
-      "name": "Artista |||| Artista",
+      "name": "Artista |||| Artistak",
       "fields": {
         "name": "Izena",
         "albumCount": "Album kopurua",
@@ -117,7 +119,7 @@
         "missing": "Ez da aurkitu"
       },
       "roles": {
-        "albumartist": "Albumeko egilea |||| Albumeko artistak",
+        "albumartist": "Albumeko artista |||| Albumeko artistak",
         "artist": "Artista |||| Artistak",
         "composer": "Konpositorea |||| Konpositoreak",
         "conductor": "Orkestra zuzendaria |||| Orkestra zuzendariak",
@@ -335,7 +337,7 @@
       }
     },
     "plugin": {
-      "name": "Plugina |||| Plugin",
+      "name": "Plugina |||| Pluginak",
       "fields": {
         "id": "IDa",
         "name": "Izena",
@@ -492,7 +494,7 @@
     "input": {
       "file": {
         "upload_several": "Jaregin edo hautatu igo nahi dituzun fitxategiak.",
-        "upload_single": "AJaregin edo hautatu igo nahi duzun fitxategia."
+        "upload_single": "Jaregin edo hautatu igo nahi duzun fitxategia."
       },
       "image": {
         "upload_several": "Jaregin edo hautatu igo nahi dituzun irudiak.",
@@ -537,9 +539,9 @@
       "skip_nav": "Joan edukira"
     },
     "notification": {
-      "updated": "Elementu bat eguneratu da |||| %{smart_count} elementu eguneratu dira",
+      "updated": "Elementua eguneratu da |||| %{smart_count} elementu eguneratu dira",
       "created": "Elementua sortu da",
-      "deleted": "Elementu bat ezabatu da |||| %{smart_count} elementu ezabatu dira.",
+      "deleted": "Elementua ezabatu da |||| %{smart_count} elementu ezabatu dira.",
       "bad_item": "Elementu okerra",
       "item_doesnt_exist": "Elementua ez dago",
       "http_error": "Errorea zerbitzariarekin komunikatzerakoan",
@@ -588,7 +590,7 @@
     "listenBrainzUnlinkSuccess": "ListenBrainz deskonektatu da eta erabiltzailearen ohiturak hirugarrenen zerbitzuekin partekatzea desaktibatu da",
     "listenBrainzUnlinkFailure": "Ezin izan da ListenBrainz deskonektatu",
     "openIn": {
-      "lastfm": "Ikusi Last.fm-n",
+      "lastfm": "Ikusi Last.fm-en",
       "musicbrainz": "Ikusi MusicBrainz-en"
     },
     "lastfmLink": "Irakurri gehiago…",

resources/i18n/fi.json

@@ -38,7 +38,9 @@
         "missing": "Puuttuva",
         "libraryName": "Kirjasto",
         "composer": "Säveltäjä",
-        "disc": "Levy %{discNumber}"
+        "disc": "Levy %{discNumber}",
+        "albumGain": "Albumin äänenvoimakkuus",
+        "trackGain": "Kappaleen äänenvoimakkuus"
       },
       "actions": {
         "addToQueue": "Lisää jonoon",

resources/i18n/gl.json

@@ -38,7 +38,9 @@
         "missing": "Falta",
         "libraryName": "Biblioteca",
         "composer": "Composición",
-        "disc": "Disco %{discNumber}"
+        "disc": "Disco %{discNumber}",
+        "albumGain": "Gañancia de Album",
+        "trackGain": "Gañancia de Canción"
       },
       "actions": {
         "addToQueue": "Ao final da cola",

resources/i18n/nl.json

@@ -38,7 +38,9 @@
         "missing": "Ontbrekend",
         "libraryName": "Bibliotheek",
         "composer": "Componist",
-        "disc": "Schijf %{discNumber}"
+        "disc": "Schijf %{discNumber}",
+        "albumGain": "Album gain",
+        "trackGain": "Nummer gain"
       },
       "actions": {
         "addToQueue": "Voeg toe aan wachtrij",

resources/i18n/sk.json

@@ -2,7 +2,7 @@
   "languageName": "Slovenčina",
   "resources": {
     "song": {
-      "name": "Skladba |||| Skladieb",
+      "name": "Skladba |||| Skladby",
       "fields": {
         "albumArtist": "Interpret albumu",
         "duration": "Dĺžka",
@@ -10,20 +10,14 @@
         "playCount": "Počet prehratí",
         "title": "Názov",
         "artist": "Interpret",
-        "composer": "Skladateľ",
         "album": "Album",
         "path": "Cesta k súboru",
-        "libraryName": "Knižnica",
         "genre": "Žáner",
         "compilation": "Kompilácia",
         "year": "Rok",
         "size": "Veľkosť súboru",
         "updatedAt": "Nahrané",
         "bitRate": "Prenosová rýchlosť",
-        "bitDepth": "Bitová hĺbka",
-        "sampleRate": "Vzorkovacia frekvencia",
-        "channels": "Kanály",
-        "disc": "Disk %{discNumber}",
         "discSubtitle": "Podtitul disku",
         "starred": "Obľúbené",
         "comment": "Komentár",
@@ -31,6 +25,7 @@
         "quality": "Kvalita",
         "bpm": "BPM",
         "playDate": "Naposledy prehraná skladba",
+        "channels": "Kanály",
         "createdAt": "Pridané",
         "grouping": "Zoskupovanie",
         "mood": "Nálada",
@@ -38,17 +33,24 @@
         "tags": "Ďalšie značky",
         "mappedTags": "Mapované značky",
         "rawTags": "Nespracované značky",
-        "missing": "Chýbajúce"
+        "bitDepth": "Bitová hĺbka",
+        "sampleRate": "Vzorkovacia frekvencia",
+        "missing": "Chýbajúce",
+        "libraryName": "Knižnica",
+        "composer": "Skladateľ",
+        "disc": "Disk %{discNumber}",
+        "albumGain": "Zosilnenie albumu",
+        "trackGain": "Zosilnenie stopy"
       },
       "actions": {
         "addToQueue": "Prehrať neskôr",
         "playNow": "Prehrať teraz",
         "addToPlaylist": "Pridať do zoznamu skladieb",
-        "showInPlaylist": "Zobraziť v zozname skladieb",
         "shuffleAll": "Zamiešať všetko",
         "download": "Stiahnuť",
         "playNext": "Prehrať ako ďalšie",
         "info": "Získať informácie",
+        "showInPlaylist": "Zobraziť v zozname skladieb",
         "instantMix": "Okamžitý mix"
       }
     },
@@ -60,38 +62,38 @@
         "duration": "Dĺžka",
         "songCount": "Skladby",
         "playCount": "Počet prehratí",
-        "size": "Veľkosť",
         "name": "Názov",
-        "libraryName": "Knižnica",
         "genre": "Žáner",
         "compilation": "Kompilácia",
         "year": "Rok",
-        "date": "Dátum záznamu",
-        "originalDate": "Pôvodné",
-        "releaseDate": "Vydané",
-        "releases": "Vydanie |||| Vydania",
-        "released": "Vydané",
         "updatedAt": "Aktualizované",
         "comment": "Komentár",
         "rating": "Hodnotenie",
         "createdAt": "Pridané",
+        "size": "Veľkosť",
+        "originalDate": "Pôvodné",
+        "releaseDate": "Vydané",
+        "releases": "Vydanie |||| Vydania",
+        "released": "Vydané",
         "recordLabel": "Štítok",
         "catalogNum": "Katalógové číslo",
         "releaseType": "Typ vydania",
         "grouping": "Zoskupovanie",
         "media": "Médiá",
         "mood": "Nálada",
-        "missing": "Chýbajúce"
+        "date": "Dátum záznamu",
+        "missing": "Chýbajúce",
+        "libraryName": "Knižnica"
       },
       "actions": {
         "playAll": "Prehrať",
         "playNext": "Prehrať ako ďalšie",
         "addToQueue": "Prehrať neskôr",
-        "share": "Zdieľať",
         "shuffle": "Zamiešať",
         "addToPlaylist": "Pridať do zoznamu skladieb",
         "download": "Stiahnuť",
-        "info": "Získať informácie"
+        "info": "Získať informácie",
+        "share": "Zdieľať"
       },
       "lists": {
         "all": "Všetko",
@@ -109,10 +111,10 @@
         "name": "Názov",
         "albumCount": "Počet albumov",
         "songCount": "Počet skladieb",
-        "size": "Veľkosť",
         "playCount": "Prehrania",
         "rating": "Hodnotenie",
         "genre": "Žáner",
+        "size": "Veľkosť",
         "role": "Rola",
         "missing": "Chýbajúci"
       },
@@ -133,9 +135,9 @@
         "maincredit": "Interpret albumu alebo interpret |||| Interpreti albumov alebo interpreti"
       },
       "actions": {
-        "topSongs": "Najpopulárnejšie skladby",
         "shuffle": "Zamiešať",
-        "radio": "Rádio"
+        "radio": "Rádio",
+        "topSongs": "Najpopulárnejšie skladby"
       }
     },
     "user": {
@@ -144,7 +146,6 @@
         "userName": "Používateľské meno",
         "isAdmin": "Správca",
         "lastLoginAt": "Naposledy prihlásený",
-        "lastAccessAt": "Posledný Prístup",
         "updatedAt": "Upravený",
         "name": "Meno",
         "password": "Heslo",
@@ -153,6 +154,7 @@
         "currentPassword": "Súčastné heslo",
         "newPassword": "Nové heslo",
         "token": "Token",
+        "lastAccessAt": "Posledný Prístup",
         "libraries": "Knižnice"
       },
       "helperTexts": {
@@ -164,14 +166,14 @@
         "updated": "Používateľ upravený",
         "deleted": "Používateľ odstránený"
       },
-      "validation": {
-        "librariesRequired": "Pre používateľov bez administrátorských práv musí byť vybratá aspoň jedna knižnica"
-      },
       "message": {
         "listenBrainzToken": "Vložte svoj používateľský ListenBrainz token.",
         "clickHereForToken": "Kliknite sem pre získanie svojho tokenu",
         "selectAllLibraries": "Vybrať všetky knižnice",
         "adminAutoLibraries": "Administrátori majú automaticky prístup ku všetkým knižniciam"
+      },
+      "validation": {
+        "librariesRequired": "Pre používateľov bez administrátorských práv musí byť vybratá aspoň jedna knižnica"
       }
     },
     "player": {
@@ -214,9 +216,9 @@
         "selectPlaylist": "Vybrať zoznam skladieb:",
         "addNewPlaylist": "Vytvoriť \"%{name}\"",
         "export": "Export",
-        "saveQueue": "Uložiť rad do zoznamu skladieb",
         "makePublic": "Zverejniť",
         "makePrivate": "Nastaviť ako súkromné",
+        "saveQueue": "Uložiť rad do zoznamu skladieb",
         "searchOrCreate": "Vyhľadajte zoznamy skladieb alebo napíšte pre vytvorenie nového...",
         "pressEnterToCreate": "Stlačte Enter pre vytvorenie nového zoznamu skladieb",
         "removeFromSelection": "Odstrániť z výberu"
@@ -247,7 +249,6 @@
         "username": "Zdieľané",
         "url": "URL",
         "description": "Popis",
-        "downloadable": "Povoliť sťahovanie?",
         "contents": "Obsah",
         "expiresAt": "Vyprší",
         "lastVisitedAt": "Naposledy navštívené",
@@ -255,19 +256,17 @@
         "format": "Formát",
         "maxBitRate": "Max. Bit Rate",
         "updatedAt": "Nahrané",
-        "createdAt": "Vytvorené"
-      },
-      "notifications": {},
-      "actions": {}
+        "createdAt": "Vytvorené",
+        "downloadable": "Povoliť sťahovanie?"
+      }
     },
     "missing": {
       "name": "Chýbajúci súbor |||| Chýbajúce súbory",
-      "empty": "Žiadne chýbajúce súbory",
       "fields": {
         "path": "Cesta",
         "size": "Veľkosť",
-        "libraryName": "Knižnica",
-        "updatedAt": "Zmizol dňa"
+        "updatedAt": "Zmizol dňa",
+        "libraryName": "Knižnica"
       },
       "actions": {
         "remove": "Odstrániť",
@@ -275,7 +274,8 @@
       },
       "notifications": {
         "removed": "Chýbajúce súbory odstránené"
-      }
+      },
+      "empty": "Žiadne chýbajúce súbory"
     },
     "library": {
       "name": "Knižnica |||| Knižnice",
@@ -305,20 +305,20 @@
       },
       "actions": {
         "scan": "Skenovať knižnicu",
-        "quickScan": "Rýchly sken",
-        "fullScan": "Úplný sken",
         "manageUsers": "Spravovať prístup používateľov",
-        "viewDetails": "Zobraziť detaily"
+        "viewDetails": "Zobraziť detaily",
+        "quickScan": "Rýchly sken",
+        "fullScan": "Úplný sken"
       },
       "notifications": {
         "created": "Knižnica úspešne vytvorená",
         "updated": "Knižnica úspešne aktualizovaná",
         "deleted": "Knižnica úspešne odstránená",
         "scanStarted": "Skenovanie knižnice spustené",
+        "scanCompleted": "Skenovanie knižnice dokončené",
         "quickScanStarted": "Rýchly sken spustený",
         "fullScanStarted": "Úplný sken spustený",
-        "scanError": "Chyba pri spustení skenu. Skontrolujte logy",
-        "scanCompleted": "Skenovanie knižnice dokončené"
+        "scanError": "Chyba pri spustení skenu. Skontrolujte logy"
       },
       "validation": {
         "nameRequired": "Názov knižnice je povinný",
@@ -391,8 +391,6 @@
       },
       "messages": {
         "configHelp": "Nakonfigurujte plugin pomocou párov kľúč-hodnota. Nechajte prázdne, ak plugin nevyžaduje žiadnu konfiguráciu.",
-        "configValidationError": "Overenie konfigurácie zlyhalo:",
-        "schemaRenderError": "Nie je možné zobraziť konfiguračný formulár. Schéma pluginu môže byť neplatná.",
         "clickPermissions": "Kliknite na oprávnenie pre detaily",
         "noConfig": "Žiadna konfigurácia nastavená",
         "allUsersHelp": "Keď je povolené, plugin bude mať prístup ku všetkým používateľom, vrátane tých vytvorených v budúcnosti.",
@@ -402,8 +400,10 @@
         "allLibrariesHelp": "Keď je povolené, plugin bude mať prístup ku všetkým knižniciam, vrátane tých vytvorených v budúcnosti.",
         "noLibraries": "Žiadne knižnice nevybrané",
         "librariesRequired": "Tento plugin vyžaduje prístup k informáciám o knižniciach. Vyberte, ku ktorým knižniciam má plugin prístup, alebo povolte 'Povoliť všetky knižnice'.",
-        "allowWriteAccessHelp": "Keď je povolené, plugin môže upravovať súbory v adresároch knižníc. Predvolene majú pluginy prístup iba na čítanie.",
-        "requiredHosts": "Požadovaní hostitelia"
+        "requiredHosts": "Požadovaní hostitelia",
+        "configValidationError": "Overenie konfigurácie zlyhalo:",
+        "schemaRenderError": "Nie je možné zobraziť konfiguračný formulár. Schéma pluginu môže byť neplatná.",
+        "allowWriteAccessHelp": "Keď je povolené, plugin môže upravovať súbory v adresároch knižníc. Predvolene majú pluginy prístup iba na čítanie."
       },
       "placeholders": {
         "configKey": "kľúč",
@@ -446,7 +446,6 @@
       "add": "Pridať",
       "back": "Ísť späť",
       "bulk_actions": "1 vybraná |||| %{smart_count} vybraných",
-      "bulk_actions_mobile": "1 |||| %{smart_count}",
       "cancel": "Zrušiť",
       "clear_input_value": "Vymazať hodnotu",
       "clone": "Klonovať",
@@ -470,6 +469,7 @@
       "close_menu": "Zavrieť ponuku",
       "unselect": "Zrušiť výber",
       "skip": "Preskočiť",
+      "bulk_actions_mobile": "1 |||| %{smart_count}",
       "share": "Zdieľať",
       "download": "Stiahnuť"
     },
@@ -557,58 +557,52 @@
     }
   },
   "message": {
-    "uploadCover": "Nahrať obrázok obalu",
-    "removeCover": "Odstrániť obrázok obalu",
-    "coverUploaded": "Obrázok obalu albumu aktualizovaný",
-    "coverRemoved": "Obrázok obalu albumu odstránený",
-    "coverUploadError": "Chyba pri nahrávaní obrázku obalu albumu",
-    "coverRemoveError": "Chyba pri odstraňovaní obrázku obalu albumu",
     "note": "POZNÁMKA",
     "transcodingDisabled": "Zmena nastavení transkódovania je vo webovom prostredí vypnutá z bezpečnostných dôvodov. Ak chcete zmeniť (upraviť alebo pridať) možnosti transkódovania, reštartujte server s možnosťou %{config}.",
     "transcodingEnabled": "Navidrome práve beží s možnosťou %{config}, ktorá umožňuje spúšťanie systémových príkazov z nastavení transkódovania pomocou webového rozhrania. Odporúčame ju vypnúť z bezpečnostných dôvodov a používať ju iba pri úprave nastavení transkódovania.",
     "songsAddedToPlaylist": "1 skladba pridaná do zoznamu skladieb |||| %{smart_count} skladieb pridaných do zoznamu skladieb",
-    "noSimilarSongsFound": "Nenašli sa žiadne podobné skladby",
-    "startingInstantMix": "Načítava sa Instant Mix...",
-    "noTopSongsFound": "Nenašli sa žiadne top skladby",
     "noPlaylistsAvailable": "Žiadne nie sú dostupné",
     "delete_user_title": "Odstrániť používateľa '%{name}'",
     "delete_user_content": "Ste si istí, že chcete odstrániť tohto používateľa a všetky jeho dáta (vrátane zoznamov skladieb a nastavení)?",
-    "remove_missing_title": "Odstráňte chýbajúce súbory",
-    "remove_missing_content": "Naozaj chcete odstrániť vybraté chýbajúce súbory z databázy? Týmto sa natrvalo odstránia všetky odkazy na ne vrátane ich počtu prehratí a hodnotení.",
-    "remove_all_missing_title": "Odstráňte všetky chýbajúce súbory",
-    "remove_all_missing_content": "Naozaj chcete z databázy odstrániť všetky chýbajúce súbory? Týmto sa natrvalo odstránia všetky odkazy na ne vrátane ich počtu prehratí a hodnotení.",
     "notifications_blocked": "Zablokovali ste si oznámenia pre túto stránku v nastaveniach vášho prehliadača",
     "notifications_not_available": "Tento prehliadač nepodporuje oznámenia na ploche alebo nepristupujete k Navidrome cez https",
     "lastfmLinkSuccess": "Last.fm úspešne pripojené a scrobbling zapnutý",
     "lastfmLinkFailure": "Last.fm sa nepodarilo pripojiť",
     "lastfmUnlinkSuccess": "Last.fm odpojené a scrobbling vypnutý",
     "lastfmUnlinkFailure": "Last.fm sa nepodarilo odpojiť",
-    "listenBrainzLinkSuccess": "ListenBrainz úspešne pripojený a scrobbling zapnutý ako používateľ: %{user}",
-    "listenBrainzLinkFailure": "ListenBrainz sa nepodarilo pripojiť: %{error}",
-    "listenBrainzUnlinkSuccess": "ListenBrainz odpojený a scrobbling vypnutý",
-    "listenBrainzUnlinkFailure": "ListenBrainz sa nepodarilo odpojiť",
     "openIn": {
       "lastfm": "Otvoriť na Last.fm",
       "musicbrainz": "Otvoriť na MusicBrainz"
     },
     "lastfmLink": "Čítať ďalej...",
+    "listenBrainzLinkSuccess": "ListenBrainz úspešne pripojený a scrobbling zapnutý ako používateľ: %{user}",
+    "listenBrainzLinkFailure": "ListenBrainz sa nepodarilo pripojiť: %{error}",
+    "listenBrainzUnlinkSuccess": "ListenBrainz odpojený a scrobbling vypnutý",
+    "listenBrainzUnlinkFailure": "ListenBrainz sa nepodarilo odpojiť",
+    "downloadOriginalFormat": "Stiahnuť v pôvodnom formáte",
     "shareOriginalFormat": "Zdieľať v pôvodnom formáte",
     "shareDialogTitle": "Zdieľať %{resource} '%{name}'",
     "shareBatchDialogTitle": "Zdieľať 1 %{resource} |||| Zdieľať %{smart_count} %{resource}",
-    "shareCopyToClipboard": "Skopírovať do schránky: Ctrl+C, Enter",
     "shareSuccess": "URL skopírovaná do schránky: %{url}",
     "shareFailure": "Chyba pri kopírovaní URL %{url} do schránky",
     "downloadDialogTitle": "Stiahnuť %{resource} '%{name}' (%{size})",
-    "downloadOriginalFormat": "Stiahnuť v pôvodnom formáte"
+    "shareCopyToClipboard": "Skopírovať do schránky: Ctrl+C, Enter",
+    "remove_missing_title": "Odstráňte chýbajúce súbory",
+    "remove_missing_content": "Naozaj chcete odstrániť vybraté chýbajúce súbory z databázy? Týmto sa natrvalo odstránia všetky odkazy na ne vrátane ich počtu prehratí a hodnotení.",
+    "remove_all_missing_title": "Odstráňte všetky chýbajúce súbory",
+    "remove_all_missing_content": "Naozaj chcete z databázy odstrániť všetky chýbajúce súbory? Týmto sa natrvalo odstránia všetky odkazy na ne vrátane ich počtu prehratí a hodnotení.",
+    "noSimilarSongsFound": "Nenašli sa žiadne podobné skladby",
+    "noTopSongsFound": "Nenašli sa žiadne top skladby",
+    "startingInstantMix": "Načítava sa Instant Mix...",
+    "uploadCover": "Nahrať obrázok obalu",
+    "removeCover": "Odstrániť obrázok obalu",
+    "coverUploaded": "Obrázok obalu albumu aktualizovaný",
+    "coverRemoved": "Obrázok obalu albumu odstránený",
+    "coverUploadError": "Chyba pri nahrávaní obrázku obalu albumu",
+    "coverRemoveError": "Chyba pri odstraňovaní obrázku obalu albumu"
   },
   "menu": {
     "library": "Knižnica",
-    "librarySelector": {
-      "allLibraries": "Všetky knižnice (%{count})",
-      "multipleLibraries": "%{selected} z %{total} knižníc",
-      "selectLibraries": "Vyberte knižnice",
-      "none": "Žiadne"
-    },
     "settings": "Nastavenia",
     "version": "Verzia",
     "theme": "Téma",
@@ -619,7 +613,6 @@
         "language": "Jazyk",
         "defaultView": "Predvolená stránka",
         "desktop_notifications": "Oznámenia na ploche",
-        "lastfmNotConfigured": "Kľúč API Last.fm nie je nakonfigurovaný",
         "lastfmScrobbling": "Scrobblovať na Last.fm",
         "listenBrainzScrobbling": "Scrobblovať na ListenBrainz",
         "replaygain": "Mód ReplayGain",
@@ -628,13 +621,20 @@
           "none": "Vypnuté",
           "album": "Použiť Album Gain",
           "track": "Použiť Track Gain"
-        }
+        },
+        "lastfmNotConfigured": "Kľúč API Last.fm nie je nakonfigurovaný"
       }
     },
     "albumList": "Albumy",
+    "about": "O Navidrome",
     "playlists": "Zoznamy skladieb",
     "sharedPlaylists": "Zdieľané zoznamy skladieb",
-    "about": "O Navidrome"
+    "librarySelector": {
+      "allLibraries": "Všetky knižnice (%{count})",
+      "multipleLibraries": "%{selected} z %{total} knižníc",
+      "selectLibraries": "Vyberte knižnice",
+      "none": "Žiadne"
+    }
   },
   "player": {
     "playListsText": "Rad",
@@ -682,11 +682,11 @@
       "currentValue": "Aktuálna hodnota",
       "configurationFile": "Konfiguračný súbor",
       "exportToml": "Exportovať konfiguráciu (TOML)",
-      "downloadToml": "Stiahnuť konfiguráciu (TOML)",
       "exportSuccess": "Konfigurácia exportovaná do schránky vo formáte TOML",
       "exportFailed": "Nepodarilo sa skopírovať konfiguráciu",
       "devFlagsHeader": "Vývojové príznaky (môžu byť zmenené/odstránené)",
-      "devFlagsComment": "Toto sú experimentálne nastavenia a môžu byť odstránené v budúcich verziách"
+      "devFlagsComment": "Toto sú experimentálne nastavenia a môžu byť odstránené v budúcich verziách",
+      "downloadToml": "Stiahnuť konfiguráciu (TOML)"
     }
   },
   "activity": {
@@ -694,17 +694,12 @@
     "totalScanned": "Naskenované priečinky",
     "quickScan": "Rýchly sken",
     "fullScan": "Úplný sken",
-    "selectiveScan": "Selektívne",
     "serverUptime": "Doba od spustenia",
     "serverDown": "OFFLINE",
     "scanType": "Posledný Sken",
     "status": "Chyba skenovania",
-    "elapsedTime": "Uplynutý čas"
-  },
-  "nowPlaying": {
-    "title": "Práve hrá",
-    "empty": "Nič sa neprehráva",
-    "minutesAgo": "pred %{smart_count} minútou |||| pred %{smart_count} minútami"
+    "elapsedTime": "Uplynutý čas",
+    "selectiveScan": "Selektívne"
   },
   "help": {
     "title": "Klávesové skratky Navidrome",
@@ -714,10 +709,15 @@
       "toggle_play": "Prehrať / Pozastaviť",
       "prev_song": "Predchádzajúca skladba",
       "next_song": "Nasledujúca skladba",
-      "current_song": "Prejsť na aktuálnu skladbu",
       "vol_up": "Zvýšiť hlasitosť",
       "vol_down": "Znížiť hlasitosť",
-      "toggle_love": "Pridať túto skladbu do obľúbených"
+      "toggle_love": "Pridať túto skladbu do obľúbených",
+      "current_song": "Prejsť na aktuálnu skladbu"
     }
+  },
+  "nowPlaying": {
+    "title": "Práve hrá",
+    "empty": "Nič sa neprehráva",
+    "minutesAgo": "pred %{smart_count} minútou |||| pred %{smart_count} minútami"
   }
 }

resources/i18n/th.json

@@ -38,7 +38,9 @@
         "missing": "หายไป",
         "libraryName": "ห้องสมุด",
         "composer": "ผู้แต่ง",
-        "disc": ""
+        "disc": "พื้นที่ %{discNumber}",
+        "albumGain": "เนื้อหาในอัลบั้ม",
+        "trackGain": "เนื้อหาในเพลง"
       },
       "actions": {
         "addToQueue": "เพิ่มในคิว",
@@ -355,7 +357,7 @@
         "selectedUsers": "ผู้ใช้ถูกเลือก",
         "allLibraries": "อนุญาติห้องสมุดเพลงทั้งหมด",
         "selectedLibraries": "ห้องสมุดเพลงถูกเลือก",
-        "allowWriteAccess": ""
+        "allowWriteAccess": "อนุญาตให้เขียน"
       },
       "sections": {
         "status": "สถานะ",
@@ -401,7 +403,7 @@
         "requiredHosts": "ต้องการ Host",
         "configValidationError": "การตั้งค่าเกิดความผิดพลาด",
         "schemaRenderError": "ไม่สามารถแสดงหน้าจอการตั้งค่า อาจเกิดจากความผิดพลาดจากปลั๊กอิน",
-        "allowWriteAccessHelp": ""
+        "allowWriteAccessHelp": "เมื่อเปิดใช้งาน ปลั๊กอินสามารถแก้ไขไฟล์ในห้องสมุด ปลั๊กอินอยู่ในโหมดอ่านอย่างเดียวเป็นค่าเริ่มต้น"
       },
       "placeholders": {
         "configKey": "คีย์",
@@ -591,7 +593,13 @@
     "remove_all_missing_content": "คุณแน่ใจว่าจะเอารายการไฟล์ที่หายไปออกจากดาต้าเบส นี่จะเป็นการลบข้อมูลอ้างอิงทั้งหมดของไฟล์ออกอย่างถาวร",
     "noSimilarSongsFound": "ไม่มีเพลงคล้ายกัน",
     "noTopSongsFound": "ไม่พบเพลงยอดนิยม",
-    "startingInstantMix": "กำลังโหลดอินสแตนท์ มิก..."
+    "startingInstantMix": "กำลังโหลดอินสแตนท์ มิก...",
+    "uploadCover": "อัพโหลดภาพหน้าปก",
+    "removeCover": "ลบถาพหน้าปก",
+    "coverUploaded": "ภาพหน้าปกถูกอัพเดทแล้ว",
+    "coverRemoved": "ภาพหน้าปกถูกลบแล้ว",
+    "coverUploadError": "อัพโหลดภาพหน้าปกผิดพลาด",
+    "coverRemoveError": "ลบภาพหน้าปกผิดพลาด"
   },
   "menu": {
     "library": "ห้องสมุดเพลง",
@@ -712,4 +720,4 @@
     "empty": "ไม่มีเพลงเล่น",
     "minutesAgo": "%{smart_count} นาทีที่แล้ว |||| %{smart_count} นาทีที่แล้ว"
   }
-}
+}

resources/i18n/zh-Hant.json

@@ -38,7 +38,9 @@
         "missing": "遺失",
         "libraryName": "媒體庫",
         "composer": "作曲者",
-        "disc": "光碟 %{discNumber}"
+        "disc": "光碟 %{discNumber}",
+        "albumGain": "專輯增益",
+        "trackGain": "曲目增益"
       },
       "actions": {
         "addToQueue": "加入至播放佇列",
@@ -718,4 +720,4 @@
     "empty": "無播放內容",
     "minutesAgo": "1 分鐘前 |||| %{smart_count} 分鐘前"
   }
-}
+}

scheduler/crontab_schedule_test.go

@@ -185,7 +185,7 @@ var _ = Describe("ParseCrontab", func() {
 // findSetBit returns the lowest bit position set in v, ignoring the starBit (bit 63).
 func findSetBit(v uint64) int {
 	v &^= 1 << 63 // clear starBit
-	for i := 0; i < 63; i++ {
+	for i := range 63 {
 		if v&(1<<uint(i)) != 0 {
 			return i
 		}

server/e2e/subsonic_sharing_test.go

@@ -125,3 +125,82 @@ var _ = Describe("Sharing Endpoints", Ordered, func() {
 		Expect(resp.Error).ToNot(BeNil())
 	})
 })
+
+var _ = Describe("Sharing Cross-User Isolation", Ordered, func() {
+	var userA, userB model.User
+	var shareID string
+	var albumID string
+
+	BeforeAll(func() {
+		conf.Server.EnableSharing = true
+		setupTestDB()
+
+		userA = createUser("share-user-a", "share-user-a", "Share User A", false)
+		userB = createUser("share-user-b", "share-user-b", "Share User B", false)
+
+		albums, err := ds.Album(ctx).GetAll(model.QueryOptions{
+			Filters: squirrel.Eq{"album.name": "Abbey Road"},
+		})
+		Expect(err).ToNot(HaveOccurred())
+		Expect(albums).ToNot(BeEmpty())
+		albumID = albums[0].ID
+
+		resp := doReqWithUser(userA, "createShare", "id", albumID, "description", "User A's share")
+		Expect(resp.Status).To(Equal(responses.StatusOK))
+		Expect(resp.Shares.Share).To(HaveLen(1))
+		shareID = resp.Shares.Share[0].ID
+		Expect(resp.Shares.Share[0].Username).To(Equal(userA.UserName))
+	})
+
+	It("userB's getShares does not leak userA's share", func() {
+		resp := doReqWithUser(userB, "getShares")
+
+		Expect(resp.Status).To(Equal(responses.StatusOK))
+		Expect(resp.Shares).ToNot(BeNil())
+		Expect(resp.Shares.Share).To(BeEmpty())
+	})
+
+	It("userA still sees own share", func() {
+		resp := doReqWithUser(userA, "getShares")
+
+		Expect(resp.Status).To(Equal(responses.StatusOK))
+		Expect(resp.Shares.Share).To(HaveLen(1))
+		Expect(resp.Shares.Share[0].ID).To(Equal(shareID))
+		Expect(resp.Shares.Share[0].Description).To(Equal("User A's share"))
+	})
+
+	It("admin sees userA's share", func() {
+		resp := doReqWithUser(adminUser, "getShares")
+
+		Expect(resp.Status).To(Equal(responses.StatusOK))
+		ids := make([]string, len(resp.Shares.Share))
+		for i, s := range resp.Shares.Share {
+			ids[i] = s.ID
+		}
+		Expect(ids).To(ContainElement(shareID))
+	})
+
+	It("userB cannot updateShare on userA's share", func() {
+		resp := doReqWithUser(userB, "updateShare", "id", shareID, "description", "hijacked")
+
+		Expect(resp.Status).To(Equal(responses.StatusFailed))
+		Expect(resp.Error).ToNot(BeNil())
+
+		// Confirm description unchanged for userA.
+		check := doReqWithUser(userA, "getShares")
+		Expect(check.Shares.Share).To(HaveLen(1))
+		Expect(check.Shares.Share[0].Description).To(Equal("User A's share"))
+	})
+
+	It("userB cannot deleteShare on userA's share", func() {
+		resp := doReqWithUser(userB, "deleteShare", "id", shareID)
+
+		Expect(resp.Status).To(Equal(responses.StatusFailed))
+		Expect(resp.Error).ToNot(BeNil())
+
+		// Confirm share still present for userA.
+		check := doReqWithUser(userA, "getShares")
+		Expect(check.Shares.Share).To(HaveLen(1))
+		Expect(check.Shares.Share[0].ID).To(Equal(shareID))
+	})
+})

server/subsonic/api.go

@@ -9,6 +9,7 @@ import (
 	"regexp"
 	"strconv"
 
+	"github.com/deluan/rest"
 	"github.com/go-chi/chi/v5"
 	"github.com/navidrome/navidrome/conf"
 	"github.com/navidrome/navidrome/core"
@@ -301,9 +302,9 @@ func mapToSubsonicError(err error) subError {
 		err = newError(responses.ErrorMissingParameter, err.Error())
 	case errors.Is(err, req.ErrInvalidParam):
 		err = newError(responses.ErrorGeneric, err.Error())
-	case errors.Is(err, model.ErrNotFound):
+	case errors.Is(err, model.ErrNotFound), errors.Is(err, rest.ErrNotFound):
 		err = newError(responses.ErrorDataNotFound, "data not found")
-	case errors.Is(err, model.ErrNotAuthorized):
+	case errors.Is(err, model.ErrNotAuthorized), errors.Is(err, rest.ErrPermissionDenied):
 		err = newError(responses.ErrorAuthorizationFail)
 	case errors.Is(err, stream.ErrTooManyTranscodes):
 		err = newError(responses.ErrorGeneric, "too many concurrent transcodes, please retry shortly")

server/subsonic/api_test.go

@@ -1,19 +1,22 @@
 package subsonic
 
 import (
+	"context"
 	"encoding/json"
 	"encoding/xml"
+	"errors"
 	"fmt"
 	"math"
 	"net/http"
 	"net/http/httptest"
 	"strings"
 
+	"github.com/deluan/rest"
 	"github.com/navidrome/navidrome/core/stream"
+	"github.com/navidrome/navidrome/model"
 	"github.com/navidrome/navidrome/server/subsonic/responses"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
-	"golang.org/x/net/context"
 )
 
 var _ = Describe("sendResponse", func() {
@@ -187,3 +190,24 @@ var _ = Describe("sendResponse", func() {
 		Expect(pointer).To(Equal(responses.ErrorDataNotFound))
 	})
 })
+
+var _ = Describe("mapToSubsonicError", func() {
+	DescribeTable("maps repository errors to the correct Subsonic error code",
+		func(err error, expectedCode int32) {
+			subErr := mapToSubsonicError(err)
+			Expect(subErr.code).To(Equal(expectedCode))
+		},
+		Entry("rest.ErrPermissionDenied -> not authorized (50)",
+			rest.ErrPermissionDenied, responses.ErrorAuthorizationFail),
+		Entry("rest.ErrNotFound -> data not found (70)",
+			rest.ErrNotFound, responses.ErrorDataNotFound),
+		Entry("model.ErrNotAuthorized -> not authorized (50)",
+			model.ErrNotAuthorized, responses.ErrorAuthorizationFail),
+		Entry("model.ErrNotFound -> data not found (70)",
+			model.ErrNotFound, responses.ErrorDataNotFound),
+		Entry("wrapped rest.ErrPermissionDenied is still mapped",
+			fmt.Errorf("update share: %w", rest.ErrPermissionDenied), responses.ErrorAuthorizationFail),
+		Entry("unknown error -> generic (0)",
+			errors.New("boom"), responses.ErrorGeneric),
+	)
+})

server/subsonic/filter/filters.go

@@ -92,7 +92,7 @@ func SongsByAlbum(albumId string) Options {
 
 func SongsByRandom(genre string, fromYear, toYear int) Options {
 	options := Options{
-		Sort: "random",
+		Sort: "random()",
 	}
 	ff := And{}
 	if genre != "" {

server/throttle_backlog.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"errors"
+	"maps"
 	"net/http"
 	"sync"
 	"time"
@@ -76,9 +77,7 @@ func (t *requestThrottle) handler(next http.Handler) http.Handler {
 			next.ServeHTTP(buf, r)
 		}()
 
-		for k, v := range buf.header {
-			w.Header()[k] = v
-		}
+		maps.Copy(w.Header(), buf.header)
 		if buf.code > 0 {
 			w.WriteHeader(buf.code)
 		}

ui/src/layout/Login.jsx

@@ -101,8 +101,13 @@ const renderInput = ({
 }) => (
   <TextField
     error={!!(touched && error)}
+    inputProps={{
+      // mobile keyboards: suppress capitalization and correction for login related fields
+      autocapitalize: 'none',
+      autocorrect: 'off',
+      ...inputProps,
+    }}
     helperText={touched && error}
-    {...inputProps}
     {...props}
     fullWidth
   />

ui/src/themes/catppuccinLatte.css.js

@@ -0,0 +1,203 @@
+const stylesheet = `
+  .react-jinke-music-player-main.light-theme svg,
+  .react-jinke-music-player .music-player-controller,
+  .react-jinke-music-player .audio-circle-process-bar circle[class='stroke'] {
+    color: #6c6f85;
+    stroke: #6c6f85;
+  }
+
+  .react-jinke-music-player-main svg:active,
+  .react-jinke-music-player-main svg:hover {
+    color: #7c7f93;
+  }
+
+  .react-jinke-music-player-main.light-theme svg:active,
+  .react-jinke-music-player-main.light-theme svg:hover {
+    color: #7c7f93;
+  }
+
+  .react-jinke-music-player-mobile-play-model-tip,
+  .react-jinke-music-player-main.light-theme .play-mode-title {
+    background-color: #6c6f85;
+    color: #eff1f5;
+  }
+
+  .react-jinke-music-player-main .music-player-panel .panel-content .rc-slider-handle,
+  .react-jinke-music-player-main .music-player-panel .panel-content .rc-slider-track {
+    background-color: #6c6f85;
+  }
+
+  .react-jinke-music-player-main ::-webkit-scrollbar-thumb {
+    background-color: #6c6f85;
+  }
+
+  .react-jinke-music-player-main .music-player-panel .panel-content .rc-slider-handle:active {
+    box-shadow: 0 0 2px #6c6f85;
+  }
+
+  .react-jinke-music-player-main .audio-item.playing svg {
+    color: #6c6f85;
+  }
+
+  .react-jinke-music-player-main .audio-item.playing .player-singer {
+    color: #6c6f85 !important;
+  }
+
+  .react-jinke-music-player-main .loading svg {
+    color: #6c6f85 !important;
+  }
+
+  .react-jinke-music-player-main .music-player-panel .panel-content .rc-slider-handle {
+    border: hidden;
+    box-shadow:
+      rgba(76, 79, 105, 0.12) 0px 4px 6px,
+      rgba(76, 79, 105, 0.08) 0px 5px 7px;
+  }
+
+  .rc-slider-rail,
+  .rc-slider-track {
+    height: 6px;
+  }
+
+  .rc-slider {
+    padding: 3px 0;
+  }
+
+  .react-jinke-music-player-main.light-theme .rc-switch-checked {
+    background-color: #6c6f85 !important;
+    border: 1px solid #6c6f85;
+  }
+
+  .sound-operation > div:nth-child(4) {
+    transform: translateX(-50%) translateY(5%) !important;
+  }
+
+  .sound-operation {
+    padding: 4px 0;
+  }
+
+  .react-jinke-music-player-main .music-player-panel {
+    background-color: #e6e9ef;
+    color: #4c4f69;
+    box-shadow: 0 0 8px rgba(76, 79, 105, 0.15);
+  }
+
+  .react-jinke-music-player-main.light-theme .music-player-panel {
+    color: #4c4f69;
+  }
+
+  .audio-lists-panel {
+    background-color: #e6e9ef;
+    bottom: 6.25rem;
+    box-shadow:
+      rgba(76, 79, 105, 0.12) 0px 4px 6px,
+      rgba(76, 79, 105, 0.08) 0px 5px 7px;
+  }
+
+  .audio-lists-panel-content .audio-item.playing {
+    background-color: rgba(0, 0, 0, 0);
+  }
+
+  .audio-lists-panel-content .audio-item:nth-child(2n+1) {
+    background-color: rgba(0, 0, 0, 0);
+  }
+
+  .audio-lists-panel-content .audio-item:active,
+  .audio-lists-panel-content .audio-item:hover {
+    background-color: rgba(76, 79, 105, 0.08);
+  }
+
+  .audio-lists-panel-header {
+    border-bottom: 1px solid #ccd0da;
+    box-shadow: none;
+  }
+
+  .react-jinke-music-player-main .music-player-panel .panel-content .player-content .audio-lists-btn {
+    background-color: rgba(0, 0, 0, 0);
+    box-shadow: 0 0 0 0;
+  }
+
+  .react-jinke-music-player-main.light-theme .audio-lists-panel-header {
+    background-color: #e6e9ef;
+    color: #4c4f69;
+  }
+
+  .audio-lists-panel-content .audio-item {
+    line-height: 32px;
+    color: #4c4f69;
+  }
+
+  .react-jinke-music-player-main .music-player-panel .panel-content .img-content {
+    box-shadow:
+      rgba(76, 79, 105, 0.12) 0px 4px 6px,
+      rgba(76, 79, 105, 0.08) 0px 5px 7px;
+  }
+
+  .react-jinke-music-player-main .music-player-lyric {
+    color: #6c6f85; /* subtext0 */
+    -webkit-text-stroke: 0.35px #eff1f5;
+    font-weight: bolder;
+  }
+
+  .react-jinke-music-player-main .lyric-btn-active,
+  .react-jinke-music-player-main .lyric-btn-active svg {
+    color: #6c6f85 !important;
+  }
+
+  .audio-lists-panel-content .audio-item.playing,
+  .audio-lists-panel-content .audio-item.playing svg {
+    color: #6c6f85;
+  }
+
+  .audio-lists-panel-content .audio-item:active .group:not([class=".player-delete"]) svg,
+  .audio-lists-panel-content .audio-item:hover .group:not([class=".player-delete"]) svg {
+    color: #6c6f85;
+  }
+
+  .audio-lists-panel-content .audio-item .player-icons {
+    scale: 75%;
+  }
+
+  .audio-lists-panel-content .audio-item:active,
+  .audio-lists-panel-content .audio-item:hover {
+    background-color: #dce0e8; /* surface1 */
+  }
+
+  /* Mobile */
+  .react-jinke-music-player-mobile-cover {
+    border: none;
+    box-shadow:
+      rgba(76, 79, 105, 0.12) 0px 4px 6px,
+      rgba(76, 79, 105, 0.08) 0px 5px 7px;
+  }
+
+  .react-jinke-music-player .music-player-controller {
+    border: none;
+    background-color: #e6e9ef;
+    border-color: #e6e9ef;
+    box-shadow:
+      rgba(76, 79, 105, 0.12) 0px 4px 6px,
+      rgba(76, 79, 105, 0.08) 0px 5px 7px;
+    color: #6c6f85;
+  }
+
+  .react-jinke-music-player .music-player-controller.music-player-playing:before {
+    border: 1px solid rgba(76, 79, 105, 0.18);
+  }
+
+  .react-jinke-music-player .music-player-controller .music-player-controller-setting {
+    background: rgba(108, 111, 133, 0.2);
+    color: #eff1f5;
+  }
+
+  .react-jinke-music-player-mobile-progress .rc-slider-handle,
+  .react-jinke-music-player-mobile-progress .rc-slider-track {
+    background-color: #6c6f85;
+  }
+
+  .react-jinke-music-player-mobile-progress .rc-slider-handle {
+    border: none;
+  }
+`
+
+export default stylesheet

ui/src/themes/catppuccinLatte.js

@@ -0,0 +1,104 @@
+import stylesheet from './catppuccinLatte.css.js'
+
+export default {
+  themeName: 'Catppuccin Latte',
+  palette: {
+    primary: { main: '#8839ef' }, // mauve
+    secondary: {
+      main: '#ccd0da', // surface0
+      contrastText: '#4c4f69', // text
+    },
+    type: 'light',
+    background: {
+      default: '#eff1f5', // base
+    },
+  },
+
+  overrides: {
+    MuiPaper: {
+      root: {
+        color: '#4c4f69', // text
+        backgroundColor: '#e6e9ef', // mantle
+      },
+    },
+
+    MuiButton: {
+      textPrimary: {
+        color: '#1e66f5', // blue
+      },
+      textSecondary: {
+        color: '#4c4f69', // text
+      },
+    },
+
+    MuiChip: {
+      clickable: {
+        background: '#ccd0da', // surface0
+      },
+    },
+
+    MuiFormGroup: {
+      root: {
+        color: '#4c4f69',
+      },
+    },
+
+    MuiFormHelperText: {
+      root: {
+        Mui: {
+          error: {
+            color: '#d20f39', // red
+          },
+        },
+      },
+    },
+
+    MuiTableHead: {
+      root: {
+        color: '#4c4f69',
+        background: '#e6e9ef',
+      },
+    },
+
+    MuiTableCell: {
+      root: {
+        color: '#4c4f69',
+        background: '#e6e9ef !important',
+      },
+      head: {
+        color: '#4c4f69',
+        background: '#e6e9ef !important',
+      },
+    },
+
+    NDLogin: {
+      systemNameLink: {
+        color: '#8839ef', // mauve
+      },
+      icon: {},
+      welcome: {
+        color: '#4c4f69',
+      },
+      card: {
+        minWidth: 300,
+        background: '#eff1f5',
+      },
+      avatar: {},
+      button: {
+        boxShadow: '3px 3px 5px #ccd0da',
+      },
+    },
+
+    NDMobileArtistDetails: {
+      bgContainer: {
+        background:
+          'linear-gradient(to bottom, rgba(255 255 255 / 72%), rgb(239 241 245))!important',
+      },
+    },
+  },
+
+  player: {
+    theme: 'light',
+    stylesheet,
+  },
+}

ui/src/themes/gruvboxDark.css.js

@@ -5,7 +5,7 @@ const stylesheet = `
 }
 
 .react-jinke-music-player-main .music-player-panel .panel-content .rc-slider-handle, .react-jinke-music-player-main .music-player-panel .panel-content .rc-slider-track {
-    background-color: #458588
+    background-color: #ebdbb2
 }
 
 .react-jinke-music-player-main ::-webkit-scrollbar-thumb {
@@ -50,6 +50,13 @@ const stylesheet = `
 .MuiCheckbox-colorSecondary.Mui-checked {
     color: #458588 !important
 }
+.react-jinke-music-player-main .music-player-panel svg {
+    color: #ebdbb2;
+    fill: #ebdbb2;
+}
+.react-jinke-music-player-main .music-player-panel button {
+    color: #ebdbb2;
+}
 `
 
 export default stylesheet

ui/src/themes/gruvboxDark.js

@@ -14,22 +14,34 @@ export default {
     background: {
       default: '#282828',
     },
+    text: {
+      primary: '#ebdbb2',
+      secondary: '#a89984',
+    },
   },
   overrides: {
     MuiPaper: {
       root: {
         color: '#ebdbb2',
         backgroundColor: '#3c3836',
-        MuiSnackbarContent: {
-          root: {
-            color: '#ebdbb2',
-            backgroundColor: '#cc241d',
-          },
-          message: {
-            color: '#ebdbb2',
-            backgroundColor: '#cc241d',
-          },
-        },
+      },
+    },
+    MuiSnackbarContent: {
+      root: {
+        color: '#3c3836',
+        backgroundColor: '#a89984',
+      },
+      message: {
+        color: '#3c3836',
+        backgroundColor: '#a89984',
+      },
+    },
+    MuiTypography: {
+      root: {
+        color: '#ebdbb2',
+      },
+      colorTextSecondary: {
+        color: '#a89984',
       },
     },
     MuiButton: {
@@ -45,6 +57,19 @@ export default {
         color: '#ebdbb2',
       },
     },
+    MuiListItemIcon: {
+      root: {
+        color: '#ebdbb2',
+      },
+    },
+    MuiListItemText: {
+      primary: {
+        color: '#ebdbb2',
+      },
+      secondary: {
+        color: '#a89984',
+      },
+    },
     MuiChip: {
       clickable: {
         background: '#49483e',
@@ -57,11 +82,10 @@ export default {
     },
     MuiFormHelperText: {
       root: {
-        Mui: {
-          error: {
-            color: '#cc241d',
-          },
-        },
+        color: '#ebdbb2',
+      },
+      error: {
+        color: '#cc241d',
       },
     },
     MuiTableHead: {
@@ -113,6 +137,17 @@ export default {
           'linear-gradient(to bottom, rgba(52 52 52 / 72%), rgb(48 48 48))!important',
       },
     },
+    NDAlbumGridView: {
+      albumName: {
+        marginTop: '0.5rem',
+        fontWeight: 700,
+        textTransform: 'none',
+        color: '#ebdbb2',
+      },
+      albumSubtitle: {
+        color: '#a89984',
+      },
+    },
   },
   player: {
     theme: 'dark',

ui/src/themes/index.js

@@ -9,12 +9,17 @@ import ElectricPurpleTheme from './electricPurple'
 import NordTheme from './nord'
 import GruvboxDarkTheme from './gruvboxDark'
 import CatppuccinMacchiatoTheme from './catppuccinMacchiato'
+import CatppuccinLatteTheme from './catppuccinLatte'
 import DraculaTheme from './dracula'
 import NuclearTheme from './nuclear'
 import NutballTheme from './nutball'
 import AmusicTheme from './amusic'
 import SquiddiesGlassTheme from './SquiddiesGlass'
 import NautilineTheme from './nautiline'
+import MoonbaseAlphaTheme from './moonbaseAlpha'
+import MoonbaseBravoTheme from './moonbaseBravo'
+import TokyoNightLightTheme from './tokyoNightLight'
+import TokyoNightTheme from './tokyoNight'
 
 export default {
   // Classic default themes
@@ -24,6 +29,7 @@ export default {
   // New themes should be added here, in alphabetic order
   AmusicTheme,
   CatppuccinMacchiatoTheme,
+  CatppuccinLatteTheme,
   DraculaTheme,
   ElectricPurpleTheme,
   ExtraDarkTheme,
@@ -31,10 +37,14 @@ export default {
   GruvboxDarkTheme,
   LigeraTheme,
   MonokaiTheme,
+  MoonbaseAlphaTheme,
+  MoonbaseBravoTheme,
   NautilineTheme,
   NordTheme,
   NuclearTheme,
   NutballTheme,
   SpotifyTheme,
   SquiddiesGlassTheme,
+  TokyoNightLightTheme,
+  TokyoNightTheme,
 }

ui/src/themes/moonbaseAlpha.css.js

@@ -0,0 +1,63 @@
+const stylesheet = `
+
+.react-jinke-music-player-main svg:active, .react-jinke-music-player-main svg:hover {
+    color: #9a7420
+}
+
+.react-jinke-music-player-main .music-player-panel .panel-content .rc-slider-handle, .react-jinke-music-player-main .music-player-panel .panel-content .rc-slider-track {
+    background-color: #b8862e;
+    border-color: #9a7420
+}
+
+.react-jinke-music-player-main ::-webkit-scrollbar-thumb {
+    background-color: #c9b896;
+}
+
+.react-jinke-music-player-main .music-player-panel .panel-content .rc-slider-handle:active {
+    box-shadow: 0 0 2px #b8862e
+}
+
+.react-jinke-music-player-main .audio-item.playing svg {
+    color: #9a7420
+}
+
+.react-jinke-music-player-main .audio-item.playing .player-singer {
+    color: #9a7420 !important
+}
+
+.react-jinke-music-player-main .rc-slider-rail {
+    background-color: #ddd7cc !important
+}
+
+.react-jinke-music-player-main .lyric-btn {
+    color: #1a1917 !important
+}
+
+.react-jinke-music-player-main .music-player-panel {
+    color: #1a1917 !important
+}
+
+.react-jinke-music-player-main .lyric-btn-active svg {
+    color: #9a7420 !important
+}
+
+.music-player-lyric {
+    color: #9a7420 !important
+}
+
+.audio-lists-panel-content .audio-item.playing, .audio-lists-panel-content .audio-item.playing svg {
+    color: #9a7420
+}
+.audio-lists-panel-content .audio-item:active .group:not(.player-delete) svg, .audio-lists-panel-content .audio-item:hover .group:not(.player-delete) svg {
+    color: #9a7420
+}
+
+.progress-bar-content .audio-title a {
+    color: #1a1917
+}
+
+.MuiCheckbox-colorSecondary.Mui-checked {
+    color: #b8862e !important
+}
+`
+export default stylesheet

ui/src/themes/moonbaseAlpha.js

@@ -0,0 +1,90 @@
+import stylesheet from './moonbaseAlpha.css.js'
+
+export default {
+  themeName: 'Moonbase - Alpha',
+  palette: {
+    primary: {
+      main: '#9a7420',
+    },
+    secondary: {
+      main: '#ede8df',
+      contrastText: '#1a1917',
+    },
+    type: 'light',
+    background: {
+      default: '#f5f0e8',
+    },
+  },
+  overrides: {
+    MuiPaper: {
+      root: {
+        color: '#1a1917',
+        backgroundColor: '#faf8f4',
+      },
+    },
+    MuiButton: {
+      textPrimary: {
+        color: '#9a7420',
+      },
+      textSecondary: {
+        color: '#1a1917',
+      },
+    },
+    MuiChip: {
+      clickable: {
+        background: '#ede8df',
+      },
+    },
+    MuiFormGroup: {
+      root: {
+        color: '#1a1917',
+      },
+    },
+    MuiFormHelperText: {
+      error: {
+        color: '#b04a2e',
+      },
+    },
+    MuiTableHead: {
+      root: {
+        color: '#6b635a',
+        background: '#f5f0e8 !important',
+      },
+    },
+    MuiTableCell: {
+      root: {
+        color: '#1a1917',
+        background: '#faf8f4 !important',
+      },
+      head: {
+        color: '#6b635a',
+        background: '#f5f0e8 !important',
+      },
+    },
+    NDLogin: {
+      systemNameLink: {
+        color: '#9a7420',
+      },
+      welcome: {
+        color: '#1a1917',
+      },
+      card: {
+        minWidth: 300,
+        background: '#faf8f4',
+      },
+      button: {
+        boxShadow: '3px 3px 5px rgba(0, 0, 0, 0.12)',
+      },
+    },
+    NDMobileArtistDetails: {
+      bgContainer: {
+        background:
+          'linear-gradient(to bottom, rgba(245, 240, 232, 0.72), #faf8f4)!important',
+      },
+    },
+  },
+  player: {
+    theme: 'light',
+    stylesheet,
+  },
+}

ui/src/themes/moonbaseBravo.css.js

@@ -0,0 +1,63 @@
+const stylesheet = `
+
+.react-jinke-music-player-main svg:active, .react-jinke-music-player-main svg:hover {
+    color: #d4a039
+}
+
+.react-jinke-music-player-main .music-player-panel .panel-content .rc-slider-handle, .react-jinke-music-player-main .music-player-panel .panel-content .rc-slider-track {
+    background-color: #d4a039;
+    border-color: #b8862e
+}
+
+.react-jinke-music-player-main ::-webkit-scrollbar-thumb {
+    background-color: #d4a039;
+}
+
+.react-jinke-music-player-main .music-player-panel .panel-content .rc-slider-handle:active {
+    box-shadow: 0 0 2px #d4a039
+}
+
+.react-jinke-music-player-main .audio-item.playing svg {
+    color: #d4a039
+}
+
+.react-jinke-music-player-main .audio-item.playing .player-singer {
+    color: #d4a039 !important
+}
+
+.react-jinke-music-player-main .rc-slider-rail {
+    background-color: #2a2a27 !important
+}
+
+.react-jinke-music-player-main .lyric-btn {
+    color: #e5ddd3 !important
+}
+
+.react-jinke-music-player-main .music-player-panel {
+    color: #e5ddd3 !important
+}
+
+.react-jinke-music-player-main .lyric-btn-active svg {
+    color: #d4a039 !important
+}
+
+.music-player-lyric {
+    color: #d4a039 !important
+}
+
+.audio-lists-panel-content .audio-item.playing, .audio-lists-panel-content .audio-item.playing svg {
+    color: #d4a039
+}
+.audio-lists-panel-content .audio-item:active .group:not(.player-delete) svg, .audio-lists-panel-content .audio-item:hover .group:not(.player-delete) svg {
+    color: #d4a039
+}
+
+.progress-bar-content .audio-title a {
+    color: #e5ddd3
+}
+
+.MuiCheckbox-colorSecondary.Mui-checked {
+    color: #d4a039 !important
+}
+`
+export default stylesheet

ui/src/themes/moonbaseBravo.js

@@ -0,0 +1,90 @@
+import stylesheet from './moonbaseBravo.css.js'
+
+export default {
+  themeName: 'Moonbase - Bravo',
+  palette: {
+    primary: {
+      main: '#d4a039',
+    },
+    secondary: {
+      main: '#1e1e1c',
+      contrastText: '#e5ddd3',
+    },
+    type: 'dark',
+    background: {
+      default: '#0a0a09',
+    },
+  },
+  overrides: {
+    MuiPaper: {
+      root: {
+        color: '#e5ddd3',
+        backgroundColor: '#141413',
+      },
+    },
+    MuiButton: {
+      textPrimary: {
+        color: '#d4a039',
+      },
+      textSecondary: {
+        color: '#e5ddd3',
+      },
+    },
+    MuiChip: {
+      clickable: {
+        background: '#1e1e1c',
+      },
+    },
+    MuiFormGroup: {
+      root: {
+        color: '#e5ddd3',
+      },
+    },
+    MuiFormHelperText: {
+      error: {
+        color: '#c45c3c',
+      },
+    },
+    MuiTableHead: {
+      root: {
+        color: '#8a8278',
+        background: '#0a0a09 !important',
+      },
+    },
+    MuiTableCell: {
+      root: {
+        color: '#e5ddd3',
+        background: '#141413 !important',
+      },
+      head: {
+        color: '#8a8278',
+        background: '#0a0a09 !important',
+      },
+    },
+    NDLogin: {
+      systemNameLink: {
+        color: '#d4a039',
+      },
+      welcome: {
+        color: '#e5ddd3',
+      },
+      card: {
+        minWidth: 300,
+        background: '#1e1e1c',
+      },
+      button: {
+        boxShadow: '3px 3px 5px #0a0a09',
+      },
+    },
+    NDMobileArtistDetails: {
+      bgContainer: {
+        background:
+          'linear-gradient(to bottom, rgba(10, 10, 9, 0.72), #141413)!important',
+      },
+    },
+  },
+  player: {
+    theme: 'dark',
+    stylesheet,
+  },
+}

ui/src/themes/tokyoNight.css.js

@@ -0,0 +1,143 @@
+const stylesheet = `
+
+.react-jinke-music-player-main svg:active, .react-jinke-music-player-main svg:hover {
+    color: #7aa2f7
+}
+
+.react-jinke-music-player-main .music-player-panel .panel-content .rc-slider-handle, .react-jinke-music-player-main .music-player-panel .panel-content .rc-slider-track {
+    background-color: #7aa2f7
+}
+
+.react-jinke-music-player-main ::-webkit-scrollbar-thumb {
+    background-color: #7aa2f7;
+}
+
+.react-jinke-music-player-main .music-player-panel .panel-content .rc-slider-handle:active {
+    box-shadow: 0 0 2px #7aa2f7
+}
+
+.react-jinke-music-player-main .audio-item.playing svg {
+    color: #7aa2f7
+}
+
+.react-jinke-music-player-main .audio-item.playing .player-singer {
+    color: #7aa2f7 !important
+}
+
+.react-jinke-music-player-main .loading svg {
+    color: #7aa2f7 !important
+}
+
+.react-jinke-music-player-main .music-player-panel .panel-content .rc-slider-handle {
+    border: hidden;
+    box-shadow: rgba(15, 17, 21, 0.25) 0px 4px 6px, rgba(15, 17, 21, 0.1) 0px 5px 7px;
+}
+
+.rc-slider-rail, .rc-slider-track {
+    height: 6px;
+}
+
+.rc-slider {
+    padding: 3px 0;
+}
+
+.sound-operation > div:nth-child(4) {
+    transform: translateX(-50%) translateY(5%) !important;
+}
+
+.sound-operation {
+    padding: 4px 0;
+}
+
+.react-jinke-music-player-main .music-player-panel {
+    background-color: #24283b;
+    color: #c0caf5;
+    box-shadow: 0 0 8px rgba(0, 0, 0, 0.25);
+}
+
+.audio-lists-panel {
+    background-color: #24283b;
+    bottom: 6.25rem;
+    box-shadow: rgba(15, 17, 21, 0.25) 0px 4px 6px, rgba(15, 17, 21, 0.1) 0px 5px 7px;
+}
+
+.audio-lists-panel-content .audio-item.playing {
+    background-color: rgba(0, 0, 0, 0);
+}
+
+.audio-lists-panel-content .audio-item:nth-child(2n+1) {
+    background-color: rgba(0, 0, 0, 0);
+}
+
+.audio-lists-panel-content .audio-item:active,
+.audio-lists-panel-content .audio-item:hover {
+    background-color: #292e42;
+}
+
+.audio-lists-panel-header {
+    border-bottom: 1px solid rgba(0, 0, 0, 0.25);
+    box-shadow: none;
+}
+
+.react-jinke-music-player-main .music-player-panel .panel-content .player-content .audio-lists-btn {
+    background-color: rgba(0, 0, 0, 0);
+    box-shadow: 0 0 0 0;
+}
+
+.audio-lists-panel-content .audio-item {
+    line-height: 32px;
+}
+
+.react-jinke-music-player-main .music-player-panel .panel-content .img-content {
+    box-shadow: rgba(15, 17, 21, 0.25) 0px 4px 6px, rgba(15, 17, 21, 0.1) 0px 5px 7px;
+}
+
+.react-jinke-music-player-main .music-player-lyric {
+    color: #c0caf5;
+    -webkit-text-stroke: 0.5px #1a1b26;
+    font-weight: bolder;
+}
+
+.react-jinke-music-player-main .lyric-btn-active, .react-jinke-music-player-main .lyric-btn-active svg {
+    color: #7aa2f7 !important;
+}
+
+.audio-lists-panel-content .audio-item.playing, .audio-lists-panel-content .audio-item.playing svg {
+    color: #7aa2f7
+}
+
+.audio-lists-panel-content .audio-item:active .group:not(.player-delete) svg, .audio-lists-panel-content .audio-item:hover .group:not(.player-delete) svg {
+    color: #7aa2f7
+}
+
+.audio-lists-panel-content .audio-item .player-icons {
+    scale: 75%;
+}
+
+/* Mobile */
+
+.react-jinke-music-player-mobile-cover {
+    border: none;
+    box-shadow: rgba(15, 17, 21, 0.25) 0px 4px 6px, rgba(15, 17, 21, 0.1) 0px 5px 7px;
+}
+
+.react-jinke-music-player .music-player-controller {
+    border: none;
+    box-shadow: rgba(15, 17, 21, 0.25) 0px 4px 6px, rgba(15, 17, 21, 0.1) 0px 5px 7px;
+    color: #7aa2f7;
+}
+
+.react-jinke-music-player .music-player-controller .music-player-controller-setting {
+    color: rgba(122, 162, 247, .3);
+}
+
+.react-jinke-music-player-mobile-progress .rc-slider-handle, .react-jinke-music-player-mobile-progress .rc-slider-track {
+    background-color: #7aa2f7;
+}
+
+.react-jinke-music-player-mobile-progress .rc-slider-handle {
+    border: none;
+}
+`
+
+export default stylesheet

ui/src/themes/tokyoNight.js

@@ -0,0 +1,382 @@
+import stylesheet from './tokyoNight.css.js'
+
+const background = '#1a1b26'
+const surface = '#24283b'
+const currentLine = '#292e42'
+const foreground = '#c0caf5'
+const comment = '#565f89'
+const blue = '#7aa2f7'
+const cyan = '#7dcfff'
+const purple = '#bb9af7'
+const red = '#f7768e'
+
+// For Album, Playlist play button
+const musicListActions = {
+  alignItems: 'center',
+  '@global': {
+    'button:first-child:not(:only-child)': {
+      '@media screen and (max-width: 720px)': {
+        transform: 'scale(1.5)',
+        margin: '1rem',
+        '&:hover': {
+          transform: 'scale(1.6) !important',
+        },
+      },
+      transform: 'scale(2)',
+      margin: '1.5rem',
+      minWidth: 0,
+      padding: 5,
+      transition: 'transform .3s ease',
+      backgroundColor: `${blue} !important`,
+      color: background,
+      borderRadius: 500,
+      border: 0,
+      '&:hover': {
+        transform: 'scale(2.1)',
+        backgroundColor: `${blue} !important`,
+        border: 0,
+      },
+    },
+    'button:only-child': {
+      margin: '1.5rem',
+    },
+    'button:first-child>span:first-child': {
+      padding: 0,
+    },
+    'button:first-child>span:first-child>span': {
+      display: 'none',
+    },
+    'button>span:first-child>span, button:not(:first-child)>span:first-child>svg':
+      {
+        color: foreground,
+      },
+  },
+}
+
+export default {
+  themeName: 'Tokyo Night',
+  palette: {
+    primary: {
+      main: blue,
+    },
+    secondary: {
+      main: purple,
+      contrastText: foreground,
+    },
+    error: {
+      main: red,
+    },
+    type: 'dark',
+    background: {
+      default: background,
+      paper: surface,
+    },
+  },
+  overrides: {
+    MuiPaper: {
+      root: {
+        color: foreground,
+        backgroundColor: surface,
+      },
+    },
+    MuiAppBar: {
+      positionFixed: {
+        backgroundColor: `${surface} !important`,
+        boxShadow:
+          'rgba(15, 17, 21, 0.25) 0px 4px 6px, rgba(15, 17, 21, 0.1) 0px 5px 7px',
+      },
+    },
+    MuiDrawer: {
+      root: {
+        background: background,
+      },
+    },
+    MuiButton: {
+      textPrimary: {
+        color: blue,
+      },
+      textSecondary: {
+        color: foreground,
+      },
+    },
+    MuiIconButton: {
+      root: {
+        color: foreground,
+      },
+    },
+    MuiChip: {
+      root: {
+        backgroundColor: currentLine,
+      },
+    },
+    MuiFormGroup: {
+      root: {
+        color: foreground,
+      },
+    },
+    MuiFormLabel: {
+      root: {
+        color: comment,
+        '&$focused': {
+          color: blue,
+        },
+      },
+    },
+    MuiFormHelperText: {
+      error: {
+        color: red,
+      },
+    },
+    MuiToolbar: {
+      root: {
+        backgroundColor: `${surface} !important`,
+      },
+    },
+    MuiOutlinedInput: {
+      root: {
+        '& $notchedOutline': {
+          borderColor: currentLine,
+        },
+        '&:hover $notchedOutline': {
+          borderColor: comment,
+        },
+        '&$focused $notchedOutline': {
+          borderColor: blue,
+        },
+      },
+    },
+    MuiFilledInput: {
+      root: {
+        backgroundColor: currentLine,
+        '&:hover': {
+          backgroundColor: comment,
+        },
+        '&$focused': {
+          backgroundColor: currentLine,
+        },
+      },
+    },
+    MuiTableRow: {
+      root: {
+        transition: 'background-color .3s ease',
+        '&:hover': {
+          backgroundColor: `${currentLine} !important`,
+        },
+      },
+    },
+    MuiTableHead: {
+      root: {
+        color: foreground,
+        background: surface,
+      },
+    },
+    MuiTableCell: {
+      root: {
+        color: foreground,
+        background: `${surface} !important`,
+        borderBottom: `1px solid ${currentLine}`,
+      },
+      head: {
+        color: `${blue} !important`,
+        background: `${currentLine} !important`,
+      },
+      body: {
+        color: `${foreground} !important`,
+      },
+    },
+    MuiSwitch: {
+      colorSecondary: {
+        '&$checked': {
+          color: blue,
+        },
+        '&$checked + $track': {
+          backgroundColor: blue,
+        },
+      },
+    },
+    NDAlbumGridView: {
+      albumName: {
+        marginTop: '0.5rem',
+        fontWeight: 700,
+        color: foreground,
+      },
+      albumSubtitle: {
+        color: comment,
+      },
+      albumContainer: {
+        backgroundColor: surface,
+        borderRadius: '8px',
+        padding: '.75rem',
+        transition: 'background-color .3s ease',
+        '&:hover': {
+          backgroundColor: currentLine,
+        },
+      },
+      albumPlayButton: {
+        backgroundColor: blue,
+        borderRadius: '50%',
+        boxShadow: '0 8px 8px rgb(0 0 0 / 30%)',
+        padding: '0.35rem',
+        transition: 'padding .3s ease',
+        '&:hover': {
+          background: `${blue} !important`,
+          padding: '0.45rem',
+        },
+      },
+    },
+    NDPlaylistDetails: {
+      container: {
+        background: `linear-gradient(${currentLine}, transparent)`,
+        borderRadius: 0,
+        paddingTop: '2.5rem !important',
+        boxShadow: 'none',
+      },
+      title: {
+        fontWeight: 700,
+        color: foreground,
+      },
+      details: {
+        fontSize: '.875rem',
+        color: comment,
+      },
+    },
+    NDAlbumDetails: {
+      root: {
+        background: `linear-gradient(${currentLine}, transparent)`,
+        borderRadius: 0,
+        boxShadow: 'none',
+      },
+      cardContents: {
+        alignItems: 'center',
+        paddingTop: '1.5rem',
+      },
+      recordName: {
+        fontWeight: 700,
+        color: foreground,
+      },
+      recordArtist: {
+        fontSize: '.875rem',
+        fontWeight: 700,
+        color: purple,
+      },
+      recordMeta: {
+        fontSize: '.875rem',
+        color: comment,
+      },
+    },
+    NDCollapsibleComment: {
+      commentBlock: {
+        fontSize: '.875rem',
+        color: comment,
+      },
+    },
+    NDAlbumShow: {
+      albumActions: musicListActions,
+    },
+    NDPlaylistShow: {
+      playlistActions: musicListActions,
+    },
+    NDAudioPlayer: {
+      audioTitle: {
+        color: foreground,
+        fontSize: '0.875rem',
+      },
+      songTitle: {
+        fontWeight: 400,
+      },
+      songInfo: {
+        fontSize: '0.675rem',
+        color: comment,
+      },
+    },
+    NDLogin: {
+      systemNameLink: {
+        color: blue,
+      },
+      welcome: {
+        color: foreground,
+      },
+      card: {
+        minWidth: 300,
+        background: surface,
+      },
+      button: {
+        boxShadow: '3px 3px 5px #15161e',
+      },
+    },
+    NDMobileArtistDetails: {
+      bgContainer: {
+        background: `linear-gradient(to bottom, rgba(26 27 38 / 72%), ${background})!important`,
+      },
+    },
+    RaLayout: {
+      content: {
+        padding: '0 !important',
+        background: background,
+      },
+      root: {
+        backgroundColor: background,
+      },
+    },
+    RaList: {
+      content: {
+        backgroundColor: background,
+      },
+    },
+    RaListToolbar: {
+      toolbar: {
+        backgroundColor: background,
+        padding: '0 .55rem !important',
+      },
+    },
+    RaSidebar: {
+      fixed: {
+        backgroundColor: background,
+      },
+      drawerPaper: {
+        backgroundColor: `${background} !important`,
+      },
+    },
+    RaMenuItemLink: {
+      root: {
+        color: foreground,
+        '&[aria-current="page"]': {
+          color: `${blue} !important`,
+        },
+        '&[aria-current="page"] .MuiListItemIcon-root': {
+          color: `${blue} !important`,
+        },
+      },
+      active: {
+        color: `${blue} !important`,
+        '& .MuiListItemIcon-root': {
+          color: `${blue} !important`,
+        },
+      },
+    },
+    RaLink: {
+      link: {
+        color: cyan,
+      },
+    },
+    RaButton: {
+      button: {
+        margin: '0 5px 0 5px',
+      },
+    },
+    RaPaginationActions: {
+      currentPageButton: {
+        border: `2px solid ${blue}`,
+      },
+      button: {
+        backgroundColor: currentLine,
+        minWidth: 48,
+        margin: '0 4px',
+      },
+    },
+  },
+  player: {
+    theme: 'dark',
+    stylesheet,
+  },
+}

ui/src/themes/tokyoNightLight.css.js

@@ -0,0 +1,123 @@
+const stylesheet = `
+.react-jinke-music-player-main.light-theme .loading svg {
+    color: #2e7de9;
+    font-size: 24px
+}
+
+.react-jinke-music-player-mobile-play-model-tip {
+    background-color: #2e7de9;
+}
+
+.react-jinke-music-player-main .music-player-panel .panel-content .rc-slider-handle, .react-jinke-music-player-main .music-player-panel .panel-content .rc-slider-track {
+    background-color: #2e7de9
+}
+
+.react-jinke-music-player-main .music-player-panel .panel-content .rc-slider-handle:active {
+    box-shadow: 0 0 2px #2e7de9
+}
+
+.react-jinke-music-player-main.light-theme .audio-item.playing svg {
+    color: #2e7de9
+}
+
+.react-jinke-music-player-main.light-theme .audio-item.playing .player-singer {
+    color: #2e7de9 !important
+}
+
+.audio-lists-panel-content .audio-item.playing, .audio-lists-panel-content .audio-item.playing svg {
+    color: #2e7de9
+}
+
+.audio-lists-panel-content .audio-item:active .group:not(.player-delete) svg, .audio-lists-panel-content .audio-item:hover .group:not(.player-delete) svg {
+    color: #2e7de9
+}
+
+.react-jinke-music-player-main.light-theme ::-webkit-scrollbar-thumb {
+    background-color: #2e7de9;
+}
+
+.react-jinke-music-player-main.light-theme svg {
+    color: #3760bf
+}
+
+.react-jinke-music-player-main.light-theme svg:active, .react-jinke-music-player-main.light-theme svg:hover {
+    color: #2e7de9
+}
+
+.react-jinke-music-player-main.light-theme .rc-slider-rail {
+    background-color: rgba(55, 96, 191, .12) !important
+}
+
+.react-jinke-music-player-main.light-theme .music-player-controller {
+    background-color: #d5d6db;
+    border-color: #d5d6db
+}
+
+.react-jinke-music-player-main.light-theme .music-player-panel {
+    background-color: #d5d6db;
+    box-shadow: 0 1px 2px 0 rgba(0, 34, 77, .05);
+    color: #3760bf
+}
+
+.react-jinke-music-player-main.light-theme .music-player-panel .img-content {
+    box-shadow: 0 0 10px #c4c8da
+}
+
+.react-jinke-music-player-main.light-theme .music-player-panel .progress-load-bar {
+    background-color: rgba(55, 96, 191, .08) !important
+}
+
+.react-jinke-music-player-main.light-theme .rc-switch {
+    color: #fff
+}
+
+.react-jinke-music-player-main.light-theme .rc-switch:after {
+    background-color: #fff
+}
+
+.react-jinke-music-player-main.light-theme .rc-switch-checked {
+    background-color: #2e7de9 !important;
+    border: 1px solid #2e7de9
+}
+
+.react-jinke-music-player-main.light-theme .rc-switch-inner {
+    color: #fff
+}
+
+.react-jinke-music-player-main.light-theme .audio-lists-btn {
+    background-color: #e1e2e7 !important
+}
+
+.react-jinke-music-player-main.light-theme .audio-lists-btn:active, .react-jinke-music-player-main.light-theme .audio-lists-btn:hover {
+    background-color: #ebebed;
+    color: #3760bf
+}
+
+.react-jinke-music-player-main.light-theme .audio-lists-btn > .group:hover, .react-jinke-music-player-main.light-theme .audio-lists-btn > .group:hover > svg {
+    color: #2e7de9
+}
+
+.react-jinke-music-player-main.light-theme .audio-lists-panel {
+    background-color: #d5d6db;
+    box-shadow: 0 0 2px #c4c8da;
+    color: #3760bf
+}
+
+.react-jinke-music-player-main.light-theme .audio-lists-panel .audio-item {
+    background-color: #d5d6db
+}
+
+.react-jinke-music-player-main.light-theme .audio-lists-panel .audio-item:nth-child(odd) {
+    background-color: #dadbe0 !important
+}
+
+.react-jinke-music-player-main.light-theme .audio-lists-panel .audio-item.playing {
+    background-color: #c4c8da !important
+}
+
+.react-jinke-music-player-main.light-theme .audio-lists-panel .audio-item.playing, .react-jinke-music-player-main.light-theme .audio-lists-panel .audio-item.playing svg {
+    color: #2e7de9 !important
+}
+`
+
+export default stylesheet

ui/src/themes/tokyoNightLight.js

@@ -0,0 +1,382 @@
+import stylesheet from './tokyoNightLight.css.js'
+
+const background = '#e1e2e7'
+const surface = '#d5d6db'
+const currentLine = '#c4c8da'
+const foreground = '#3760bf'
+const comment = '#848cb5'
+const blue = '#2e7de9'
+const cyan = '#007197'
+const purple = '#9854f1'
+const red = '#f52a65'
+
+// For Album, Playlist play button
+const musicListActions = {
+  alignItems: 'center',
+  '@global': {
+    'button:first-child:not(:only-child)': {
+      '@media screen and (max-width: 720px)': {
+        transform: 'scale(1.5)',
+        margin: '1rem',
+        '&:hover': {
+          transform: 'scale(1.6) !important',
+        },
+      },
+      transform: 'scale(2)',
+      margin: '1.5rem',
+      minWidth: 0,
+      padding: 5,
+      transition: 'transform .3s ease',
+      backgroundColor: `${blue} !important`,
+      color: background,
+      borderRadius: 500,
+      border: 0,
+      '&:hover': {
+        transform: 'scale(2.1)',
+        backgroundColor: `${blue} !important`,
+        border: 0,
+      },
+    },
+    'button:only-child': {
+      margin: '1.5rem',
+    },
+    'button:first-child>span:first-child': {
+      padding: 0,
+    },
+    'button:first-child>span:first-child>span': {
+      display: 'none',
+    },
+    'button>span:first-child>span, button:not(:first-child)>span:first-child>svg':
+      {
+        color: foreground,
+      },
+  },
+}
+
+export default {
+  themeName: 'Tokyo Night Light',
+  palette: {
+    primary: {
+      main: blue,
+    },
+    secondary: {
+      main: purple,
+      contrastText: foreground,
+    },
+    error: {
+      main: red,
+    },
+    type: 'light',
+    background: {
+      default: background,
+      paper: surface,
+    },
+  },
+  overrides: {
+    MuiPaper: {
+      root: {
+        color: foreground,
+        backgroundColor: surface,
+      },
+    },
+    MuiAppBar: {
+      positionFixed: {
+        backgroundColor: `${surface} !important`,
+        boxShadow:
+          'rgba(15, 17, 21, 0.15) 0px 4px 6px, rgba(15, 17, 21, 0.08) 0px 5px 7px',
+      },
+    },
+    MuiDrawer: {
+      root: {
+        background: background,
+      },
+    },
+    MuiButton: {
+      textPrimary: {
+        color: blue,
+      },
+      textSecondary: {
+        color: foreground,
+      },
+    },
+    MuiIconButton: {
+      root: {
+        color: foreground,
+      },
+    },
+    MuiChip: {
+      root: {
+        backgroundColor: currentLine,
+      },
+    },
+    MuiFormGroup: {
+      root: {
+        color: foreground,
+      },
+    },
+    MuiFormLabel: {
+      root: {
+        color: comment,
+        '&$focused': {
+          color: blue,
+        },
+      },
+    },
+    MuiFormHelperText: {
+      error: {
+        color: red,
+      },
+    },
+    MuiToolbar: {
+      root: {
+        backgroundColor: `${surface} !important`,
+      },
+    },
+    MuiOutlinedInput: {
+      root: {
+        '& $notchedOutline': {
+          borderColor: currentLine,
+        },
+        '&:hover $notchedOutline': {
+          borderColor: comment,
+        },
+        '&$focused $notchedOutline': {
+          borderColor: blue,
+        },
+      },
+    },
+    MuiFilledInput: {
+      root: {
+        backgroundColor: currentLine,
+        '&:hover': {
+          backgroundColor: comment,
+        },
+        '&$focused': {
+          backgroundColor: currentLine,
+        },
+      },
+    },
+    MuiTableRow: {
+      root: {
+        transition: 'background-color .3s ease',
+        '&:hover': {
+          backgroundColor: `${currentLine} !important`,
+        },
+      },
+    },
+    MuiTableHead: {
+      root: {
+        color: foreground,
+        background: surface,
+      },
+    },
+    MuiTableCell: {
+      root: {
+        color: foreground,
+        background: `${surface} !important`,
+        borderBottom: `1px solid ${currentLine}`,
+      },
+      head: {
+        color: `${blue} !important`,
+        background: `${currentLine} !important`,
+      },
+      body: {
+        color: `${foreground} !important`,
+      },
+    },
+    MuiSwitch: {
+      colorSecondary: {
+        '&$checked': {
+          color: blue,
+        },
+        '&$checked + $track': {
+          backgroundColor: blue,
+        },
+      },
+    },
+    NDAlbumGridView: {
+      albumName: {
+        marginTop: '0.5rem',
+        fontWeight: 700,
+        color: foreground,
+      },
+      albumSubtitle: {
+        color: comment,
+      },
+      albumContainer: {
+        backgroundColor: surface,
+        borderRadius: '8px',
+        padding: '.75rem',
+        transition: 'background-color .3s ease',
+        '&:hover': {
+          backgroundColor: currentLine,
+        },
+      },
+      albumPlayButton: {
+        backgroundColor: blue,
+        borderRadius: '50%',
+        boxShadow: '0 8px 8px rgb(0 0 0 / 20%)',
+        padding: '0.35rem',
+        transition: 'padding .3s ease',
+        '&:hover': {
+          background: `${blue} !important`,
+          padding: '0.45rem',
+        },
+      },
+    },
+    NDPlaylistDetails: {
+      container: {
+        background: `linear-gradient(${currentLine}, transparent)`,
+        borderRadius: 0,
+        paddingTop: '2.5rem !important',
+        boxShadow: 'none',
+      },
+      title: {
+        fontWeight: 700,
+        color: foreground,
+      },
+      details: {
+        fontSize: '.875rem',
+        color: comment,
+      },
+    },
+    NDAlbumDetails: {
+      root: {
+        background: `linear-gradient(${currentLine}, transparent)`,
+        borderRadius: 0,
+        boxShadow: 'none',
+      },
+      cardContents: {
+        alignItems: 'center',
+        paddingTop: '1.5rem',
+      },
+      recordName: {
+        fontWeight: 700,
+        color: foreground,
+      },
+      recordArtist: {
+        fontSize: '.875rem',
+        fontWeight: 700,
+        color: purple,
+      },
+      recordMeta: {
+        fontSize: '.875rem',
+        color: comment,
+      },
+    },
+    NDCollapsibleComment: {
+      commentBlock: {
+        fontSize: '.875rem',
+        color: comment,
+      },
+    },
+    NDAlbumShow: {
+      albumActions: musicListActions,
+    },
+    NDPlaylistShow: {
+      playlistActions: musicListActions,
+    },
+    NDAudioPlayer: {
+      audioTitle: {
+        color: foreground,
+        fontSize: '0.875rem',
+      },
+      songTitle: {
+        fontWeight: 400,
+      },
+      songInfo: {
+        fontSize: '0.675rem',
+        color: comment,
+      },
+    },
+    NDLogin: {
+      systemNameLink: {
+        color: blue,
+      },
+      welcome: {
+        color: foreground,
+      },
+      card: {
+        minWidth: 300,
+        background: surface,
+      },
+      button: {
+        boxShadow: '3px 3px 5px #a8aecb',
+      },
+    },
+    NDMobileArtistDetails: {
+      bgContainer: {
+        background: `linear-gradient(to bottom, rgba(225 226 231 / 72%), ${background})!important`,
+      },
+    },
+    RaLayout: {
+      content: {
+        padding: '0 !important',
+        background: background,
+      },
+      root: {
+        backgroundColor: background,
+      },
+    },
+    RaList: {
+      content: {
+        backgroundColor: background,
+      },
+    },
+    RaListToolbar: {
+      toolbar: {
+        backgroundColor: background,
+        padding: '0 .55rem !important',
+      },
+    },
+    RaSidebar: {
+      fixed: {
+        backgroundColor: background,
+      },
+      drawerPaper: {
+        backgroundColor: `${background} !important`,
+      },
+    },
+    RaMenuItemLink: {
+      root: {
+        color: foreground,
+        '&[aria-current="page"]': {
+          color: `${blue} !important`,
+        },
+        '&[aria-current="page"] .MuiListItemIcon-root': {
+          color: `${blue} !important`,
+        },
+      },
+      active: {
+        color: `${blue} !important`,
+        '& .MuiListItemIcon-root': {
+          color: `${blue} !important`,
+        },
+      },
+    },
+    RaLink: {
+      link: {
+        color: cyan,
+      },
+    },
+    RaButton: {
+      button: {
+        margin: '0 5px 0 5px',
+      },
+    },
+    RaPaginationActions: {
+      currentPageButton: {
+        border: `2px solid ${blue}`,
+      },
+      button: {
+        backgroundColor: currentLine,
+        minWidth: 48,
+        margin: '0 4px',
+      },
+    },
+  },
+  player: {
+    theme: 'light',
+    stylesheet,
+  },
+}

utils/cache/benchmark_test.go

@@ -116,7 +116,7 @@ func BenchmarkConcurrentCacheRead(b *testing.B) {
 			for i := 0; i < b.N; i++ {
 				var wg sync.WaitGroup
 				wg.Add(n)
-				for g := 0; g < n; g++ {
+				for range n {
 					go func() {
 						defer wg.Done()
 						s, err := fc.Get(context.Background(), item)
@@ -152,7 +152,7 @@ func BenchmarkConcurrentCacheMiss(b *testing.B) {
 				wg.Add(n)
 				// All goroutines request the SAME key (not yet cached)
 				item := &benchItem{key: fmt.Sprintf("miss-%d", i)}
-				for g := 0; g < n; g++ {
+				for range n {
 					go func() {
 						defer wg.Done()
 						s, err := fc.Get(context.Background(), item)

utils/cache/cached_http_client_test.go

@@ -20,6 +20,8 @@ var _ = Describe("HTTPClient", func() {
 		var header string
 
 		BeforeEach(func() {
+			requestsReceived = 0
+			header = ""
 			ts = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 				requestsReceived++
 				header = r.Header.Get("head")

utils/cache/file_haunter_test.go

@@ -29,15 +29,15 @@ var _ = Describe("FileHaunter", func() {
 		Expect(err).ToNot(HaveOccurred())
 		DeferCleanup(func() { _ = os.RemoveAll(tempDir) })
 
+		// Use a short haunter period so cleanup runs promptly; the assertions
+		// below poll with Eventually instead of racing a fixed sleep.
 		fsCache, err = fscache.NewCacheWithHaunter(fs, fscache.NewLRUHaunterStrategy(
-			cache.NewFileHaunter("", maxItems, maxSize, 300*time.Millisecond),
+			cache.NewFileHaunter("", maxItems, maxSize, 100*time.Millisecond),
 		))
 		Expect(err).ToNot(HaveOccurred())
 		DeferCleanup(fsCache.Clean)
 
 		Expect(createTestFiles(fsCache)).To(Succeed())
-
-		<-time.After(400 * time.Millisecond)
 	})
 
 	Context("When maxSize is defined", func() {
@@ -46,24 +46,39 @@ var _ = Describe("FileHaunter", func() {
 		})
 
 		It("removes files", func() {
-			Expect(os.ReadDir(cacheDir)).To(HaveLen(4))
-			Expect(fsCache.Exists("stream-5")).To(BeFalse(), "stream-5 (empty file) should have been scrubbed")
-			// TODO Fix flaky tests
-			//Expect(fsCache.Exists("stream-0")).To(BeFalse(), "stream-0 should have been scrubbed")
+			// stream-0..4 hold "hello" (5 bytes each) and stream-5 is empty.
+			// With maxSize=20, the haunter scrubs the empty file plus enough of
+			// the oldest files to bring the total size down to <= 20 bytes.
+			// Which files survive (and therefore the exact count) depends on
+			// access-time ordering, so we only assert the haunter's guarantees:
+			// the empty file is always scrubbed and the total size stays within
+			// the configured limit.
+			Eventually(func(g Gomega) {
+				g.Expect(fsCache.Exists("stream-5")).To(BeFalse(), "stream-5 (empty file) should have been scrubbed")
+				size, err := dirSize(cacheDir)
+				g.Expect(err).ToNot(HaveOccurred())
+				g.Expect(size).To(BeNumerically("<=", maxSize))
+			}).WithTimeout(5 * time.Second).WithPolling(50 * time.Millisecond).Should(Succeed())
 		})
 	})
 
-	XContext("When maxItems is defined", func() {
+	Context("When maxItems is defined", func() {
 		BeforeEach(func() {
 			maxItems = 3
 		})
 
 		It("removes files", func() {
-			Expect(os.ReadDir(cacheDir)).To(HaveLen(maxItems))
-			Expect(fsCache.Exists("stream-5")).To(BeFalse(), "stream-5 (empty file) should have been scrubbed")
-			// TODO Fix flaky tests
-			//Expect(fsCache.Exists("stream-0")).To(BeFalse(), "stream-0 should have been scrubbed")
-			//Expect(fsCache.Exists("stream-1")).To(BeFalse(), "stream-1 should have been scrubbed")
+			// With maxItems=3, the haunter scrubs the empty file plus enough of
+			// the oldest files to bring the count within the limit. As above, the
+			// exact survivors depend on access-time ordering, so we assert the
+			// guaranteed invariants: the empty file is gone and the item count
+			// stays within the configured limit.
+			Eventually(func(g Gomega) {
+				g.Expect(fsCache.Exists("stream-5")).To(BeFalse(), "stream-5 (empty file) should have been scrubbed")
+				entries, readErr := os.ReadDir(cacheDir)
+				g.Expect(readErr).ToNot(HaveOccurred())
+				g.Expect(len(entries)).To(BeNumerically("<=", maxItems))
+			}).WithTimeout(5 * time.Second).WithPolling(50 * time.Millisecond).Should(Succeed())
 		})
 	})
 })
@@ -93,6 +108,26 @@ func createTestFiles(c *fscache.FSCache) error {
 	return nil
 }
 
+// dirSize returns the total size in bytes of all regular files in dir.
+func dirSize(dir string) (uint64, error) {
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return 0, err
+	}
+	var total uint64
+	for _, e := range entries {
+		info, err := e.Info()
+		if err != nil {
+			return 0, err
+		}
+		if !info.Mode().IsRegular() {
+			continue
+		}
+		total += uint64(info.Size())
+	}
+	return total, nil
+}
+
 func createCachedStream(c *fscache.FSCache, name string, contents string) fscache.ReadAtCloser {
 	r, w, _ := c.Get(name)
 	_, _ = w.Write([]byte(contents))