zkvvoob 42e4068c52
feat(subsonic): accept app passwords as Subsonic credentials
Falls back to validating against the user's active app passwords when
the primary password match fails and no JWT is presented. Supports both
p= (plaintext / enc:) and t=/s= (token+salt md5) shapes, uses
crypto/subtle for constant-time comparison, and updates last_used_at
asynchronously after a successful match.

Lets Subsonic clients (DSub, play:Sub, Symfonium, Feishin, etc.)
authenticate with named per-application secrets instead of the primary
account password.
2026-05-20 13:51:55 +03:00
..