.gitea/workflows/ci.yml

@@ -0,0 +1,36 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.26'
+
+      - name: gofmt
+        run: test -z "$(gofmt -l .)"
+
+      - run: go build ./...
+
+      - run: go vet ./...
+
+      - run: go test ./...
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: '12'
+
+      - name: web check
+        working-directory: web
+        run: pnpm install --frozen-lockfile && pnpm check

LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Vellum contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

Makefile

@@ -7,7 +7,7 @@ BINARY  := vellum
 VERSION ?= 0.4.0-dev
 LDFLAGS := -s -w -X main.version=$(VERSION)
 
-.PHONY: build web build-go dev run test fmt vet tidy check gate docker clean
+.PHONY: build web build-go dev run test fmt vet tidy check docker clean
 
 # Backend + Vite dev server together, with hot reload. Ctrl-C stops both.
 dev:
@@ -39,22 +39,9 @@ vet:
 tidy:
 	go mod tidy
 
-# Fix formatting, then vet and test. Rewrites files, so it is a fixer, not a
+# What CI should run.
-# gate — use `gate` before pushing.
 check: fmt vet test
 
-# The same checks as check, but verify-only: gate never rewrites a file.
-gate:
-	gofmt_out=$$(gofmt -l .); if [ -n "$$gofmt_out" ]; then echo "gofmt: not formatted:"; echo "$$gofmt_out"; exit 1; fi
-	echo "go build"
-	go build ./...
-	echo "go vet"
-	go vet ./...
-	echo "go test"
-	go test ./...
-	echo "web check"
-	cd web && pnpm install --frozen-lockfile && pnpm check
-
 docker:
 	podman build --build-arg VERSION=$(VERSION) -t localhost/vellum:$(VERSION) .
 

internal/auth/auth_test.go

@@ -550,34 +550,3 @@ func TestAdminCreatesUserAndGrants(t *testing.T) {
 }
 
 func itoa(n int64) string { return strconv.FormatInt(n, 10) }
-
-// ── login rate limiting ─────────────────────────────────────────────────
-
-// AllowLogin/ResetLogin are what every password-checking surface calls, so the
-// limiter can sit on the Authenticator and one budget covers all of them.
-func TestAllowLoginRefusesAfterTenAndResetClears(t *testing.T) {
-	log := slog.New(slog.NewTextHandler(io.Discard, nil))
-	a := NewAuthenticator(nil, "", time.Hour, false, log)
-
-	for i := 1; i <= 10; i++ {
-		if !a.AllowLogin("10.0.0.1", "alice") {
-			t.Fatalf("attempt %d refused, want it under the limit", i)
-		}
-	}
-	if a.AllowLogin("10.0.0.1", "alice") {
-		t.Error("11th attempt was allowed")
-	}
-
-	// The window is per ip and username, so nobody else is locked out.
-	if !a.AllowLogin("10.0.0.2", "alice") {
-		t.Error("another ip was refused")
-	}
-	if !a.AllowLogin("10.0.0.1", "bob") {
-		t.Error("another username was refused")
-	}
-
-	a.ResetLogin("10.0.0.1", "alice")
-	if !a.AllowLogin("10.0.0.1", "alice") {
-		t.Error("attempt refused after a successful login cleared the window")
-	}
-}

internal/auth/handlers.go

@@ -5,6 +5,7 @@ import (
 	"log/slog"
 	"net/http"
 	"strconv"
+	"sync"
 	"time"
 
 	"github.com/mithral/vellum/internal/httpx"
@@ -12,13 +13,18 @@ import (
 
 // Handlers serves the authentication and user-management endpoints.
 type Handlers struct {
-	auth *Authenticator
+	auth    *Authenticator
-	log  *slog.Logger
+	log     *slog.Logger
+	limiter *loginLimiter
 }
 
 // NewHandlers builds the auth HTTP layer.
 func NewHandlers(a *Authenticator, log *slog.Logger) *Handlers {
-	return &Handlers{auth: a, log: log}
+	return &Handlers{
+		auth:    a,
+		log:     log,
+		limiter: newLoginLimiter(10, 5*time.Minute),
+	}
 }
 
 // Register mounts the routes onto the shared mux.
@@ -78,7 +84,7 @@ func (h *Handlers) handleLogin(w http.ResponseWriter, r *http.Request) {
 	}
 
 	ip := h.auth.ClientIP(r)
-	if !h.auth.AllowLogin(ip, req.Username) {
+	if !h.limiter.allow(ip + "|" + req.Username) {
 		h.log.Warn("login rate limited", "ip", ip, "username", req.Username)
 		httpx.WriteError(w, http.StatusTooManyRequests, "too many login attempts, try again later")
 		return
@@ -106,7 +112,7 @@ func (h *Handlers) handleLogin(w http.ResponseWriter, r *http.Request) {
 	}
 
 	h.auth.SetSessionCookie(w, token, time.Now().Add(h.auth.CookieTTL))
-	h.auth.ResetLogin(ip, req.Username)
+	h.limiter.reset(ip + "|" + req.Username)
 	h.log.Info("login ok", "user", u.Username, "ip", ip)
 	httpx.WriteJSON(w, http.StatusOK, map[string]any{
 		"user":       toDTO(u),
@@ -307,3 +313,59 @@ func pathInt(w http.ResponseWriter, r *http.Request, name string) (int64, bool)
 	}
 	return n, true
 }
+
+// ── login rate limiting ────────────────────────────────────────────────
+
+// loginLimiter is a fixed-window counter keyed by "ip|username".
+//
+// In-memory is the right scope for a single-process server: it cannot be
+// bypassed by restarting a client, and there is no second process to share it
+// with. Persisting failed-login counts would be overkill for a LAN server.
+type loginLimiter struct {
+	mu     sync.Mutex
+	hits   map[string]*hitWindow
+	max    int
+	window time.Duration
+}
+
+type hitWindow struct {
+	count int
+	reset time.Time
+}
+
+func newLoginLimiter(max int, window time.Duration) *loginLimiter {
+	return &loginLimiter{hits: make(map[string]*hitWindow), max: max, window: window}
+}
+
+func (l *loginLimiter) allow(key string) bool {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	now := time.Now()
+	h, ok := l.hits[key]
+	if !ok || now.After(h.reset) {
+		l.hits[key] = &hitWindow{count: 1, reset: now.Add(l.window)}
+		l.pruneLocked(now)
+		return true
+	}
+	h.count++
+	return h.count <= l.max
+}
+
+func (l *loginLimiter) reset(key string) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	delete(l.hits, key)
+}
+
+// pruneLocked drops expired windows so the map cannot grow without bound.
+func (l *loginLimiter) pruneLocked(now time.Time) {
+	if len(l.hits) < 1000 {
+		return
+	}
+	for k, h := range l.hits {
+		if now.After(h.reset) {
+			delete(l.hits, k)
+		}
+	}
+}

internal/auth/middleware.go

@@ -7,7 +7,6 @@ import (
 	"net"
 	"net/http"
 	"strings"
-	"sync"
 	"time"
 
 	"github.com/mithral/vellum/internal/httpx"
@@ -39,12 +38,6 @@ type Authenticator struct {
 	// X-Forwarded-For. Empty means trust nobody. Set from cfg.TrustedProxies.
 	TrustedProxies []*net.IPNet
 
-	// limiter throttles password attempts. It lives here rather than on any one
-	// handler so that every surface which checks a password — the web login,
-	// the Jellyfin login, Subsonic's per-request auth — spends one budget, and
-	// an attacker cannot multiply it by guessing through a different surface.
-	limiter *loginLimiter
-
 	// touchEvery is the minimum age of a session's last_seen before Middleware
 	// will write it again. A zero value means "touch on every request" (the
 	// pre-throttling behaviour), which is a safe fallback for hand-built values.
@@ -62,7 +55,6 @@ func NewAuthenticator(db *sql.DB, cookieName string, ttl time.Duration, secure b
 		CookieTTL:  ttl,
 		Secure:     secure,
 		Log:        log,
-		limiter:    newLoginLimiter(10, 5*time.Minute),
 		touchEvery: defaultTouchEvery,
 	}
 }
@@ -240,75 +232,3 @@ func (a *Authenticator) trusts(ip string) bool {
 	}
 	return false
 }
-
-// ── login rate limiting ─────────────────────────────────────────────────
-
-// AllowLogin records a password attempt and reports whether it is still within
-// budget. Call it before checking a password, on every surface that checks one.
-func (a *Authenticator) AllowLogin(ip, username string) bool {
-	return a.limiter.allow(loginKey(ip, username))
-}
-
-// ResetLogin clears the window after a successful login, so a user who fumbled
-// a few guesses is not left locked out of their own account.
-func (a *Authenticator) ResetLogin(ip, username string) {
-	a.limiter.reset(loginKey(ip, username))
-}
-
-// loginKey builds the limiter key. It lives here so the web login, Jellyfin and
-// Subsonic all count one thing as one attempt.
-func loginKey(ip, username string) string { return ip + "|" + username }
-
-// loginLimiter is a fixed-window counter keyed by "ip|username".
-//
-// In-memory is the right scope for a single-process server: it cannot be
-// bypassed by restarting a client, and there is no second process to share it
-// with. Persisting failed-login counts would be overkill for a LAN server.
-type loginLimiter struct {
-	mu     sync.Mutex
-	hits   map[string]*hitWindow
-	max    int
-	window time.Duration
-}
-
-type hitWindow struct {
-	count int
-	reset time.Time
-}
-
-func newLoginLimiter(max int, window time.Duration) *loginLimiter {
-	return &loginLimiter{hits: make(map[string]*hitWindow), max: max, window: window}
-}
-
-func (l *loginLimiter) allow(key string) bool {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-
-	now := time.Now()
-	h, ok := l.hits[key]
-	if !ok || now.After(h.reset) {
-		l.hits[key] = &hitWindow{count: 1, reset: now.Add(l.window)}
-		l.pruneLocked(now)
-		return true
-	}
-	h.count++
-	return h.count <= l.max
-}
-
-func (l *loginLimiter) reset(key string) {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	delete(l.hits, key)
-}
-
-// pruneLocked drops expired windows so the map cannot grow without bound.
-func (l *loginLimiter) pruneLocked(now time.Time) {
-	if len(l.hits) < 1000 {
-		return
-	}
-	for k, h := range l.hits {
-		if now.After(h.reset) {
-			delete(l.hits, k)
-		}
-	}
-}

internal/jellyfin/jellyfin_test.go

@@ -309,66 +309,6 @@ func TestStreamRefusesUnreadableItem(t *testing.T) {
 
 // ── authenticate ────────────────────────────────────────────────────────
 
-// postLogin calls /Users/AuthenticateByName and returns the status code.
-func (f *fixture) postLogin(t *testing.T, username, pw string) int {
-	t.Helper()
-	req, err := http.NewRequest("POST", f.srv.URL+"/Users/AuthenticateByName",
-		strings.NewReader(`{"Username":"`+username+`","Pw":"`+pw+`"}`))
-	if err != nil {
-		t.Fatalf("new request: %v", err)
-	}
-	req.Header.Set("Content-Type", "application/json")
-	resp, err := f.srv.Client().Do(req)
-	if err != nil {
-		t.Fatalf("do: %v", err)
-	}
-	_ = resp.Body.Close()
-	return resp.StatusCode
-}
-
-// This surface must share the login limiter with the web login, or a Jellyfin
-// client is an unthrottled way to guess the same password.
-func TestAuthenticateByNameIsRateLimited(t *testing.T) {
-	f := newFixture(t)
-
-	for i := 1; i <= 10; i++ {
-		if code := f.postLogin(t, "admin", "wrong"); code != http.StatusUnauthorized {
-			t.Fatalf("attempt %d: status = %d, want 401", i, code)
-		}
-	}
-	if code := f.postLogin(t, "admin", "wrong"); code != http.StatusTooManyRequests {
-		t.Errorf("11th attempt: status = %d, want 429", code)
-	}
-	// The window is per ip and username: another account still logs in.
-	if code := f.postLogin(t, "granted", "pw"); code != http.StatusOK {
-		t.Errorf("another user: status = %d, want 200", code)
-	}
-}
-
-// A correct password clears the window, so a user who fumbled a few guesses is
-// not locked out of their own account for the rest of it.
-func TestAuthenticateByNameSuccessResetsTheWindow(t *testing.T) {
-	f := newFixture(t)
-
-	for i := 1; i <= 5; i++ {
-		if code := f.postLogin(t, "admin", "wrong"); code != http.StatusUnauthorized {
-			t.Fatalf("attempt %d: status = %d, want 401", i, code)
-		}
-	}
-	if code := f.postLogin(t, "admin", "pw"); code != http.StatusOK {
-		t.Fatalf("login after failures: status = %d, want 200", code)
-	}
-	// Had the success not cleared the counter, the sixth of these would be 429.
-	for i := 1; i <= 10; i++ {
-		if code := f.postLogin(t, "admin", "wrong"); code != http.StatusUnauthorized {
-			t.Fatalf("post-reset attempt %d: status = %d, want 401", i, code)
-		}
-	}
-	if code := f.postLogin(t, "admin", "wrong"); code != http.StatusTooManyRequests {
-		t.Errorf("11th post-reset attempt: status = %d, want 429", code)
-	}
-}
-
 func TestAuthenticateByName(t *testing.T) {
 	f := newFixture(t)
 

internal/jellyfin/system.go

@@ -35,15 +35,6 @@ func (h *Handlers) handleAuthenticateByName(w http.ResponseWriter, r *http.Reque
 		return
 	}
 
-	ip := h.a.ClientIP(r)
-	if !h.a.AllowLogin(ip, req.Username) {
-		// Same wording as the web login: this surface shares its budget, and a
-		// client cannot tell which one refused it.
-		h.log.Warn("jellyfin login rate limited", "ip", ip, "username", req.Username)
-		httpx.WriteError(w, http.StatusTooManyRequests, "too many login attempts, try again later")
-		return
-	}
-
 	u, err := auth.Authenticate(r.Context(), h.db, req.Username, req.Pw)
 	if err != nil {
 		if errors.Is(err, auth.ErrInvalidCredentials) {
@@ -55,7 +46,6 @@ func (h *Handlers) handleAuthenticateByName(w http.ResponseWriter, r *http.Reque
 		h.fail(w, "authenticate", err)
 		return
 	}
-	h.a.ResetLogin(ip, req.Username)
 
 	label := deviceLabel(r)
 	token, err := apitoken.Mint(r.Context(), h.db, u.ID, apitoken.KindJellyfin, label)

internal/subsonic/auth.go

@@ -28,30 +28,13 @@ import (
 // A missing user, a user with no Subsonic key, or a wrong credential all
 // collapse to "not authenticated": the caller must not be able to tell them
 // apart, and the response is always error code 40.
-func (h *Handlers) authenticate(r *http.Request) (_ auth.User, ok bool) {
+func (h *Handlers) authenticate(r *http.Request) (auth.User, bool) {
 	ctx := r.Context()
 	q := r.FormValue
 
 	username := strings.TrimSpace(q("u"))
 	apiKey := strings.TrimSpace(q("apiKey"))
 
-	// Subsonic has no login step: authenticate runs on EVERY request, so the
-	// login limiter is consulted only when a credential was actually supplied.
-	// Charging playback against the login budget would lock out a client that
-	// is simply using the server, and a request with no credentials must not
-	// touch the limiter at all.
-	if username != "" && (q("p") != "" || q("t") != "" || q("token") != "" || apiKey != "") {
-		ip := h.auth.ClientIP(r)
-		if !h.auth.AllowLogin(ip, username) {
-			return auth.User{}, false // The caller answers with code 40.
-		}
-		defer func() {
-			if ok {
-				h.auth.ResetLogin(ip, username)
-			}
-		}()
-	}
-
 	// apiKey auth carries no username; resolve the key to its owner.
 	if username == "" {
 		if apiKey == "" {

internal/subsonic/subsonic_test.go

@@ -245,55 +245,6 @@ func TestAuthUnknownUserIsCode40(t *testing.T) {
 	}
 }
 
-// ── login rate limiting ─────────────────────────────────────────────────
-
-// Subsonic is a third way to guess a password, so it shares the login budget:
-// otherwise the web login's limit is bypassed by pointing a client here. The
-// refusal is indistinguishable from any other credential failure — code 40.
-func TestFailedAuthIsRateLimited(t *testing.T) {
-	srv, f := newFixture(t)
-	bad := "u=alice&s=abc123&t=deadbeef&v=1.16.1&c=test&f=json"
-
-	for i := 1; i <= 10; i++ {
-		root := jsonEnvelope(t, readBody(t, get(t, srv.URL+"/rest/ping.view?"+bad)))
-		if root["status"] != "failed" {
-			t.Fatalf("attempt %d: status = %v, want failed", i, root["status"])
-		}
-	}
-	// The correct key is refused too: that is the limiter, not the key.
-	root := jsonEnvelope(t, readBody(t, get(t, srv.URL+"/rest/ping.view?"+f.authQuery()+"&f=json")))
-	if root["status"] != "failed" {
-		t.Errorf("the correct key still worked after 10 failures; the limiter is not engaged")
-	}
-}
-
-// The budget must move only on a failed check with a credential behind it.
-// authenticate runs on EVERY request, so charging a working client would lock a
-// listener out mid-album, and a request that supplies no credential must not
-// spend anything either.
-func TestSuccessAndUncredentialedDoNotConsumeTheBudget(t *testing.T) {
-	srv, f := newFixture(t)
-
-	for i := 1; i <= 25; i++ {
-		// A username but no credential: charged against nothing, so a client
-		// that sends one cannot lock the real user out.
-		readBody(t, get(t, srv.URL+"/rest/ping.view?u=alice&v=1.16.1&c=test&f=json"))
-	}
-	root := jsonEnvelope(t, readBody(t, get(t, srv.URL+"/rest/ping.view?"+f.authQuery()+"&f=json")))
-	if root["status"] != "ok" {
-		t.Fatalf("the correct key was refused after 25 requests carrying no credential")
-	}
-
-	// A success does not spend budget either: authenticate runs on every
-	// request, so a listener browsing for hours must never be locked out.
-	for i := 1; i <= 25; i++ {
-		root := jsonEnvelope(t, readBody(t, get(t, srv.URL+"/rest/ping.view?"+f.authQuery()+"&f=json")))
-		if root["status"] != "ok" {
-			t.Fatalf("request %d with the correct key: status = %v, want ok", i, root["status"])
-		}
-	}
-}
-
 // ── system / browse ────────────────────────────────────────────────────
 
 func TestPingJSONAndXML(t *testing.T) {