nik/navidrome
1
0
Fork 0
mirror of https://github.com/navidrome/navidrome.git synced 2026-08-31 07:30:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(server): address review: log DB error in app-password auth

Browse Source 
Reviewer note: The original error from GetActiveForUser is being swallowed and replaced with model.ErrInvalidAuth. If a database error occurs here, it will be difficult to diagnose because it will be logged as a simple invalid login. It's better to return the actual error so the caller can log it appropriately.

Proposed implementation: If we just return err from validateAppPasswordCredentials, a DB failure gets logged as WARN "Invalid login" — same diagnostic hole, different error string. Instead, log the DB error at Error level inside validateAppPasswordCredentials before returning ErrInvalidAuth, so it shows up regardless of how the caller treats the return value.
This commit is contained in:
zkvvoob 2026-05-20 17:52:43 +03:00
parent 47c3e2fea3
commit e5ef453ebe
No known key found for this signature in database
GPG Key ID: 3CBAEDB5B3509ECE
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
server/subsonic/middlewares.go
View File

@ -174,7 +174,11 @@ func authenticate(ds model.DataStore) func(next http.Handler) http.Handler {
// committed by the time the UPDATE returns.
func validateAppPasswordCredentials(ctx context.Context, ds model.DataStore, user *model.User, pass, token, salt string) error {
aps, err := ds.AppPassword(ctx).GetActiveForUser(ctx, user.ID)
if err != nil || len(aps) == 0 {
if err != nil {
log.Error(ctx, "Failed to load app passwords during auth", "userId", user.ID, err)
return model.ErrInvalidAuth
}
if len(aps) == 0 {
return model.ErrInvalidAuth
}