Adds nullable storage fields + availability column on tracks, remote
source/source_id identity on albums/artists, TrackRepository.materialize()
and get_or_create_remote() repos — groundwork for on-demand YTM library
(placeholders saved without audio, materialized in-place on first play).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Two related gaps surfaced from "uploaded a track, nothing changed / no status":
- A track could stay stuck on `pending` forever (an unexpected worker error
rolled back the run without recording anything), and `failed` carried no
reason. Add `tracks.metadata_error` + `tracks.enriched_at` (migration), stamp
the outcome in apply_enrichment, add TrackRepository.mark_enrichment_failed,
wrap enrich_task to persist crashes as `failed` in a fresh session, and emit a
human-readable no-match reason. Expose metadata_error/enriched_at in TrackOut.
- The tag-first merge let junk embedded tags (e.g. "Music Track"/"Sound_13958")
override even a 0.99-confidence AcoustID match. Add acoustid_trust_score
(default 0.85): above it the acoustic identity wins for title/artist/album/
year, tags are fallback; below it, tag-first as before.
Add a license-free real-file fixture (Scarlet Fire / Otis McDonald) whose junk
tags AcoustID overrides, with an always-on tag-reader test plus fpcalc/AcoustID/
network-gated identity + full-pipeline tests (skip on host, run in the container).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Subsonic auth (t=md5(password+salt), legacy p=) needs a recoverable secret,
but login passwords are stored as a one-way argon2 hash. Add a separate,
per-user app-password: high-entropy, random, and encrypted at rest with a
Fernet key derived from SUBSONIC_SECRET_KEY (never stored in the DB).
- SubsonicPasswordCipher + generate_subsonic_password in core.security
- users.subsonic_password_enc column (+ Alembic migration), repo + port methods
- SubsonicAuthService: verify (t+s / p / p=enc:) and rotate/reveal lifecycle
- self-service GET/POST /users/me/subsonic-password + admin rotate endpoint
- domain SubsonicCredentials + SubsonicCipher port; deps wiring
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add S3FileStorage adapter (any S3-compatible backend: AWS, MinIO, Garage)
alongside the local adapter, selected via STORAGE_BACKEND. Proxied range
streaming via get_object+Range; as_local_path downloads to a tempfile for
ffmpeg/fpcalc. Rename track.file_path -> storage_uri across domain entity,
ORM, repositories, port, and services, with an Alembic migration. Adds
mocked S3 unit tests.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Senko-san
olly