From cf3f6666e09b3aaf9c16313296e2607b2ea812f6 Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@ozx.me>
Date: Sat, 5 Aug 2023 15:19:10 -0700
Subject: [PATCH 01/64] Added LDAP link

---
 server/ctrladmin/adminui/pages/home.tmpl | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/server/ctrladmin/adminui/pages/home.tmpl b/server/ctrladmin/adminui/pages/home.tmpl
index 27dfbc48..ded1361e 100644
--- a/server/ctrladmin/adminui/pages/home.tmpl
+++ b/server/ctrladmin/adminui/pages/home.tmpl
@@ -35,7 +35,9 @@
         {{ end }}
     {{ end }}
     {{ if .User.IsAdmin }}
-        <div class="col-span-full">{{ component "link" (props . "To" (path "/admin/create_user")) }}create new{{ end }}</div>
+				<div class="col-span-full">{{ component "link" (props . "To" (path 
+				"/admin/create_user")) }}create new{{ end }} {{component "link" 
+				(props . "To" (path "/admin/ldap")) }}LDAP{{ end }}</div>
     {{ end }}
 </div>
 {{ end }}

From c5b35a6ff15dca163bdfd56c97d769769a841dd1 Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@ozx.me>
Date: Sat, 5 Aug 2023 16:30:54 -0700
Subject: [PATCH 02/64] Added LDAP config template

---
 server/ctrladmin/adminui/pages/ldap.tmpl | 69 ++++++++++++++++++++++++
 1 file changed, 69 insertions(+)
 create mode 100644 server/ctrladmin/adminui/pages/ldap.tmpl

diff --git a/server/ctrladmin/adminui/pages/ldap.tmpl b/server/ctrladmin/adminui/pages/ldap.tmpl
new file mode 100644
index 00000000..9a2d0dc4
--- /dev/null
+++ b/server/ctrladmin/adminui/pages/ldap.tmpl
@@ -0,0 +1,69 @@
+{{ component "layout" . }}
+{{ component "layout_user" . }}
+
+{{ component "block" (props .
+    "Icon" "user"
+		"Name" "configuring LDAP"
+) }}
+		<form class="flex flex-col gap-2 items-end" action="{{ path 
+		"/admin/ldap_do" }}" method="post">
+				<input
+					type="username"
+					id="bind_user_uid"
+					name="bind_user"
+					placeholder="bind username"
+				>
+				<input
+					type="password"
+					id="bind_user_password"
+					name="bind_user_password"
+					placeholder="bind password"
+				>
+				
+				<input
+					type="text"
+					id="fqdn"
+					name="fqdn"
+					placeholder="LDAP server"
+				>
+				
+				<input
+					type="number"
+					id="port"
+					name="port"
+					placeholder="port"
+					value="389"
+				>
+
+				
+
+				<label>
+					<input
+						type="checkbox"
+						id="tls"
+						name="tls"
+					>
+					TLS
+				</label>
+
+				<input
+					type="text"
+					id="base_cn"
+					name="base_cn"
+					placeholder="Base CN"
+				>
+				
+				<input
+					type="text"
+					id="filter"
+					name="filter"
+					placeholder="filter"
+				>
+				
+
+				<input type="submit" value="update">
+    </form>
+{{ end }}
+
+{{ end }}
+{{ end }}

From ae9f95aa7520e7b582421a7d9ff4df08ffbe2958 Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@ozx.me>
Date: Sat, 5 Aug 2023 16:43:03 -0700
Subject: [PATCH 03/64] Added LDAP route

---
 server/ctrladmin/handlers.go | 9 +++++++++
 server/server.go             | 1 +
 2 files changed, 10 insertions(+)

diff --git a/server/ctrladmin/handlers.go b/server/ctrladmin/handlers.go
index 3b08bee4..5bd54b23 100644
--- a/server/ctrladmin/handlers.go
+++ b/server/ctrladmin/handlers.go
@@ -157,6 +157,15 @@ func (c *Controller) ServeUnlinkListenBrainzDo(r *http.Request) *Response {
 	return &Response{redirect: "/admin/home"}
 }
 
+func (c *Controller) ServeLDAPConfig(r *http.Request) *Response {
+	data := &templateData{}
+
+	return &Response{
+		template: "ldap.tmpl",
+		data: data,
+	}
+}
+
 func (c *Controller) ServeChangeUsername(r *http.Request) *Response {
 	user, err := selectedUserIfAdmin(c, r)
 	if err != nil {
diff --git a/server/server.go b/server/server.go
index 56d8b39a..2199c8f3 100644
--- a/server/server.go
+++ b/server/server.go
@@ -173,6 +173,7 @@ func setupAdmin(r *mux.Router, ctrl *ctrladmin.Controller) {
 	routUser.Use(ctrl.WithUserSession)
 	routUser.Handle("/logout", ctrl.HR(ctrl.ServeLogout)) // "raw" handler, updates session
 	routUser.Handle("/home", ctrl.H(ctrl.ServeHome))
+	routUser.Handle("/ldap", ctrl.H(ctrl.ServeLDAPConfig))
 	routUser.Handle("/change_username", ctrl.H(ctrl.ServeChangeUsername))
 	routUser.Handle("/change_username_do", ctrl.H(ctrl.ServeChangeUsernameDo))
 	routUser.Handle("/change_password", ctrl.H(ctrl.ServeChangePassword))

From 13bb999bd51a5257920b128982d4c25c12497d2b Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@ozx.me>
Date: Sat, 5 Aug 2023 17:06:37 -0700
Subject: [PATCH 04/64] Made TLS checkbox work. TODO: Make the styles match the
 rest of the page and move them out of inline.

---
 server/ctrladmin/adminui/pages/ldap.tmpl | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/server/ctrladmin/adminui/pages/ldap.tmpl b/server/ctrladmin/adminui/pages/ldap.tmpl
index 9a2d0dc4..56a68b2d 100644
--- a/server/ctrladmin/adminui/pages/ldap.tmpl
+++ b/server/ctrladmin/adminui/pages/ldap.tmpl
@@ -35,13 +35,16 @@
 					value="389"
 				>
 
-				
-
-				<label>
+				<label >
 					<input
 						type="checkbox"
 						id="tls"
 						name="tls"
+						value="TLS"
+						style="
+						all: revert !important;
+						width: 20px !important;
+						height: 20px !important;"
 					>
 					TLS
 				</label>

From 830ab090fd32df6f7e4cd3d000c82528a0d232a9 Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@ozx.me>
Date: Sat, 5 Aug 2023 18:42:27 -0700
Subject: [PATCH 05/64] Fixed typo

---
 server/ctrladmin/adminui/pages/ldap.tmpl | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/server/ctrladmin/adminui/pages/ldap.tmpl b/server/ctrladmin/adminui/pages/ldap.tmpl
index 56a68b2d..d7434ef7 100644
--- a/server/ctrladmin/adminui/pages/ldap.tmpl
+++ b/server/ctrladmin/adminui/pages/ldap.tmpl
@@ -9,7 +9,7 @@
 		"/admin/ldap_do" }}" method="post">
 				<input
 					type="username"
-					id="bind_user_uid"
+					id="bind_user"
 					name="bind_user"
 					placeholder="bind username"
 				>
@@ -51,9 +51,9 @@
 
 				<input
 					type="text"
-					id="base_cn"
-					name="base_cn"
-					placeholder="Base CN"
+					id="base_dn"
+					name="base_dn"
+					placeholder="Base DN"
 				>
 				
 				<input

From 98be763e371454f1f6148875b323a658e42b2126 Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@ozx.me>
Date: Sat, 5 Aug 2023 18:46:47 -0700
Subject: [PATCH 06/64] Added saving of LDAP settings

---
 server/ctrladmin/handlers.go | 28 ++++++++++++++++++++++++++++
 server/server.go             |  1 +
 2 files changed, 29 insertions(+)

diff --git a/server/ctrladmin/handlers.go b/server/ctrladmin/handlers.go
index 5bd54b23..40023ec4 100644
--- a/server/ctrladmin/handlers.go
+++ b/server/ctrladmin/handlers.go
@@ -166,6 +166,34 @@ func (c *Controller) ServeLDAPConfig(r *http.Request) *Response {
 	}
 }
 
+func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
+	bindUID := r.FormValue("bind_user")
+	bindPSWD := r.FormValue("bind_user_password")
+	fqdn := r.FormValue("fqdn")
+	port := r.FormValue("port")
+	tls := r.FormValue("tls")
+	baseDN := r.FormValue("base_dn")
+	filter := r.FormValue("filter")
+	
+	if bindUID == "" || bindPSWD == "" || fqdn == "" || port == "" || port == "" || baseDN == "" || filter == "" {
+		return &Response{
+			redirect: r.Referer(),
+			flashW:   []string{"please provide a bind username and password, a FQDN, port, base CN, and filter"},
+		}
+	}
+	
+	c.DB.SetSetting("ldap_bind_user", bindUID)
+	c.DB.SetSetting("ldap_bind_user_password", bindPSWD)
+	
+	c.DB.SetSetting("ldap_fqdn", fqdn)
+	c.DB.SetSetting("ldap_port", port)
+	c.DB.SetSetting("ldap_tls", tls)
+	c.DB.SetSetting("ldap_base_dn", baseDN)
+	c.DB.SetSetting("ldap_filter", filter)
+
+	return &Response{redirect: "/admin/home"}
+}
+
 func (c *Controller) ServeChangeUsername(r *http.Request) *Response {
 	user, err := selectedUserIfAdmin(c, r)
 	if err != nil {
diff --git a/server/server.go b/server/server.go
index 2199c8f3..5fd2211a 100644
--- a/server/server.go
+++ b/server/server.go
@@ -174,6 +174,7 @@ func setupAdmin(r *mux.Router, ctrl *ctrladmin.Controller) {
 	routUser.Handle("/logout", ctrl.HR(ctrl.ServeLogout)) // "raw" handler, updates session
 	routUser.Handle("/home", ctrl.H(ctrl.ServeHome))
 	routUser.Handle("/ldap", ctrl.H(ctrl.ServeLDAPConfig))
+	routUser.Handle("/ldap_do", ctrl.H(ctrl.ServeLDAPConfigDo))
 	routUser.Handle("/change_username", ctrl.H(ctrl.ServeChangeUsername))
 	routUser.Handle("/change_username_do", ctrl.H(ctrl.ServeChangeUsernameDo))
 	routUser.Handle("/change_password", ctrl.H(ctrl.ServeChangePassword))

From 1fab1921952ad854284fbef67ce7780f25dd9823 Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@ozx.me>
Date: Sat, 5 Aug 2023 18:48:01 -0700
Subject: [PATCH 07/64] Added TODO

---
 server/ctrladmin/handlers.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/ctrladmin/handlers.go b/server/ctrladmin/handlers.go
index 40023ec4..c6524b2e 100644
--- a/server/ctrladmin/handlers.go
+++ b/server/ctrladmin/handlers.go
@@ -168,7 +168,7 @@ func (c *Controller) ServeLDAPConfig(r *http.Request) *Response {
 
 func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 	bindUID := r.FormValue("bind_user")
-	bindPSWD := r.FormValue("bind_user_password")
+	bindPSWD := r.FormValue("bind_user_password") // TODO: Secure this better.
 	fqdn := r.FormValue("fqdn")
 	port := r.FormValue("port")
 	tls := r.FormValue("tls")

From 23e797e62a14e24880e5e0f23940b8293a5d11a5 Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@ozx.me>
Date: Sat, 5 Aug 2023 22:11:05 -0700
Subject: [PATCH 08/64] Addd default value for LDAP config page

---
 server/ctrladmin/adminui/pages/ldap.tmpl |  25 +-
 server/ctrladmin/ctrl.go                 |   7 +
 server/ctrladmin/eURL(r)                 | 671 +++++++++++++++++++++++
 server/ctrladmin/handlers.go             |  19 +-
 4 files changed, 706 insertions(+), 16 deletions(-)
 create mode 100644 server/ctrladmin/eURL(r)

diff --git a/server/ctrladmin/adminui/pages/ldap.tmpl b/server/ctrladmin/adminui/pages/ldap.tmpl
index d7434ef7..662bb9d9 100644
--- a/server/ctrladmin/adminui/pages/ldap.tmpl
+++ b/server/ctrladmin/adminui/pages/ldap.tmpl
@@ -12,6 +12,7 @@
 					id="bind_user"
 					name="bind_user"
 					placeholder="bind username"
+					value={{ default "" .CurrentBindUID }}
 				>
 				<input
 					type="password"
@@ -25,6 +26,7 @@
 					id="fqdn"
 					name="fqdn"
 					placeholder="LDAP server"
+					value={{ default "" .CurrentFQDN }}
 				>
 				
 				<input
@@ -32,28 +34,20 @@
 					id="port"
 					name="port"
 					placeholder="port"
-					value="389"
+					value={{ default "389" .CurrentPort }}
 				>
-
-				<label >
-					<input
-						type="checkbox"
-						id="tls"
-						name="tls"
-						value="TLS"
-						style="
-						all: revert !important;
-						width: 20px !important;
-						height: 20px !important;"
-					>
-					TLS
-				</label>
+				
+				<select name="tls" id="tls">
+					<option value="true">TLS</option>
+					<option value="false" {{ .CurrentNoTLS }}>None</option>
+				</select>
 
 				<input
 					type="text"
 					id="base_dn"
 					name="base_dn"
 					placeholder="Base DN"
+					value={{ default "" .CurrentBaseDN }}
 				>
 				
 				<input
@@ -61,6 +55,7 @@
 					id="filter"
 					name="filter"
 					placeholder="filter"
+					value={{ default "" .CurrentFilter }}
 				>
 				
 
diff --git a/server/ctrladmin/ctrl.go b/server/ctrladmin/ctrl.go
index a374349a..4170bcae 100644
--- a/server/ctrladmin/ctrl.go
+++ b/server/ctrladmin/ctrl.go
@@ -129,6 +129,13 @@ type templateData struct {
 	Podcasts              []*db.Podcast
 	InternetRadioStations []*db.InternetRadioStation
 
+	CurrentBindUID		string
+	CurrentFQDN				string
+	CurrentPort				string
+	CurrentNoTLS			string
+	CurrentBaseDN			string
+	CurrentFilter			string
+
 	// avatar
 	Avatar []byte
 }
diff --git a/server/ctrladmin/eURL(r) b/server/ctrladmin/eURL(r)
new file mode 100644
index 00000000..c6524b2e
--- /dev/null
+++ b/server/ctrladmin/eURL(r)
@@ -0,0 +1,671 @@
+//nolint:goerr113
+package ctrladmin
+
+import (
+	"bytes"
+	"fmt"
+	"image"
+	_ "image/gif" // to decode uploaded GIF avatars
+	"image/jpeg"
+	_ "image/png" // to decode uploaded PNG avatars
+	"log"
+	"net/http"
+	"net/url"
+	"sort"
+	"strconv"
+	"time"
+
+	"github.com/mmcdole/gofeed"
+	"github.com/nfnt/resize"
+
+	"go.senan.xyz/gonic/db"
+	"go.senan.xyz/gonic/scanner"
+	"go.senan.xyz/gonic/scrobble/listenbrainz"
+	"go.senan.xyz/gonic/transcode"
+)
+
+func doScan(scanner *scanner.Scanner, opts scanner.ScanOptions) {
+	go func() {
+		if _, err := scanner.ScanAndClean(opts); err != nil {
+			log.Printf("error while scanning: %v\n", err)
+		}
+	}()
+}
+
+func (c *Controller) ServeNotFound(_ *http.Request) *Response {
+	return &Response{template: "not_found.tmpl", code: 404}
+}
+
+func (c *Controller) ServeLogin(_ *http.Request) *Response {
+	return &Response{template: "login.tmpl"}
+}
+
+func (c *Controller) ServeHome(r *http.Request) *Response {
+	user := r.Context().Value(CtxUser).(*db.User)
+
+	data := &templateData{}
+	// stats box
+	c.DB.Model(&db.Artist{}).Count(&data.ArtistCount)
+	c.DB.Model(&db.Album{}).Count(&data.AlbumCount)
+	c.DB.Table("tracks").Count(&data.TrackCount)
+	// lastfm box
+	data.RequestRoot = c.BaseURL(r)
+	data.CurrentLastFMAPIKey, _ = c.DB.GetSetting("lastfm_api_key")
+	data.DefaultListenBrainzURL = listenbrainz.BaseURL
+
+	// users box
+	allUsersQ := c.DB.DB
+	if !user.IsAdmin {
+		allUsersQ = allUsersQ.Where("name=?", user.Name)
+	}
+	allUsersQ.Find(&data.AllUsers)
+
+	// recent folders box
+	c.DB.
+		Where("tag_artist_id IS NOT NULL").
+		Order("created_at DESC").
+		Limit(8).
+		Find(&data.RecentFolders)
+	data.IsScanning = c.Scanner.IsScanning()
+	if tStr, err := c.DB.GetSetting("last_scan_time"); err != nil {
+		i, _ := strconv.ParseInt(tStr, 10, 64)
+		data.LastScanTime = time.Unix(i, 0)
+	}
+
+	// transcoding box
+	c.DB.
+		Where("user_id=?", user.ID).
+		Find(&data.TranscodePreferences)
+	for profile := range transcode.UserProfiles {
+		data.TranscodeProfiles = append(data.TranscodeProfiles, profile)
+	}
+	sort.Strings(data.TranscodeProfiles)
+	// podcasts box
+	c.DB.Find(&data.Podcasts)
+
+	// internet radio box
+	c.DB.Find(&data.InternetRadioStations)
+
+	return &Response{
+		template: "home.tmpl",
+		data:     data,
+	}
+}
+
+func (c *Controller) ServeLinkLastFMDo(r *http.Request) *Response {
+	token := r.URL.Query().Get("token")
+	if token == "" {
+		return &Response{code: 400, err: "please provide a token"}
+	}
+	apiKey, err := c.DB.GetSetting("lastfm_api_key")
+	if err != nil {
+		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("couldn't get api key: %v", err)}}
+	}
+	secret, err := c.DB.GetSetting("lastfm_secret")
+	if err != nil {
+		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("couldn't get secret: %v", err)}}
+	}
+	sessionKey, err := c.lastfmClient.GetSession(apiKey, secret, token)
+	if err != nil {
+		return &Response{
+			redirect: "/admin/home",
+			flashW:   []string{err.Error()},
+		}
+	}
+	user := r.Context().Value(CtxUser).(*db.User)
+	user.LastFMSession = sessionKey
+	if err := c.DB.Save(user).Error; err != nil {
+		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("save user: %v", err)}}
+	}
+	return &Response{redirect: "/admin/home"}
+}
+
+func (c *Controller) ServeUnlinkLastFMDo(r *http.Request) *Response {
+	user := r.Context().Value(CtxUser).(*db.User)
+	user.LastFMSession = ""
+	if err := c.DB.Save(user).Error; err != nil {
+		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("save user: %v", err)}}
+	}
+	return &Response{redirect: "/admin/home"}
+}
+
+func (c *Controller) ServeLinkListenBrainzDo(r *http.Request) *Response {
+	token := r.FormValue("token")
+	url := r.FormValue("url")
+	if token == "" || url == "" {
+		return &Response{
+			redirect: r.Referer(),
+			flashW:   []string{"please provide a url and token"},
+		}
+	}
+	user := r.Context().Value(CtxUser).(*db.User)
+	user.ListenBrainzURL = url
+	user.ListenBrainzToken = token
+	if err := c.DB.Save(user).Error; err != nil {
+		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("save user: %v", err)}}
+	}
+	return &Response{redirect: "/admin/home"}
+}
+
+func (c *Controller) ServeUnlinkListenBrainzDo(r *http.Request) *Response {
+	user := r.Context().Value(CtxUser).(*db.User)
+	user.ListenBrainzURL = ""
+	user.ListenBrainzToken = ""
+	if err := c.DB.Save(user).Error; err != nil {
+		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("save user: %v", err)}}
+	}
+	return &Response{redirect: "/admin/home"}
+}
+
+func (c *Controller) ServeLDAPConfig(r *http.Request) *Response {
+	data := &templateData{}
+
+	return &Response{
+		template: "ldap.tmpl",
+		data: data,
+	}
+}
+
+func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
+	bindUID := r.FormValue("bind_user")
+	bindPSWD := r.FormValue("bind_user_password") // TODO: Secure this better.
+	fqdn := r.FormValue("fqdn")
+	port := r.FormValue("port")
+	tls := r.FormValue("tls")
+	baseDN := r.FormValue("base_dn")
+	filter := r.FormValue("filter")
+	
+	if bindUID == "" || bindPSWD == "" || fqdn == "" || port == "" || port == "" || baseDN == "" || filter == "" {
+		return &Response{
+			redirect: r.Referer(),
+			flashW:   []string{"please provide a bind username and password, a FQDN, port, base CN, and filter"},
+		}
+	}
+	
+	c.DB.SetSetting("ldap_bind_user", bindUID)
+	c.DB.SetSetting("ldap_bind_user_password", bindPSWD)
+	
+	c.DB.SetSetting("ldap_fqdn", fqdn)
+	c.DB.SetSetting("ldap_port", port)
+	c.DB.SetSetting("ldap_tls", tls)
+	c.DB.SetSetting("ldap_base_dn", baseDN)
+	c.DB.SetSetting("ldap_filter", filter)
+
+	return &Response{redirect: "/admin/home"}
+}
+
+func (c *Controller) ServeChangeUsername(r *http.Request) *Response {
+	user, err := selectedUserIfAdmin(c, r)
+	if err != nil {
+		return &Response{code: 400, err: err.Error()}
+	}
+	data := &templateData{}
+	data.SelectedUser = user
+	return &Response{
+		template: "change_username.tmpl",
+		data:     data,
+	}
+}
+
+func (c *Controller) ServeChangeUsernameDo(r *http.Request) *Response {
+	user, err := selectedUserIfAdmin(c, r)
+	if err != nil {
+		return &Response{code: 400, err: err.Error()}
+	}
+	usernameNew := r.FormValue("username")
+	if err := validateUsername(usernameNew); err != nil {
+		return &Response{
+			redirect: r.Referer(),
+			flashW:   []string{err.Error()},
+		}
+	}
+	user.Name = usernameNew
+	if err := c.DB.Save(user).Error; err != nil {
+		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("save username: %v", err)}}
+	}
+	return &Response{redirect: "/admin/home"}
+}
+
+func (c *Controller) ServeChangePassword(r *http.Request) *Response {
+	user, err := selectedUserIfAdmin(c, r)
+	if err != nil {
+		return &Response{code: 400, err: err.Error()}
+	}
+	data := &templateData{}
+	data.SelectedUser = user
+	return &Response{
+		template: "change_password.tmpl",
+		data:     data,
+	}
+}
+
+func (c *Controller) ServeChangePasswordDo(r *http.Request) *Response {
+	user, err := selectedUserIfAdmin(c, r)
+	if err != nil {
+		return &Response{code: 400, err: err.Error()}
+	}
+	passwordOne := r.FormValue("password_one")
+	passwordTwo := r.FormValue("password_two")
+	if err := validatePasswords(passwordOne, passwordTwo); err != nil {
+		return &Response{
+			redirect: r.Referer(),
+			flashW:   []string{err.Error()},
+		}
+	}
+	user.Password = passwordOne
+	if err := c.DB.Save(user).Error; err != nil {
+		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("save user: %v", err)}}
+	}
+	return &Response{redirect: "/admin/home"}
+}
+
+func (c *Controller) ServeChangeAvatar(r *http.Request) *Response {
+	user, err := selectedUserIfAdmin(c, r)
+	if err != nil {
+		return &Response{code: 400, err: err.Error()}
+	}
+	data := &templateData{}
+	data.SelectedUser = user
+	return &Response{
+		template: "change_avatar.tmpl",
+		data:     data,
+	}
+}
+
+func (c *Controller) ServeChangeAvatarDo(r *http.Request) *Response {
+	user, err := selectedUserIfAdmin(c, r)
+	if err != nil {
+		return &Response{code: 400, err: err.Error()}
+	}
+	avatar, err := getAvatarFile(r)
+	if err != nil {
+		return &Response{
+			redirect: r.Referer(),
+			flashW:   []string{err.Error()},
+		}
+	}
+	user.Avatar = avatar
+	if err := c.DB.Save(user).Error; err != nil {
+		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("save user: %v", err)}}
+	}
+	return &Response{
+		redirect: r.Referer(),
+		flashN:   []string{"avatar saved successfully"},
+	}
+}
+
+func (c *Controller) ServeDeleteAvatarDo(r *http.Request) *Response {
+	user, err := selectedUserIfAdmin(c, r)
+	if err != nil {
+		return &Response{code: 400, err: err.Error()}
+	}
+	user.Avatar = nil
+	if err := c.DB.Save(user).Error; err != nil {
+		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("save user: %v", err)}}
+	}
+	return &Response{
+		redirect: r.Referer(),
+		flashN:   []string{"avatar deleted successfully"},
+	}
+}
+
+func (c *Controller) ServeDeleteUser(r *http.Request) *Response {
+	user, err := selectedUserIfAdmin(c, r)
+	if err != nil {
+		return &Response{code: 400, err: err.Error()}
+	}
+	data := &templateData{}
+	data.SelectedUser = user
+	return &Response{
+		template: "delete_user.tmpl",
+		data:     data,
+	}
+}
+
+func (c *Controller) ServeDeleteUserDo(r *http.Request) *Response {
+	user, err := selectedUserIfAdmin(c, r)
+	if err != nil {
+		return &Response{code: 400, err: err.Error()}
+	}
+	if user.IsAdmin {
+		return &Response{
+			redirect: "/admin/home",
+			flashW:   []string{"can't delete the admin user"},
+		}
+	}
+	if err := c.DB.Delete(user).Error; err != nil {
+		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("delete user: %v", err)}}
+	}
+	return &Response{redirect: "/admin/home"}
+}
+
+func (c *Controller) ServeCreateUser(_ *http.Request) *Response {
+	return &Response{template: "create_user.tmpl"}
+}
+
+func (c *Controller) ServeCreateUserDo(r *http.Request) *Response {
+	username := r.FormValue("username")
+	if err := validateUsername(username); err != nil {
+		return &Response{
+			redirect: r.Referer(),
+			flashW:   []string{err.Error()},
+		}
+	}
+	passwordOne := r.FormValue("password_one")
+	passwordTwo := r.FormValue("password_two")
+	if err := validatePasswords(passwordOne, passwordTwo); err != nil {
+		return &Response{
+			redirect: r.Referer(),
+			flashW:   []string{err.Error()},
+		}
+	}
+	user := db.User{
+		Name:     username,
+		Password: passwordOne,
+	}
+	if err := c.DB.Create(&user).Error; err != nil {
+		return &Response{
+			redirect: r.Referer(),
+			flashW:   []string{fmt.Sprintf("could not create user `%s`: %v", username, err)},
+		}
+	}
+	return &Response{redirect: "/admin/home"}
+}
+
+func (c *Controller) ServeUpdateLastFMAPIKey(r *http.Request) *Response {
+	data := &templateData{}
+	var err error
+	if data.CurrentLastFMAPIKey, err = c.DB.GetSetting("lastfm_api_key"); err != nil {
+		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("couldn't get api key: %v", err)}}
+	}
+	if data.CurrentLastFMAPISecret, err = c.DB.GetSetting("lastfm_secret"); err != nil {
+		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("couldn't get secret: %v", err)}}
+	}
+	return &Response{
+		template: "update_lastfm_api_key.tmpl",
+		data:     data,
+	}
+}
+
+func (c *Controller) ServeUpdateLastFMAPIKeyDo(r *http.Request) *Response {
+	apiKey := r.FormValue("api_key")
+	secret := r.FormValue("secret")
+	if err := validateAPIKey(apiKey, secret); err != nil {
+		return &Response{
+			redirect: r.Referer(),
+			flashW:   []string{err.Error()},
+		}
+	}
+	if err := c.DB.SetSetting("lastfm_api_key", apiKey); err != nil {
+		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("couldn't set api key: %v", err)}}
+	}
+	if err := c.DB.SetSetting("lastfm_secret", secret); err != nil {
+		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("couldn't set secret: %v", err)}}
+	}
+	return &Response{redirect: "/admin/home"}
+}
+
+func (c *Controller) ServeStartScanIncDo(_ *http.Request) *Response {
+	defer doScan(c.Scanner, scanner.ScanOptions{})
+	return &Response{
+		redirect: "/admin/home",
+		flashN:   []string{"incremental scan started. refresh for results"},
+	}
+}
+
+func (c *Controller) ServeStartScanFullDo(_ *http.Request) *Response {
+	defer doScan(c.Scanner, scanner.ScanOptions{IsFull: true})
+	return &Response{
+		redirect: "/admin/home",
+		flashN:   []string{"full scan started. refresh for results"},
+	}
+}
+
+func (c *Controller) ServeCreateTranscodePrefDo(r *http.Request) *Response {
+	client := r.FormValue("client")
+	profile := r.FormValue("profile")
+	if client == "" {
+		return &Response{
+			redirect: "/admin/home",
+			flashW:   []string{"please provide a client name"},
+		}
+	}
+	user := r.Context().Value(CtxUser).(*db.User)
+	pref := db.TranscodePreference{
+		UserID:  user.ID,
+		Client:  client,
+		Profile: profile,
+	}
+	if err := c.DB.Create(&pref).Error; err != nil {
+		return &Response{
+			redirect: "/admin/home",
+			flashW:   []string{fmt.Sprintf("could not create preference: %v", err)},
+		}
+	}
+	return &Response{redirect: "/admin/home"}
+}
+
+func (c *Controller) ServeDeleteTranscodePrefDo(r *http.Request) *Response {
+	user := r.Context().Value(CtxUser).(*db.User)
+	client := r.URL.Query().Get("client")
+	if client == "" {
+		return &Response{code: 400, err: "please provide a client"}
+	}
+	c.DB.
+		Where("user_id=? AND client=?", user.ID, client).
+		Delete(db.TranscodePreference{})
+	return &Response{
+		redirect: "/admin/home",
+	}
+}
+
+func (c *Controller) ServePodcastAddDo(r *http.Request) *Response {
+	rssURL := r.FormValue("feed")
+	fp := gofeed.NewParser()
+	feed, err := fp.ParseURL(rssURL)
+	if err != nil {
+		return &Response{
+			redirect: "/admin/home",
+			flashW:   []string{fmt.Sprintf("could not create feed: %v", err)},
+		}
+	}
+	if _, err := c.Podcasts.AddNewPodcast(rssURL, feed); err != nil {
+		return &Response{
+			redirect: "/admin/home",
+			flashW:   []string{fmt.Sprintf("could not create feed: %v", err)},
+		}
+	}
+	return &Response{
+		redirect: "/admin/home",
+	}
+}
+
+func (c *Controller) ServePodcastDownloadDo(r *http.Request) *Response {
+	id, err := strconv.Atoi(r.URL.Query().Get("id"))
+	if err != nil {
+		return &Response{code: 400, err: "please provide a valid podcast id"}
+	}
+	if err := c.Podcasts.DownloadPodcastAll(id); err != nil {
+		return &Response{code: 400, err: "please provide a valid podcast id"}
+	}
+	return &Response{
+		redirect: "/admin/home",
+		flashN:   []string{"started downloading podcast episodes"},
+	}
+}
+
+func (c *Controller) ServePodcastUpdateDo(r *http.Request) *Response {
+	id, err := strconv.Atoi(r.URL.Query().Get("id"))
+	if err != nil {
+		return &Response{code: 400, err: "please provide a valid podcast id"}
+	}
+	setting := db.PodcastAutoDownload(r.FormValue("setting"))
+	var message string
+	switch setting {
+	case db.PodcastAutoDownloadLatest:
+		message = "future podcast episodes will be automatically downloaded"
+	case db.PodcastAutoDownloadNone:
+		message = "future podcast episodes will not be downloaded"
+	default:
+		return &Response{code: 400, err: "please provide a valid podcast download type"}
+	}
+	if err := c.Podcasts.SetAutoDownload(id, setting); err != nil {
+		return &Response{
+			flashW: []string{fmt.Sprintf("could not update auto download setting: %v", err)},
+			code:   400,
+		}
+	}
+	return &Response{
+		redirect: "/admin/home",
+		flashN:   []string{message},
+	}
+}
+
+func (c *Controller) ServePodcastDeleteDo(r *http.Request) *Response {
+	id, err := strconv.Atoi(r.URL.Query().Get("id"))
+	if err != nil {
+		return &Response{code: 400, err: "please provide a valid podcast id"}
+	}
+	if err := c.Podcasts.DeletePodcast(id); err != nil {
+		return &Response{code: 400, err: "please provide a valid podcast id"}
+	}
+	return &Response{
+		redirect: "/admin/home",
+	}
+}
+
+func (c *Controller) ServeInternetRadioStationAddDo(r *http.Request) *Response {
+	streamURL := r.FormValue("streamURL")
+	name := r.FormValue("name")
+	homepageURL := r.FormValue("homepageURL")
+
+	if name == "" {
+		return &Response{redirect: "/admin/home", flashW: []string{"no name provided"}}
+	}
+
+	if _, err := url.ParseRequestURI(streamURL); err != nil {
+		return &Response{redirect: "/admin/home", flashW: []string{fmt.Sprintf("bad stream URL provided: %v", err)}}
+	}
+
+	if homepageURL != "" {
+		if _, err := url.ParseRequestURI(homepageURL); err != nil {
+			return &Response{redirect: "/admin/home", flashW: []string{fmt.Sprintf("bad homepage URL provided: %v", err)}}
+		}
+	}
+
+	var station db.InternetRadioStation
+	station.StreamURL = streamURL
+	station.Name = name
+	station.HomepageURL = homepageURL
+	if err := c.DB.Save(&station).Error; err != nil {
+		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("error saving station: %v", err)}}
+	}
+
+	return &Response{
+		redirect: "/admin/home",
+	}
+}
+
+func (c *Controller) ServeInternetRadioStationUpdateDo(r *http.Request) *Response {
+	stationID, err := strconv.Atoi(r.URL.Query().Get("id"))
+	if err != nil {
+		return &Response{code: 400, err: "please provide a valid internet radio station id"}
+	}
+
+	streamURL := r.FormValue("streamURL")
+	name := r.FormValue("name")
+	homepageURL := r.FormValue("homepageURL")
+
+	if name == "" {
+		return &Response{
+			redirect: "/admin/home",
+			flashW:   []string{"no name provided"},
+		}
+	}
+
+	if _, err := url.ParseRequestURI(streamURL); err != nil {
+		return &Response{
+			redirect: "/admin/home",
+			flashW:   []string{fmt.Sprintf("bad stream URL provided: %v", err)},
+		}
+	}
+
+	if homepageURL != "" {
+		if _, err := url.ParseRequestURI(homepageURL); err != nil {
+			return &Response{
+				redirect: "/admin/home",
+				flashW:   []string{fmt.Sprintf("bad homepage URL provided: %v", err)},
+			}
+		}
+	}
+
+	var station db.InternetRadioStation
+	if err := c.DB.Where("id=?", stationID).First(&station).Error; err != nil {
+		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("find station by id: %v", err)}}
+	}
+
+	station.StreamURL = streamURL
+	station.Name = name
+	station.HomepageURL = homepageURL
+	if err := c.DB.Save(&station).Error; err != nil {
+		return &Response{code: 500, err: "please provide a valid internet radio station id"}
+	}
+
+	return &Response{
+		redirect: "/admin/home",
+	}
+}
+
+func (c *Controller) ServeInternetRadioStationDeleteDo(r *http.Request) *Response {
+	stationID, err := strconv.Atoi(r.URL.Query().Get("id"))
+	if err != nil {
+		return &Response{code: 400, err: "please provide a valid internet radio station id"}
+	}
+
+	var station db.InternetRadioStation
+	if err := c.DB.Where("id=?", stationID).First(&station).Error; err != nil {
+		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("find station by id: %v", err)}}
+	}
+
+	if err := c.DB.Where("id=?", stationID).Delete(&db.InternetRadioStation{}).Error; err != nil {
+		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("deleting radio station: %v", err)}}
+	}
+
+	return &Response{
+		redirect: "/admin/home",
+	}
+}
+
+func getAvatarFile(r *http.Request) ([]byte, error) {
+	err := r.ParseMultipartForm(10 << 20) // keep up to 10MB in memory
+	if err != nil {
+		return nil, err
+	}
+	file, _, err := r.FormFile("avatar")
+	if err != nil {
+		return nil, fmt.Errorf("read form file: %w", err)
+	}
+	i, _, err := image.Decode(file)
+	if err != nil {
+		return nil, fmt.Errorf("decode image: %w", err)
+	}
+	resized := resize.Resize(64, 64, i, resize.Lanczos3)
+	var buff bytes.Buffer
+	if err := jpeg.Encode(&buff, resized, nil); err != nil {
+		return nil, err
+	}
+	return buff.Bytes(), nil
+}
+
+func selectedUserIfAdmin(c *Controller, r *http.Request) (*db.User, error) {
+	selectedUsername := r.URL.Query().Get("user")
+	if selectedUsername == "" {
+		return nil, fmt.Errorf("please provide a username")
+	}
+	user := r.Context().Value(CtxUser).(*db.User)
+	if !user.IsAdmin && user.Name != selectedUsername {
+		return nil, fmt.Errorf("must be admin to perform actions for other users")
+	}
+	selectedUser := c.DB.GetUserByName(selectedUsername)
+	return selectedUser, nil
+}
diff --git a/server/ctrladmin/handlers.go b/server/ctrladmin/handlers.go
index c6524b2e..4a72ade6 100644
--- a/server/ctrladmin/handlers.go
+++ b/server/ctrladmin/handlers.go
@@ -160,6 +160,20 @@ func (c *Controller) ServeUnlinkListenBrainzDo(r *http.Request) *Response {
 func (c *Controller) ServeLDAPConfig(r *http.Request) *Response {
 	data := &templateData{}
 
+	data.CurrentBindUID, _ = c.DB.GetSetting("ldap_bind_user")
+	data.CurrentFQDN, _ = c.DB.GetSetting("ldap_fqdn")
+	data.CurrentPort, _ = c.DB.GetSetting("ldap_port")
+	data.CurrentBaseDN, _ = c.DB.GetSetting("ldap_base_dn")
+	data.CurrentFilter, _ = c.DB.GetSetting("ldap_filter")
+	
+	// This is to fix the fact that select boxes are strange.
+	currentTLS, _ := c.DB.GetSetting("ldap_tls")
+	data.CurrentNoTLS = "selected"
+
+	if currentTLS == "true" {
+		data.CurrentNoTLS = ""
+	}
+
 	return &Response{
 		template: "ldap.tmpl",
 		data: data,
@@ -175,7 +189,10 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 	baseDN := r.FormValue("base_dn")
 	filter := r.FormValue("filter")
 	
-	if bindUID == "" || bindPSWD == "" || fqdn == "" || port == "" || port == "" || baseDN == "" || filter == "" {
+	log.Print("AHHH")
+	log.Print(tls)
+
+	if bindUID == "" || bindPSWD == "" || fqdn == "" || port == "" || baseDN == "" || filter == "" {
 		return &Response{
 			redirect: r.Referer(),
 			flashW:   []string{"please provide a bind username and password, a FQDN, port, base CN, and filter"},

From 6b2f853b3c207dfd9fe7787898be012b82625652 Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@ozx.me>
Date: Sat, 5 Aug 2023 22:12:13 -0700
Subject: [PATCH 09/64] Removed eURL file

---
 server/ctrladmin/eURL(r) | 671 ---------------------------------------
 1 file changed, 671 deletions(-)
 delete mode 100644 server/ctrladmin/eURL(r)

diff --git a/server/ctrladmin/eURL(r) b/server/ctrladmin/eURL(r)
deleted file mode 100644
index c6524b2e..00000000
--- a/server/ctrladmin/eURL(r)
+++ /dev/null
@@ -1,671 +0,0 @@
-//nolint:goerr113
-package ctrladmin
-
-import (
-	"bytes"
-	"fmt"
-	"image"
-	_ "image/gif" // to decode uploaded GIF avatars
-	"image/jpeg"
-	_ "image/png" // to decode uploaded PNG avatars
-	"log"
-	"net/http"
-	"net/url"
-	"sort"
-	"strconv"
-	"time"
-
-	"github.com/mmcdole/gofeed"
-	"github.com/nfnt/resize"
-
-	"go.senan.xyz/gonic/db"
-	"go.senan.xyz/gonic/scanner"
-	"go.senan.xyz/gonic/scrobble/listenbrainz"
-	"go.senan.xyz/gonic/transcode"
-)
-
-func doScan(scanner *scanner.Scanner, opts scanner.ScanOptions) {
-	go func() {
-		if _, err := scanner.ScanAndClean(opts); err != nil {
-			log.Printf("error while scanning: %v\n", err)
-		}
-	}()
-}
-
-func (c *Controller) ServeNotFound(_ *http.Request) *Response {
-	return &Response{template: "not_found.tmpl", code: 404}
-}
-
-func (c *Controller) ServeLogin(_ *http.Request) *Response {
-	return &Response{template: "login.tmpl"}
-}
-
-func (c *Controller) ServeHome(r *http.Request) *Response {
-	user := r.Context().Value(CtxUser).(*db.User)
-
-	data := &templateData{}
-	// stats box
-	c.DB.Model(&db.Artist{}).Count(&data.ArtistCount)
-	c.DB.Model(&db.Album{}).Count(&data.AlbumCount)
-	c.DB.Table("tracks").Count(&data.TrackCount)
-	// lastfm box
-	data.RequestRoot = c.BaseURL(r)
-	data.CurrentLastFMAPIKey, _ = c.DB.GetSetting("lastfm_api_key")
-	data.DefaultListenBrainzURL = listenbrainz.BaseURL
-
-	// users box
-	allUsersQ := c.DB.DB
-	if !user.IsAdmin {
-		allUsersQ = allUsersQ.Where("name=?", user.Name)
-	}
-	allUsersQ.Find(&data.AllUsers)
-
-	// recent folders box
-	c.DB.
-		Where("tag_artist_id IS NOT NULL").
-		Order("created_at DESC").
-		Limit(8).
-		Find(&data.RecentFolders)
-	data.IsScanning = c.Scanner.IsScanning()
-	if tStr, err := c.DB.GetSetting("last_scan_time"); err != nil {
-		i, _ := strconv.ParseInt(tStr, 10, 64)
-		data.LastScanTime = time.Unix(i, 0)
-	}
-
-	// transcoding box
-	c.DB.
-		Where("user_id=?", user.ID).
-		Find(&data.TranscodePreferences)
-	for profile := range transcode.UserProfiles {
-		data.TranscodeProfiles = append(data.TranscodeProfiles, profile)
-	}
-	sort.Strings(data.TranscodeProfiles)
-	// podcasts box
-	c.DB.Find(&data.Podcasts)
-
-	// internet radio box
-	c.DB.Find(&data.InternetRadioStations)
-
-	return &Response{
-		template: "home.tmpl",
-		data:     data,
-	}
-}
-
-func (c *Controller) ServeLinkLastFMDo(r *http.Request) *Response {
-	token := r.URL.Query().Get("token")
-	if token == "" {
-		return &Response{code: 400, err: "please provide a token"}
-	}
-	apiKey, err := c.DB.GetSetting("lastfm_api_key")
-	if err != nil {
-		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("couldn't get api key: %v", err)}}
-	}
-	secret, err := c.DB.GetSetting("lastfm_secret")
-	if err != nil {
-		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("couldn't get secret: %v", err)}}
-	}
-	sessionKey, err := c.lastfmClient.GetSession(apiKey, secret, token)
-	if err != nil {
-		return &Response{
-			redirect: "/admin/home",
-			flashW:   []string{err.Error()},
-		}
-	}
-	user := r.Context().Value(CtxUser).(*db.User)
-	user.LastFMSession = sessionKey
-	if err := c.DB.Save(user).Error; err != nil {
-		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("save user: %v", err)}}
-	}
-	return &Response{redirect: "/admin/home"}
-}
-
-func (c *Controller) ServeUnlinkLastFMDo(r *http.Request) *Response {
-	user := r.Context().Value(CtxUser).(*db.User)
-	user.LastFMSession = ""
-	if err := c.DB.Save(user).Error; err != nil {
-		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("save user: %v", err)}}
-	}
-	return &Response{redirect: "/admin/home"}
-}
-
-func (c *Controller) ServeLinkListenBrainzDo(r *http.Request) *Response {
-	token := r.FormValue("token")
-	url := r.FormValue("url")
-	if token == "" || url == "" {
-		return &Response{
-			redirect: r.Referer(),
-			flashW:   []string{"please provide a url and token"},
-		}
-	}
-	user := r.Context().Value(CtxUser).(*db.User)
-	user.ListenBrainzURL = url
-	user.ListenBrainzToken = token
-	if err := c.DB.Save(user).Error; err != nil {
-		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("save user: %v", err)}}
-	}
-	return &Response{redirect: "/admin/home"}
-}
-
-func (c *Controller) ServeUnlinkListenBrainzDo(r *http.Request) *Response {
-	user := r.Context().Value(CtxUser).(*db.User)
-	user.ListenBrainzURL = ""
-	user.ListenBrainzToken = ""
-	if err := c.DB.Save(user).Error; err != nil {
-		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("save user: %v", err)}}
-	}
-	return &Response{redirect: "/admin/home"}
-}
-
-func (c *Controller) ServeLDAPConfig(r *http.Request) *Response {
-	data := &templateData{}
-
-	return &Response{
-		template: "ldap.tmpl",
-		data: data,
-	}
-}
-
-func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
-	bindUID := r.FormValue("bind_user")
-	bindPSWD := r.FormValue("bind_user_password") // TODO: Secure this better.
-	fqdn := r.FormValue("fqdn")
-	port := r.FormValue("port")
-	tls := r.FormValue("tls")
-	baseDN := r.FormValue("base_dn")
-	filter := r.FormValue("filter")
-	
-	if bindUID == "" || bindPSWD == "" || fqdn == "" || port == "" || port == "" || baseDN == "" || filter == "" {
-		return &Response{
-			redirect: r.Referer(),
-			flashW:   []string{"please provide a bind username and password, a FQDN, port, base CN, and filter"},
-		}
-	}
-	
-	c.DB.SetSetting("ldap_bind_user", bindUID)
-	c.DB.SetSetting("ldap_bind_user_password", bindPSWD)
-	
-	c.DB.SetSetting("ldap_fqdn", fqdn)
-	c.DB.SetSetting("ldap_port", port)
-	c.DB.SetSetting("ldap_tls", tls)
-	c.DB.SetSetting("ldap_base_dn", baseDN)
-	c.DB.SetSetting("ldap_filter", filter)
-
-	return &Response{redirect: "/admin/home"}
-}
-
-func (c *Controller) ServeChangeUsername(r *http.Request) *Response {
-	user, err := selectedUserIfAdmin(c, r)
-	if err != nil {
-		return &Response{code: 400, err: err.Error()}
-	}
-	data := &templateData{}
-	data.SelectedUser = user
-	return &Response{
-		template: "change_username.tmpl",
-		data:     data,
-	}
-}
-
-func (c *Controller) ServeChangeUsernameDo(r *http.Request) *Response {
-	user, err := selectedUserIfAdmin(c, r)
-	if err != nil {
-		return &Response{code: 400, err: err.Error()}
-	}
-	usernameNew := r.FormValue("username")
-	if err := validateUsername(usernameNew); err != nil {
-		return &Response{
-			redirect: r.Referer(),
-			flashW:   []string{err.Error()},
-		}
-	}
-	user.Name = usernameNew
-	if err := c.DB.Save(user).Error; err != nil {
-		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("save username: %v", err)}}
-	}
-	return &Response{redirect: "/admin/home"}
-}
-
-func (c *Controller) ServeChangePassword(r *http.Request) *Response {
-	user, err := selectedUserIfAdmin(c, r)
-	if err != nil {
-		return &Response{code: 400, err: err.Error()}
-	}
-	data := &templateData{}
-	data.SelectedUser = user
-	return &Response{
-		template: "change_password.tmpl",
-		data:     data,
-	}
-}
-
-func (c *Controller) ServeChangePasswordDo(r *http.Request) *Response {
-	user, err := selectedUserIfAdmin(c, r)
-	if err != nil {
-		return &Response{code: 400, err: err.Error()}
-	}
-	passwordOne := r.FormValue("password_one")
-	passwordTwo := r.FormValue("password_two")
-	if err := validatePasswords(passwordOne, passwordTwo); err != nil {
-		return &Response{
-			redirect: r.Referer(),
-			flashW:   []string{err.Error()},
-		}
-	}
-	user.Password = passwordOne
-	if err := c.DB.Save(user).Error; err != nil {
-		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("save user: %v", err)}}
-	}
-	return &Response{redirect: "/admin/home"}
-}
-
-func (c *Controller) ServeChangeAvatar(r *http.Request) *Response {
-	user, err := selectedUserIfAdmin(c, r)
-	if err != nil {
-		return &Response{code: 400, err: err.Error()}
-	}
-	data := &templateData{}
-	data.SelectedUser = user
-	return &Response{
-		template: "change_avatar.tmpl",
-		data:     data,
-	}
-}
-
-func (c *Controller) ServeChangeAvatarDo(r *http.Request) *Response {
-	user, err := selectedUserIfAdmin(c, r)
-	if err != nil {
-		return &Response{code: 400, err: err.Error()}
-	}
-	avatar, err := getAvatarFile(r)
-	if err != nil {
-		return &Response{
-			redirect: r.Referer(),
-			flashW:   []string{err.Error()},
-		}
-	}
-	user.Avatar = avatar
-	if err := c.DB.Save(user).Error; err != nil {
-		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("save user: %v", err)}}
-	}
-	return &Response{
-		redirect: r.Referer(),
-		flashN:   []string{"avatar saved successfully"},
-	}
-}
-
-func (c *Controller) ServeDeleteAvatarDo(r *http.Request) *Response {
-	user, err := selectedUserIfAdmin(c, r)
-	if err != nil {
-		return &Response{code: 400, err: err.Error()}
-	}
-	user.Avatar = nil
-	if err := c.DB.Save(user).Error; err != nil {
-		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("save user: %v", err)}}
-	}
-	return &Response{
-		redirect: r.Referer(),
-		flashN:   []string{"avatar deleted successfully"},
-	}
-}
-
-func (c *Controller) ServeDeleteUser(r *http.Request) *Response {
-	user, err := selectedUserIfAdmin(c, r)
-	if err != nil {
-		return &Response{code: 400, err: err.Error()}
-	}
-	data := &templateData{}
-	data.SelectedUser = user
-	return &Response{
-		template: "delete_user.tmpl",
-		data:     data,
-	}
-}
-
-func (c *Controller) ServeDeleteUserDo(r *http.Request) *Response {
-	user, err := selectedUserIfAdmin(c, r)
-	if err != nil {
-		return &Response{code: 400, err: err.Error()}
-	}
-	if user.IsAdmin {
-		return &Response{
-			redirect: "/admin/home",
-			flashW:   []string{"can't delete the admin user"},
-		}
-	}
-	if err := c.DB.Delete(user).Error; err != nil {
-		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("delete user: %v", err)}}
-	}
-	return &Response{redirect: "/admin/home"}
-}
-
-func (c *Controller) ServeCreateUser(_ *http.Request) *Response {
-	return &Response{template: "create_user.tmpl"}
-}
-
-func (c *Controller) ServeCreateUserDo(r *http.Request) *Response {
-	username := r.FormValue("username")
-	if err := validateUsername(username); err != nil {
-		return &Response{
-			redirect: r.Referer(),
-			flashW:   []string{err.Error()},
-		}
-	}
-	passwordOne := r.FormValue("password_one")
-	passwordTwo := r.FormValue("password_two")
-	if err := validatePasswords(passwordOne, passwordTwo); err != nil {
-		return &Response{
-			redirect: r.Referer(),
-			flashW:   []string{err.Error()},
-		}
-	}
-	user := db.User{
-		Name:     username,
-		Password: passwordOne,
-	}
-	if err := c.DB.Create(&user).Error; err != nil {
-		return &Response{
-			redirect: r.Referer(),
-			flashW:   []string{fmt.Sprintf("could not create user `%s`: %v", username, err)},
-		}
-	}
-	return &Response{redirect: "/admin/home"}
-}
-
-func (c *Controller) ServeUpdateLastFMAPIKey(r *http.Request) *Response {
-	data := &templateData{}
-	var err error
-	if data.CurrentLastFMAPIKey, err = c.DB.GetSetting("lastfm_api_key"); err != nil {
-		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("couldn't get api key: %v", err)}}
-	}
-	if data.CurrentLastFMAPISecret, err = c.DB.GetSetting("lastfm_secret"); err != nil {
-		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("couldn't get secret: %v", err)}}
-	}
-	return &Response{
-		template: "update_lastfm_api_key.tmpl",
-		data:     data,
-	}
-}
-
-func (c *Controller) ServeUpdateLastFMAPIKeyDo(r *http.Request) *Response {
-	apiKey := r.FormValue("api_key")
-	secret := r.FormValue("secret")
-	if err := validateAPIKey(apiKey, secret); err != nil {
-		return &Response{
-			redirect: r.Referer(),
-			flashW:   []string{err.Error()},
-		}
-	}
-	if err := c.DB.SetSetting("lastfm_api_key", apiKey); err != nil {
-		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("couldn't set api key: %v", err)}}
-	}
-	if err := c.DB.SetSetting("lastfm_secret", secret); err != nil {
-		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("couldn't set secret: %v", err)}}
-	}
-	return &Response{redirect: "/admin/home"}
-}
-
-func (c *Controller) ServeStartScanIncDo(_ *http.Request) *Response {
-	defer doScan(c.Scanner, scanner.ScanOptions{})
-	return &Response{
-		redirect: "/admin/home",
-		flashN:   []string{"incremental scan started. refresh for results"},
-	}
-}
-
-func (c *Controller) ServeStartScanFullDo(_ *http.Request) *Response {
-	defer doScan(c.Scanner, scanner.ScanOptions{IsFull: true})
-	return &Response{
-		redirect: "/admin/home",
-		flashN:   []string{"full scan started. refresh for results"},
-	}
-}
-
-func (c *Controller) ServeCreateTranscodePrefDo(r *http.Request) *Response {
-	client := r.FormValue("client")
-	profile := r.FormValue("profile")
-	if client == "" {
-		return &Response{
-			redirect: "/admin/home",
-			flashW:   []string{"please provide a client name"},
-		}
-	}
-	user := r.Context().Value(CtxUser).(*db.User)
-	pref := db.TranscodePreference{
-		UserID:  user.ID,
-		Client:  client,
-		Profile: profile,
-	}
-	if err := c.DB.Create(&pref).Error; err != nil {
-		return &Response{
-			redirect: "/admin/home",
-			flashW:   []string{fmt.Sprintf("could not create preference: %v", err)},
-		}
-	}
-	return &Response{redirect: "/admin/home"}
-}
-
-func (c *Controller) ServeDeleteTranscodePrefDo(r *http.Request) *Response {
-	user := r.Context().Value(CtxUser).(*db.User)
-	client := r.URL.Query().Get("client")
-	if client == "" {
-		return &Response{code: 400, err: "please provide a client"}
-	}
-	c.DB.
-		Where("user_id=? AND client=?", user.ID, client).
-		Delete(db.TranscodePreference{})
-	return &Response{
-		redirect: "/admin/home",
-	}
-}
-
-func (c *Controller) ServePodcastAddDo(r *http.Request) *Response {
-	rssURL := r.FormValue("feed")
-	fp := gofeed.NewParser()
-	feed, err := fp.ParseURL(rssURL)
-	if err != nil {
-		return &Response{
-			redirect: "/admin/home",
-			flashW:   []string{fmt.Sprintf("could not create feed: %v", err)},
-		}
-	}
-	if _, err := c.Podcasts.AddNewPodcast(rssURL, feed); err != nil {
-		return &Response{
-			redirect: "/admin/home",
-			flashW:   []string{fmt.Sprintf("could not create feed: %v", err)},
-		}
-	}
-	return &Response{
-		redirect: "/admin/home",
-	}
-}
-
-func (c *Controller) ServePodcastDownloadDo(r *http.Request) *Response {
-	id, err := strconv.Atoi(r.URL.Query().Get("id"))
-	if err != nil {
-		return &Response{code: 400, err: "please provide a valid podcast id"}
-	}
-	if err := c.Podcasts.DownloadPodcastAll(id); err != nil {
-		return &Response{code: 400, err: "please provide a valid podcast id"}
-	}
-	return &Response{
-		redirect: "/admin/home",
-		flashN:   []string{"started downloading podcast episodes"},
-	}
-}
-
-func (c *Controller) ServePodcastUpdateDo(r *http.Request) *Response {
-	id, err := strconv.Atoi(r.URL.Query().Get("id"))
-	if err != nil {
-		return &Response{code: 400, err: "please provide a valid podcast id"}
-	}
-	setting := db.PodcastAutoDownload(r.FormValue("setting"))
-	var message string
-	switch setting {
-	case db.PodcastAutoDownloadLatest:
-		message = "future podcast episodes will be automatically downloaded"
-	case db.PodcastAutoDownloadNone:
-		message = "future podcast episodes will not be downloaded"
-	default:
-		return &Response{code: 400, err: "please provide a valid podcast download type"}
-	}
-	if err := c.Podcasts.SetAutoDownload(id, setting); err != nil {
-		return &Response{
-			flashW: []string{fmt.Sprintf("could not update auto download setting: %v", err)},
-			code:   400,
-		}
-	}
-	return &Response{
-		redirect: "/admin/home",
-		flashN:   []string{message},
-	}
-}
-
-func (c *Controller) ServePodcastDeleteDo(r *http.Request) *Response {
-	id, err := strconv.Atoi(r.URL.Query().Get("id"))
-	if err != nil {
-		return &Response{code: 400, err: "please provide a valid podcast id"}
-	}
-	if err := c.Podcasts.DeletePodcast(id); err != nil {
-		return &Response{code: 400, err: "please provide a valid podcast id"}
-	}
-	return &Response{
-		redirect: "/admin/home",
-	}
-}
-
-func (c *Controller) ServeInternetRadioStationAddDo(r *http.Request) *Response {
-	streamURL := r.FormValue("streamURL")
-	name := r.FormValue("name")
-	homepageURL := r.FormValue("homepageURL")
-
-	if name == "" {
-		return &Response{redirect: "/admin/home", flashW: []string{"no name provided"}}
-	}
-
-	if _, err := url.ParseRequestURI(streamURL); err != nil {
-		return &Response{redirect: "/admin/home", flashW: []string{fmt.Sprintf("bad stream URL provided: %v", err)}}
-	}
-
-	if homepageURL != "" {
-		if _, err := url.ParseRequestURI(homepageURL); err != nil {
-			return &Response{redirect: "/admin/home", flashW: []string{fmt.Sprintf("bad homepage URL provided: %v", err)}}
-		}
-	}
-
-	var station db.InternetRadioStation
-	station.StreamURL = streamURL
-	station.Name = name
-	station.HomepageURL = homepageURL
-	if err := c.DB.Save(&station).Error; err != nil {
-		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("error saving station: %v", err)}}
-	}
-
-	return &Response{
-		redirect: "/admin/home",
-	}
-}
-
-func (c *Controller) ServeInternetRadioStationUpdateDo(r *http.Request) *Response {
-	stationID, err := strconv.Atoi(r.URL.Query().Get("id"))
-	if err != nil {
-		return &Response{code: 400, err: "please provide a valid internet radio station id"}
-	}
-
-	streamURL := r.FormValue("streamURL")
-	name := r.FormValue("name")
-	homepageURL := r.FormValue("homepageURL")
-
-	if name == "" {
-		return &Response{
-			redirect: "/admin/home",
-			flashW:   []string{"no name provided"},
-		}
-	}
-
-	if _, err := url.ParseRequestURI(streamURL); err != nil {
-		return &Response{
-			redirect: "/admin/home",
-			flashW:   []string{fmt.Sprintf("bad stream URL provided: %v", err)},
-		}
-	}
-
-	if homepageURL != "" {
-		if _, err := url.ParseRequestURI(homepageURL); err != nil {
-			return &Response{
-				redirect: "/admin/home",
-				flashW:   []string{fmt.Sprintf("bad homepage URL provided: %v", err)},
-			}
-		}
-	}
-
-	var station db.InternetRadioStation
-	if err := c.DB.Where("id=?", stationID).First(&station).Error; err != nil {
-		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("find station by id: %v", err)}}
-	}
-
-	station.StreamURL = streamURL
-	station.Name = name
-	station.HomepageURL = homepageURL
-	if err := c.DB.Save(&station).Error; err != nil {
-		return &Response{code: 500, err: "please provide a valid internet radio station id"}
-	}
-
-	return &Response{
-		redirect: "/admin/home",
-	}
-}
-
-func (c *Controller) ServeInternetRadioStationDeleteDo(r *http.Request) *Response {
-	stationID, err := strconv.Atoi(r.URL.Query().Get("id"))
-	if err != nil {
-		return &Response{code: 400, err: "please provide a valid internet radio station id"}
-	}
-
-	var station db.InternetRadioStation
-	if err := c.DB.Where("id=?", stationID).First(&station).Error; err != nil {
-		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("find station by id: %v", err)}}
-	}
-
-	if err := c.DB.Where("id=?", stationID).Delete(&db.InternetRadioStation{}).Error; err != nil {
-		return &Response{redirect: r.Referer(), flashW: []string{fmt.Sprintf("deleting radio station: %v", err)}}
-	}
-
-	return &Response{
-		redirect: "/admin/home",
-	}
-}
-
-func getAvatarFile(r *http.Request) ([]byte, error) {
-	err := r.ParseMultipartForm(10 << 20) // keep up to 10MB in memory
-	if err != nil {
-		return nil, err
-	}
-	file, _, err := r.FormFile("avatar")
-	if err != nil {
-		return nil, fmt.Errorf("read form file: %w", err)
-	}
-	i, _, err := image.Decode(file)
-	if err != nil {
-		return nil, fmt.Errorf("decode image: %w", err)
-	}
-	resized := resize.Resize(64, 64, i, resize.Lanczos3)
-	var buff bytes.Buffer
-	if err := jpeg.Encode(&buff, resized, nil); err != nil {
-		return nil, err
-	}
-	return buff.Bytes(), nil
-}
-
-func selectedUserIfAdmin(c *Controller, r *http.Request) (*db.User, error) {
-	selectedUsername := r.URL.Query().Get("user")
-	if selectedUsername == "" {
-		return nil, fmt.Errorf("please provide a username")
-	}
-	user := r.Context().Value(CtxUser).(*db.User)
-	if !user.IsAdmin && user.Name != selectedUsername {
-		return nil, fmt.Errorf("must be admin to perform actions for other users")
-	}
-	selectedUser := c.DB.GetUserByName(selectedUsername)
-	return selectedUser, nil
-}

From 6602495032a258a11a6ab0051a81a59ffb4a769b Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@ozx.me>
Date: Sun, 6 Aug 2023 00:40:26 -0700
Subject: [PATCH 10/64] Added a way of disabling LDAP auth

---
 server/ctrladmin/adminui/pages/ldap.tmpl |  1 +
 server/ctrladmin/handlers.go             | 14 +++++++++-----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/server/ctrladmin/adminui/pages/ldap.tmpl b/server/ctrladmin/adminui/pages/ldap.tmpl
index 662bb9d9..47f61868 100644
--- a/server/ctrladmin/adminui/pages/ldap.tmpl
+++ b/server/ctrladmin/adminui/pages/ldap.tmpl
@@ -7,6 +7,7 @@
 ) }}
 		<form class="flex flex-col gap-2 items-end" action="{{ path 
 		"/admin/ldap_do" }}" method="post">
+				<p>Leave the server empty to disable LDAP.</p>
 				<input
 					type="username"
 					id="bind_user"
diff --git a/server/ctrladmin/handlers.go b/server/ctrladmin/handlers.go
index 4a72ade6..8185c58e 100644
--- a/server/ctrladmin/handlers.go
+++ b/server/ctrladmin/handlers.go
@@ -188,14 +188,11 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 	tls := r.FormValue("tls")
 	baseDN := r.FormValue("base_dn")
 	filter := r.FormValue("filter")
-	
-	log.Print("AHHH")
-	log.Print(tls)
 
-	if bindUID == "" || bindPSWD == "" || fqdn == "" || port == "" || baseDN == "" || filter == "" {
+	if bindUID == "" || bindPSWD == ""|| port == "" || baseDN == "" || filter == "" {
 		return &Response{
 			redirect: r.Referer(),
-			flashW:   []string{"please provide a bind username and password, a FQDN, port, base CN, and filter"},
+			flashW:   []string{"please provide a bind username and password, port, base CN, and filter"},
 		}
 	}
 	
@@ -208,6 +205,13 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 	c.DB.SetSetting("ldap_base_dn", baseDN)
 	c.DB.SetSetting("ldap_filter", filter)
 
+	if fqdn == "" {
+		return &Response{
+			redirect: "/admin/home",
+			flashW:   []string{"LDAP server was left empty, LDAP authentication will be disabled."},
+		}
+	}
+
 	return &Response{redirect: "/admin/home"}
 }
 

From 6c8f5fa968115db4babf6c38906fd3fcc0d07f0a Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@ozx.me>
Date: Sun, 6 Aug 2023 00:43:20 -0700
Subject: [PATCH 11/64] Added go-ldap dep

---
 go.mod | 2 ++
 go.sum | 4 ++++
 2 files changed, 6 insertions(+)

diff --git a/go.mod b/go.mod
index 4cdf1a81..d2b740fb 100644
--- a/go.mod
+++ b/go.mod
@@ -41,6 +41,7 @@ require (
 	github.com/PuerkitoBio/goquery v1.8.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/felixge/httpsnoop v1.0.3 // indirect
+	github.com/go-ldap/ldap v3.0.3+incompatible // indirect
 	github.com/go-openapi/jsonpointer v0.19.5 // indirect
 	github.com/go-openapi/swag v0.21.1 // indirect
 	github.com/gorilla/context v1.1.1 // indirect
@@ -62,6 +63,7 @@ require (
 	golang.org/x/image v0.5.0 // indirect
 	golang.org/x/sys v0.5.0 // indirect
 	golang.org/x/text v0.7.0 // indirect
+	gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d // indirect
 	gopkg.in/natefinch/npipe.v2 v2.0.0-20160621034901-c1b8fa8bdcce // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
diff --git a/go.sum b/go.sum
index 2ead1788..2f0651c6 100644
--- a/go.sum
+++ b/go.sum
@@ -34,6 +34,8 @@ github.com/felixge/httpsnoop v1.0.3 h1:s/nj+GCswXYzN5v2DpNMuMQYe+0DDwt5WVCU6CWBd
 github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
 github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
+github.com/go-ldap/ldap v3.0.3+incompatible h1:HTeSZO8hWMS1Rgb2Ziku6b8a7qRIZZMHjsvuZyatzwk=
+github.com/go-ldap/ldap v3.0.3+incompatible/go.mod h1:qfd9rJvER9Q0/D/Sqn1DfHRoBp40uXYvFoEVrNEPqRc=
 github.com/go-openapi/jsonpointer v0.19.5 h1:gZr+CIYByUqjcgeLXnQu2gHYQC9o73G2XUeOFYEICuY=
 github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
 github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
@@ -201,6 +203,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7 h1:9zdDQZ7Thm29KFXgAX/+yaf3eVbP7djjWp/dXAppNCc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/appengine v1.3.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d h1:TxyelI5cVkbREznMhfzycHdkp5cLA7DpE+GKjSslYhM=
+gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d/go.mod h1:cuepJuh7vyXfUyUwEgHQXw849cJrilpS5NeIjOWESAw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=

From fdb2ec66de090c5b9ebecddeba5c6b7a305a5dee Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@ozx.me>
Date: Sun, 6 Aug 2023 01:33:21 -0700
Subject: [PATCH 12/64] Added LDAP auth if there is a user

---
 server/ctrlsubsonic/middleware.go | 46 +++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/server/ctrlsubsonic/middleware.go b/server/ctrlsubsonic/middleware.go
index 11ab2858..293481aa 100644
--- a/server/ctrlsubsonic/middleware.go
+++ b/server/ctrlsubsonic/middleware.go
@@ -6,9 +6,12 @@ import (
 	"encoding/hex"
 	"fmt"
 	"net/http"
+	"log"
 
 	"go.senan.xyz/gonic/server/ctrlsubsonic/params"
 	"go.senan.xyz/gonic/server/ctrlsubsonic/spec"
+
+	"github.com/go-ldap/ldap"
 )
 
 func checkCredsToken(password, token, salt string) bool {
@@ -80,6 +83,49 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 			credsOk = checkCredsBasic(user.Password, password)
 		}
 		if !credsOk {
+			// Because internal authentication failed, we can now try to use LDAP, if 
+			// it was enabled by the user.
+			ldapFQDN, err := c.DB.GetSetting("ldap_fqdn")
+
+			if ldapFQDN != "" && err == nil {
+				// The configuration page wouldn't allow these setting to not be set 
+				// while LDAP is enabled (a FQDN/IP is set).
+				//bindUID, _ := c.DB.GetSetting("ldap_bind_user")
+				//bindPWD, _ := c.DB.GetSetting("ldap_bind_user_password")
+				ldapPort, _ := c.DB.GetSetting("ldap_port")
+				baseDN, _ := c.DB.GetSetting("ldap_base_dn")
+				//filter, _ := c.DB.GetSetting("ldap_filter")
+				tls, _ := c.DB.GetSetting("ldap_tls")
+				
+				protocol := "ldap"
+				if tls == "true" {
+					protocol = "ldaps"
+				}
+				
+				// Now, we can try to connect to the LDAP server.
+				l, err := ldap.DialURL(fmt.Sprintf("%s://%s:%s", protocol, ldapFQDN, ldapPort))
+				defer l.Close()
+				if err != nil {
+					// Warn the server and return a generic error.
+					log.Println("Failed to connect to LDAP server", err)
+					
+					_ = writeResp(w, r, spec.NewError(0, "Failed to connect to LDAP server."))
+					return
+				}
+				
+				// After we have a connection, let's try binding
+				err = l.Bind(username, password)
+				_, err = l.SimpleBind(&ldap.SimpleBindRequest{
+					Username: fmt.Sprintf("uid=%s,%s", username, baseDN),
+					Password: password,
+				})
+
+				if err == nil {
+					withUser := context.WithValue(r.Context(), CtxUser, user)
+					next.ServeHTTP(w, r.WithContext(withUser))
+				}
+			}
+			
 			_ = writeResp(w, r, spec.NewError(40, "invalid password"))
 			return
 		}

From d8338590fd62dfc020135e6b10217bed447d63aa Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@ozx.me>
Date: Sun, 6 Aug 2023 02:54:17 -0700
Subject: [PATCH 13/64] Added LDAP user creation

---
 server/ctrladmin/adminui/pages/ldap.tmpl |  2 +-
 server/ctrladmin/handlers.go             |  2 +-
 server/ctrlsubsonic/middleware.go        | 92 +++++++++++++++++++++---
 3 files changed, 84 insertions(+), 12 deletions(-)

diff --git a/server/ctrladmin/adminui/pages/ldap.tmpl b/server/ctrladmin/adminui/pages/ldap.tmpl
index 47f61868..c9c70f8f 100644
--- a/server/ctrladmin/adminui/pages/ldap.tmpl
+++ b/server/ctrladmin/adminui/pages/ldap.tmpl
@@ -55,7 +55,7 @@
 					type="text"
 					id="filter"
 					name="filter"
-					placeholder="filter"
+					placeholder="group name (filter)"
 					value={{ default "" .CurrentFilter }}
 				>
 				
diff --git a/server/ctrladmin/handlers.go b/server/ctrladmin/handlers.go
index 8185c58e..0b8802b6 100644
--- a/server/ctrladmin/handlers.go
+++ b/server/ctrladmin/handlers.go
@@ -192,7 +192,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 	if bindUID == "" || bindPSWD == ""|| port == "" || baseDN == "" || filter == "" {
 		return &Response{
 			redirect: r.Referer(),
-			flashW:   []string{"please provide a bind username and password, port, base CN, and filter"},
+			flashW:   []string{"please provide a bind username and password, port, base CN, and filter (group name)"},
 		}
 	}
 	
diff --git a/server/ctrlsubsonic/middleware.go b/server/ctrlsubsonic/middleware.go
index 293481aa..53baa897 100644
--- a/server/ctrlsubsonic/middleware.go
+++ b/server/ctrlsubsonic/middleware.go
@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"log"
 
+	"go.senan.xyz/gonic/db"
 	"go.senan.xyz/gonic/server/ctrlsubsonic/params"
 	"go.senan.xyz/gonic/server/ctrlsubsonic/spec"
 
@@ -71,30 +72,102 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 			return
 		}
 		user := c.DB.GetUserByName(username)
+
+		newLDAPUser := false
 		if user == nil {
-			_ = writeResp(w, r, spec.NewError(40,
-				"invalid username `%s`", username))
-			return
+			// Because the user wasn't found we can now try 
+			// to use LDAP. ldapFQDN, err := c.DB.GetSetting("ldap_fqdn")
+			ldapFQDN, err := c.DB.GetSetting("ldap_fqdn")
+			
+			if ldapFQDN != "" && err == nil {
+				// The configuration page wouldn't allow these setting to not be set 
+				// while LDAP is enabled (a FQDN/IP is set).
+				bindUID, _ := c.DB.GetSetting("ldap_bind_user")
+				bindPWD, _ := c.DB.GetSetting("ldap_bind_user_password")
+				ldapPort, _ := c.DB.GetSetting("ldap_port")
+				baseDN, _ := c.DB.GetSetting("ldap_base_dn")
+				filter, _ := c.DB.GetSetting("ldap_filter")
+				tls, _ := c.DB.GetSetting("ldap_tls")
+
+				protocol := "ldap"
+				if tls == "true" {
+					protocol = "ldaps"
+				}
+				
+				// Now, we can try to connect to the LDAP server.
+				l, err := ldap.DialURL(fmt.Sprintf("%s://%s:%s", protocol, ldapFQDN, ldapPort))
+				defer l.Close()
+				if err != nil {
+					newLDAPUser = true
+					
+					// Warn the server and return a generic error.
+					log.Println("Failed to connect to LDAP server", err)
+					
+					_ = writeResp(w, r, spec.NewError(0, "Failed to connect to LDAP server."))
+					return
+				}
+
+				// After we have a connection, let's try binding
+				_, err = l.SimpleBind(&ldap.SimpleBindRequest{
+					Username: fmt.Sprintf("uid=%s,%s", bindUID, baseDN),
+					Password: bindPWD,
+				})
+				if err != nil {
+					log.Println("Failed to bind to LDAP:", err)
+					_ = writeResp(w, r, spec.NewError(40, "invalid username `%s`", username))
+					return
+				}
+
+				searchReq := ldap.NewSearchRequest(
+					baseDN,
+					ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
+					fmt.Sprintf("(&%s(uid=%s))", filter, ldap.EscapeFilter(username)),
+					[]string{"dn"},
+					nil,
+				)
+
+				result, err := l.Search(searchReq)
+				if err != nil {
+        	log.Println("failed to query LDAP:", err)
+				}
+
+  		  if len(result.Entries) > 0 {
+					user := db.User{
+						Name: username,
+						Password: "", // no password because we want auth to fail.
+					}
+
+					if err := c.DB.Create(&user).Error; err != nil {
+						fmt.Println("User created via LDAP:", username)
+					}
+		    } else {
+    	    _ = writeResp(w, r, spec.NewError(40, "invalid username `%s`", username))
+					return
+		    }
+			} else {
+				_ = writeResp(w, r, spec.NewError(40,
+					"invalid username `%s`", username))
+				return
+			}
 		}
 		var credsOk bool
-		if tokenAuth {
+		if tokenAuth && newLDAPUser {
 			credsOk = checkCredsToken(user.Password, token, salt)
 		} else {
-			credsOk = checkCredsBasic(user.Password, password)
+			if newLDAPUser {
+				credsOk = checkCredsBasic(user.Password, password)
+			}
 		}
 		if !credsOk {
 			// Because internal authentication failed, we can now try to use LDAP, if 
 			// it was enabled by the user.
 			ldapFQDN, err := c.DB.GetSetting("ldap_fqdn")
-
+			
 			if ldapFQDN != "" && err == nil {
 				// The configuration page wouldn't allow these setting to not be set 
 				// while LDAP is enabled (a FQDN/IP is set).
-				//bindUID, _ := c.DB.GetSetting("ldap_bind_user")
-				//bindPWD, _ := c.DB.GetSetting("ldap_bind_user_password")
 				ldapPort, _ := c.DB.GetSetting("ldap_port")
 				baseDN, _ := c.DB.GetSetting("ldap_base_dn")
-				//filter, _ := c.DB.GetSetting("ldap_filter")
 				tls, _ := c.DB.GetSetting("ldap_tls")
 				
 				protocol := "ldap"
@@ -114,7 +187,6 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 				}
 				
 				// After we have a connection, let's try binding
-				err = l.Bind(username, password)
 				_, err = l.SimpleBind(&ldap.SimpleBindRequest{
 					Username: fmt.Sprintf("uid=%s,%s", username, baseDN),
 					Password: password,

From 79b28ef6537d88ba08ef701d8a25636ec4aeb4ff Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@ozx.me>
Date: Sun, 6 Aug 2023 02:58:40 -0700
Subject: [PATCH 14/64] Fixed ineffassign to

---
 server/ctrlsubsonic/middleware.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/ctrlsubsonic/middleware.go b/server/ctrlsubsonic/middleware.go
index 53baa897..1256986b 100644
--- a/server/ctrlsubsonic/middleware.go
+++ b/server/ctrlsubsonic/middleware.go
@@ -73,7 +73,7 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 		}
 		user := c.DB.GetUserByName(username)
 
-		newLDAPUser := false
+		var newLDAPUser bool
 		if user == nil {
 			// Because the user wasn't found we can now try 
 			// to use LDAP. ldapFQDN, err := c.DB.GetSetting("ldap_fqdn")

From 9c56bf61ab4167b37cf9728c4000621863309ecf Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@ozx.me>
Date: Sun, 6 Aug 2023 03:00:00 -0700
Subject: [PATCH 15/64] Fixed  for LDAP connection

---
 server/ctrlsubsonic/middleware.go | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/server/ctrlsubsonic/middleware.go b/server/ctrlsubsonic/middleware.go
index 1256986b..ff77e6c9 100644
--- a/server/ctrlsubsonic/middleware.go
+++ b/server/ctrlsubsonic/middleware.go
@@ -96,7 +96,6 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 				
 				// Now, we can try to connect to the LDAP server.
 				l, err := ldap.DialURL(fmt.Sprintf("%s://%s:%s", protocol, ldapFQDN, ldapPort))
-				defer l.Close()
 				if err != nil {
 					newLDAPUser = true
 					
@@ -106,7 +105,8 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 					_ = writeResp(w, r, spec.NewError(0, "Failed to connect to LDAP server."))
 					return
 				}
-
+				defer l.Close()
+				
 				// After we have a connection, let's try binding
 				_, err = l.SimpleBind(&ldap.SimpleBindRequest{
 					Username: fmt.Sprintf("uid=%s,%s", bindUID, baseDN),
@@ -177,7 +177,6 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 				
 				// Now, we can try to connect to the LDAP server.
 				l, err := ldap.DialURL(fmt.Sprintf("%s://%s:%s", protocol, ldapFQDN, ldapPort))
-				defer l.Close()
 				if err != nil {
 					// Warn the server and return a generic error.
 					log.Println("Failed to connect to LDAP server", err)
@@ -185,6 +184,7 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 					_ = writeResp(w, r, spec.NewError(0, "Failed to connect to LDAP server."))
 					return
 				}
+				defer l.Close()
 				
 				// After we have a connection, let's try binding
 				_, err = l.SimpleBind(&ldap.SimpleBindRequest{

From 1fd8c9b2c3ea5b711002399cfe019afb652b3048 Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@ozx.me>
Date: Sun, 6 Aug 2023 03:01:25 -0700
Subject: [PATCH 16/64] Fix else if (`gocritic`)

---
 server/ctrlsubsonic/middleware.go | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/server/ctrlsubsonic/middleware.go b/server/ctrlsubsonic/middleware.go
index ff77e6c9..a7e72d8e 100644
--- a/server/ctrlsubsonic/middleware.go
+++ b/server/ctrlsubsonic/middleware.go
@@ -153,10 +153,8 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 		var credsOk bool
 		if tokenAuth && newLDAPUser {
 			credsOk = checkCredsToken(user.Password, token, salt)
-		} else {
-			if newLDAPUser {
-				credsOk = checkCredsBasic(user.Password, password)
-			}
+		} else if newLDAPUser {
+			credsOk = checkCredsBasic(user.Password, password)
 		}
 		if !credsOk {
 			// Because internal authentication failed, we can now try to use LDAP, if 

From 23d23c7c6a828815a361989b85b1875242c52316 Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@ozx.me>
Date: Sun, 6 Aug 2023 03:04:59 -0700
Subject: [PATCH 17/64] Fixed r param `revive`

---
 server/ctrladmin/handlers.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/ctrladmin/handlers.go b/server/ctrladmin/handlers.go
index 0b8802b6..d434b2ea 100644
--- a/server/ctrladmin/handlers.go
+++ b/server/ctrladmin/handlers.go
@@ -157,7 +157,7 @@ func (c *Controller) ServeUnlinkListenBrainzDo(r *http.Request) *Response {
 	return &Response{redirect: "/admin/home"}
 }
 
-func (c *Controller) ServeLDAPConfig(r *http.Request) *Response {
+func (c *Controller) ServeLDAPConfig(_ *http.Request) *Response {
 	data := &templateData{}
 
 	data.CurrentBindUID, _ = c.DB.GetSetting("ldap_bind_user")

From 80f5facbd2a5a55d8f58a86160ceec904d7e7ba6 Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@ozx.me>
Date: Sun, 6 Aug 2023 03:12:36 -0700
Subject: [PATCH 18/64] Added `c.DB.SetSetting` (`errcheck`)

---
 server/ctrladmin/handlers.go | 65 ++++++++++++++++++++++++++++++++++--
 1 file changed, 63 insertions(+), 2 deletions(-)

diff --git a/server/ctrladmin/handlers.go b/server/ctrladmin/handlers.go
index d434b2ea..dfc7d261 100644
--- a/server/ctrladmin/handlers.go
+++ b/server/ctrladmin/handlers.go
@@ -196,14 +196,75 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}
 	
-	c.DB.SetSetting("ldap_bind_user", bindUID)
-	c.DB.SetSetting("ldap_bind_user_password", bindPSWD)
+	err := c.DB.SetSetting("ldap_bind_user", bindUID)
+	if err != nil {
+		log.Println("Failed to set bind user:", err)
+
+		return &Response{
+			redirect: r.Refer(),
+			flashW:   []string{"Failed to set bind user."}
+		}
+	}
 	
+	c.DB.SetSetting("ldap_bind_user_password", bindPSWD)
+	if err != nil {
+		log.Println("Failed to set bind user password:", err)
+
+		return &Response{
+			redirect: r.Refer(),
+			flashW:   []string{"Failed to set bind user password."}
+		}
+	}	
+
 	c.DB.SetSetting("ldap_fqdn", fqdn)
+	if err != nil {
+		log.Println("Failed to set server:", err)
+
+		return &Response{
+			redirect: r.Refer(),
+			flashW:   []string{"Failed to set server."}
+		}
+	}
+
 	c.DB.SetSetting("ldap_port", port)
+	if err != nil {
+		log.Println("Failed to set port:", err)
+
+		return &Response{
+			redirect: r.Refer(),
+			flashW:   []string{"Failed to set port."}
+		}
+	}
+
 	c.DB.SetSetting("ldap_tls", tls)
+	if err != nil {
+		log.Println("Failed to set TLS:", err)
+
+		return &Response{
+			redirect: r.Refer(),
+			flashW:   []string{"Failed to set TLS."}
+		}
+	}
+
 	c.DB.SetSetting("ldap_base_dn", baseDN)
+	if err != nil {
+		log.Println("Failed to set base DN:", err)
+
+		return &Response{
+			redirect: r.Refer(),
+			flashW:   []string{"Failed to set base DN."}
+		}
+	}
+
 	c.DB.SetSetting("ldap_filter", filter)
+	if err != nil {
+		log.Println("Failed to set filter:", err)
+
+		return &Response{
+			redirect: r.Refer(),
+			flashW:   []string{"Failed to set filter."}
+		}
+	}
 
 	if fqdn == "" {
 		return &Response{

From e5f815c79ebc1555b0dc64b373b35292c80a1ef3 Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@ozx.me>
Date: Sun, 6 Aug 2023 03:14:43 -0700
Subject: [PATCH 19/64] Fixed filter labels

---
 server/ctrladmin/adminui/pages/ldap.tmpl | 2 +-
 server/ctrladmin/handlers.go             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/ctrladmin/adminui/pages/ldap.tmpl b/server/ctrladmin/adminui/pages/ldap.tmpl
index c9c70f8f..47f61868 100644
--- a/server/ctrladmin/adminui/pages/ldap.tmpl
+++ b/server/ctrladmin/adminui/pages/ldap.tmpl
@@ -55,7 +55,7 @@
 					type="text"
 					id="filter"
 					name="filter"
-					placeholder="group name (filter)"
+					placeholder="filter"
 					value={{ default "" .CurrentFilter }}
 				>
 				
diff --git a/server/ctrladmin/handlers.go b/server/ctrladmin/handlers.go
index dfc7d261..d990c72f 100644
--- a/server/ctrladmin/handlers.go
+++ b/server/ctrladmin/handlers.go
@@ -192,7 +192,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 	if bindUID == "" || bindPSWD == ""|| port == "" || baseDN == "" || filter == "" {
 		return &Response{
 			redirect: r.Referer(),
-			flashW:   []string{"please provide a bind username and password, port, base CN, and filter (group name)"},
+			flashW:   []string{"please provide a bind username and password, port, base CN, and filter"},
 		}
 	}
 	

From a558947da694b546c07892853f6970713250cead Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@ozx.me>
Date: Sun, 6 Aug 2023 03:20:29 -0700
Subject: [PATCH 20/64] Fixed `SetSetting` err checking

---
 server/ctrladmin/handlers.go | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/server/ctrladmin/handlers.go b/server/ctrladmin/handlers.go
index d990c72f..8c04b1c0 100644
--- a/server/ctrladmin/handlers.go
+++ b/server/ctrladmin/handlers.go
@@ -201,8 +201,8 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		log.Println("Failed to set bind user:", err)
 
 		return &Response{
-			redirect: r.Refer(),
-			flashW:   []string{"Failed to set bind user."}
+			redirect: r.Referer(),
+			flashW:   []string{"Failed to set bind user."},
 		}
 	}
 	
@@ -211,8 +211,8 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		log.Println("Failed to set bind user password:", err)
 
 		return &Response{
-			redirect: r.Refer(),
-			flashW:   []string{"Failed to set bind user password."}
+			redirect: r.Referer(),
+			flashW:   []string{"Failed to set bind user password."},
 		}
 	}	
 
@@ -221,8 +221,8 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		log.Println("Failed to set server:", err)
 
 		return &Response{
-			redirect: r.Refer(),
-			flashW:   []string{"Failed to set server."}
+			redirect: r.Referer(),
+			flashW:   []string{"Failed to set server."},
 		}
 	}
 
@@ -231,8 +231,8 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		log.Println("Failed to set port:", err)
 
 		return &Response{
-			redirect: r.Refer(),
-			flashW:   []string{"Failed to set port."}
+			redirect: r.Referer(),
+			flashW:   []string{"Failed to set port."},
 		}
 	}
 
@@ -241,8 +241,8 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		log.Println("Failed to set TLS:", err)
 
 		return &Response{
-			redirect: r.Refer(),
-			flashW:   []string{"Failed to set TLS."}
+			redirect: r.Referer(),
+			flashW:   []string{"Failed to set TLS."},
 		}
 	}
 
@@ -251,8 +251,8 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		log.Println("Failed to set base DN:", err)
 
 		return &Response{
-			redirect: r.Refer(),
-			flashW:   []string{"Failed to set base DN."}
+			redirect: r.Referer(),
+			flashW:   []string{"Failed to set base DN."},
 		}
 	}
 
@@ -261,8 +261,8 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		log.Println("Failed to set filter:", err)
 
 		return &Response{
-			redirect: r.Refer(),
-			flashW:   []string{"Failed to set filter."}
+			redirect: r.Referer(),
+			flashW:   []string{"Failed to set filter."},
 		}
 	}
 

From 46dac6d463366df5a767ae171b282d0751939f47 Mon Sep 17 00:00:00 2001
From: beta <beta@hai.haus>
Date: Sat, 9 Sep 2023 09:27:12 -0700
Subject: [PATCH 21/64] Check errors in ldap do handler

---
 server/ctrladmin/handlers.go | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/server/ctrladmin/handlers.go b/server/ctrladmin/handlers.go
index 8c04b1c0..afbd2a67 100644
--- a/server/ctrladmin/handlers.go
+++ b/server/ctrladmin/handlers.go
@@ -206,7 +206,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}
 	
-	c.DB.SetSetting("ldap_bind_user_password", bindPSWD)
+  err := c.DB.SetSetting("ldap_bind_user_password", bindPSWD)
 	if err != nil {
 		log.Println("Failed to set bind user password:", err)
 
@@ -216,7 +216,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}	
 
-	c.DB.SetSetting("ldap_fqdn", fqdn)
+  err := c.DB.SetSetting("ldap_fqdn", fqdn)
 	if err != nil {
 		log.Println("Failed to set server:", err)
 
@@ -226,7 +226,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}
 
-	c.DB.SetSetting("ldap_port", port)
+  err := c.DB.SetSetting("ldap_port", port)
 	if err != nil {
 		log.Println("Failed to set port:", err)
 
@@ -236,7 +236,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}
 
-	c.DB.SetSetting("ldap_tls", tls)
+  err := c.DB.SetSetting("ldap_tls", tls)
 	if err != nil {
 		log.Println("Failed to set TLS:", err)
 
@@ -246,7 +246,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}
 
-	c.DB.SetSetting("ldap_base_dn", baseDN)
+  err := c.DB.SetSetting("ldap_base_dn", baseDN)
 	if err != nil {
 		log.Println("Failed to set base DN:", err)
 
@@ -256,7 +256,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}
 
-	c.DB.SetSetting("ldap_filter", filter)
+  err := c.DB.SetSetting("ldap_filter", filter)
 	if err != nil {
 		log.Println("Failed to set filter:", err)
 

From 94027dcf9b702f393e86a7cf065e1f280f2baa60 Mon Sep 17 00:00:00 2001
From: beta <beta@hai.haus>
Date: Sat, 9 Sep 2023 09:28:31 -0700
Subject: [PATCH 22/64] Fixed variable defs

---
 server/ctrladmin/handlers.go | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/server/ctrladmin/handlers.go b/server/ctrladmin/handlers.go
index afbd2a67..6debb37e 100644
--- a/server/ctrladmin/handlers.go
+++ b/server/ctrladmin/handlers.go
@@ -206,7 +206,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}
 	
-  err := c.DB.SetSetting("ldap_bind_user_password", bindPSWD)
+  err = c.DB.SetSetting("ldap_bind_user_password", bindPSWD)
 	if err != nil {
 		log.Println("Failed to set bind user password:", err)
 
@@ -216,7 +216,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}	
 
-  err := c.DB.SetSetting("ldap_fqdn", fqdn)
+  err = c.DB.SetSetting("ldap_fqdn", fqdn)
 	if err != nil {
 		log.Println("Failed to set server:", err)
 
@@ -226,7 +226,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}
 
-  err := c.DB.SetSetting("ldap_port", port)
+  err = c.DB.SetSetting("ldap_port", port)
 	if err != nil {
 		log.Println("Failed to set port:", err)
 
@@ -236,7 +236,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}
 
-  err := c.DB.SetSetting("ldap_tls", tls)
+  err = c.DB.SetSetting("ldap_tls", tls)
 	if err != nil {
 		log.Println("Failed to set TLS:", err)
 
@@ -246,7 +246,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}
 
-  err := c.DB.SetSetting("ldap_base_dn", baseDN)
+  err = c.DB.SetSetting("ldap_base_dn", baseDN)
 	if err != nil {
 		log.Println("Failed to set base DN:", err)
 
@@ -256,7 +256,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}
 
-  err := c.DB.SetSetting("ldap_filter", filter)
+  err = c.DB.SetSetting("ldap_filter", filter)
 	if err != nil {
 		log.Println("Failed to set filter:", err)
 

From e7d6fdab691af18244eda8e1eb1ce0f55e6000d1 Mon Sep 17 00:00:00 2001
From: beta <beta@hai.haus>
Date: Sat, 9 Sep 2023 09:37:36 -0700
Subject: [PATCH 23/64] Fixed bug where two requests got merged

---
 server/ctrlsubsonic/middleware.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/server/ctrlsubsonic/middleware.go b/server/ctrlsubsonic/middleware.go
index a7e72d8e..c0810fbe 100644
--- a/server/ctrlsubsonic/middleware.go
+++ b/server/ctrlsubsonic/middleware.go
@@ -193,6 +193,7 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 				if err == nil {
 					withUser := context.WithValue(r.Context(), CtxUser, user)
 					next.ServeHTTP(w, r.WithContext(withUser))
+          return
 				}
 			}
 			

From 7de6cf1e9ed1849d115ddf58c6506eb747173369 Mon Sep 17 00:00:00 2001
From: beta <beta@hai.haus>
Date: Sat, 9 Sep 2023 09:48:54 -0700
Subject: [PATCH 24/64] Fixed use of `newLDAPUser`

---
 server/ctrlsubsonic/middleware.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/ctrlsubsonic/middleware.go b/server/ctrlsubsonic/middleware.go
index c0810fbe..236e1d96 100644
--- a/server/ctrlsubsonic/middleware.go
+++ b/server/ctrlsubsonic/middleware.go
@@ -151,9 +151,9 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 			}
 		}
 		var credsOk bool
-		if tokenAuth && newLDAPUser {
+		if tokenAuth && !newLDAPUser {
 			credsOk = checkCredsToken(user.Password, token, salt)
-		} else if newLDAPUser {
+		} else if !newLDAPUser {
 			credsOk = checkCredsBasic(user.Password, password)
 		}
 		if !credsOk {

From 238856ad73900d9994fcb602730573695fb7cc34 Mon Sep 17 00:00:00 2001
From: beta <beta@hai.haus>
Date: Sat, 9 Sep 2023 09:49:48 -0700
Subject: [PATCH 25/64] Fixed `newLDAPUser` def

---
 server/ctrlsubsonic/middleware.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/ctrlsubsonic/middleware.go b/server/ctrlsubsonic/middleware.go
index 236e1d96..301ca4e3 100644
--- a/server/ctrlsubsonic/middleware.go
+++ b/server/ctrlsubsonic/middleware.go
@@ -73,7 +73,7 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 		}
 		user := c.DB.GetUserByName(username)
 
-		var newLDAPUser bool
+    newLDAPUser := false 
 		if user == nil {
 			// Because the user wasn't found we can now try 
 			// to use LDAP. ldapFQDN, err := c.DB.GetSetting("ldap_fqdn")

From 9e5b8d4ac8179f80247a7f2249f8b7e147bd5ead Mon Sep 17 00:00:00 2001
From: beta <beta@hai.haus>
Date: Sat, 9 Sep 2023 09:55:29 -0700
Subject: [PATCH 26/64] Fixed `newLDAPUser` being reset

---
 server/ctrlsubsonic/middleware.go | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/server/ctrlsubsonic/middleware.go b/server/ctrlsubsonic/middleware.go
index 301ca4e3..ca1c210f 100644
--- a/server/ctrlsubsonic/middleware.go
+++ b/server/ctrlsubsonic/middleware.go
@@ -75,7 +75,9 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 
     newLDAPUser := false 
 		if user == nil {
-			// Because the user wasn't found we can now try 
+			newLDAPUser = true
+			
+      // Because the user wasn't found we can now try 
 			// to use LDAP. ldapFQDN, err := c.DB.GetSetting("ldap_fqdn")
 			ldapFQDN, err := c.DB.GetSetting("ldap_fqdn")
 			
@@ -97,7 +99,6 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 				// Now, we can try to connect to the LDAP server.
 				l, err := ldap.DialURL(fmt.Sprintf("%s://%s:%s", protocol, ldapFQDN, ldapPort))
 				if err != nil {
-					newLDAPUser = true
 					
 					// Warn the server and return a generic error.
 					log.Println("Failed to connect to LDAP server", err)

From d6d51ed9f7f58ad6b2637fcd22850abd1713aca2 Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@hai.haus>
Date: Fri, 27 Oct 2023 10:50:33 -0700
Subject: [PATCH 27/64] Update username error message to match Subsonic API

---
 server/ctrlsubsonic/middleware.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/ctrlsubsonic/middleware.go b/server/ctrlsubsonic/middleware.go
index ca1c210f..62e52729 100644
--- a/server/ctrlsubsonic/middleware.go
+++ b/server/ctrlsubsonic/middleware.go
@@ -5,8 +5,8 @@ import (
 	"crypto/md5"
 	"encoding/hex"
 	"fmt"
-	"net/http"
 	"log"
+	"net/http"
 
 	"go.senan.xyz/gonic/db"
 	"go.senan.xyz/gonic/server/ctrlsubsonic/params"
@@ -115,7 +115,7 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 				})
 				if err != nil {
 					log.Println("Failed to bind to LDAP:", err)
-					_ = writeResp(w, r, spec.NewError(40, "invalid username `%s`", username))
+					_ = writeResp(w, r, spec.NewError(40, "Wrong username or password."))
 					return
 				}
 

From 38ea72bbc6c79d72cac3e05f69ad4c798203f56e Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@hai.haus>
Date: Fri, 27 Oct 2023 10:53:43 -0700
Subject: [PATCH 28/64] Only try to login if there is exactly 1 user, otherwise
 return an error.

---
 server/ctrlsubsonic/middleware.go | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/server/ctrlsubsonic/middleware.go b/server/ctrlsubsonic/middleware.go
index 62e52729..b1eb12e5 100644
--- a/server/ctrlsubsonic/middleware.go
+++ b/server/ctrlsubsonic/middleware.go
@@ -131,8 +131,10 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 				if err != nil {
         	log.Println("failed to query LDAP:", err)
 				}
-
-  		  if len(result.Entries) > 0 {
+				
+				if len(result.Entries) > 1 {
+					_ = writeResp(w, r, spec.NewError(40, "Ambiguous user: `%s`", username))
+				} else if len(result.Entries) == 1 {
 					user := db.User{
 						Name: username,
 						Password: "", // no password because we want auth to fail.

From 667cf731fd2c6ff8e7142d0f5e1b74c675a7df45 Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@hai.haus>
Date: Fri, 27 Oct 2023 15:48:41 -0700
Subject: [PATCH 29/64] Extract out LDAP connection creation

---
 go.mod                            |  3 +--
 server/ctrlsubsonic/middleware.go | 40 ++++++++++++++++---------------
 2 files changed, 22 insertions(+), 21 deletions(-)

diff --git a/go.mod b/go.mod
index 865d8055..f511dbaa 100644
--- a/go.mod
+++ b/go.mod
@@ -16,7 +16,6 @@ require (
 	github.com/gorilla/mux v1.8.0
 	github.com/gorilla/securecookie v1.1.1
 	github.com/gorilla/sessions v1.2.1
-	jaytaylor.com/html2text v0.0.0-20230321000545-74c2419ad056
 	github.com/jinzhu/gorm v1.9.17-0.20211120011537-5c235b72a414
 	github.com/josephburnett/jd v1.5.2
 	github.com/mattn/go-sqlite3 v1.14.16
@@ -34,6 +33,7 @@ require (
 	golang.org/x/exp v0.0.0-20230224173230-c95f2b4c22f2
 	golang.org/x/net v0.7.0
 	gopkg.in/gormigrate.v1 v1.6.0
+	jaytaylor.com/html2text v0.0.0-20230321000545-74c2419ad056
 )
 
 require (
@@ -71,5 +71,4 @@ require (
 	gopkg.in/natefinch/npipe.v2 v2.0.0-20160621034901-c1b8fa8bdcce // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	jaytaylor.com/html2text v0.0.0-20230321000545-74c2419ad056 // indirect
 )
diff --git a/server/ctrlsubsonic/middleware.go b/server/ctrlsubsonic/middleware.go
index b1eb12e5..fa0ed71a 100644
--- a/server/ctrlsubsonic/middleware.go
+++ b/server/ctrlsubsonic/middleware.go
@@ -91,18 +91,10 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 				filter, _ := c.DB.GetSetting("ldap_filter")
 				tls, _ := c.DB.GetSetting("ldap_tls")
 
-				protocol := "ldap"
-				if tls == "true" {
-					protocol = "ldaps"
-				}
-				
 				// Now, we can try to connect to the LDAP server.
-				l, err := ldap.DialURL(fmt.Sprintf("%s://%s:%s", protocol, ldapFQDN, ldapPort))
+				l, err := createLDAPconnection(tls, ldapFQDN, ldapPort)
 				if err != nil {
-					
-					// Warn the server and return a generic error.
-					log.Println("Failed to connect to LDAP server", err)
-					
+					// Return a generic error.
 					_ = writeResp(w, r, spec.NewError(0, "Failed to connect to LDAP server."))
 					return
 				}
@@ -171,17 +163,10 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 				baseDN, _ := c.DB.GetSetting("ldap_base_dn")
 				tls, _ := c.DB.GetSetting("ldap_tls")
 				
-				protocol := "ldap"
-				if tls == "true" {
-					protocol = "ldaps"
-				}
-				
 				// Now, we can try to connect to the LDAP server.
-				l, err := ldap.DialURL(fmt.Sprintf("%s://%s:%s", protocol, ldapFQDN, ldapPort))
+				l, err := createLDAPconnection(tls, ldapFQDN, ldapPort)
 				if err != nil {
-					// Warn the server and return a generic error.
-					log.Println("Failed to connect to LDAP server", err)
-					
+					// Return a generic error.
 					_ = writeResp(w, r, spec.NewError(0, "Failed to connect to LDAP server."))
 					return
 				}
@@ -207,3 +192,20 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 		next.ServeHTTP(w, r.WithContext(withUser))
 	})
 }
+
+func createLDAPconnection(tls string, fqdn string, port string) (*ldap.Conn, error) {
+	protocol := "ldap"
+	if tls == "true" {
+		protocol = "ldaps"
+	}
+
+	// Now, we can try to connect to the LDAP server.
+	l, err := ldap.DialURL(fmt.Sprintf("%s://%s:%s", protocol, fqdn, port))
+	if err != nil {
+		// Warn the server and return a generic error.
+		log.Println("Failed to connect to LDAP server", err)
+		return nil, err
+	}
+
+	return l, nil
+}
\ No newline at end of file

From a99d63ab12838a1b16771abd6cf200d82b2c0b51 Mon Sep 17 00:00:00 2001
From: BetaPictoris <beta@hai.haus>
Date: Fri, 27 Oct 2023 16:02:47 -0700
Subject: [PATCH 30/64] Fixed nil password causing invalid dereferences

---
 db/model.go                       | 2 +-
 server/ctrlsubsonic/middleware.go | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/db/model.go b/db/model.go
index 17091561..4e2858b1 100644
--- a/db/model.go
+++ b/db/model.go
@@ -169,7 +169,7 @@ type User struct {
 	ID                int `gorm:"primary_key"`
 	CreatedAt         time.Time
 	Name              string `gorm:"not null; unique_index" sql:"default: null"`
-	Password          string `gorm:"not null" sql:"default: null"`
+	Password          string `sql:"default: null"`
 	LastFMSession     string `sql:"default: null"`
 	ListenBrainzURL   string `sql:"default: null"`
 	ListenBrainzToken string `sql:"default: null"`
diff --git a/server/ctrlsubsonic/middleware.go b/server/ctrlsubsonic/middleware.go
index fa0ed71a..a9ec70e8 100644
--- a/server/ctrlsubsonic/middleware.go
+++ b/server/ctrlsubsonic/middleware.go
@@ -146,9 +146,9 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 			}
 		}
 		var credsOk bool
-		if tokenAuth && !newLDAPUser {
+		if tokenAuth && !newLDAPUser && user != nil {
 			credsOk = checkCredsToken(user.Password, token, salt)
-		} else if !newLDAPUser {
+		} else if !newLDAPUser && user != nil {
 			credsOk = checkCredsBasic(user.Password, password)
 		}
 		if !credsOk {

From e770eaa07a63585c446016149815fc40015cca53 Mon Sep 17 00:00:00 2001
From: Daniel <beta@hai.haus>
Date: Fri, 10 Nov 2023 13:58:33 -0800
Subject: [PATCH 31/64] Fixed old references to use the new style

Readded goldap
Fixed `c.DB` to `c.dbc`
Fixed `WithUser`
---
 server/ctrladmin/handlers.go | 26 +++++++++++++-------------
 server/ctrlsubsonic/ctrl.go  | 32 +++++++++++++++++---------------
 2 files changed, 30 insertions(+), 28 deletions(-)

diff --git a/server/ctrladmin/handlers.go b/server/ctrladmin/handlers.go
index 40a78bbf..3c81b997 100644
--- a/server/ctrladmin/handlers.go
+++ b/server/ctrladmin/handlers.go
@@ -141,14 +141,14 @@ func (c *Controller) ServeUnlinkListenBrainzDo(r *http.Request) *Response {
 func (c *Controller) ServeLDAPConfig(_ *http.Request) *Response {
 	data := &templateData{}
 
-	data.CurrentBindUID, _ = c.DB.GetSetting("ldap_bind_user")
-	data.CurrentFQDN, _ = c.DB.GetSetting("ldap_fqdn")
-	data.CurrentPort, _ = c.DB.GetSetting("ldap_port")
-	data.CurrentBaseDN, _ = c.DB.GetSetting("ldap_base_dn")
-	data.CurrentFilter, _ = c.DB.GetSetting("ldap_filter")
+	data.CurrentBindUID, _ = c.dbc.GetSetting("ldap_bind_user")
+	data.CurrentFQDN, _ = c.dbc.GetSetting("ldap_fqdn")
+	data.CurrentPort, _ = c.dbc.GetSetting("ldap_port")
+	data.CurrentBaseDN, _ = c.dbc.GetSetting("ldap_base_dn")
+	data.CurrentFilter, _ = c.dbc.GetSetting("ldap_filter")
 	
 	// This is to fix the fact that select boxes are strange.
-	currentTLS, _ := c.DB.GetSetting("ldap_tls")
+	currentTLS, _ := c.dbc.GetSetting("ldap_tls")
 	data.CurrentNoTLS = "selected"
 
 	if currentTLS == "true" {
@@ -177,7 +177,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}
 	
-	err := c.DB.SetSetting("ldap_bind_user", bindUID)
+	err := c.dbc.SetSetting("ldap_bind_user", bindUID)
 	if err != nil {
 		log.Println("Failed to set bind user:", err)
 
@@ -187,7 +187,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}
 	
-  err = c.DB.SetSetting("ldap_bind_user_password", bindPSWD)
+  err = c.dbc.SetSetting("ldap_bind_user_password", bindPSWD)
 	if err != nil {
 		log.Println("Failed to set bind user password:", err)
 
@@ -197,7 +197,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}	
 
-  err = c.DB.SetSetting("ldap_fqdn", fqdn)
+  err = c.dbc.SetSetting("ldap_fqdn", fqdn)
 	if err != nil {
 		log.Println("Failed to set server:", err)
 
@@ -207,7 +207,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}
 
-  err = c.DB.SetSetting("ldap_port", port)
+  err = c.dbc.SetSetting("ldap_port", port)
 	if err != nil {
 		log.Println("Failed to set port:", err)
 
@@ -217,7 +217,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}
 
-  err = c.DB.SetSetting("ldap_tls", tls)
+  err = c.dbc.SetSetting("ldap_tls", tls)
 	if err != nil {
 		log.Println("Failed to set TLS:", err)
 
@@ -227,7 +227,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}
 
-  err = c.DB.SetSetting("ldap_base_dn", baseDN)
+  err = c.dbc.SetSetting("ldap_base_dn", baseDN)
 	if err != nil {
 		log.Println("Failed to set base DN:", err)
 
@@ -237,7 +237,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}
 
-  err = c.DB.SetSetting("ldap_filter", filter)
+  err = c.dbc.SetSetting("ldap_filter", filter)
 	if err != nil {
 		log.Println("Failed to set filter:", err)
 
diff --git a/server/ctrlsubsonic/ctrl.go b/server/ctrlsubsonic/ctrl.go
index 16851d52..f74b22a7 100644
--- a/server/ctrlsubsonic/ctrl.go
+++ b/server/ctrlsubsonic/ctrl.go
@@ -24,6 +24,8 @@ import (
 	"go.senan.xyz/gonic/server/ctrlsubsonic/params"
 	"go.senan.xyz/gonic/server/ctrlsubsonic/spec"
 	"go.senan.xyz/gonic/transcode"
+
+	"github.com/go-ldap/ldap"
 )
 
 type CtxKey int
@@ -92,7 +94,7 @@ func New(dbc *db.DB, scannr *scanner.Scanner, musicPaths []MusicPath, podcastsPa
 	chain := handlerutil.Chain(
 		withParams,
 		withRequiredParams,
-		withUser(dbc),
+		c.WithUser,
 	)
 
 	c.Handle("/getLicense", chain(resp(c.ServeGetLicence)))
@@ -234,25 +236,25 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 				"please provide `t` and `s`, or just `p`"))
 			return
 		}
-		user := c.DB.GetUserByName(username)
+		user := c.dbc.GetUserByName(username)
 
     newLDAPUser := false 
 		if user == nil {
 			newLDAPUser = true
 			
       // Because the user wasn't found we can now try 
-			// to use LDAP. ldapFQDN, err := c.DB.GetSetting("ldap_fqdn")
-			ldapFQDN, err := c.DB.GetSetting("ldap_fqdn")
+			// to use LDAP. ldapFQDN, err := c.dbc.GetSetting("ldap_fqdn")
+			ldapFQDN, err := c.dbc.GetSetting("ldap_fqdn")
 			
 			if ldapFQDN != "" && err == nil {
 				// The configuration page wouldn't allow these setting to not be set 
 				// while LDAP is enabled (a FQDN/IP is set).
-				bindUID, _ := c.DB.GetSetting("ldap_bind_user")
-				bindPWD, _ := c.DB.GetSetting("ldap_bind_user_password")
-				ldapPort, _ := c.DB.GetSetting("ldap_port")
-				baseDN, _ := c.DB.GetSetting("ldap_base_dn")
-				filter, _ := c.DB.GetSetting("ldap_filter")
-				tls, _ := c.DB.GetSetting("ldap_tls")
+				bindUID, _ := c.dbc.GetSetting("ldap_bind_user")
+				bindPWD, _ := c.dbc.GetSetting("ldap_bind_user_password")
+				ldapPort, _ := c.dbc.GetSetting("ldap_port")
+				baseDN, _ := c.dbc.GetSetting("ldap_base_dn")
+				filter, _ := c.dbc.GetSetting("ldap_filter")
+				tls, _ := c.dbc.GetSetting("ldap_tls")
 
 				// Now, we can try to connect to the LDAP server.
 				l, err := createLDAPconnection(tls, ldapFQDN, ldapPort)
@@ -295,7 +297,7 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 						Password: "", // no password because we want auth to fail.
 					}
 
-					if err := c.DB.Create(&user).Error; err != nil {
+					if err := c.dbc.Create(&user).Error; err != nil {
 						fmt.Println("User created via LDAP:", username)
 					}
 		    } else {
@@ -317,14 +319,14 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 		if !credsOk {
 			// Because internal authentication failed, we can now try to use LDAP, if 
 			// it was enabled by the user.
-			ldapFQDN, err := c.DB.GetSetting("ldap_fqdn")
+			ldapFQDN, err := c.dbc.GetSetting("ldap_fqdn")
 			
 			if ldapFQDN != "" && err == nil {
 				// The configuration page wouldn't allow these setting to not be set 
 				// while LDAP is enabled (a FQDN/IP is set).
-				ldapPort, _ := c.DB.GetSetting("ldap_port")
-				baseDN, _ := c.DB.GetSetting("ldap_base_dn")
-				tls, _ := c.DB.GetSetting("ldap_tls")
+				ldapPort, _ := c.dbc.GetSetting("ldap_port")
+				baseDN, _ := c.dbc.GetSetting("ldap_base_dn")
+				tls, _ := c.dbc.GetSetting("ldap_tls")
 				
 				// Now, we can try to connect to the LDAP server.
 				l, err := createLDAPconnection(tls, ldapFQDN, ldapPort)

From 322aa0747a323b4245480661582958ce04b3c8d4 Mon Sep 17 00:00:00 2001
From: Daniel <beta@hai.haus>
Date: Thu, 30 Nov 2023 14:23:51 -0800
Subject: [PATCH 32/64] Made `WithUser` middleware private

---
 server/ctrlsubsonic/ctrl.go | 44 ++++++++++++++++++-------------------
 1 file changed, 22 insertions(+), 22 deletions(-)

diff --git a/server/ctrlsubsonic/ctrl.go b/server/ctrlsubsonic/ctrl.go
index f74b22a7..f6732365 100644
--- a/server/ctrlsubsonic/ctrl.go
+++ b/server/ctrlsubsonic/ctrl.go
@@ -94,7 +94,7 @@ func New(dbc *db.DB, scannr *scanner.Scanner, musicPaths []MusicPath, podcastsPa
 	chain := handlerutil.Chain(
 		withParams,
 		withRequiredParams,
-		c.WithUser,
+		c.withUser,
 	)
 
 	c.Handle("/getLicense", chain(resp(c.ServeGetLicence)))
@@ -220,7 +220,7 @@ func withRequiredParams(next http.Handler) http.Handler {
 	})
 }
 
-func (c *Controller) WithUser(next http.Handler) http.Handler {
+func (c *Controller) withUser(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		params := r.Context().Value(CtxParams).(params.Params)
 		// ignoring errors here, a middleware has already ensured they exist
@@ -238,16 +238,16 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 		}
 		user := c.dbc.GetUserByName(username)
 
-    newLDAPUser := false 
+		newLDAPUser := false
 		if user == nil {
 			newLDAPUser = true
-			
-      // Because the user wasn't found we can now try 
-			// to use LDAP. ldapFQDN, err := c.dbc.GetSetting("ldap_fqdn")
+
+			// Because the user wasn't found we can now try
+			// to use LDAP.
 			ldapFQDN, err := c.dbc.GetSetting("ldap_fqdn")
-			
+
 			if ldapFQDN != "" && err == nil {
-				// The configuration page wouldn't allow these setting to not be set 
+				// The configuration page wouldn't allow these setting to not be set
 				// while LDAP is enabled (a FQDN/IP is set).
 				bindUID, _ := c.dbc.GetSetting("ldap_bind_user")
 				bindPWD, _ := c.dbc.GetSetting("ldap_bind_user_password")
@@ -264,7 +264,7 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 					return
 				}
 				defer l.Close()
-				
+
 				// After we have a connection, let's try binding
 				_, err = l.SimpleBind(&ldap.SimpleBindRequest{
 					Username: fmt.Sprintf("uid=%s,%s", bindUID, baseDN),
@@ -286,24 +286,24 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 
 				result, err := l.Search(searchReq)
 				if err != nil {
-        	log.Println("failed to query LDAP:", err)
+					log.Println("failed to query LDAP:", err)
 				}
-				
+
 				if len(result.Entries) > 1 {
 					_ = writeResp(w, r, spec.NewError(40, "Ambiguous user: `%s`", username))
 				} else if len(result.Entries) == 1 {
 					user := db.User{
-						Name: username,
+						Name:     username,
 						Password: "", // no password because we want auth to fail.
 					}
 
 					if err := c.dbc.Create(&user).Error; err != nil {
 						fmt.Println("User created via LDAP:", username)
 					}
-		    } else {
-    	    _ = writeResp(w, r, spec.NewError(40, "invalid username `%s`", username))
+				} else {
+					_ = writeResp(w, r, spec.NewError(40, "invalid username `%s`", username))
 					return
-		    }
+				}
 			} else {
 				_ = writeResp(w, r, spec.NewError(40,
 					"invalid username `%s`", username))
@@ -317,17 +317,17 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 			credsOk = checkCredsBasic(user.Password, password)
 		}
 		if !credsOk {
-			// Because internal authentication failed, we can now try to use LDAP, if 
+			// Because internal authentication failed, we can now try to use LDAP, if
 			// it was enabled by the user.
 			ldapFQDN, err := c.dbc.GetSetting("ldap_fqdn")
-			
+
 			if ldapFQDN != "" && err == nil {
-				// The configuration page wouldn't allow these setting to not be set 
+				// The configuration page wouldn't allow these setting to not be set
 				// while LDAP is enabled (a FQDN/IP is set).
 				ldapPort, _ := c.dbc.GetSetting("ldap_port")
 				baseDN, _ := c.dbc.GetSetting("ldap_base_dn")
 				tls, _ := c.dbc.GetSetting("ldap_tls")
-				
+
 				// Now, we can try to connect to the LDAP server.
 				l, err := createLDAPconnection(tls, ldapFQDN, ldapPort)
 				if err != nil {
@@ -336,7 +336,7 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 					return
 				}
 				defer l.Close()
-				
+
 				// After we have a connection, let's try binding
 				_, err = l.SimpleBind(&ldap.SimpleBindRequest{
 					Username: fmt.Sprintf("uid=%s,%s", username, baseDN),
@@ -346,10 +346,10 @@ func (c *Controller) WithUser(next http.Handler) http.Handler {
 				if err == nil {
 					withUser := context.WithValue(r.Context(), CtxUser, user)
 					next.ServeHTTP(w, r.WithContext(withUser))
-          return
+					return
 				}
 			}
-			
+
 			_ = writeResp(w, r, spec.NewError(40, "invalid password"))
 			return
 		}

From 4799fb2441c02efa6d3ad1ed74b7b0344793354f Mon Sep 17 00:00:00 2001
From: Daniel <beta@hai.haus>
Date: Fri, 1 Dec 2023 12:31:24 -0800
Subject: [PATCH 33/64] Update `go-ldap/ldap` to v3

---
 go.mod                      |  6 +++---
 go.sum                      | 29 ++++++++++++++++++++---------
 server/ctrlsubsonic/ctrl.go |  2 +-
 3 files changed, 24 insertions(+), 13 deletions(-)

diff --git a/go.mod b/go.mod
index d2251dd0..1023eeb8 100644
--- a/go.mod
+++ b/go.mod
@@ -10,6 +10,7 @@ require (
 	github.com/dustin/go-humanize v1.0.1
 	github.com/fatih/structs v1.1.0
 	github.com/fsnotify/fsnotify v1.7.0
+	github.com/go-ldap/ldap/v3 v3.4.6
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
 	github.com/google/uuid v1.4.0
 	github.com/gorilla/securecookie v1.1.2
@@ -34,12 +35,12 @@ require (
 )
 
 require (
+	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver v1.5.0 // indirect
 	github.com/PuerkitoBio/goquery v1.8.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/felixge/httpsnoop v1.0.3 // indirect
-	github.com/go-ldap/ldap v3.0.3+incompatible // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.5 // indirect
 	github.com/go-openapi/jsonpointer v0.20.0 // indirect
 	github.com/go-openapi/swag v0.22.4 // indirect
 	github.com/gorilla/context v1.1.2 // indirect
@@ -62,7 +63,6 @@ require (
 	github.com/rivo/uniseg v0.4.4 // indirect
 	github.com/rogpeppe/go-internal v1.11.0 // indirect
 	github.com/ssor/bom v0.0.0-20170718123548-6386211fdfcf // indirect
-	gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d // indirect
 	golang.org/x/crypto v0.15.0 // indirect
 	golang.org/x/image v0.14.0 // indirect
 	golang.org/x/sys v0.14.0 // indirect
diff --git a/go.sum b/go.sum
index 9d71d3ee..97de4b58 100644
--- a/go.sum
+++ b/go.sum
@@ -1,4 +1,6 @@
 cloud.google.com/go v0.33.1/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
@@ -9,6 +11,8 @@ github.com/Masterminds/sprig v2.22.0+incompatible/go.mod h1:y6hNFY5UBTIWBxnzTeuN
 github.com/PuerkitoBio/goquery v1.5.1/go.mod h1:GsLWisAFVj4WgDibEWF4pvYnkVQBpKBKeU+7zCJoLcc=
 github.com/PuerkitoBio/goquery v1.8.1 h1:uQxhNlArOIdbrH1tr0UXwdVFgDcZDrZVdcpygAcwmWM=
 github.com/PuerkitoBio/goquery v1.8.1/go.mod h1:Q8ICL1kNUJ2sXGoAhPGUdYDJvgQgHzJsnnd3H7Ho5jQ=
+github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74 h1:Kk6a4nehpJ3UuJRqlA3JxYxBZEqCeOmATOvrbT4p9RA=
+github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
 github.com/andybalholm/cascadia v1.1.0/go.mod h1:GsXiBklL0woXo1j/WYWtSYYC4ouU9PqHO0sqidkEA4Y=
 github.com/andybalholm/cascadia v1.3.1/go.mod h1:R4bJ1UQfqADjvDa4P6HZHLh/3OxWWEqc0Sk8XGwHqvA=
 github.com/andybalholm/cascadia v1.3.2 h1:3Xi6Dw5lHF15JtdcmAHD3i1+T8plmv7BQ/nsViSLyss=
@@ -29,15 +33,12 @@ github.com/erikstmartin/go-testdb v0.0.0-20160219214506-8d10e4a1bae5 h1:Yzb9+7DP
 github.com/erikstmartin/go-testdb v0.0.0-20160219214506-8d10e4a1bae5/go.mod h1:a2zkGnVExMxdzMo3M0Hi/3sEU+cWnZpSni0O6/Yb/P0=
 github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=
 github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
-github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/felixge/httpsnoop v1.0.3 h1:s/nj+GCswXYzN5v2DpNMuMQYe+0DDwt5WVCU6CWBdXk=
-github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
-github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
-github.com/go-ldap/ldap v3.0.3+incompatible h1:HTeSZO8hWMS1Rgb2Ziku6b8a7qRIZZMHjsvuZyatzwk=
-github.com/go-ldap/ldap v3.0.3+incompatible/go.mod h1:qfd9rJvER9Q0/D/Sqn1DfHRoBp40uXYvFoEVrNEPqRc=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
+github.com/go-asn1-ber/asn1-ber v1.5.5 h1:MNHlNMBDgEKD4TcKr36vQN68BA00aDfjIt3/bD50WnA=
+github.com/go-asn1-ber/asn1-ber v1.5.5/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/go-ldap/ldap/v3 v3.4.6 h1:ert95MdbiG7aWo/oPYp9btL3KJlMPKnP58r09rI8T+A=
+github.com/go-ldap/ldap/v3 v3.4.6/go.mod h1:IGMQANNtxpsOzj7uUAMjpGBaOVTC4DYyIy8VsTdxmtc=
 github.com/go-openapi/jsonpointer v0.20.0 h1:ESKJdU9ASRfaPNOPRx12IUyA1vn3R9GiE3KYD14BXdQ=
 github.com/go-openapi/jsonpointer v0.20.0/go.mod h1:6PGzBjjIIumbLYysB73Klnms1mwnU4G3YHOECG3CedA=
 github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
@@ -55,6 +56,7 @@ github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
+github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.4.0 h1:MtMxsa51/r9yyhkyLsVeVt0B+BGQZzpQiTQ4eHZ8bc4=
 github.com/google/uuid v1.4.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
@@ -146,7 +148,10 @@ github.com/sentriz/gormstore v0.0.0-20220105134332-64e31f7f6981/go.mod h1:Rx8XB1
 github.com/ssor/bom v0.0.0-20170718123548-6386211fdfcf h1:pvbZ0lM0XWPBqUKqFU8cmavspvIl9nulOYwdy6IFRRo=
 github.com/ssor/bom v0.0.0-20170718123548-6386211fdfcf/go.mod h1:RJID2RhlZKId02nZ62WenDCkgHFerpIOmW0iT7GKmXM=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
@@ -155,6 +160,7 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191205180655-e7c4368fe9dd/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.15.0 h1:frVn1TEaCEaZcn3Tmd7Y2b5KKPaZ+I32Q2OA3kYp5TA=
 golang.org/x/crypto v0.15.0/go.mod h1:4ChreQoLWfG3xLDer1WdlH5NdlQ3+mwnQq1YTKY+72g=
 golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa h1:FRnLl4eNAQl8hwxVVC17teOw8kdjVDVAiFMtgUdTSRQ=
@@ -176,6 +182,7 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.18.0 h1:mIYleuAkSbHh0tCv7RvjL3F6ZVbLjq4+R7zbOn3Kokg=
 golang.org/x/net v0.18.0/go.mod h1:/czyP5RqHAH4odGYxBJ1qz0+CE5WZ+2j1YgoEo8F2jQ=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -193,18 +200,23 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.14.0 h1:Vz7Qs629MkJkGyHxUlRHizWJRG2j8fbQKjELVSNhy7Q=
 golang.org/x/sys v0.14.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -214,8 +226,6 @@ golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7 h1:9zdDQZ7Thm29KFXgAX/+yaf3eVbP7djjWp/dXAppNCc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/appengine v1.3.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d h1:TxyelI5cVkbREznMhfzycHdkp5cLA7DpE+GKjSslYhM=
-gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d/go.mod h1:cuepJuh7vyXfUyUwEgHQXw849cJrilpS5NeIjOWESAw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -226,6 +236,7 @@ gopkg.in/natefinch/npipe.v2 v2.0.0-20160621034901-c1b8fa8bdcce/go.mod h1:5AcXVHN
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 jaytaylor.com/html2text v0.0.0-20230321000545-74c2419ad056 h1:6YFJoB+0fUH6X3xU/G2tQqCYg+PkGtnZ5nMR5rpw72g=
diff --git a/server/ctrlsubsonic/ctrl.go b/server/ctrlsubsonic/ctrl.go
index f6732365..76d3ad0b 100644
--- a/server/ctrlsubsonic/ctrl.go
+++ b/server/ctrlsubsonic/ctrl.go
@@ -25,7 +25,7 @@ import (
 	"go.senan.xyz/gonic/server/ctrlsubsonic/spec"
 	"go.senan.xyz/gonic/transcode"
 
-	"github.com/go-ldap/ldap"
+	"github.com/go-ldap/ldap/v3"
 )
 
 type CtxKey int

From df42923f7be2a963e6e47df6b01aba66ba4b4126 Mon Sep 17 00:00:00 2001
From: Daniel <beta@hai.haus>
Date: Fri, 8 Dec 2023 23:04:13 -0800
Subject: [PATCH 34/64] Made LDAP query log message match others

---
 server/ctrlsubsonic/ctrl.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/ctrlsubsonic/ctrl.go b/server/ctrlsubsonic/ctrl.go
index 76d3ad0b..113b33ca 100644
--- a/server/ctrlsubsonic/ctrl.go
+++ b/server/ctrlsubsonic/ctrl.go
@@ -286,7 +286,7 @@ func (c *Controller) withUser(next http.Handler) http.Handler {
 
 				result, err := l.Search(searchReq)
 				if err != nil {
-					log.Println("failed to query LDAP:", err)
+					log.Println("failed to query LDAP server:", err)
 				}
 
 				if len(result.Entries) > 1 {

From 7c6e1957fb2c49f65ad3789d6831a05264ff420e Mon Sep 17 00:00:00 2001
From: Daniel <beta@hai.haus>
Date: Fri, 8 Dec 2023 23:10:06 -0800
Subject: [PATCH 35/64] Simplified code using gofmt

---
 server/ctrladmin/ctrl.go | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/server/ctrladmin/ctrl.go b/server/ctrladmin/ctrl.go
index 7331890f..d36a372e 100644
--- a/server/ctrladmin/ctrl.go
+++ b/server/ctrladmin/ctrl.go
@@ -292,13 +292,12 @@ type templateData struct {
 	DefaultListenBrainzURL string
 	SelectedUser           *db.User
 
-
-	CurrentBindUID		string
-	CurrentFQDN				string
-	CurrentPort				string
-	CurrentNoTLS			string
-	CurrentBaseDN			string
-	CurrentFilter			string
+	CurrentBindUID string
+	CurrentFQDN    string
+	CurrentPort    string
+	CurrentNoTLS   string
+	CurrentBaseDN  string
+	CurrentFilter  string
 
 	Podcasts              []*db.Podcast
 	InternetRadioStations []*db.InternetRadioStation

From 05149961b5b9b75c3d0249910b3bcd00822b3c84 Mon Sep 17 00:00:00 2001
From: Daniel <beta@hai.haus>
Date: Fri, 8 Dec 2023 23:15:10 -0800
Subject: [PATCH 36/64] Used `log` to log instead of `fmt`

---
 server/ctrlsubsonic/ctrl.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/ctrlsubsonic/ctrl.go b/server/ctrlsubsonic/ctrl.go
index 8c86c7b7..2bfd773f 100644
--- a/server/ctrlsubsonic/ctrl.go
+++ b/server/ctrlsubsonic/ctrl.go
@@ -303,7 +303,7 @@ func (c *Controller) withUser(next http.Handler) http.Handler {
 					}
 
 					if err := c.dbc.Create(&user).Error; err != nil {
-						fmt.Println("User created via LDAP:", username)
+						log.Println("User created via LDAP:", username)
 					}
 				} else {
 					_ = writeResp(w, r, spec.NewError(40, "invalid username `%s`", username))

From 90b5324179ee350db290c74171052464ec9a4603 Mon Sep 17 00:00:00 2001
From: Daniel <beta@hai.haus>
Date: Fri, 8 Dec 2023 23:15:51 -0800
Subject: [PATCH 37/64] `gofmt` handlers

---
 server/ctrladmin/handlers.go | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/server/ctrladmin/handlers.go b/server/ctrladmin/handlers.go
index 3c81b997..17efc6de 100644
--- a/server/ctrladmin/handlers.go
+++ b/server/ctrladmin/handlers.go
@@ -146,7 +146,7 @@ func (c *Controller) ServeLDAPConfig(_ *http.Request) *Response {
 	data.CurrentPort, _ = c.dbc.GetSetting("ldap_port")
 	data.CurrentBaseDN, _ = c.dbc.GetSetting("ldap_base_dn")
 	data.CurrentFilter, _ = c.dbc.GetSetting("ldap_filter")
-	
+
 	// This is to fix the fact that select boxes are strange.
 	currentTLS, _ := c.dbc.GetSetting("ldap_tls")
 	data.CurrentNoTLS = "selected"
@@ -157,7 +157,7 @@ func (c *Controller) ServeLDAPConfig(_ *http.Request) *Response {
 
 	return &Response{
 		template: "ldap.tmpl",
-		data: data,
+		data:     data,
 	}
 }
 
@@ -170,13 +170,13 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 	baseDN := r.FormValue("base_dn")
 	filter := r.FormValue("filter")
 
-	if bindUID == "" || bindPSWD == ""|| port == "" || baseDN == "" || filter == "" {
+	if bindUID == "" || bindPSWD == "" || port == "" || baseDN == "" || filter == "" {
 		return &Response{
 			redirect: r.Referer(),
 			flashW:   []string{"please provide a bind username and password, port, base CN, and filter"},
 		}
 	}
-	
+
 	err := c.dbc.SetSetting("ldap_bind_user", bindUID)
 	if err != nil {
 		log.Println("Failed to set bind user:", err)
@@ -186,8 +186,8 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 			flashW:   []string{"Failed to set bind user."},
 		}
 	}
-	
-  err = c.dbc.SetSetting("ldap_bind_user_password", bindPSWD)
+
+	err = c.dbc.SetSetting("ldap_bind_user_password", bindPSWD)
 	if err != nil {
 		log.Println("Failed to set bind user password:", err)
 
@@ -195,9 +195,9 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 			redirect: r.Referer(),
 			flashW:   []string{"Failed to set bind user password."},
 		}
-	}	
+	}
 
-  err = c.dbc.SetSetting("ldap_fqdn", fqdn)
+	err = c.dbc.SetSetting("ldap_fqdn", fqdn)
 	if err != nil {
 		log.Println("Failed to set server:", err)
 
@@ -207,7 +207,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}
 
-  err = c.dbc.SetSetting("ldap_port", port)
+	err = c.dbc.SetSetting("ldap_port", port)
 	if err != nil {
 		log.Println("Failed to set port:", err)
 
@@ -217,7 +217,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}
 
-  err = c.dbc.SetSetting("ldap_tls", tls)
+	err = c.dbc.SetSetting("ldap_tls", tls)
 	if err != nil {
 		log.Println("Failed to set TLS:", err)
 
@@ -227,7 +227,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}
 
-  err = c.dbc.SetSetting("ldap_base_dn", baseDN)
+	err = c.dbc.SetSetting("ldap_base_dn", baseDN)
 	if err != nil {
 		log.Println("Failed to set base DN:", err)
 
@@ -237,7 +237,7 @@ func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
 		}
 	}
 
-  err = c.dbc.SetSetting("ldap_filter", filter)
+	err = c.dbc.SetSetting("ldap_filter", filter)
 	if err != nil {
 		log.Println("Failed to set filter:", err)
 

From 408d325c2c15dd01ce100562cc19fc92031a86dc Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Sat, 17 Feb 2024 22:12:56 -0800
Subject: [PATCH 38/64] Move LDAP into a seperate file

---
 ldap/ldap.go                | 150 ++++++++++++++++++++++++++++++++++++
 server/ctrlsubsonic/ctrl.go | 135 +++-----------------------------
 2 files changed, 161 insertions(+), 124 deletions(-)
 create mode 100644 ldap/ldap.go

diff --git a/ldap/ldap.go b/ldap/ldap.go
new file mode 100644
index 00000000..fad30ea1
--- /dev/null
+++ b/ldap/ldap.go
@@ -0,0 +1,150 @@
+package ldap
+
+import (
+	"errors"
+	"fmt"
+	"log"
+
+	"go.senan.xyz/gonic/db"
+
+	"github.com/go-ldap/ldap/v3"
+)
+
+func CheckLDAPcreds(username string, password string, dbc *db.DB) (bool, error) {
+	err := createUserFromLDAP(username, password, dbc)
+	if err != nil {
+		return false, err
+	}
+
+	ldapFQDN, err := dbc.GetSetting("ldap_fqdn")
+
+	log.Println(err)
+	log.Println(ldapFQDN)
+
+	// This checks if LDAP is setup or not.
+	if ldapFQDN == "" || err != nil {
+		return false, err
+	}
+
+	// The configuration page wouldn't allow these setting to not be set
+	// while LDAP is enabled (a FQDN/IP is set).
+	ldapPort, _ := dbc.GetSetting("ldap_port")
+	baseDN, _ := dbc.GetSetting("ldap_base_dn")
+	tls, _ := dbc.GetSetting("ldap_tls")
+
+	// Now, we can try to connect to the LDAP server.
+	l, err := createLDAPconnection(tls, ldapFQDN, ldapPort)
+	if err != nil {
+		// Return a generic error.
+		log.Println("Failed to connect to LDAP server:", err)
+		return false, errors.New("Failed to connect to LDAP server.")
+	}
+	defer l.Close()
+
+	// After we have a connection, let's try binding
+	_, err = l.SimpleBind(&ldap.SimpleBindRequest{
+		Username: fmt.Sprintf("uid=%s,%s", username, baseDN),
+		Password: password,
+	})
+
+	if err == nil {
+		return true, nil
+	}
+
+	log.Println("Failed to bind to LDAP server:", err)
+	return false, nil
+}
+
+// Creates a user from creds
+func createUserFromLDAP(username string, password string, dbc *db.DB) error {
+	user := dbc.GetUserByName(username)
+	if user != nil {
+		return nil
+	}
+
+	ldapFQDN, err := dbc.GetSetting("ldap_fqdn")
+
+	// This is basically checking if LDAP is setup, if ldapFQDN isn't set we can
+	// assume that the user hasn't configured LDAP.
+	if ldapFQDN == "" {
+		return nil
+	} else if err != nil {
+		return err
+	}
+
+	// The configuration page wouldn't allow these setting to not be set
+	// while LDAP is enabled (a FQDN/IP is set).
+	bindUID, _ := dbc.GetSetting("ldap_bind_user")
+	bindPWD, _ := dbc.GetSetting("ldap_bind_user_password")
+	ldapPort, _ := dbc.GetSetting("ldap_port")
+	baseDN, _ := dbc.GetSetting("ldap_base_dn")
+	filter, _ := dbc.GetSetting("ldap_filter")
+	tls, _ := dbc.GetSetting("ldap_tls")
+
+	// Now, we can try to connect to the LDAP server.
+	l, err := createLDAPconnection(tls, ldapFQDN, ldapPort)
+	if err != nil {
+		// Return a generic error.
+		return errors.New("Failed to connect to LDAP server.")
+	}
+	defer l.Close()
+
+	// After we have a connection, let's try binding
+	_, err = l.SimpleBind(&ldap.SimpleBindRequest{
+		Username: fmt.Sprintf("uid=%s,%s", bindUID, baseDN),
+		Password: bindPWD,
+	})
+	if err != nil {
+		log.Println("Failed to bind to LDAP:", err)
+		return errors.New("Wrong username or password.")
+	}
+
+	searchReq := ldap.NewSearchRequest(
+		baseDN,
+		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
+		fmt.Sprintf("(&%s(uid=%s))", filter, ldap.EscapeFilter(username)),
+		[]string{"dn"},
+		nil,
+	)
+
+	result, err := l.Search(searchReq)
+	if err != nil {
+		log.Println("failed to query LDAP server:", err)
+	}
+
+	if len(result.Entries) > 1 {
+		return errors.New("Ambiguous user")
+	} else if len(result.Entries) == 1 {
+		user := db.User{
+			Name:     username,
+			Password: "", // no password because we want auth to fail.
+		}
+
+		if err := dbc.Create(&user).Error; err != nil {
+			log.Println("User created via LDAP:", username)
+		}
+
+		return nil
+	} else {
+		return errors.New("Invalid username")
+	}
+
+}
+
+// Creates a connection to an LDAP server.
+func createLDAPconnection(tls string, fqdn string, port string) (*ldap.Conn, error) {
+	protocol := "ldap"
+	if tls == "true" {
+		protocol = "ldaps"
+	}
+
+	// Now, we can try to connect to the LDAP server.
+	l, err := ldap.DialURL(fmt.Sprintf("%s://%s:%s", protocol, fqdn, port))
+	if err != nil {
+		// Warn the server and return a generic error.
+		log.Println("Failed to connect to LDAP server", err)
+		return nil, err
+	}
+
+	return l, nil
+}
diff --git a/server/ctrlsubsonic/ctrl.go b/server/ctrlsubsonic/ctrl.go
index 0f31f859..3618c4de 100644
--- a/server/ctrlsubsonic/ctrl.go
+++ b/server/ctrlsubsonic/ctrl.go
@@ -18,6 +18,7 @@ import (
 	"go.senan.xyz/gonic/infocache/artistinfocache"
 	"go.senan.xyz/gonic/jukebox"
 	"go.senan.xyz/gonic/lastfm"
+	"go.senan.xyz/gonic/ldap"
 	"go.senan.xyz/gonic/playlist"
 	"go.senan.xyz/gonic/podcast"
 	"go.senan.xyz/gonic/scanner"
@@ -25,8 +26,6 @@ import (
 	"go.senan.xyz/gonic/server/ctrlsubsonic/params"
 	"go.senan.xyz/gonic/server/ctrlsubsonic/spec"
 	"go.senan.xyz/gonic/transcode"
-
-	"github.com/go-ldap/ldap/v3"
 )
 
 type CtxKey int
@@ -243,143 +242,31 @@ func (c *Controller) withUser(next http.Handler) http.Handler {
 		}
 		user := c.dbc.GetUserByName(username)
 
-		newLDAPUser := false
-		if user == nil {
-			newLDAPUser = true
-
-			// Because the user wasn't found we can now try
-			// to use LDAP.
-			ldapFQDN, err := c.dbc.GetSetting("ldap_fqdn")
-
-			if ldapFQDN != "" && err == nil {
-				// The configuration page wouldn't allow these setting to not be set
-				// while LDAP is enabled (a FQDN/IP is set).
-				bindUID, _ := c.dbc.GetSetting("ldap_bind_user")
-				bindPWD, _ := c.dbc.GetSetting("ldap_bind_user_password")
-				ldapPort, _ := c.dbc.GetSetting("ldap_port")
-				baseDN, _ := c.dbc.GetSetting("ldap_base_dn")
-				filter, _ := c.dbc.GetSetting("ldap_filter")
-				tls, _ := c.dbc.GetSetting("ldap_tls")
-
-				// Now, we can try to connect to the LDAP server.
-				l, err := createLDAPconnection(tls, ldapFQDN, ldapPort)
-				if err != nil {
-					// Return a generic error.
-					_ = writeResp(w, r, spec.NewError(0, "Failed to connect to LDAP server."))
-					return
-				}
-				defer l.Close()
-
-				// After we have a connection, let's try binding
-				_, err = l.SimpleBind(&ldap.SimpleBindRequest{
-					Username: fmt.Sprintf("uid=%s,%s", bindUID, baseDN),
-					Password: bindPWD,
-				})
-				if err != nil {
-					log.Println("Failed to bind to LDAP:", err)
-					_ = writeResp(w, r, spec.NewError(40, "Wrong username or password."))
-					return
-				}
-
-				searchReq := ldap.NewSearchRequest(
-					baseDN,
-					ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
-					fmt.Sprintf("(&%s(uid=%s))", filter, ldap.EscapeFilter(username)),
-					[]string{"dn"},
-					nil,
-				)
-
-				result, err := l.Search(searchReq)
-				if err != nil {
-					log.Println("failed to query LDAP server:", err)
-				}
-
-				if len(result.Entries) > 1 {
-					_ = writeResp(w, r, spec.NewError(40, "Ambiguous user: `%s`", username))
-				} else if len(result.Entries) == 1 {
-					user := db.User{
-						Name:     username,
-						Password: "", // no password because we want auth to fail.
-					}
-
-					if err := c.dbc.Create(&user).Error; err != nil {
-						log.Println("User created via LDAP:", username)
-					}
-				} else {
-					_ = writeResp(w, r, spec.NewError(40, "invalid username `%s`", username))
-					return
-				}
-			} else {
-				_ = writeResp(w, r, spec.NewError(40,
-					"invalid username `%s`", username))
-				return
-			}
-		}
 		var credsOk bool
-		if tokenAuth && !newLDAPUser && user != nil {
+		if tokenAuth && user != nil {
 			credsOk = checkCredsToken(user.Password, token, salt)
-		} else if !newLDAPUser && user != nil {
+		} else if user != nil {
 			credsOk = checkCredsBasic(user.Password, password)
 		}
 		if !credsOk {
 			// Because internal authentication failed, we can now try to use LDAP, if
 			// it was enabled by the user.
-			ldapFQDN, err := c.dbc.GetSetting("ldap_fqdn")
-
-			if ldapFQDN != "" && err == nil {
-				// The configuration page wouldn't allow these setting to not be set
-				// while LDAP is enabled (a FQDN/IP is set).
-				ldapPort, _ := c.dbc.GetSetting("ldap_port")
-				baseDN, _ := c.dbc.GetSetting("ldap_base_dn")
-				tls, _ := c.dbc.GetSetting("ldap_tls")
-
-				// Now, we can try to connect to the LDAP server.
-				l, err := createLDAPconnection(tls, ldapFQDN, ldapPort)
-				if err != nil {
-					// Return a generic error.
-					_ = writeResp(w, r, spec.NewError(0, "Failed to connect to LDAP server."))
-					return
-				}
-				defer l.Close()
-
-				// After we have a connection, let's try binding
-				_, err = l.SimpleBind(&ldap.SimpleBindRequest{
-					Username: fmt.Sprintf("uid=%s,%s", username, baseDN),
-					Password: password,
-				})
-
-				if err == nil {
-					withUser := context.WithValue(r.Context(), CtxUser, user)
-					next.ServeHTTP(w, r.WithContext(withUser))
-					return
-				}
+			ok, err := ldap.CheckLDAPcreds(username, password, c.dbc)
+			if err != nil {
+				_ = writeResp(w, r, spec.NewError(40, err.Error()))
+				return
 			}
 
-			_ = writeResp(w, r, spec.NewError(40, "invalid password"))
-			return
+			if !ok {
+				_ = writeResp(w, r, spec.NewError(40, "invalid password"))
+				return
+			}
 		}
 		withUser := context.WithValue(r.Context(), CtxUser, user)
 		next.ServeHTTP(w, r.WithContext(withUser))
 	})
 }
 
-func createLDAPconnection(tls string, fqdn string, port string) (*ldap.Conn, error) {
-	protocol := "ldap"
-	if tls == "true" {
-		protocol = "ldaps"
-	}
-
-	// Now, we can try to connect to the LDAP server.
-	l, err := ldap.DialURL(fmt.Sprintf("%s://%s:%s", protocol, fqdn, port))
-	if err != nil {
-		// Warn the server and return a generic error.
-		log.Println("Failed to connect to LDAP server", err)
-		return nil, err
-	}
-
-	return l, nil
-}
-
 func slow(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		rc := http.NewResponseController(w)  //nolint:bodyclose

From 6301cb25bcca8edae98f937aa96fd46872c30a59 Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Sat, 17 Feb 2024 22:13:52 -0800
Subject: [PATCH 39/64] Fix `User` struct from having `not null` passwords This
 is required for LDAP auth to work, blank passwords don't work anyway.

---
 db/db.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/db/db.go b/db/db.go
index 0b60c084..8db0fcac 100644
--- a/db/db.go
+++ b/db/db.go
@@ -290,7 +290,7 @@ type User struct {
 	ID                int `gorm:"primary_key"`
 	CreatedAt         time.Time
 	Name              string `gorm:"not null; unique_index" sql:"default: null"`
-	Password          string `gorm:"not null" sql:"default: null"`
+	Password          string `sql:"default: null"`
 	LastFMSession     string `sql:"default: null"`
 	ListenBrainzURL   string `sql:"default: null"`
 	ListenBrainzToken string `sql:"default: null"`

From fdceb555bf6252906a0d48e012776586f4e78af4 Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Sat, 17 Feb 2024 22:23:12 -0800
Subject: [PATCH 40/64] Removed unused logs

---
 ldap/ldap.go | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/ldap/ldap.go b/ldap/ldap.go
index fad30ea1..4430e917 100644
--- a/ldap/ldap.go
+++ b/ldap/ldap.go
@@ -18,9 +18,6 @@ func CheckLDAPcreds(username string, password string, dbc *db.DB) (bool, error)
 
 	ldapFQDN, err := dbc.GetSetting("ldap_fqdn")
 
-	log.Println(err)
-	log.Println(ldapFQDN)
-
 	// This checks if LDAP is setup or not.
 	if ldapFQDN == "" || err != nil {
 		return false, err

From f6ecd6d39b0a46bd2f8ae590021533ccb0071277 Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Sat, 17 Feb 2024 22:23:38 -0800
Subject: [PATCH 41/64] Added dashboard login for LDAP users

---
 server/ctrladmin/handlers_raw.go | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/server/ctrladmin/handlers_raw.go b/server/ctrladmin/handlers_raw.go
index 49d9e2a8..185fea7e 100644
--- a/server/ctrladmin/handlers_raw.go
+++ b/server/ctrladmin/handlers_raw.go
@@ -4,6 +4,7 @@ import (
 	"net/http"
 
 	"github.com/gorilla/sessions"
+	"go.senan.xyz/gonic/ldap"
 )
 
 func (c *Controller) ServeLoginDo(w http.ResponseWriter, r *http.Request) {
@@ -18,10 +19,18 @@ func (c *Controller) ServeLoginDo(w http.ResponseWriter, r *http.Request) {
 	}
 	user := c.dbc.GetUserByName(username)
 	if user == nil || password != user.Password {
-		sessAddFlashW(session, []string{"invalid username / password"})
-		sessLogSave(session, w, r)
-		http.Redirect(w, r, r.Referer(), http.StatusSeeOther)
-		return
+		// Because internal authentication failed, we can now try to use LDAP, if
+		// it was enabled by the user.
+		ok, err := ldap.CheckLDAPcreds(username, password, c.dbc)
+		if err != nil {
+			sessAddFlashW(session, []string{err.Error()})
+		} else if !ok {
+			sessAddFlashW(session, []string{"invalid username / password"})
+
+			sessLogSave(session, w, r)
+			http.Redirect(w, r, r.Referer(), http.StatusSeeOther)
+			return
+		}
 	}
 	// put the user name into the session. future endpoints after this one
 	// are wrapped with WithUserSession() which will get the name from the

From bc62b213a559e0ee432fa743244c9ca45059fd43 Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Sat, 17 Feb 2024 22:27:08 -0800
Subject: [PATCH 42/64] Lower-cased and removed punctuation for errors Fixes
 linting

---
 ldap/ldap.go | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/ldap/ldap.go b/ldap/ldap.go
index 4430e917..fb876a2c 100644
--- a/ldap/ldap.go
+++ b/ldap/ldap.go
@@ -34,7 +34,7 @@ func CheckLDAPcreds(username string, password string, dbc *db.DB) (bool, error)
 	if err != nil {
 		// Return a generic error.
 		log.Println("Failed to connect to LDAP server:", err)
-		return false, errors.New("Failed to connect to LDAP server.")
+		return false, errors.New("failed to connect to LDAP server")
 	}
 	defer l.Close()
 
@@ -82,7 +82,7 @@ func createUserFromLDAP(username string, password string, dbc *db.DB) error {
 	l, err := createLDAPconnection(tls, ldapFQDN, ldapPort)
 	if err != nil {
 		// Return a generic error.
-		return errors.New("Failed to connect to LDAP server.")
+		return errors.New("failed to connect to LDAP server")
 	}
 	defer l.Close()
 
@@ -93,7 +93,7 @@ func createUserFromLDAP(username string, password string, dbc *db.DB) error {
 	})
 	if err != nil {
 		log.Println("Failed to bind to LDAP:", err)
-		return errors.New("Wrong username or password.")
+		return errors.New("wrong username or password")
 	}
 
 	searchReq := ldap.NewSearchRequest(
@@ -110,7 +110,7 @@ func createUserFromLDAP(username string, password string, dbc *db.DB) error {
 	}
 
 	if len(result.Entries) > 1 {
-		return errors.New("Ambiguous user")
+		return errors.New("ambiguous user")
 	} else if len(result.Entries) == 1 {
 		user := db.User{
 			Name:     username,
@@ -123,7 +123,7 @@ func createUserFromLDAP(username string, password string, dbc *db.DB) error {
 
 		return nil
 	} else {
-		return errors.New("Invalid username")
+		return errors.New("invalid username")
 	}
 
 }

From 683525aad2840d674ae480201db1624491909670 Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Sat, 17 Feb 2024 22:27:57 -0800
Subject: [PATCH 43/64] Removed unused password parameter from
 `createUserFromLDAP`

---
 ldap/ldap.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ldap/ldap.go b/ldap/ldap.go
index fb876a2c..a121b7c7 100644
--- a/ldap/ldap.go
+++ b/ldap/ldap.go
@@ -11,7 +11,7 @@ import (
 )
 
 func CheckLDAPcreds(username string, password string, dbc *db.DB) (bool, error) {
-	err := createUserFromLDAP(username, password, dbc)
+	err := createUserFromLDAP(username, dbc)
 	if err != nil {
 		return false, err
 	}
@@ -53,7 +53,7 @@ func CheckLDAPcreds(username string, password string, dbc *db.DB) (bool, error)
 }
 
 // Creates a user from creds
-func createUserFromLDAP(username string, password string, dbc *db.DB) error {
+func createUserFromLDAP(username string, dbc *db.DB) error {
 	user := dbc.GetUserByName(username)
 	if user != nil {
 		return nil

From ac31258f8857f5fadf275785eecf1096716c95e6 Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Sat, 17 Feb 2024 22:29:29 -0800
Subject: [PATCH 44/64] Removed unnecessary trailing newline

---
 ldap/ldap.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/ldap/ldap.go b/ldap/ldap.go
index a121b7c7..2f710e88 100644
--- a/ldap/ldap.go
+++ b/ldap/ldap.go
@@ -125,7 +125,6 @@ func createUserFromLDAP(username string, dbc *db.DB) error {
 	} else {
 		return errors.New("invalid username")
 	}
-
 }
 
 // Creates a connection to an LDAP server.

From 8793a3636495a1726b1be2a0b3870cf54c9c9869 Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Sat, 17 Feb 2024 22:38:19 -0800
Subject: [PATCH 45/64] Rewrote if-else to switch for LDAP results

---
 ldap/ldap.go | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/ldap/ldap.go b/ldap/ldap.go
index 2f710e88..2f8d888e 100644
--- a/ldap/ldap.go
+++ b/ldap/ldap.go
@@ -109,9 +109,8 @@ func createUserFromLDAP(username string, dbc *db.DB) error {
 		log.Println("failed to query LDAP server:", err)
 	}
 
-	if len(result.Entries) > 1 {
-		return errors.New("ambiguous user")
-	} else if len(result.Entries) == 1 {
+	switch len(result.Entries) {
+	case 1:
 		user := db.User{
 			Name:     username,
 			Password: "", // no password because we want auth to fail.
@@ -122,8 +121,10 @@ func createUserFromLDAP(username string, dbc *db.DB) error {
 		}
 
 		return nil
-	} else {
+	case 0:
 		return errors.New("invalid username")
+	default:
+		return errors.New("ambiguous user")
 	}
 }
 

From 0d85e0ce02ab2c9424c9a4dc698163d6519a80c2 Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Sun, 18 Feb 2024 09:44:26 -0800
Subject: [PATCH 46/64] Stopped opening up a second connection when creating a
 user from LDAP

---
 ldap/ldap.go | 23 +++++++----------------
 1 file changed, 7 insertions(+), 16 deletions(-)

diff --git a/ldap/ldap.go b/ldap/ldap.go
index 2f8d888e..24e84dae 100644
--- a/ldap/ldap.go
+++ b/ldap/ldap.go
@@ -11,11 +11,6 @@ import (
 )
 
 func CheckLDAPcreds(username string, password string, dbc *db.DB) (bool, error) {
-	err := createUserFromLDAP(username, dbc)
-	if err != nil {
-		return false, err
-	}
-
 	ldapFQDN, err := dbc.GetSetting("ldap_fqdn")
 
 	// This checks if LDAP is setup or not.
@@ -38,6 +33,12 @@ func CheckLDAPcreds(username string, password string, dbc *db.DB) (bool, error)
 	}
 	defer l.Close()
 
+	// Create the user if it doesn't exist on the database already.
+	err = createUserFromLDAP(username, dbc, l)
+	if err != nil {
+		return false, err
+	}
+
 	// After we have a connection, let's try binding
 	_, err = l.SimpleBind(&ldap.SimpleBindRequest{
 		Username: fmt.Sprintf("uid=%s,%s", username, baseDN),
@@ -53,7 +54,7 @@ func CheckLDAPcreds(username string, password string, dbc *db.DB) (bool, error)
 }
 
 // Creates a user from creds
-func createUserFromLDAP(username string, dbc *db.DB) error {
+func createUserFromLDAP(username string, dbc *db.DB, l *ldap.Conn) error {
 	user := dbc.GetUserByName(username)
 	if user != nil {
 		return nil
@@ -73,18 +74,8 @@ func createUserFromLDAP(username string, dbc *db.DB) error {
 	// while LDAP is enabled (a FQDN/IP is set).
 	bindUID, _ := dbc.GetSetting("ldap_bind_user")
 	bindPWD, _ := dbc.GetSetting("ldap_bind_user_password")
-	ldapPort, _ := dbc.GetSetting("ldap_port")
 	baseDN, _ := dbc.GetSetting("ldap_base_dn")
 	filter, _ := dbc.GetSetting("ldap_filter")
-	tls, _ := dbc.GetSetting("ldap_tls")
-
-	// Now, we can try to connect to the LDAP server.
-	l, err := createLDAPconnection(tls, ldapFQDN, ldapPort)
-	if err != nil {
-		// Return a generic error.
-		return errors.New("failed to connect to LDAP server")
-	}
-	defer l.Close()
 
 	// After we have a connection, let's try binding
 	_, err = l.SimpleBind(&ldap.SimpleBindRequest{

From c531666eb6e000f9a4fb6987598cde123985f764 Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Mon, 1 Apr 2024 10:13:33 -0700
Subject: [PATCH 47/64] Bump LDAP deps

---
 go.sum | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/go.sum b/go.sum
index 339b554d..0aa30071 100644
--- a/go.sum
+++ b/go.sum
@@ -1,4 +1,6 @@
 cloud.google.com/go v0.33.1/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
+github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
 github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
@@ -8,6 +10,7 @@ github.com/Masterminds/sprig v2.22.0+incompatible/go.mod h1:y6hNFY5UBTIWBxnzTeuN
 github.com/PuerkitoBio/goquery v1.5.1/go.mod h1:GsLWisAFVj4WgDibEWF4pvYnkVQBpKBKeU+7zCJoLcc=
 github.com/PuerkitoBio/goquery v1.9.0 h1:zgjKkdpRY9T97Q5DCtcXwfqkcylSFIVCocZmn2huTp8=
 github.com/PuerkitoBio/goquery v1.9.0/go.mod h1:cW1n6TmIMDoORQU5IU/P1T3tGFunOeXEpGP2WHRwkbY=
+github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
 github.com/andybalholm/cascadia v1.1.0/go.mod h1:GsXiBklL0woXo1j/WYWtSYYC4ouU9PqHO0sqidkEA4Y=
 github.com/andybalholm/cascadia v1.3.2 h1:3Xi6Dw5lHF15JtdcmAHD3i1+T8plmv7BQ/nsViSLyss=
 github.com/andybalholm/cascadia v1.3.2/go.mod h1:7gtRlve5FxPPgIgX36uWBX58OdBsSS6lUvCFb+h7KvU=
@@ -50,6 +53,7 @@ github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
+github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
@@ -151,6 +155,7 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191205180655-e7c4368fe9dd/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.20.0 h1:jmAMJJZXr5KiCw05dfYK9QnqaqKLYXijU23lsEdcQqg=
 golang.org/x/crypto v0.20.0/go.mod h1:Xwo95rrVNIoSMx9wa1JroENMToLWn3RNVrTBpLHgZPQ=
 golang.org/x/exp v0.0.0-20240222234643-814bf88cf225 h1:LfspQV/FYTatPTr/3HzIcmiUFH7PGP+OQ6mgDYo3yuQ=
@@ -170,6 +175,7 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.21.0 h1:AQyQV4dYCvJ7vGmJyKki9+PBdyvhkSd8EIx/qb0AYv4=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -186,6 +192,8 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=

From 3cf6d0a28b44ad8fb2ccf3c4b9e0b3e0a7c7d56c Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Mon, 1 Apr 2024 10:33:59 -0700
Subject: [PATCH 48/64] Added LDAP config

---
 cmd/gonic/gonic.go      |  17 +++++++++++++++++
 gonic.db.1711991474.bak | Bin 0 -> 208896 bytes
 ldap/ldap.go            |  11 +++++++++++
 3 files changed, 28 insertions(+)
 create mode 100644 gonic.db.1711991474.bak

diff --git a/cmd/gonic/gonic.go b/cmd/gonic/gonic.go
index 3235e1d7..81f9e223 100644
--- a/cmd/gonic/gonic.go
+++ b/cmd/gonic/gonic.go
@@ -47,6 +47,7 @@ import (
 	"go.senan.xyz/gonic/tags/tagcommon"
 	"go.senan.xyz/gonic/tags/taglib"
 	"go.senan.xyz/gonic/transcode"
+  "go.senan.xyz/gonic/ldap"
 )
 
 func main() {
@@ -82,6 +83,22 @@ func main() {
 
 	confExcludePattern := flag.String("exclude-pattern", "", "regex pattern to exclude files from scan (optional)")
 
+  var ldapConfig ldap.Config
+  flag.StringVar(&ldapConfig.BindUser, "ldap-bind-user", "", "the bind user to bind to LDAP with (required for LDAP)")
+	flag.StringVar(&ldapConfig.BindPass, "ldap-bind-pass", "", "the password of the LDAP bind user (required for LDAP)")
+	flag.StringVar(&ldapConfig.BaseDN, "ldap-base-dn", "", "the base DN for LDAP objects (required for LDAP)")
+  flag.StringVar(&ldapConfig.Filter, "ldap-filter", "(uid=*)", "the filter to select LDAP objects with (optional)")
+
+	flag.StringVar(&ldapConfig.FQDN, "ldap-fqdn", "", "the name of the server to connect to (required for LDAP)")
+	flag.UintVar(&ldapConfig.Port, "ldap-port", 389, "what port the LDAP server is hosted on (optional)")
+  flag.BoolVar(&ldapConfig.TLS, "ldap-tls", false, "whether gonic will connect to the LDAP server using TLS (optional)")
+
+  if ldapConfig.FQDN != "" {
+    if ldapConfig.BindUser == "" || ldapConfig.BindPass == "" || ldapConfig.BaseDN == "" {
+      log.Fatal("a server was provided for an LDAP connection, but configuration is incomplete")
+    }
+  }
+
 	var confMultiValueGenre, confMultiValueArtist, confMultiValueAlbumArtist multiValueSetting
 	flag.Var(&confMultiValueGenre, "multi-value-genre", "setting for mutli-valued genre scanning (optional)")
 	flag.Var(&confMultiValueArtist, "multi-value-artist", "setting for mutli-valued track artist scanning (optional)")
diff --git a/gonic.db.1711991474.bak b/gonic.db.1711991474.bak
new file mode 100644
index 0000000000000000000000000000000000000000..5fbd15305c7b235359f0af5ec0df257af876b08c
GIT binary patch
literal 208896
zcmeI*-*4Q;fd}xVe(dTe>EDc^x*5??B*v?FxsswNd1yBBy75Jp9a(DPm-47xS|Ys5
zU6Wkf3eYqwI|n2MirjM#xB~auEAn1kP@o6g(>1{z`c~iyT>pUH!=-oV!`*QBW652v
zEalW7xBC^G)y{A@<a}m0!{N}*?YGwrM<;h{R#kJzV(L_CU?BB6A*ob~qyH_^|AHSk
zJQM`zZ#Vq3A1?LMgO7%3ssZ6kH|-VSPr{e{o0H{<-%q5*KN$OTyf~7|{5btt=JxP!
z()+{w(9Z|w2EG^=82H=N=TFN#Vf#VunT#lk+>`G(+D=8USG0YbeN3%w77JTNvQ>Cv
zy+|Y$Cy{x{C`-gJ9er1~NZm53nzc{v>H9=$I5op8S$b7BovhTbbxZZrlFj0^;%0GU
zt$3Tb@%Fq?mdVWxa<#Z#q=#55++HhOEs~9!TV!K<eVxz^*9zO~TZEX6N+m04m7PX4
zDL1y^*x5NoRhLLvb9DDx`@u@JhUtW5%t{sA+;#TC2qHJ1y^s+vUgQokjLg;@$1r#8
z;I|lu3!+^+>Lif|npN7<toi)%vfRDM541{yo@6X>Ooe30t<CE<3Y&MxTg5wm=CXW6
zOp9w5xs+j+^+)#o3T>;ZS2Z-O1}CE`!MA6&&!<IM<o4MP4dao@YDhJ;s?NS$@Qbs(
zasBP>BDubCwfHWHr*o^4Rk$t9OYV-6Odb!NW9{n0U53Q6Vjt(@JS^@Q?TR)qT5n}l
zqg52tVAeZm9II<%s%y6Wux8O_+#Q$Jx@J4--6|EcZKGyBC9z>Ux~cA1nqj`DHmu5V
zk~_6~`cv{ZY*i~)4Vr4FR;#o(SnYx4Xcpa8sqMtK5&8RPGvdND*W|+L)hvget<5Uf
z|9-Ap6-U#uO7<gK)!e*#CL>Nya|bG`W`Dc?>ukKLgPo7wiLka5ucn|{y*gJLYFRHG
zuB|=LEp1m<EzP}5B|;le8zH@<XHI2AMd6y&NHJ8cUe`5CGfTSdoqIIqbW-7>3EW2Q
z?-uDZ+d4D18*RUkTRTM(%ktXkwD^wF?aJ;vK~?FDJJUSFXT-TVu37R5$~smro$d9q
zen4m|UNqrJmuyu?i#O)FmMnT`TBvC7RDCidE>3aH8P>jy@+0+btx~2#&s~G|+q5fk
zEUk3U=95}@LTc8?y<KP<5Au+*Bp88Y^5McnMx2`BK3-;mUSjWaGH&MQbM)q(+_yFA
zZa>%F<Avvze0g*Xp+Wj1T``O}VetNH!>w(+M@O>Yo*_1fb&jrWn|BPV=yc!R(RNkG
za4Lrmm02lFc9i0?#BQ@uy=&p{?xmI5Y*cr2+7EXrshhBD*d_G{>HLwzt%Ab_sUvl5
zXU3veJZqGG!R%OIJfZal3EeB+OC0aY*jN(Wm?iaP;ZC$G3lq!o>iA(-eC)JTB^I1`
ze>5Ym%yP|z@QM$vO?6i{EuEf?7r{dIShp*`V=r%jV@==NRhkddWJ!><Oq$wAMx34H
z9uG%)P;ZCmaYy5t(M_!TJlRVuI6c<*qPN@Li5>5Lo5=5H+Kq#H42``AFZ+>h#vOaL
z`d2R_dczo`i5sV*#?fO%zh~mc(M=r<Hj2U$9(&es!p3)o)8geR?g!zGnP<uF%e=4Y
zBv$v%JCc%tdg0bh*{va(^=0l3YoPudz}D|KboWlin-T=U;TU1t#(8%D&C;ZDV~~w`
z%_7UvJD&GB6w5&JPvz)i-XXVmMBe7o;>-;9kR7#Z?7FvbHPdc=8;Bjf6;Ei3C*Lb<
zuDw~<^d?%7xstp%kQTo?)9rqvm5Zu`-|5Wx;tc(mJ~v4}MgEhN@CV^{!WY6Xg-?Z_
z3ZDoc2zB8vg<HbwLQWvUDIvxGf&U%<1^-L_Q~swkIes7j0SG_<0uX=z1Rwwb2tWV=
z|0e-n9GK1L@_EJm$t|z&7rbz8CBLjFORw<f{qW05PFcz?^XGzaPElUYzrvsO!%O*<
z+-h!-KjVk<`6VT<yuzOj!fq(H%AX3txz&75S>y#jtmKyR`Nfxco`v0$$t$bN3P0(G
zbGapDaWThFcwu*|vP92sJP79&X(@92m>+h_v%I*%j|Sn~E3`bT{0Ix@=-DjO^Ld%i
zc;VdAVlJPf;j|xKr02g(&v!To(>>hd4~1bx$>;O@pdY5^LxXvKAQH|gt2`G8E4kbl
ztu2v%FD3jNeFE@n;U9#b2|p1&7WRcb;T_?cuq-?;oD~N6|Ddz~&-u^zzvusk{}D}&
z9|%AI0uX=z1Rwwb2tWV=5P-lD1x^jla?zQ-7(@h9{R?4)Ki5Csitr};=fVhowtqH^
z@TdD{S`prS|8y(DoA93sBm5b^;77Ek{9%MY=bsEBf=T~GE5e)gkB1Tdw12D>;m!L;
z{fKblKN3U)GyhB&;ZOb3tq5=KKOBi*lmDSG!k_&Q#v<tSe?S<V9i{3y_tfd*iJZIs
zPha}S4+J0p0SG_<0uX=z1Rwwb2tWV=JuKkP|2g`1^S!^G-@^q((I5Z;2tWV=5P$##
zAOHafKmY=LCosYdilgk`Ds$ie$NGQYH2@SC0uX=z1Rwwb2tWV=5P$##`b+@t|Myvi
zqqq=&00bZa0SG_<0uX=z1R&6t0$Bg=%W6lVApijgKmY;|fB*y_009U<pw9%b{@-U6
zj^aW90uX=z1Rwwb2tWV=5P(2m3Sj-eFRLAeh5!U0009U<00Izz00bZafj$$!`hTBQ
zIEo7a2tWV=5P$##AOHafKmY=LDS-9=zN~f>8Uhf200bZa0SG_<0uX=z1o}(>>;HXL
z;V3QyAOHafKmY;|fB*y_009W}r2y9d`?A_mXb3<60uX=z1Rwwb2tWV=5a=@jtpE2}
zg`>C-fB*y_009U<00Izz00bb=mjYP-@5^dOp&<YP2tWV=5P$##AOHafK%mbAu>Rj?
z6^`OU00Izz00bZa0SG_<0uX>eUkYITzb~sDg@ynGAOHafKmY;|fB*y_0D(Re!1{lm
zRXB<Z0SG_<0uX=z1Rwwb2tWV=eJOzT|Gunt6dD2$fB*y_009U<00Izz00jC>z+M06
zgnvrWKlp(F1Rwwb2tWV=5P$##AOHafK;WA#u)>X{Zi^y4$<b6kmtR`Q(LV}Na<3}N
ztIE<#tIJC-ufDRZC=0ojS93Y7Ts2Jg;jaI4!XH!g4}Ks30SG_<0uX=z1Rwwb2tWV=
z5a=y|kwI~k&HwTD|9h)qQ5pz900Izz00bZa0SG_<0uX>ek^uhxf07E~AOHafKmY;|
zfB*y_009U<00O-wfc5|0s!x;#0uX=z1Rwwb2tWV=5P$##Adn=0_5UOl#6bW85P$##
zAOHafKmY;|fB*z~OJGv?uhhB0xs*^5e#QSM|9AYGljVuuPo%~_82fa*IFiczIQ`%0
z&(hBh|7MsU`uX78z!w9H0|TkgQ;&}AaFBZ@BZ?yT<U5YGvptm-uZWy&m}UKuQGTS>
zE84!THf-HejWP>7yS7;@Y!%7%jjP3XNk<xTbAw1Mp)~LBCX?7PDmvTDKBoN4whC{o
z7lZxCykwLmVwjG;t6QXQ8CA{NC-?MyqBWeFVU{ets+&$$@(;k$lFj0^;%0GUt$3Tb
z@%Fq?mff?tT3j#E^Ia?4UMpNJl8u{NWMg}MozM-}3ft>jgqV#=B`ax_oko?GvLiRP
z;n>+ZMpc(cS#xyvTl>LEwT9`0Wz0$y-Q0Ed!U!T?5!2$@MJ~l^!oFWI99{KFPiscC
zb;mKxU0YRxZ_hNJy^s+vUgQokv>q#Z5Fh*&<I+L2M6oHXL>_2XX-~7}^UKR}ccTYd
zr9n#-OB`b)S#oRh`i;Wo9r9N3j-R<KZ=X+#vdHbT(lm@mtVP+Xsa17WR~P)V+upeT
z_IA*=;^|n!Vu_`B$=y+s$>X7OtnGfd%gW5QvXAre(t5icy<O1;M(eGtYP5=i8q9hJ
zjhDS^W2$Sm{jg@y#?;-4*1Bdp>fI`>PTMwW=2H?IwxgTsj-?sqduqd~94EO`yQe=T
zf5TSUzda(6om#EZ-e9!{nxk2CTcx%W-$vx`pUsF1(_E7at5>redbVB#``^!XtKw){
zR>^)utD2iv&t$~uY3@K})$DKgf1Qn2b+Gf%E1R{Ycr^vp>ead0P|JGhaBb~@ZfU!^
zYH99uDG}O$+6alfb~-J-qjbBZy%SfpdR^Bn%`EBk;_i$))0{b#5fz1NRwEYCy*l?f
zog@_9#q9+A-69=tTaW1W#qAe&Yo|zJSzZ;=;*Ghk1!euLx2s#mXz*0?44)C_=D23b
zD_(SCETzy^sA$5IE>C?jBQ8#H&6#jmyj!c3>5zEWp#3)OiX2NT-Lv_m7VZv^ZK+u!
z_jaLeJjg@Jl3)aq$%hLQ8F6Zg`*@i#c!|Bw$#}v2e2(7Sll!(t-R<Yvd%W=6k}r>r
zAv8#Tq$`Hi*oh6dw(%Yvn1XwT*qGEgy0&fJF{q-`eRoIORUN~r96Iu4r7+o1iq8_e
z%|`XEgu}a+R%)|R-O*`3+@+*$!m?qP)FY(xM-sOR4jZJ7(zP|uj72Y7)+qgg*|ETQ
zLhB6@x|gk&INl4fu_U-LOX`NgooFu<CZ^rc_+i~p?6g!R7Mys0G$XFea?OSCiVv<$
zbyqhnot}*s!9w;}w=2J6FK>WjP2by9nh(-sNszTnn%YQ4oSo$!4@bH|Z-?k{N8_5&
zO{@<**-I=qJ=XZ5x7*%{9q)dd$nR&`je~j&jlBpj`;l(O9ecI<S1%)5nh(;%jnh%%
z=&_>TGjZeSrj7<1MPUh#J!?2&<2%D?@$wY+gYd@8vt&2k-q&;zt9$1iNy$LHaO<Y*
z))3A5GIxhHP=A7A>-QVFd+XxOSAyVhjIeFvygPtqX;Qf{$i}>8k!9%}&-)yTWgz*d
za`Z9pkXt+=Z*ysJW`=vnj#@Q#-CMYtX}7)&#E#yIC$z<r?-e%J-Yjf-^QOquM_wFA
zi{G8;b`#XfMO9kg2kGp6#GS!o{r}j{F|Y#!AOHafKmY;|fB*y_009U<;QyV#<XAQ}
zIq-|r<UdZ%O?)~2tMSU{zhvG_|MT!qhCUe@8u$f2&F!WBV(jtQwXti-g-gGfW*ZKs
z=e?&~``(j8@A;@r*Ya%tSt<K|IrfYrc#O(6xlg&=1=QdPZ1f=)TUb5bgTLrATK6e-
zG&_G$=(riWr>VN@7p>LWj&<mu1kuCON5pf7JtFp=r+Q0z;YyVseDUD?^BM8dCGPQk
z50*V^^;}zD=h|3XTTWi}WFPh((=<4^EFWAW>^+1h-ePUNRxZ(1ZaesWDJ~L3yBv|H
z{)fKwk+@V<t(A?tM#l<P$1*uxrs-VC$x3D2E?Gw1eexGy4arLM?Gw7Nn~)LP(4Jbi
ztQuXOi7u$nCP!aeQOmW5W~HXJt+r$(t5$R9noZkIL~f2gM^}1RxaLZ@2;nzkwNx?a
z`!DnfvuT%VWnHaX`d!^(PhKV8H})oly9gQIH+V*#kU{X;PL@dCap;Q{2P5C659?RB
z$5&WmPdsvB<V?J}6VsgdrQn}-tP;Av(^9u;?z&~X&blQh^1+ph?7Dw4%P8E}m{j`I
zyP?~WuOwdV$d+R?^y9452HjhGkLt#ETZCv^1uZo!+JxvEFY&fpui1uoS@=tiS&6<V
zWbV>SZKv(MA$qMidex5SK;->z(RNIi&zHk?>~*Z#j;+=;XOD&K=ejlAc;eOq8eP_@
z=yx5KMV45`?q2xazoO_mdS;rfDSTwKI%(TG-nZjb<VF6OYNt!*6rO%ujCKiOVd7i5
zwaVxoM_GKXYi>;^4d@<2mjSq~!F1`k+ESHj^wpTQVzea*7tWua%x?_rE+(G(E3CgC
zaRJ;ty?y#pPS-{EqpXm>`)pcNMDAgD4Y2ngRj)k$tCipKn`HZ|l|drb_St@|Rb!dZ
z|5Nnq$?t5wb~!EHl)EiK`L}<q+Z*rJ&=0?~BB#Z-W}mV%yWa`lQ(~d)0eOMF3-I`d
zt!vJIFUq_0f`FWG1qRzrd`t)oI~K1syz_cuFX7;w*RSE7*PR*qw&eo%SKflPe*>-R
zb;G8&g28=u7=Au}k+moPdI!AV=m`xjm<V(kdV)7HJ6<_E?%jO7u~RYZy|(G1dy8H+
zYDstb?JtLQyiJysV(*@1TW|EW-AU2z(P^~Z9c8722?LSw@Bbw~)j%u+AOHafKmY;|
zfB*y_009U<pqB*j{(mpkCdvW<2tWV=5P$##AOHafKmY;|NEX2Qf3gc=ApijgKmY;|
zfB*y_009U<00O-vfcbwf)h5aU0SG_<0uX=z1Rwwb2tWV=5J(ol`~S%<h=l+IAOHaf
zKmY;|fB*y_009W}k^t8Kd#N^276?E90uX=z1Rwwb2tWV=5P(3k0OtS6E{KHy1Rwwb
z2tWV=5P$##AOHaf^pXJP|GiY3C<_E2009U<00Izz00bZa0SG`KSpf6@WEaFj00Izz
z00bZa0SG_<0uX=z1bRsT^Z#C|O_T)!5P$##AOHafKmY;|fB*y_kSu_I|3BFUu@Ha&
z1Rwwb2tWV=5P$##AOL}062SU@FV!Z>0s#m>00Izz00bZa0SG_<0uV?R!1{l(3t}Mv
z0SG_<0uX=z1Rwwb2tWV=y(ED3|6Zz1lm!A1fB*y_009U<00Izz00bbAEP(a@WEaFj
z00Izz00bZa0SG_<0uX=z1bRsT>;Jt}n<xteAOHafKmY;|fB*y_009U<AXxzG|H&?h
zg#ZK~009U<00Izz00bZa0SNSxz~snBDSr63DgIw4|1|OM6F(dOXnbQVH~PnsUyuBC
z=GBqS;oqkJr<cl$vOoX=5a<Vi1M*TvoSWkw|IpEPD!OB7rF*KSIfl7w#{&7a&0=Az
zNVW=ZtQUzC+a{5DsbTAuYLq2nm=4)2UMp@EH`a=`i5qXv8)cc?+#pwr>qVN!TH*Fu
z;cAg=+}t7?+w1FuZn#$1Uf&|bY*Z>)Klg;(*kO;IomU=qYWl8jwT_!5w>GceC~V##
zZx!!E3K2O2Szf)87H`aPDZ?!5kL>#u!_if(;nY}IjX|hNEVy`ZKARCQUE&_!kLcQt
zX8E@4Yc5HaZTY6Vx+kfYHAk0-`{@`}og9gDc_A%czjQb$69_<AK%p1ph<j1Kb~!EH
zl)LS&S&m^lK_ga`c=)A*7hcSWvdlfnusVrvjfWQEH51=>;+5lPpU~>PEni2oZ=HiI
zugGcft=Xq2`?cin$3oeI>G_N}JIg)Zj|#JG(R7y+by>1+zO8$jM{oL3*44Sgx)ZIk
z)2K$;ZZ!Df0eK<XS;x}G0&*K|G?$aNWw|FcTX)0P(rSY<kmcps!+I7Ei8V3WFR;B>
zVE*9z^U;nvvMKU)E=l#z)Lw%UwGXH4bdGI$%+?wlT$Y>LmonmOuW<(jb}7@bUAIi#
z?Oe-7O{Lj7M$NRlM86RC>XOQBkACA}gLB<7s+zS=?&<r)8)i$EUe!$}E74I?*Q#p6
zsz~I4W|j6dYd*icEN3NCtI|Oz9=BJk>UC{b?@UkRgBPWY_}p{clS`~zJGI(9deD1z
z_+>VJ?qU2f&i1R^5w+b1)oZrl3Wv8YS*cX3x)|++rBT*Cz5i03{d$K)urZnqm2~v7
zs?nT+u{$d@>hAY=ERpg4e?QCwP(}zq00Izz00bZa0SG_<0ubnT0lfd;?=1l3hX4d1
z009U<00Izz00bZafqoFc`hP#vGRg=62tWV=5P$##AOHafKmY>$E`as_es2LNKLj8E
V0SG_<0uX=z1Rwwb2=s%%{{px=TY~@q

literal 0
HcmV?d00001

diff --git a/ldap/ldap.go b/ldap/ldap.go
index 24e84dae..1ac657db 100644
--- a/ldap/ldap.go
+++ b/ldap/ldap.go
@@ -10,6 +10,17 @@ import (
 	"github.com/go-ldap/ldap/v3"
 )
 
+type Config struct {
+  BindUser string
+  BindPass string
+  BaseDN   string
+  Filter   string
+
+  FQDN string
+  Port uint
+  TLS  bool
+}
+
 func CheckLDAPcreds(username string, password string, dbc *db.DB) (bool, error) {
 	ldapFQDN, err := dbc.GetSetting("ldap_fqdn")
 

From dc3682dc8f1f2a457eeccc065b5a23b2341aff9c Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Mon, 1 Apr 2024 10:40:42 -0700
Subject: [PATCH 49/64] Removed LDAP web UI

---
 server/ctrladmin/adminui/pages/home.tmpl |   3 +-
 server/ctrladmin/adminui/pages/ldap.tmpl |  68 -------------
 server/ctrladmin/ctrl.go                 |   2 -
 server/ctrladmin/handlers.go             | 119 -----------------------
 4 files changed, 1 insertion(+), 191 deletions(-)
 delete mode 100644 server/ctrladmin/adminui/pages/ldap.tmpl

diff --git a/server/ctrladmin/adminui/pages/home.tmpl b/server/ctrladmin/adminui/pages/home.tmpl
index 2b3244e2..a436c773 100644
--- a/server/ctrladmin/adminui/pages/home.tmpl
+++ b/server/ctrladmin/adminui/pages/home.tmpl
@@ -44,8 +44,7 @@
     {{ end }}
     {{ if .User.IsAdmin }}
 				<div class="col-span-full">{{ component "link" (props . "To" (path 
-				"/admin/create_user")) }}create new{{ end }} {{component "link" 
-				(props . "To" (path "/admin/ldap")) }}LDAP{{ end }}</div>
+				"/admin/create_user")) }}create new{{ end }}</div>
     {{ end }}
 </div>
 {{ end }}
diff --git a/server/ctrladmin/adminui/pages/ldap.tmpl b/server/ctrladmin/adminui/pages/ldap.tmpl
deleted file mode 100644
index 47f61868..00000000
--- a/server/ctrladmin/adminui/pages/ldap.tmpl
+++ /dev/null
@@ -1,68 +0,0 @@
-{{ component "layout" . }}
-{{ component "layout_user" . }}
-
-{{ component "block" (props .
-    "Icon" "user"
-		"Name" "configuring LDAP"
-) }}
-		<form class="flex flex-col gap-2 items-end" action="{{ path 
-		"/admin/ldap_do" }}" method="post">
-				<p>Leave the server empty to disable LDAP.</p>
-				<input
-					type="username"
-					id="bind_user"
-					name="bind_user"
-					placeholder="bind username"
-					value={{ default "" .CurrentBindUID }}
-				>
-				<input
-					type="password"
-					id="bind_user_password"
-					name="bind_user_password"
-					placeholder="bind password"
-				>
-				
-				<input
-					type="text"
-					id="fqdn"
-					name="fqdn"
-					placeholder="LDAP server"
-					value={{ default "" .CurrentFQDN }}
-				>
-				
-				<input
-					type="number"
-					id="port"
-					name="port"
-					placeholder="port"
-					value={{ default "389" .CurrentPort }}
-				>
-				
-				<select name="tls" id="tls">
-					<option value="true">TLS</option>
-					<option value="false" {{ .CurrentNoTLS }}>None</option>
-				</select>
-
-				<input
-					type="text"
-					id="base_dn"
-					name="base_dn"
-					placeholder="Base DN"
-					value={{ default "" .CurrentBaseDN }}
-				>
-				
-				<input
-					type="text"
-					id="filter"
-					name="filter"
-					placeholder="filter"
-					value={{ default "" .CurrentFilter }}
-				>
-				
-
-				<input type="submit" value="update">
-    </form>
-{{ end }}
-
-{{ end }}
-{{ end }}
diff --git a/server/ctrladmin/ctrl.go b/server/ctrladmin/ctrl.go
index d36a372e..505d5689 100644
--- a/server/ctrladmin/ctrl.go
+++ b/server/ctrladmin/ctrl.go
@@ -85,8 +85,6 @@ func New(dbc *db.DB, sessDB *gormstore.Store, scanner *scanner.Scanner, podcasts
 	// user routes (if session is valid)
 	c.Handle("/logout", userChain(respRaw(c.ServeLogout)))
 	c.Handle("/home", userChain(resp(c.ServeHome)))
-	c.Handle("/ldap", userChain(resp(c.ServeLDAPConfig)))
-	c.Handle("/ldap_do", userChain(resp(c.ServeLDAPConfigDo)))
 	c.Handle("/change_username", userChain(resp(c.ServeChangeUsername)))
 	c.Handle("/change_username_do", userChain(resp(c.ServeChangeUsernameDo)))
 	c.Handle("/change_password", userChain(resp(c.ServeChangePassword)))
diff --git a/server/ctrladmin/handlers.go b/server/ctrladmin/handlers.go
index 17efc6de..cb081983 100644
--- a/server/ctrladmin/handlers.go
+++ b/server/ctrladmin/handlers.go
@@ -138,125 +138,6 @@ func (c *Controller) ServeUnlinkListenBrainzDo(r *http.Request) *Response {
 	return &Response{redirect: "/admin/home"}
 }
 
-func (c *Controller) ServeLDAPConfig(_ *http.Request) *Response {
-	data := &templateData{}
-
-	data.CurrentBindUID, _ = c.dbc.GetSetting("ldap_bind_user")
-	data.CurrentFQDN, _ = c.dbc.GetSetting("ldap_fqdn")
-	data.CurrentPort, _ = c.dbc.GetSetting("ldap_port")
-	data.CurrentBaseDN, _ = c.dbc.GetSetting("ldap_base_dn")
-	data.CurrentFilter, _ = c.dbc.GetSetting("ldap_filter")
-
-	// This is to fix the fact that select boxes are strange.
-	currentTLS, _ := c.dbc.GetSetting("ldap_tls")
-	data.CurrentNoTLS = "selected"
-
-	if currentTLS == "true" {
-		data.CurrentNoTLS = ""
-	}
-
-	return &Response{
-		template: "ldap.tmpl",
-		data:     data,
-	}
-}
-
-func (c *Controller) ServeLDAPConfigDo(r *http.Request) *Response {
-	bindUID := r.FormValue("bind_user")
-	bindPSWD := r.FormValue("bind_user_password") // TODO: Secure this better.
-	fqdn := r.FormValue("fqdn")
-	port := r.FormValue("port")
-	tls := r.FormValue("tls")
-	baseDN := r.FormValue("base_dn")
-	filter := r.FormValue("filter")
-
-	if bindUID == "" || bindPSWD == "" || port == "" || baseDN == "" || filter == "" {
-		return &Response{
-			redirect: r.Referer(),
-			flashW:   []string{"please provide a bind username and password, port, base CN, and filter"},
-		}
-	}
-
-	err := c.dbc.SetSetting("ldap_bind_user", bindUID)
-	if err != nil {
-		log.Println("Failed to set bind user:", err)
-
-		return &Response{
-			redirect: r.Referer(),
-			flashW:   []string{"Failed to set bind user."},
-		}
-	}
-
-	err = c.dbc.SetSetting("ldap_bind_user_password", bindPSWD)
-	if err != nil {
-		log.Println("Failed to set bind user password:", err)
-
-		return &Response{
-			redirect: r.Referer(),
-			flashW:   []string{"Failed to set bind user password."},
-		}
-	}
-
-	err = c.dbc.SetSetting("ldap_fqdn", fqdn)
-	if err != nil {
-		log.Println("Failed to set server:", err)
-
-		return &Response{
-			redirect: r.Referer(),
-			flashW:   []string{"Failed to set server."},
-		}
-	}
-
-	err = c.dbc.SetSetting("ldap_port", port)
-	if err != nil {
-		log.Println("Failed to set port:", err)
-
-		return &Response{
-			redirect: r.Referer(),
-			flashW:   []string{"Failed to set port."},
-		}
-	}
-
-	err = c.dbc.SetSetting("ldap_tls", tls)
-	if err != nil {
-		log.Println("Failed to set TLS:", err)
-
-		return &Response{
-			redirect: r.Referer(),
-			flashW:   []string{"Failed to set TLS."},
-		}
-	}
-
-	err = c.dbc.SetSetting("ldap_base_dn", baseDN)
-	if err != nil {
-		log.Println("Failed to set base DN:", err)
-
-		return &Response{
-			redirect: r.Referer(),
-			flashW:   []string{"Failed to set base DN."},
-		}
-	}
-
-	err = c.dbc.SetSetting("ldap_filter", filter)
-	if err != nil {
-		log.Println("Failed to set filter:", err)
-
-		return &Response{
-			redirect: r.Referer(),
-			flashW:   []string{"Failed to set filter."},
-		}
-	}
-
-	if fqdn == "" {
-		return &Response{
-			redirect: "/admin/home",
-			flashW:   []string{"LDAP server was left empty, LDAP authentication will be disabled."},
-		}
-	}
-
-	return &Response{redirect: "/admin/home"}
-}
-
 func (c *Controller) ServeChangeUsername(r *http.Request) *Response {
 	user, err := selectedUserIfAdmin(c, r)
 	if err != nil {

From 8ba05ef14dbdf7d55b1e82f29978ddadf67aecdf Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Mon, 1 Apr 2024 10:42:11 -0700
Subject: [PATCH 50/64] Reverted home template

---
 server/ctrladmin/adminui/pages/home.tmpl | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/server/ctrladmin/adminui/pages/home.tmpl b/server/ctrladmin/adminui/pages/home.tmpl
index a436c773..134f6075 100644
--- a/server/ctrladmin/adminui/pages/home.tmpl
+++ b/server/ctrladmin/adminui/pages/home.tmpl
@@ -43,8 +43,7 @@
         {{ end }}
     {{ end }}
     {{ if .User.IsAdmin }}
-				<div class="col-span-full">{{ component "link" (props . "To" (path 
-				"/admin/create_user")) }}create new{{ end }}</div>
+        <div class="col-span-full">{{ component "link" (props . "To" (path "/admin/create_user")) }}create new{{ end }}</div>
     {{ end }}
 </div>
 {{ end }}

From 6bf39cc0c4281775bb13330592a8377e5461bd45 Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Mon, 1 Apr 2024 10:45:55 -0700
Subject: [PATCH 51/64] Removed LDAP config from admin templates

---
 server/ctrladmin/ctrl.go | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/server/ctrladmin/ctrl.go b/server/ctrladmin/ctrl.go
index 505d5689..063869f6 100644
--- a/server/ctrladmin/ctrl.go
+++ b/server/ctrladmin/ctrl.go
@@ -290,13 +290,6 @@ type templateData struct {
 	DefaultListenBrainzURL string
 	SelectedUser           *db.User
 
-	CurrentBindUID string
-	CurrentFQDN    string
-	CurrentPort    string
-	CurrentNoTLS   string
-	CurrentBaseDN  string
-	CurrentFilter  string
-
 	Podcasts              []*db.Podcast
 	InternetRadioStations []*db.InternetRadioStation
 

From 6eddc2a1a9b2f1285cba4f757078e7f83627e818 Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Sun, 7 Apr 2024 09:40:25 -0700
Subject: [PATCH 52/64] Made withUser return a middleware and take dbc

---
 server/ctrlsubsonic/ctrl.go | 78 +++++++++++++++++++------------------
 1 file changed, 40 insertions(+), 38 deletions(-)

diff --git a/server/ctrlsubsonic/ctrl.go b/server/ctrlsubsonic/ctrl.go
index 3618c4de..5e28b469 100644
--- a/server/ctrlsubsonic/ctrl.go
+++ b/server/ctrlsubsonic/ctrl.go
@@ -94,7 +94,7 @@ func New(dbc *db.DB, scannr *scanner.Scanner, musicPaths []MusicPath, podcastsPa
 	chain := handlerutil.Chain(
 		withParams,
 		withRequiredParams,
-		c.withUser,
+		withUser(dbc),
 	)
 	chainRaw := handlerutil.Chain(
 		chain,
@@ -224,47 +224,49 @@ func withRequiredParams(next http.Handler) http.Handler {
 	})
 }
 
-func (c *Controller) withUser(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		params := r.Context().Value(CtxParams).(params.Params)
-		// ignoring errors here, a middleware has already ensured they exist
-		username, _ := params.Get("u")
-		password, _ := params.Get("p")
-		token, _ := params.Get("t")
-		salt, _ := params.Get("s")
-
-		passwordAuth := token == "" && salt == ""
-		tokenAuth := password == ""
-		if tokenAuth == passwordAuth {
-			_ = writeResp(w, r, spec.NewError(10,
-				"please provide `t` and `s`, or just `p`"))
-			return
-		}
-		user := c.dbc.GetUserByName(username)
-
-		var credsOk bool
-		if tokenAuth && user != nil {
-			credsOk = checkCredsToken(user.Password, token, salt)
-		} else if user != nil {
-			credsOk = checkCredsBasic(user.Password, password)
-		}
-		if !credsOk {
-			// Because internal authentication failed, we can now try to use LDAP, if
-			// it was enabled by the user.
-			ok, err := ldap.CheckLDAPcreds(username, password, c.dbc)
-			if err != nil {
-				_ = writeResp(w, r, spec.NewError(40, err.Error()))
+func withUser(dbc *db.DB) handlerutil.Middleware {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			params := r.Context().Value(CtxParams).(params.Params)
+			// ignoring errors here, a middleware has already ensured they exist
+			username, _ := params.Get("u")
+			password, _ := params.Get("p")
+			token, _ := params.Get("t")
+			salt, _ := params.Get("s")
+
+			passwordAuth := token == "" && salt == ""
+			tokenAuth := password == ""
+			if tokenAuth == passwordAuth {
+				_ = writeResp(w, r, spec.NewError(10,
+					"please provide `t` and `s`, or just `p`"))
 				return
 			}
+			user := dbc.GetUserByName(username)
 
-			if !ok {
-				_ = writeResp(w, r, spec.NewError(40, "invalid password"))
-				return
+			var credsOk bool
+			if tokenAuth && user != nil {
+				credsOk = checkCredsToken(user.Password, token, salt)
+			} else if user != nil {
+				credsOk = checkCredsBasic(user.Password, password)
 			}
-		}
-		withUser := context.WithValue(r.Context(), CtxUser, user)
-		next.ServeHTTP(w, r.WithContext(withUser))
-	})
+			if !credsOk {
+				// Because internal authentication failed, we can now try to use LDAP,
+				// if it was enabled by the user.
+				ok, err := ldap.CheckLDAPcreds(username, password, dbc)
+				if err != nil {
+					_ = writeResp(w, r, spec.NewError(40, err.Error()))
+					return
+				}
+
+				if !ok {
+					_ = writeResp(w, r, spec.NewError(40, "invalid password"))
+					return
+				}
+			}
+			withUser := context.WithValue(r.Context(), CtxUser, user)
+			next.ServeHTTP(w, r.WithContext(withUser))
+		})
+	}
 }
 
 func slow(next http.Handler) http.Handler {

From 995c566131d58fc3faef727f3a1ab55c1a3e1754 Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Sun, 7 Apr 2024 09:55:46 -0700
Subject: [PATCH 53/64] Readded gofeed dep

---
 go.sum | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/go.sum b/go.sum
index 9ed07bb0..ea3a6e0d 100644
--- a/go.sum
+++ b/go.sum
@@ -10,6 +10,8 @@ github.com/Masterminds/sprig v2.22.0+incompatible/go.mod h1:y6hNFY5UBTIWBxnzTeuN
 github.com/PuerkitoBio/goquery v1.5.1/go.mod h1:GsLWisAFVj4WgDibEWF4pvYnkVQBpKBKeU+7zCJoLcc=
 github.com/PuerkitoBio/goquery v1.9.0 h1:zgjKkdpRY9T97Q5DCtcXwfqkcylSFIVCocZmn2huTp8=
 github.com/PuerkitoBio/goquery v1.9.0/go.mod h1:cW1n6TmIMDoORQU5IU/P1T3tGFunOeXEpGP2WHRwkbY=
+github.com/PuerkitoBio/goquery v1.9.1 h1:mTL6XjbJTZdpfL+Gwl5U2h1l9yEkJjhmlTeV9VPW7UI=
+github.com/PuerkitoBio/goquery v1.9.1/go.mod h1:cW1n6TmIMDoORQU5IU/P1T3tGFunOeXEpGP2WHRwkbY=
 github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
 github.com/andybalholm/cascadia v1.1.0/go.mod h1:GsXiBklL0woXo1j/WYWtSYYC4ouU9PqHO0sqidkEA4Y=
 github.com/andybalholm/cascadia v1.3.2 h1:3Xi6Dw5lHF15JtdcmAHD3i1+T8plmv7BQ/nsViSLyss=

From b36f26e32ad678d01114c04c538da9a850761f89 Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Sun, 7 Apr 2024 10:18:00 -0700
Subject: [PATCH 54/64] Have LDAP read from config

---
 .gitignore                       |   1 +
 cmd/gonic/gonic.go               |  26 +++++------
 gonic.db.1711991474.bak          | Bin 208896 -> 0 bytes
 ldap/ldap.go                     |  76 ++++++++++++-------------------
 server/ctrladmin/ctrl.go         |   5 +-
 server/ctrladmin/handlers_raw.go |   2 +-
 server/ctrlsubsonic/ctrl.go      |   8 ++--
 7 files changed, 53 insertions(+), 65 deletions(-)
 delete mode 100644 gonic.db.1711991474.bak

diff --git a/.gitignore b/.gitignore
index ace40cd7..c4e881d8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,5 @@
 *.db
+*.db.*.bak
 *db-wal
 *db-shm
 *.sql
diff --git a/cmd/gonic/gonic.go b/cmd/gonic/gonic.go
index 81f9e223..f5af91e9 100644
--- a/cmd/gonic/gonic.go
+++ b/cmd/gonic/gonic.go
@@ -37,6 +37,7 @@ import (
 	"go.senan.xyz/gonic/infocache/artistinfocache"
 	"go.senan.xyz/gonic/jukebox"
 	"go.senan.xyz/gonic/lastfm"
+	"go.senan.xyz/gonic/ldap"
 	"go.senan.xyz/gonic/listenbrainz"
 	"go.senan.xyz/gonic/playlist"
 	"go.senan.xyz/gonic/podcast"
@@ -47,7 +48,6 @@ import (
 	"go.senan.xyz/gonic/tags/tagcommon"
 	"go.senan.xyz/gonic/tags/taglib"
 	"go.senan.xyz/gonic/transcode"
-  "go.senan.xyz/gonic/ldap"
 )
 
 func main() {
@@ -83,21 +83,21 @@ func main() {
 
 	confExcludePattern := flag.String("exclude-pattern", "", "regex pattern to exclude files from scan (optional)")
 
-  var ldapConfig ldap.Config
-  flag.StringVar(&ldapConfig.BindUser, "ldap-bind-user", "", "the bind user to bind to LDAP with (required for LDAP)")
+	var ldapConfig ldap.Config
+	flag.StringVar(&ldapConfig.BindUser, "ldap-bind-user", "", "the bind user to bind to LDAP with (required for LDAP)")
 	flag.StringVar(&ldapConfig.BindPass, "ldap-bind-pass", "", "the password of the LDAP bind user (required for LDAP)")
 	flag.StringVar(&ldapConfig.BaseDN, "ldap-base-dn", "", "the base DN for LDAP objects (required for LDAP)")
-  flag.StringVar(&ldapConfig.Filter, "ldap-filter", "(uid=*)", "the filter to select LDAP objects with (optional)")
+	flag.StringVar(&ldapConfig.Filter, "ldap-filter", "(uid=*)", "the filter to select LDAP objects with (optional)")
 
 	flag.StringVar(&ldapConfig.FQDN, "ldap-fqdn", "", "the name of the server to connect to (required for LDAP)")
 	flag.UintVar(&ldapConfig.Port, "ldap-port", 389, "what port the LDAP server is hosted on (optional)")
-  flag.BoolVar(&ldapConfig.TLS, "ldap-tls", false, "whether gonic will connect to the LDAP server using TLS (optional)")
+	flag.BoolVar(&ldapConfig.TLS, "ldap-tls", false, "whether gonic will connect to the LDAP server using TLS (optional)")
 
-  if ldapConfig.FQDN != "" {
-    if ldapConfig.BindUser == "" || ldapConfig.BindPass == "" || ldapConfig.BaseDN == "" {
-      log.Fatal("a server was provided for an LDAP connection, but configuration is incomplete")
-    }
-  }
+	if ldapConfig.FQDN != "" {
+		if ldapConfig.BindUser == "" || ldapConfig.BindPass == "" || ldapConfig.BaseDN == "" {
+			log.Fatal("a server was provided for an LDAP connection, but configuration is incomplete")
+		}
+	}
 
 	var confMultiValueGenre, confMultiValueArtist, confMultiValueAlbumArtist multiValueSetting
 	flag.Var(&confMultiValueGenre, "multi-value-genre", "setting for mutli-valued genre scanning (optional)")
@@ -122,7 +122,7 @@ func main() {
 		log.Fatalf("invalid exclude pattern: %v\n", err)
 	}
 
-	if len(confMusicPaths) == 0 {
+	if len(confMusicPaths) == -1 {
 		log.Fatalf("please provide a music directory")
 	}
 
@@ -264,11 +264,11 @@ func main() {
 		return path.Join(*confProxyPrefix, in)
 	}
 
-	ctrlAdmin, err := ctrladmin.New(dbc, sessDB, scannr, podcast, lastfmClient, resolveProxyPath)
+	ctrlAdmin, err := ctrladmin.New(dbc, sessDB, scannr, podcast, lastfmClient, resolveProxyPath, ldapConfig)
 	if err != nil {
 		log.Panicf("error creating admin controller: %v\n", err)
 	}
-	ctrlSubsonic, err := ctrlsubsonic.New(dbc, scannr, musicPaths, *confPodcastPath, cacheDirAudio, cacheDirCovers, jukebx, playlistStore, scrobblers, podcast, transcoder, lastfmClient, artistInfoCache, albumInfoCache, resolveProxyPath)
+	ctrlSubsonic, err := ctrlsubsonic.New(dbc, scannr, musicPaths, *confPodcastPath, cacheDirAudio, cacheDirCovers, jukebx, playlistStore, scrobblers, podcast, transcoder, lastfmClient, artistInfoCache, albumInfoCache, resolveProxyPath, ldapConfig)
 	if err != nil {
 		log.Panicf("error creating subsonic controller: %v\n", err)
 	}
diff --git a/gonic.db.1711991474.bak b/gonic.db.1711991474.bak
deleted file mode 100644
index 5fbd15305c7b235359f0af5ec0df257af876b08c..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 208896
zcmeI*-*4Q;fd}xVe(dTe>EDc^x*5??B*v?FxsswNd1yBBy75Jp9a(DPm-47xS|Ys5
zU6Wkf3eYqwI|n2MirjM#xB~auEAn1kP@o6g(>1{z`c~iyT>pUH!=-oV!`*QBW652v
zEalW7xBC^G)y{A@<a}m0!{N}*?YGwrM<;h{R#kJzV(L_CU?BB6A*ob~qyH_^|AHSk
zJQM`zZ#Vq3A1?LMgO7%3ssZ6kH|-VSPr{e{o0H{<-%q5*KN$OTyf~7|{5btt=JxP!
z()+{w(9Z|w2EG^=82H=N=TFN#Vf#VunT#lk+>`G(+D=8USG0YbeN3%w77JTNvQ>Cv
zy+|Y$Cy{x{C`-gJ9er1~NZm53nzc{v>H9=$I5op8S$b7BovhTbbxZZrlFj0^;%0GU
zt$3Tb@%Fq?mdVWxa<#Z#q=#55++HhOEs~9!TV!K<eVxz^*9zO~TZEX6N+m04m7PX4
zDL1y^*x5NoRhLLvb9DDx`@u@JhUtW5%t{sA+;#TC2qHJ1y^s+vUgQokjLg;@$1r#8
z;I|lu3!+^+>Lif|npN7<toi)%vfRDM541{yo@6X>Ooe30t<CE<3Y&MxTg5wm=CXW6
zOp9w5xs+j+^+)#o3T>;ZS2Z-O1}CE`!MA6&&!<IM<o4MP4dao@YDhJ;s?NS$@Qbs(
zasBP>BDubCwfHWHr*o^4Rk$t9OYV-6Odb!NW9{n0U53Q6Vjt(@JS^@Q?TR)qT5n}l
zqg52tVAeZm9II<%s%y6Wux8O_+#Q$Jx@J4--6|EcZKGyBC9z>Ux~cA1nqj`DHmu5V
zk~_6~`cv{ZY*i~)4Vr4FR;#o(SnYx4Xcpa8sqMtK5&8RPGvdND*W|+L)hvget<5Uf
z|9-Ap6-U#uO7<gK)!e*#CL>Nya|bG`W`Dc?>ukKLgPo7wiLka5ucn|{y*gJLYFRHG
zuB|=LEp1m<EzP}5B|;le8zH@<XHI2AMd6y&NHJ8cUe`5CGfTSdoqIIqbW-7>3EW2Q
z?-uDZ+d4D18*RUkTRTM(%ktXkwD^wF?aJ;vK~?FDJJUSFXT-TVu37R5$~smro$d9q
zen4m|UNqrJmuyu?i#O)FmMnT`TBvC7RDCidE>3aH8P>jy@+0+btx~2#&s~G|+q5fk
zEUk3U=95}@LTc8?y<KP<5Au+*Bp88Y^5McnMx2`BK3-;mUSjWaGH&MQbM)q(+_yFA
zZa>%F<Avvze0g*Xp+Wj1T``O}VetNH!>w(+M@O>Yo*_1fb&jrWn|BPV=yc!R(RNkG
za4Lrmm02lFc9i0?#BQ@uy=&p{?xmI5Y*cr2+7EXrshhBD*d_G{>HLwzt%Ab_sUvl5
zXU3veJZqGG!R%OIJfZal3EeB+OC0aY*jN(Wm?iaP;ZC$G3lq!o>iA(-eC)JTB^I1`
ze>5Ym%yP|z@QM$vO?6i{EuEf?7r{dIShp*`V=r%jV@==NRhkddWJ!><Oq$wAMx34H
z9uG%)P;ZCmaYy5t(M_!TJlRVuI6c<*qPN@Li5>5Lo5=5H+Kq#H42``AFZ+>h#vOaL
z`d2R_dczo`i5sV*#?fO%zh~mc(M=r<Hj2U$9(&es!p3)o)8geR?g!zGnP<uF%e=4Y
zBv$v%JCc%tdg0bh*{va(^=0l3YoPudz}D|KboWlin-T=U;TU1t#(8%D&C;ZDV~~w`
z%_7UvJD&GB6w5&JPvz)i-XXVmMBe7o;>-;9kR7#Z?7FvbHPdc=8;Bjf6;Ei3C*Lb<
zuDw~<^d?%7xstp%kQTo?)9rqvm5Zu`-|5Wx;tc(mJ~v4}MgEhN@CV^{!WY6Xg-?Z_
z3ZDoc2zB8vg<HbwLQWvUDIvxGf&U%<1^-L_Q~swkIes7j0SG_<0uX=z1Rwwb2tWV=
z|0e-n9GK1L@_EJm$t|z&7rbz8CBLjFORw<f{qW05PFcz?^XGzaPElUYzrvsO!%O*<
z+-h!-KjVk<`6VT<yuzOj!fq(H%AX3txz&75S>y#jtmKyR`Nfxco`v0$$t$bN3P0(G
zbGapDaWThFcwu*|vP92sJP79&X(@92m>+h_v%I*%j|Sn~E3`bT{0Ix@=-DjO^Ld%i
zc;VdAVlJPf;j|xKr02g(&v!To(>>hd4~1bx$>;O@pdY5^LxXvKAQH|gt2`G8E4kbl
ztu2v%FD3jNeFE@n;U9#b2|p1&7WRcb;T_?cuq-?;oD~N6|Ddz~&-u^zzvusk{}D}&
z9|%AI0uX=z1Rwwb2tWV=5P-lD1x^jla?zQ-7(@h9{R?4)Ki5Csitr};=fVhowtqH^
z@TdD{S`prS|8y(DoA93sBm5b^;77Ek{9%MY=bsEBf=T~GE5e)gkB1Tdw12D>;m!L;
z{fKblKN3U)GyhB&;ZOb3tq5=KKOBi*lmDSG!k_&Q#v<tSe?S<V9i{3y_tfd*iJZIs
zPha}S4+J0p0SG_<0uX=z1Rwwb2tWV=JuKkP|2g`1^S!^G-@^q((I5Z;2tWV=5P$##
zAOHafKmY=LCosYdilgk`Ds$ie$NGQYH2@SC0uX=z1Rwwb2tWV=5P$##`b+@t|Myvi
zqqq=&00bZa0SG_<0uX=z1R&6t0$Bg=%W6lVApijgKmY;|fB*y_009U<pw9%b{@-U6
zj^aW90uX=z1Rwwb2tWV=5P(2m3Sj-eFRLAeh5!U0009U<00Izz00bZafj$$!`hTBQ
zIEo7a2tWV=5P$##AOHafKmY=LDS-9=zN~f>8Uhf200bZa0SG_<0uX=z1o}(>>;HXL
z;V3QyAOHafKmY;|fB*y_009W}r2y9d`?A_mXb3<60uX=z1Rwwb2tWV=5a=@jtpE2}
zg`>C-fB*y_009U<00Izz00bb=mjYP-@5^dOp&<YP2tWV=5P$##AOHafK%mbAu>Rj?
z6^`OU00Izz00bZa0SG_<0uX>eUkYITzb~sDg@ynGAOHafKmY;|fB*y_0D(Re!1{lm
zRXB<Z0SG_<0uX=z1Rwwb2tWV=eJOzT|Gunt6dD2$fB*y_009U<00Izz00jC>z+M06
zgnvrWKlp(F1Rwwb2tWV=5P$##AOHafK;WA#u)>X{Zi^y4$<b6kmtR`Q(LV}Na<3}N
ztIE<#tIJC-ufDRZC=0ojS93Y7Ts2Jg;jaI4!XH!g4}Ks30SG_<0uX=z1Rwwb2tWV=
z5a=y|kwI~k&HwTD|9h)qQ5pz900Izz00bZa0SG_<0uX>ek^uhxf07E~AOHafKmY;|
zfB*y_009U<00O-wfc5|0s!x;#0uX=z1Rwwb2tWV=5P$##Adn=0_5UOl#6bW85P$##
zAOHafKmY;|fB*z~OJGv?uhhB0xs*^5e#QSM|9AYGljVuuPo%~_82fa*IFiczIQ`%0
z&(hBh|7MsU`uX78z!w9H0|TkgQ;&}AaFBZ@BZ?yT<U5YGvptm-uZWy&m}UKuQGTS>
zE84!THf-HejWP>7yS7;@Y!%7%jjP3XNk<xTbAw1Mp)~LBCX?7PDmvTDKBoN4whC{o
z7lZxCykwLmVwjG;t6QXQ8CA{NC-?MyqBWeFVU{ets+&$$@(;k$lFj0^;%0GUt$3Tb
z@%Fq?mff?tT3j#E^Ia?4UMpNJl8u{NWMg}MozM-}3ft>jgqV#=B`ax_oko?GvLiRP
z;n>+ZMpc(cS#xyvTl>LEwT9`0Wz0$y-Q0Ed!U!T?5!2$@MJ~l^!oFWI99{KFPiscC
zb;mKxU0YRxZ_hNJy^s+vUgQokv>q#Z5Fh*&<I+L2M6oHXL>_2XX-~7}^UKR}ccTYd
zr9n#-OB`b)S#oRh`i;Wo9r9N3j-R<KZ=X+#vdHbT(lm@mtVP+Xsa17WR~P)V+upeT
z_IA*=;^|n!Vu_`B$=y+s$>X7OtnGfd%gW5QvXAre(t5icy<O1;M(eGtYP5=i8q9hJ
zjhDS^W2$Sm{jg@y#?;-4*1Bdp>fI`>PTMwW=2H?IwxgTsj-?sqduqd~94EO`yQe=T
zf5TSUzda(6om#EZ-e9!{nxk2CTcx%W-$vx`pUsF1(_E7at5>redbVB#``^!XtKw){
zR>^)utD2iv&t$~uY3@K})$DKgf1Qn2b+Gf%E1R{Ycr^vp>ead0P|JGhaBb~@ZfU!^
zYH99uDG}O$+6alfb~-J-qjbBZy%SfpdR^Bn%`EBk;_i$))0{b#5fz1NRwEYCy*l?f
zog@_9#q9+A-69=tTaW1W#qAe&Yo|zJSzZ;=;*Ghk1!euLx2s#mXz*0?44)C_=D23b
zD_(SCETzy^sA$5IE>C?jBQ8#H&6#jmyj!c3>5zEWp#3)OiX2NT-Lv_m7VZv^ZK+u!
z_jaLeJjg@Jl3)aq$%hLQ8F6Zg`*@i#c!|Bw$#}v2e2(7Sll!(t-R<Yvd%W=6k}r>r
zAv8#Tq$`Hi*oh6dw(%Yvn1XwT*qGEgy0&fJF{q-`eRoIORUN~r96Iu4r7+o1iq8_e
z%|`XEgu}a+R%)|R-O*`3+@+*$!m?qP)FY(xM-sOR4jZJ7(zP|uj72Y7)+qgg*|ETQ
zLhB6@x|gk&INl4fu_U-LOX`NgooFu<CZ^rc_+i~p?6g!R7Mys0G$XFea?OSCiVv<$
zbyqhnot}*s!9w;}w=2J6FK>WjP2by9nh(-sNszTnn%YQ4oSo$!4@bH|Z-?k{N8_5&
zO{@<**-I=qJ=XZ5x7*%{9q)dd$nR&`je~j&jlBpj`;l(O9ecI<S1%)5nh(;%jnh%%
z=&_>TGjZeSrj7<1MPUh#J!?2&<2%D?@$wY+gYd@8vt&2k-q&;zt9$1iNy$LHaO<Y*
z))3A5GIxhHP=A7A>-QVFd+XxOSAyVhjIeFvygPtqX;Qf{$i}>8k!9%}&-)yTWgz*d
za`Z9pkXt+=Z*ysJW`=vnj#@Q#-CMYtX}7)&#E#yIC$z<r?-e%J-Yjf-^QOquM_wFA
zi{G8;b`#XfMO9kg2kGp6#GS!o{r}j{F|Y#!AOHafKmY;|fB*y_009U<;QyV#<XAQ}
zIq-|r<UdZ%O?)~2tMSU{zhvG_|MT!qhCUe@8u$f2&F!WBV(jtQwXti-g-gGfW*ZKs
z=e?&~``(j8@A;@r*Ya%tSt<K|IrfYrc#O(6xlg&=1=QdPZ1f=)TUb5bgTLrATK6e-
zG&_G$=(riWr>VN@7p>LWj&<mu1kuCON5pf7JtFp=r+Q0z;YyVseDUD?^BM8dCGPQk
z50*V^^;}zD=h|3XTTWi}WFPh((=<4^EFWAW>^+1h-ePUNRxZ(1ZaesWDJ~L3yBv|H
z{)fKwk+@V<t(A?tM#l<P$1*uxrs-VC$x3D2E?Gw1eexGy4arLM?Gw7Nn~)LP(4Jbi
ztQuXOi7u$nCP!aeQOmW5W~HXJt+r$(t5$R9noZkIL~f2gM^}1RxaLZ@2;nzkwNx?a
z`!DnfvuT%VWnHaX`d!^(PhKV8H})oly9gQIH+V*#kU{X;PL@dCap;Q{2P5C659?RB
z$5&WmPdsvB<V?J}6VsgdrQn}-tP;Av(^9u;?z&~X&blQh^1+ph?7Dw4%P8E}m{j`I
zyP?~WuOwdV$d+R?^y9452HjhGkLt#ETZCv^1uZo!+JxvEFY&fpui1uoS@=tiS&6<V
zWbV>SZKv(MA$qMidex5SK;->z(RNIi&zHk?>~*Z#j;+=;XOD&K=ejlAc;eOq8eP_@
z=yx5KMV45`?q2xazoO_mdS;rfDSTwKI%(TG-nZjb<VF6OYNt!*6rO%ujCKiOVd7i5
zwaVxoM_GKXYi>;^4d@<2mjSq~!F1`k+ESHj^wpTQVzea*7tWua%x?_rE+(G(E3CgC
zaRJ;ty?y#pPS-{EqpXm>`)pcNMDAgD4Y2ngRj)k$tCipKn`HZ|l|drb_St@|Rb!dZ
z|5Nnq$?t5wb~!EHl)EiK`L}<q+Z*rJ&=0?~BB#Z-W}mV%yWa`lQ(~d)0eOMF3-I`d
zt!vJIFUq_0f`FWG1qRzrd`t)oI~K1syz_cuFX7;w*RSE7*PR*qw&eo%SKflPe*>-R
zb;G8&g28=u7=Au}k+moPdI!AV=m`xjm<V(kdV)7HJ6<_E?%jO7u~RYZy|(G1dy8H+
zYDstb?JtLQyiJysV(*@1TW|EW-AU2z(P^~Z9c8722?LSw@Bbw~)j%u+AOHafKmY;|
zfB*y_009U<pqB*j{(mpkCdvW<2tWV=5P$##AOHafKmY;|NEX2Qf3gc=ApijgKmY;|
zfB*y_009U<00O-vfcbwf)h5aU0SG_<0uX=z1Rwwb2tWV=5J(ol`~S%<h=l+IAOHaf
zKmY;|fB*y_009W}k^t8Kd#N^276?E90uX=z1Rwwb2tWV=5P(3k0OtS6E{KHy1Rwwb
z2tWV=5P$##AOHaf^pXJP|GiY3C<_E2009U<00Izz00bZa0SG`KSpf6@WEaFj00Izz
z00bZa0SG_<0uX=z1bRsT^Z#C|O_T)!5P$##AOHafKmY;|fB*y_kSu_I|3BFUu@Ha&
z1Rwwb2tWV=5P$##AOL}062SU@FV!Z>0s#m>00Izz00bZa0SG_<0uV?R!1{l(3t}Mv
z0SG_<0uX=z1Rwwb2tWV=y(ED3|6Zz1lm!A1fB*y_009U<00Izz00bbAEP(a@WEaFj
z00Izz00bZa0SG_<0uX=z1bRsT>;Jt}n<xteAOHafKmY;|fB*y_009U<AXxzG|H&?h
zg#ZK~009U<00Izz00bZa0SNSxz~snBDSr63DgIw4|1|OM6F(dOXnbQVH~PnsUyuBC
z=GBqS;oqkJr<cl$vOoX=5a<Vi1M*TvoSWkw|IpEPD!OB7rF*KSIfl7w#{&7a&0=Az
zNVW=ZtQUzC+a{5DsbTAuYLq2nm=4)2UMp@EH`a=`i5qXv8)cc?+#pwr>qVN!TH*Fu
z;cAg=+}t7?+w1FuZn#$1Uf&|bY*Z>)Klg;(*kO;IomU=qYWl8jwT_!5w>GceC~V##
zZx!!E3K2O2Szf)87H`aPDZ?!5kL>#u!_if(;nY}IjX|hNEVy`ZKARCQUE&_!kLcQt
zX8E@4Yc5HaZTY6Vx+kfYHAk0-`{@`}og9gDc_A%czjQb$69_<AK%p1ph<j1Kb~!EH
zl)LS&S&m^lK_ga`c=)A*7hcSWvdlfnusVrvjfWQEH51=>;+5lPpU~>PEni2oZ=HiI
zugGcft=Xq2`?cin$3oeI>G_N}JIg)Zj|#JG(R7y+by>1+zO8$jM{oL3*44Sgx)ZIk
z)2K$;ZZ!Df0eK<XS;x}G0&*K|G?$aNWw|FcTX)0P(rSY<kmcps!+I7Ei8V3WFR;B>
zVE*9z^U;nvvMKU)E=l#z)Lw%UwGXH4bdGI$%+?wlT$Y>LmonmOuW<(jb}7@bUAIi#
z?Oe-7O{Lj7M$NRlM86RC>XOQBkACA}gLB<7s+zS=?&<r)8)i$EUe!$}E74I?*Q#p6
zsz~I4W|j6dYd*icEN3NCtI|Oz9=BJk>UC{b?@UkRgBPWY_}p{clS`~zJGI(9deD1z
z_+>VJ?qU2f&i1R^5w+b1)oZrl3Wv8YS*cX3x)|++rBT*Cz5i03{d$K)urZnqm2~v7
zs?nT+u{$d@>hAY=ERpg4e?QCwP(}zq00Izz00bZa0SG_<0ubnT0lfd;?=1l3hX4d1
z009U<00Izz00bZafqoFc`hP#vGRg=62tWV=5P$##AOHafKmY>$E`as_es2LNKLj8E
V0SG_<0uX=z1Rwwb2=s%%{{px=TY~@q

diff --git a/ldap/ldap.go b/ldap/ldap.go
index 1ac657db..e20fda27 100644
--- a/ldap/ldap.go
+++ b/ldap/ldap.go
@@ -11,32 +11,29 @@ import (
 )
 
 type Config struct {
-  BindUser string
-  BindPass string
-  BaseDN   string
-  Filter   string
-
-  FQDN string
-  Port uint
-  TLS  bool
+	BindUser string
+	BindPass string
+	BaseDN   string
+	Filter   string
+
+	FQDN string
+	Port uint
+	TLS  bool
 }
 
-func CheckLDAPcreds(username string, password string, dbc *db.DB) (bool, error) {
-	ldapFQDN, err := dbc.GetSetting("ldap_fqdn")
+func (c Config) IsSetup() bool {
+	// This is basically checking if LDAP is setup, if ldapFQDN isn't set we can
+	// assume that the user hasn't configured LDAP.
+	return c.FQDN != ""
+}
 
-	// This checks if LDAP is setup or not.
-	if ldapFQDN == "" || err != nil {
-		return false, err
+func CheckLDAPcreds(username string, password string, dbc *db.DB, config Config) (bool, error) {
+	if !config.IsSetup() {
+		return false, nil
 	}
 
-	// The configuration page wouldn't allow these setting to not be set
-	// while LDAP is enabled (a FQDN/IP is set).
-	ldapPort, _ := dbc.GetSetting("ldap_port")
-	baseDN, _ := dbc.GetSetting("ldap_base_dn")
-	tls, _ := dbc.GetSetting("ldap_tls")
-
 	// Now, we can try to connect to the LDAP server.
-	l, err := createLDAPconnection(tls, ldapFQDN, ldapPort)
+	l, err := createLDAPconnection(config)
 	if err != nil {
 		// Return a generic error.
 		log.Println("Failed to connect to LDAP server:", err)
@@ -45,14 +42,14 @@ func CheckLDAPcreds(username string, password string, dbc *db.DB) (bool, error)
 	defer l.Close()
 
 	// Create the user if it doesn't exist on the database already.
-	err = createUserFromLDAP(username, dbc, l)
+	err = createUserFromLDAP(username, dbc, config, l)
 	if err != nil {
 		return false, err
 	}
 
 	// After we have a connection, let's try binding
 	_, err = l.SimpleBind(&ldap.SimpleBindRequest{
-		Username: fmt.Sprintf("uid=%s,%s", username, baseDN),
+		Username: fmt.Sprintf("uid=%s,%s", username, config.BaseDN),
 		Password: password,
 	})
 
@@ -65,33 +62,20 @@ func CheckLDAPcreds(username string, password string, dbc *db.DB) (bool, error)
 }
 
 // Creates a user from creds
-func createUserFromLDAP(username string, dbc *db.DB, l *ldap.Conn) error {
+func createUserFromLDAP(username string, dbc *db.DB, config Config, l *ldap.Conn) error {
 	user := dbc.GetUserByName(username)
 	if user != nil {
 		return nil
 	}
 
-	ldapFQDN, err := dbc.GetSetting("ldap_fqdn")
-
-	// This is basically checking if LDAP is setup, if ldapFQDN isn't set we can
-	// assume that the user hasn't configured LDAP.
-	if ldapFQDN == "" {
+	if !config.IsSetup() {
 		return nil
-	} else if err != nil {
-		return err
 	}
 
-	// The configuration page wouldn't allow these setting to not be set
-	// while LDAP is enabled (a FQDN/IP is set).
-	bindUID, _ := dbc.GetSetting("ldap_bind_user")
-	bindPWD, _ := dbc.GetSetting("ldap_bind_user_password")
-	baseDN, _ := dbc.GetSetting("ldap_base_dn")
-	filter, _ := dbc.GetSetting("ldap_filter")
-
 	// After we have a connection, let's try binding
-	_, err = l.SimpleBind(&ldap.SimpleBindRequest{
-		Username: fmt.Sprintf("uid=%s,%s", bindUID, baseDN),
-		Password: bindPWD,
+	_, err := l.SimpleBind(&ldap.SimpleBindRequest{
+		Username: fmt.Sprintf("uid=%s,%s", config.BindUser, config.BaseDN),
+		Password: config.BindPass,
 	})
 	if err != nil {
 		log.Println("Failed to bind to LDAP:", err)
@@ -99,9 +83,9 @@ func createUserFromLDAP(username string, dbc *db.DB, l *ldap.Conn) error {
 	}
 
 	searchReq := ldap.NewSearchRequest(
-		baseDN,
+		config.BaseDN,
 		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
-		fmt.Sprintf("(&%s(uid=%s))", filter, ldap.EscapeFilter(username)),
+		fmt.Sprintf("(&%s(uid=%s))", config.Filter, ldap.EscapeFilter(username)),
 		[]string{"dn"},
 		nil,
 	)
@@ -131,16 +115,16 @@ func createUserFromLDAP(username string, dbc *db.DB, l *ldap.Conn) error {
 }
 
 // Creates a connection to an LDAP server.
-func createLDAPconnection(tls string, fqdn string, port string) (*ldap.Conn, error) {
+func createLDAPconnection(config Config) (*ldap.Conn, error) {
 	protocol := "ldap"
-	if tls == "true" {
+	if config.TLS {
 		protocol = "ldaps"
 	}
 
 	// Now, we can try to connect to the LDAP server.
-	l, err := ldap.DialURL(fmt.Sprintf("%s://%s:%s", protocol, fqdn, port))
+	l, err := ldap.DialURL(fmt.Sprintf("%s://%s:%d", protocol, config.FQDN, config.Port))
 	if err != nil {
-		// Warn the server and return a generic error.
+		// Warn the server and return the error.
 		log.Println("Failed to connect to LDAP server", err)
 		return nil, err
 	}
diff --git a/server/ctrladmin/ctrl.go b/server/ctrladmin/ctrl.go
index 063869f6..2a00384a 100644
--- a/server/ctrladmin/ctrl.go
+++ b/server/ctrladmin/ctrl.go
@@ -27,6 +27,7 @@ import (
 	"go.senan.xyz/gonic/db"
 	"go.senan.xyz/gonic/handlerutil"
 	"go.senan.xyz/gonic/lastfm"
+	"go.senan.xyz/gonic/ldap"
 	"go.senan.xyz/gonic/podcast"
 	"go.senan.xyz/gonic/scanner"
 	"go.senan.xyz/gonic/server/ctrladmin/adminui"
@@ -48,11 +49,12 @@ type Controller struct {
 	podcasts         *podcast.Podcasts
 	lastfmClient     *lastfm.Client
 	resolveProxyPath ProxyPathResolver
+	ldapConfig       ldap.Config
 }
 
 type ProxyPathResolver func(in string) string
 
-func New(dbc *db.DB, sessDB *gormstore.Store, scanner *scanner.Scanner, podcasts *podcast.Podcasts, lastfmClient *lastfm.Client, resolveProxyPath ProxyPathResolver) (*Controller, error) {
+func New(dbc *db.DB, sessDB *gormstore.Store, scanner *scanner.Scanner, podcasts *podcast.Podcasts, lastfmClient *lastfm.Client, resolveProxyPath ProxyPathResolver, ldapConfig ldap.Config) (*Controller, error) {
 	c := Controller{
 		ServeMux: http.NewServeMux(),
 
@@ -62,6 +64,7 @@ func New(dbc *db.DB, sessDB *gormstore.Store, scanner *scanner.Scanner, podcasts
 		podcasts:         podcasts,
 		lastfmClient:     lastfmClient,
 		resolveProxyPath: resolveProxyPath,
+		ldapConfig:       ldapConfig,
 	}
 
 	resp := respHandler(adminui.TemplatesFS, resolveProxyPath)
diff --git a/server/ctrladmin/handlers_raw.go b/server/ctrladmin/handlers_raw.go
index 185fea7e..14fe2b75 100644
--- a/server/ctrladmin/handlers_raw.go
+++ b/server/ctrladmin/handlers_raw.go
@@ -21,7 +21,7 @@ func (c *Controller) ServeLoginDo(w http.ResponseWriter, r *http.Request) {
 	if user == nil || password != user.Password {
 		// Because internal authentication failed, we can now try to use LDAP, if
 		// it was enabled by the user.
-		ok, err := ldap.CheckLDAPcreds(username, password, c.dbc)
+		ok, err := ldap.CheckLDAPcreds(username, password, c.dbc, c.ldapConfig)
 		if err != nil {
 			sessAddFlashW(session, []string{err.Error()})
 		} else if !ok {
diff --git a/server/ctrlsubsonic/ctrl.go b/server/ctrlsubsonic/ctrl.go
index 5e28b469..1e647d61 100644
--- a/server/ctrlsubsonic/ctrl.go
+++ b/server/ctrlsubsonic/ctrl.go
@@ -70,7 +70,7 @@ type Controller struct {
 	resolveProxyPath ProxyPathResolver
 }
 
-func New(dbc *db.DB, scannr *scanner.Scanner, musicPaths []MusicPath, podcastsPath string, cacheAudioPath string, cacheCoverPath string, jukebox *jukebox.Jukebox, playlistStore *playlist.Store, scrobblers []scrobble.Scrobbler, podcasts *podcast.Podcasts, transcoder transcode.Transcoder, lastFMClient *lastfm.Client, artistInfoCache *artistinfocache.ArtistInfoCache, albumInfoCache *albuminfocache.AlbumInfoCache, resolveProxyPath ProxyPathResolver) (*Controller, error) {
+func New(dbc *db.DB, scannr *scanner.Scanner, musicPaths []MusicPath, podcastsPath string, cacheAudioPath string, cacheCoverPath string, jukebox *jukebox.Jukebox, playlistStore *playlist.Store, scrobblers []scrobble.Scrobbler, podcasts *podcast.Podcasts, transcoder transcode.Transcoder, lastFMClient *lastfm.Client, artistInfoCache *artistinfocache.ArtistInfoCache, albumInfoCache *albuminfocache.AlbumInfoCache, resolveProxyPath ProxyPathResolver, ldapConfig ldap.Config) (*Controller, error) {
 	c := Controller{
 		ServeMux: http.NewServeMux(),
 
@@ -94,7 +94,7 @@ func New(dbc *db.DB, scannr *scanner.Scanner, musicPaths []MusicPath, podcastsPa
 	chain := handlerutil.Chain(
 		withParams,
 		withRequiredParams,
-		withUser(dbc),
+		withUser(dbc, ldapConfig),
 	)
 	chainRaw := handlerutil.Chain(
 		chain,
@@ -224,7 +224,7 @@ func withRequiredParams(next http.Handler) http.Handler {
 	})
 }
 
-func withUser(dbc *db.DB) handlerutil.Middleware {
+func withUser(dbc *db.DB, ldapConfig ldap.Config) handlerutil.Middleware {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			params := r.Context().Value(CtxParams).(params.Params)
@@ -252,7 +252,7 @@ func withUser(dbc *db.DB) handlerutil.Middleware {
 			if !credsOk {
 				// Because internal authentication failed, we can now try to use LDAP,
 				// if it was enabled by the user.
-				ok, err := ldap.CheckLDAPcreds(username, password, dbc)
+				ok, err := ldap.CheckLDAPcreds(username, password, dbc, ldapConfig)
 				if err != nil {
 					_ = writeResp(w, r, spec.NewError(40, err.Error()))
 					return

From 6ca68b2c260d855b8965b762621efd9396c16107 Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Sun, 7 Apr 2024 10:43:07 -0700
Subject: [PATCH 55/64] Only allow use of subsonic API with one auth method

---
 server/ctrlsubsonic/ctrl.go | 40 +++++++++++++++++++++++++++----------
 1 file changed, 30 insertions(+), 10 deletions(-)

diff --git a/server/ctrlsubsonic/ctrl.go b/server/ctrlsubsonic/ctrl.go
index 1e647d61..4f583ff1 100644
--- a/server/ctrlsubsonic/ctrl.go
+++ b/server/ctrlsubsonic/ctrl.go
@@ -241,20 +241,17 @@ func withUser(dbc *db.DB, ldapConfig ldap.Config) handlerutil.Middleware {
 					"please provide `t` and `s`, or just `p`"))
 				return
 			}
+
 			user := dbc.GetUserByName(username)
 
-			var credsOk bool
-			if tokenAuth && user != nil {
-				credsOk = checkCredsToken(user.Password, token, salt)
-			} else if user != nil {
-				credsOk = checkCredsBasic(user.Password, password)
-			}
-			if !credsOk {
-				// Because internal authentication failed, we can now try to use LDAP,
-				// if it was enabled by the user.
+			if ldapConfig.IsSetup() {
+				// Complete auth using LDAP
+				log.Println("Authenticating using LDAP ...")
+
 				ok, err := ldap.CheckLDAPcreds(username, password, dbc, ldapConfig)
 				if err != nil {
-					_ = writeResp(w, r, spec.NewError(40, err.Error()))
+					log.Println("Failed to check LDAP creds:", err)
+					_ = writeResp(w, r, spec.NewError(40, "invalid password"))
 					return
 				}
 
@@ -262,7 +259,30 @@ func withUser(dbc *db.DB, ldapConfig ldap.Config) handlerutil.Middleware {
 					_ = writeResp(w, r, spec.NewError(40, "invalid password"))
 					return
 				}
+
+				withUser := context.WithValue(r.Context(), CtxUser, user)
+				next.ServeHTTP(w, r.WithContext(withUser))
+				return
 			}
+
+			log.Println("Authenticating using built-in ...")
+			if user == nil {
+				_ = writeResp(w, r, spec.NewError(40, "invalid password"))
+				return
+			}
+
+			var credsOk bool
+			if tokenAuth {
+				credsOk = checkCredsToken(user.Password, token, salt)
+			} else {
+				credsOk = checkCredsBasic(user.Password, password)
+			}
+
+			if !credsOk {
+				_ = writeResp(w, r, spec.NewError(40, "invalid password"))
+				return
+			}
+
 			withUser := context.WithValue(r.Context(), CtxUser, user)
 			next.ServeHTTP(w, r.WithContext(withUser))
 		})

From 5638ef5df7346adf28335c0c125100004416e876 Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Sun, 7 Apr 2024 11:24:26 -0700
Subject: [PATCH 56/64] Added LDAP admin filter

---
 cmd/gonic/gonic.go |  2 ++
 ldap/ldap.go       | 90 ++++++++++++++++++++++++++++++++++------------
 2 files changed, 69 insertions(+), 23 deletions(-)

diff --git a/cmd/gonic/gonic.go b/cmd/gonic/gonic.go
index f5af91e9..aa385be1 100644
--- a/cmd/gonic/gonic.go
+++ b/cmd/gonic/gonic.go
@@ -87,7 +87,9 @@ func main() {
 	flag.StringVar(&ldapConfig.BindUser, "ldap-bind-user", "", "the bind user to bind to LDAP with (required for LDAP)")
 	flag.StringVar(&ldapConfig.BindPass, "ldap-bind-pass", "", "the password of the LDAP bind user (required for LDAP)")
 	flag.StringVar(&ldapConfig.BaseDN, "ldap-base-dn", "", "the base DN for LDAP objects (required for LDAP)")
+
 	flag.StringVar(&ldapConfig.Filter, "ldap-filter", "(uid=*)", "the filter to select LDAP objects with (optional)")
+	flag.StringVar(&ldapConfig.Filter, "ldap-admin-filter", "(memberof=cn=admin)", "the filter to select LDAP objects with (optional)")
 
 	flag.StringVar(&ldapConfig.FQDN, "ldap-fqdn", "", "the name of the server to connect to (required for LDAP)")
 	flag.UintVar(&ldapConfig.Port, "ldap-port", 389, "what port the LDAP server is hosted on (optional)")
diff --git a/ldap/ldap.go b/ldap/ldap.go
index e20fda27..e4864b81 100644
--- a/ldap/ldap.go
+++ b/ldap/ldap.go
@@ -14,7 +14,9 @@ type Config struct {
 	BindUser string
 	BindPass string
 	BaseDN   string
-	Filter   string
+
+	Filter      string
+	AdminFilter string
 
 	FQDN string
 	Port uint
@@ -44,6 +46,7 @@ func CheckLDAPcreds(username string, password string, dbc *db.DB, config Config)
 	// Create the user if it doesn't exist on the database already.
 	err = createUserFromLDAP(username, dbc, config, l)
 	if err != nil {
+		log.Println("Failed to create user from LDAP:", err)
 		return false, err
 	}
 
@@ -72,20 +75,37 @@ func createUserFromLDAP(username string, dbc *db.DB, config Config, l *ldap.Conn
 		return nil
 	}
 
-	// After we have a connection, let's try binding
-	_, err := l.SimpleBind(&ldap.SimpleBindRequest{
-		Username: fmt.Sprintf("uid=%s,%s", config.BindUser, config.BaseDN),
-		Password: config.BindPass,
-	})
+	isAdmin := doesLDAPAdminExist(username, config, l)
+
+	if doesLDAPUserExist(username, config, l) && !isAdmin {
+		return errors.New("no such user")
+	}
+
+	newUser := db.User{
+		Name:     username,
+		Password: "", // no password because we want auth to fail.
+		IsAdmin:  isAdmin,
+	}
+
+	log.Println(username, isAdmin)
+
+	err := dbc.Create(&newUser).Error
 	if err != nil {
-		log.Println("Failed to bind to LDAP:", err)
-		return errors.New("wrong username or password")
+		return err
 	}
 
+	log.Println("User created via LDAP:", username)
+	return nil
+}
+
+// doesLDAPAdminExist checks if an admin exists on the server.
+func doesLDAPAdminExist(username string, config Config, l *ldap.Conn) bool {
+	filter := fmt.Sprintf("(&(uid=%s)%s)", ldap.EscapeFilter(username), config.AdminFilter)
+
 	searchReq := ldap.NewSearchRequest(
 		config.BaseDN,
 		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
-		fmt.Sprintf("(&%s(uid=%s))", config.Filter, ldap.EscapeFilter(username)),
+		filter,
 		[]string{"dn"},
 		nil,
 	)
@@ -93,25 +113,39 @@ func createUserFromLDAP(username string, dbc *db.DB, config Config, l *ldap.Conn
 	result, err := l.Search(searchReq)
 	if err != nil {
 		log.Println("failed to query LDAP server:", err)
+		return false
+	}
+
+	if len(result.Entries) == 1 {
+		return true
 	}
 
-	switch len(result.Entries) {
-	case 1:
-		user := db.User{
-			Name:     username,
-			Password: "", // no password because we want auth to fail.
-		}
+	return false
+}
 
-		if err := dbc.Create(&user).Error; err != nil {
-			log.Println("User created via LDAP:", username)
-		}
+// doesLDAPUserExist checks if a user exists on the server.
+func doesLDAPUserExist(username string, config Config, l *ldap.Conn) bool {
+	filter := fmt.Sprintf("(&(uid=%s)%s)", ldap.EscapeFilter(username), config.Filter)
 
-		return nil
-	case 0:
-		return errors.New("invalid username")
-	default:
-		return errors.New("ambiguous user")
+	searchReq := ldap.NewSearchRequest(
+		config.BaseDN,
+		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
+		filter,
+		[]string{"dn"},
+		nil,
+	)
+
+	result, err := l.Search(searchReq)
+	if err != nil {
+		log.Println("failed to query LDAP server:", err)
+		return false
+	}
+
+	if len(result.Entries) == 1 {
+		return true
 	}
+
+	return false
 }
 
 // Creates a connection to an LDAP server.
@@ -129,5 +163,15 @@ func createLDAPconnection(config Config) (*ldap.Conn, error) {
 		return nil, err
 	}
 
+	// After we have a connection, let's try binding
+	_, err = l.SimpleBind(&ldap.SimpleBindRequest{
+		Username: fmt.Sprintf("uid=%s,%s", config.BindUser, config.BaseDN),
+		Password: config.BindPass,
+	})
+	if err != nil {
+		log.Println("Failed to bind to LDAP:", err)
+		return nil, errors.New("wrong username or password")
+	}
+
 	return l, nil
 }

From fccf01642f0553fd6d22336e14c8bb06d591c478 Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Sun, 7 Apr 2024 12:29:45 -0700
Subject: [PATCH 57/64] Added LDAP password cache

---
 ldap/ldap.go | 55 ++++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 53 insertions(+), 2 deletions(-)

diff --git a/ldap/ldap.go b/ldap/ldap.go
index e4864b81..720b9d48 100644
--- a/ldap/ldap.go
+++ b/ldap/ldap.go
@@ -4,12 +4,56 @@ import (
 	"errors"
 	"fmt"
 	"log"
+	"time"
 
 	"go.senan.xyz/gonic/db"
 
 	"github.com/go-ldap/ldap/v3"
 )
 
+var ldapStore = make(LDAPStore)
+
+// LDAPStore maps users to a cached password
+type LDAPStore map[string]CachedLDAPpassword
+
+// Add caches a password username set.
+func (store *LDAPStore) Add(username, password string) {
+	newStore := *store
+	newStore[username] = CachedLDAPpassword{
+		Password:  password,
+		ExpiresAt: time.Now().Add(time.Hour * 8), // Keep the password valid for 8 hours.
+	}
+
+	store = &newStore
+}
+
+// IsValid checks if a user's password is stored in the cache and checks if a
+// given password is valid.
+func (store LDAPStore) IsValid(username, password string) bool {
+	cached, ok := store[username]
+	if !ok {
+		return false
+	}
+
+	if cached.Password != password {
+		return false
+	}
+
+	return cached.IsValid()
+}
+
+// CachedLDAPpassword stores an LDAP user's password and a time at which the
+// server should no longer accept it.
+type CachedLDAPpassword struct {
+	Password  string
+	ExpiresAt time.Time
+}
+
+func (password CachedLDAPpassword) IsValid() bool {
+	return password.ExpiresAt.After(time.Now())
+}
+
+// Cofig stores the user's LDAP server options.
 type Config struct {
 	BindUser string
 	BindPass string
@@ -34,6 +78,13 @@ func CheckLDAPcreds(username string, password string, dbc *db.DB, config Config)
 		return false, nil
 	}
 
+	if ldapStore.IsValid(username, password) {
+		log.Println("Password authenticated via cache!")
+		return true, nil
+	}
+
+	log.Println("Checking password against LDAP server ...")
+
 	// Now, we can try to connect to the LDAP server.
 	l, err := createLDAPconnection(config)
 	if err != nil {
@@ -57,6 +108,8 @@ func CheckLDAPcreds(username string, password string, dbc *db.DB, config Config)
 	})
 
 	if err == nil {
+		// Authentication was OK
+		ldapStore.Add(username, password)
 		return true, nil
 	}
 
@@ -87,8 +140,6 @@ func createUserFromLDAP(username string, dbc *db.DB, config Config, l *ldap.Conn
 		IsAdmin:  isAdmin,
 	}
 
-	log.Println(username, isAdmin)
-
 	err := dbc.Create(&newUser).Error
 	if err != nil {
 		return err

From f5195f15c4042357417d866af66ce8fd9fd711ee Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Sun, 7 Apr 2024 12:55:29 -0700
Subject: [PATCH 58/64] Fix password check for local users

---
 ldap/ldap.go                     |  1 +
 server/ctrladmin/handlers_raw.go | 25 +++++++++++++++++++------
 2 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/ldap/ldap.go b/ldap/ldap.go
index 720b9d48..06405eee 100644
--- a/ldap/ldap.go
+++ b/ldap/ldap.go
@@ -129,6 +129,7 @@ func createUserFromLDAP(username string, dbc *db.DB, config Config, l *ldap.Conn
 	}
 
 	isAdmin := doesLDAPAdminExist(username, config, l)
+	log.Println(username, isAdmin)
 
 	if doesLDAPUserExist(username, config, l) && !isAdmin {
 		return errors.New("no such user")
diff --git a/server/ctrladmin/handlers_raw.go b/server/ctrladmin/handlers_raw.go
index 14fe2b75..af416336 100644
--- a/server/ctrladmin/handlers_raw.go
+++ b/server/ctrladmin/handlers_raw.go
@@ -1,6 +1,7 @@
 package ctrladmin
 
 import (
+	"log"
 	"net/http"
 
 	"github.com/gorilla/sessions"
@@ -11,27 +12,39 @@ func (c *Controller) ServeLoginDo(w http.ResponseWriter, r *http.Request) {
 	session := r.Context().Value(CtxSession).(*sessions.Session)
 	username := r.FormValue("username")
 	password := r.FormValue("password")
+	user := c.dbc.GetUserByName(username)
 	if username == "" || password == "" {
 		sessAddFlashW(session, []string{"please provide username and password"})
 		sessLogSave(session, w, r)
 		http.Redirect(w, r, r.Referer(), http.StatusSeeOther)
 		return
 	}
-	user := c.dbc.GetUserByName(username)
-	if user == nil || password != user.Password {
-		// Because internal authentication failed, we can now try to use LDAP, if
-		// it was enabled by the user.
+
+	if c.ldapConfig.IsSetup() {
 		ok, err := ldap.CheckLDAPcreds(username, password, c.dbc, c.ldapConfig)
 		if err != nil {
-			sessAddFlashW(session, []string{err.Error()})
+			log.Println("Failed to check LDAP credentials:", err)
+			sessAddFlashW(session, []string{"failed to check LDAP credentials"})
 		} else if !ok {
 			sessAddFlashW(session, []string{"invalid username / password"})
-
 			sessLogSave(session, w, r)
 			http.Redirect(w, r, r.Referer(), http.StatusSeeOther)
 			return
 		}
+	} else if user == nil {
+		sessAddFlashW(session, []string{"invalid username / password"})
+		sessLogSave(session, w, r)
+		http.Redirect(w, r, r.Referer(), http.StatusSeeOther)
+		return
+	} else if user.Password != password {
+		sessAddFlashW(session, []string{"invalid username / password"})
+		sessLogSave(session, w, r)
+		http.Redirect(w, r, r.Referer(), http.StatusSeeOther)
+		return
 	}
+
+	user = c.dbc.GetUserByName(username)
+
 	// put the user name into the session. future endpoints after this one
 	// are wrapped with WithUserSession() which will get the name from the
 	// session and put the row into the request context

From 0f7e24b39bdab05938299a0841c42ed7cc7e0d31 Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Mon, 8 Apr 2024 13:52:04 -0700
Subject: [PATCH 59/64] Fixed filter params

---
 cmd/gonic/gonic.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cmd/gonic/gonic.go b/cmd/gonic/gonic.go
index aa385be1..3a8489f3 100644
--- a/cmd/gonic/gonic.go
+++ b/cmd/gonic/gonic.go
@@ -88,8 +88,8 @@ func main() {
 	flag.StringVar(&ldapConfig.BindPass, "ldap-bind-pass", "", "the password of the LDAP bind user (required for LDAP)")
 	flag.StringVar(&ldapConfig.BaseDN, "ldap-base-dn", "", "the base DN for LDAP objects (required for LDAP)")
 
-	flag.StringVar(&ldapConfig.Filter, "ldap-filter", "(uid=*)", "the filter to select LDAP objects with (optional)")
-	flag.StringVar(&ldapConfig.Filter, "ldap-admin-filter", "(memberof=cn=admin)", "the filter to select LDAP objects with (optional)")
+	flag.StringVar(&ldapConfig.Filter, "ldap-filter", "", "the filter to select LDAP objects with (optional)")
+	flag.StringVar(&ldapConfig.AdminFilter, "ldap-admin-filter", "(memberof=cn=admin)", "the filter to select LDAP objects with (optional)")
 
 	flag.StringVar(&ldapConfig.FQDN, "ldap-fqdn", "", "the name of the server to connect to (required for LDAP)")
 	flag.UintVar(&ldapConfig.Port, "ldap-port", 389, "what port the LDAP server is hosted on (optional)")

From e2415e944cf50438c778bfb35f82e44a54c3d5c8 Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Mon, 8 Apr 2024 18:13:16 -0700
Subject: [PATCH 60/64] Do session change on failed LDAP check

---
 server/ctrladmin/handlers_raw.go | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/server/ctrladmin/handlers_raw.go b/server/ctrladmin/handlers_raw.go
index af416336..e6359d0c 100644
--- a/server/ctrladmin/handlers_raw.go
+++ b/server/ctrladmin/handlers_raw.go
@@ -27,10 +27,11 @@ func (c *Controller) ServeLoginDo(w http.ResponseWriter, r *http.Request) {
 			sessAddFlashW(session, []string{"failed to check LDAP credentials"})
 		} else if !ok {
 			sessAddFlashW(session, []string{"invalid username / password"})
-			sessLogSave(session, w, r)
-			http.Redirect(w, r, r.Referer(), http.StatusSeeOther)
-			return
 		}
+
+		sessLogSave(session, w, r)
+		http.Redirect(w, r, r.Referer(), http.StatusSeeOther)
+		return
 	} else if user == nil {
 		sessAddFlashW(session, []string{"invalid username / password"})
 		sessLogSave(session, w, r)

From 7159e1ca09ba389674a3f23c2319d99906da58f5 Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Wed, 26 Jun 2024 15:33:54 -0700
Subject: [PATCH 61/64] fix: Fixed conf music path check

---
 cmd/gonic/gonic.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cmd/gonic/gonic.go b/cmd/gonic/gonic.go
index a67a7ee4..17be3d90 100644
--- a/cmd/gonic/gonic.go
+++ b/cmd/gonic/gonic.go
@@ -125,7 +125,7 @@ func main() {
 		log.Fatalf("invalid exclude pattern: %v\n", err)
 	}
 
-	if len(confMusicPaths) == -1 {
+	if len(confMusicPaths) == 0 {
 		log.Fatalf("please provide a music directory")
 	}
 

From 4c5c0151900ff8c49167296a316726598ffa29f8 Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Wed, 26 Jun 2024 15:34:15 -0700
Subject: [PATCH 62/64] go mod tidy

---
 go.mod | 3 ++-
 go.sum | 7 +++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/go.mod b/go.mod
index 13441925..04c4247b 100644
--- a/go.mod
+++ b/go.mod
@@ -30,7 +30,6 @@ require (
 	go.senan.xyz/flagconf v0.1.8
 	golang.org/x/net v0.24.0
 	golang.org/x/sync v0.7.0
-	golang.org/x/sys v0.19.0
 	gopkg.in/gormigrate.v1 v1.6.0
 	jaytaylor.com/html2text v0.0.0-20230321000545-74c2419ad056
 )
@@ -41,6 +40,7 @@ require (
 	github.com/Masterminds/semver v1.5.0 // indirect
 	github.com/PuerkitoBio/goquery v1.9.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.5 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/gorilla/context v1.1.2 // indirect
@@ -64,6 +64,7 @@ require (
 	github.com/ssor/bom v0.0.0-20170718123548-6386211fdfcf // indirect
 	golang.org/x/crypto v0.22.0 // indirect
 	golang.org/x/image v0.15.0 // indirect
+	golang.org/x/sys v0.19.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	gopkg.in/natefinch/npipe.v2 v2.0.0-20160621034901-c1b8fa8bdcce // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
diff --git a/go.sum b/go.sum
index be6ef54f..e6cd5679 100644
--- a/go.sum
+++ b/go.sum
@@ -10,6 +10,7 @@ github.com/Masterminds/sprig v2.22.0+incompatible/go.mod h1:y6hNFY5UBTIWBxnzTeuN
 github.com/PuerkitoBio/goquery v1.5.1/go.mod h1:GsLWisAFVj4WgDibEWF4pvYnkVQBpKBKeU+7zCJoLcc=
 github.com/PuerkitoBio/goquery v1.9.1 h1:mTL6XjbJTZdpfL+Gwl5U2h1l9yEkJjhmlTeV9VPW7UI=
 github.com/PuerkitoBio/goquery v1.9.1/go.mod h1:cW1n6TmIMDoORQU5IU/P1T3tGFunOeXEpGP2WHRwkbY=
+github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74 h1:Kk6a4nehpJ3UuJRqlA3JxYxBZEqCeOmATOvrbT4p9RA=
 github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
 github.com/andybalholm/cascadia v1.1.0/go.mod h1:GsXiBklL0woXo1j/WYWtSYYC4ouU9PqHO0sqidkEA4Y=
 github.com/andybalholm/cascadia v1.3.2 h1:3Xi6Dw5lHF15JtdcmAHD3i1+T8plmv7BQ/nsViSLyss=
@@ -145,6 +146,8 @@ github.com/ssor/bom v0.0.0-20170718123548-6386211fdfcf/go.mod h1:RJID2RhlZKId02n
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
@@ -155,6 +158,7 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191205180655-e7c4368fe9dd/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
 golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
 golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
@@ -172,6 +176,7 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w=
 golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -189,6 +194,8 @@ golang.org/x/sys v0.0.0-20220615213510-4f61da869c0c/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
 golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=

From 758c4c7279915902e3b4ec067db6ed19cb55f69d Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Wed, 26 Jun 2024 15:49:41 -0700
Subject: [PATCH 63/64] lint: Fixed ineffassign on Add

---
 ldap/ldap.go | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/ldap/ldap.go b/ldap/ldap.go
index 06405eee..8be9565d 100644
--- a/ldap/ldap.go
+++ b/ldap/ldap.go
@@ -17,14 +17,11 @@ var ldapStore = make(LDAPStore)
 type LDAPStore map[string]CachedLDAPpassword
 
 // Add caches a password username set.
-func (store *LDAPStore) Add(username, password string) {
-	newStore := *store
-	newStore[username] = CachedLDAPpassword{
+func (store LDAPStore) Add(username, password string) {
+	store[username] = CachedLDAPpassword{
 		Password:  password,
 		ExpiresAt: time.Now().Add(time.Hour * 8), // Keep the password valid for 8 hours.
 	}
-
-	store = &newStore
 }
 
 // IsValid checks if a user's password is stored in the cache and checks if a

From 21b562b5fe319d3c4892ca16e18e999944f02a31 Mon Sep 17 00:00:00 2001
From: Daniel Hall <beta@hai.haus>
Date: Wed, 26 Jun 2024 15:54:39 -0700
Subject: [PATCH 64/64] style: Made invalid auth chain less chain-y

---
 server/ctrladmin/handlers_raw.go | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/server/ctrladmin/handlers_raw.go b/server/ctrladmin/handlers_raw.go
index e6359d0c..d304afd7 100644
--- a/server/ctrladmin/handlers_raw.go
+++ b/server/ctrladmin/handlers_raw.go
@@ -32,12 +32,7 @@ func (c *Controller) ServeLoginDo(w http.ResponseWriter, r *http.Request) {
 		sessLogSave(session, w, r)
 		http.Redirect(w, r, r.Referer(), http.StatusSeeOther)
 		return
-	} else if user == nil {
-		sessAddFlashW(session, []string{"invalid username / password"})
-		sessLogSave(session, w, r)
-		http.Redirect(w, r, r.Referer(), http.StatusSeeOther)
-		return
-	} else if user.Password != password {
+	} else if user == nil || user.Password != password {
 		sessAddFlashW(session, []string{"invalid username / password"})
 		sessLogSave(session, w, r)
 		http.Redirect(w, r, r.Referer(), http.StatusSeeOther)