crabidy-server.toml gains an [auth] section with one argon2 PHC hash
per role: owner (everything), queue-owner (queue and playback, no
library writes), queue-appender (browse, search, and Append only).
Enforcement is a single fail-closed tower layer in front of the tonic
service — unknown methods require owner, a malformed config aborts
startup, and a missing one keeps the server open as before. Successful
credentials are cached so argon2 runs once, failures re-verify at full
cost and stay indistinguishable. crabidy-server hash-password turns a
stdin password into the config hash; cbd-tui sends the header from new
user/password options.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Deletion (d) previously reached only top-level folders of editable
stores. /captures now exposes its whole tree: nested folders delete
recursively, single tracks delete their metadata file plus the
downloaded audio next to it (never audio outside the instance root).
Tracks advertise this through the new LibraryNode.tracks_deletable
flag. Because these deletes destroy slow-to-redo downloads, the TUI
asks delete <title>? [y/N] first; cheap deletables (search terms,
bookmarks, saved queues) stay unconfirmed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The root README covers the binaries, quick start, the config directory,
and links per-provider READMEs; each provider README explains how the
provider works, how it is used from the TUI, and its config file with
every option and default (tidaly.toml, fsdy.toml, ytdy.toml,
cbd-tui.toml). The fsdy README doubles as the reference for the
.cbd-track.toml on-disk format shared by queues, bookmarks, and
captures.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adds devenv.nix (with alsa-lib and pkg-config for rodio/cpal builds),
rust-toolchain.toml pinning stable, and updated .gitignore.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Test User
AI User