3 Commits

Include renames

• Add review, discover, email; rebuild the design system

  Three features and a typographic pass over everything.
  
  REVIEW. Picking a file and trusting it are different questions, so they now
  use different numbers. The existing rank decides which candidate to fetch and
  is right to weigh peer upload slots and queue length -- but none of that says
  anything about whether the file is the correct recording, and a fast peer must
  not be able to raise the confidence of a wrong match. So confidence() scores
  the filename alone: title 0.75, artist 0.25, album +0.05, and a variant tag
  you did not ask for multiplies by 0.8 AND caps below the auto threshold.
  
  Confidence gates the IMPORT, not the download. The transfer completes either
  way and the file waits in downloads, so approving is instant and rejecting is
  a delete. Holding the transfer instead would mean the peer is usually gone by
  the time anyone looks.
  
  The two cases it exists for: "02 Creep.flac" in an unsorted folder scores 0.75
  -- title exactly right, artist simply absent, the commonest honest case there
  is -- and must be reviewed rather than binned. And "Creep (Live at
  Glastonbury)" scores 0.80 with BOTH artist and title perfect; the cap is what
  stops a live recording auto-filing over the studio version. Ask for "Creep
  (Acoustic)" and it auto-imports at 0.97, because then the variant is the
  request.
  
  DISCOVER. Related artists seeded from what you have actually imported, plus a
  recap of top artists, genres and decades. Built on muse's own request history,
  never on listening data: Navidrome owns play counts and history, and a second
  source of truth for those would disagree with the one you listen through.
  
  EMAIL. Optional, off unless MUSE_SMTP_HOST is set. Sends on import and on
  review-needed. smtplib is blocking so it runs off the event loop, and every
  failure is logged and swallowed -- a notification is never worth failing an
  import over. Google accounts need no configuration, since the identity is an
  address. Each user owns their own setting under Settings, deliberately not an
  admin route: an address you cannot change yourself is someone else's chore.
  
  DESIGN. A real type scale (display/title/headline/body/callout/caption) whose
  tracking tightens as size grows, which is the single biggest tell of typography
  nobody set. Specular top edges on glass surfaces -- blur alone reads as a grey
  rectangle. A two-part elevation scale, contact shadow plus soft light. Semantic
  colours are now per-theme: the amber tuned for the dark background failed
  contrast outright on white, which was exactly the text a reviewer most needs to
  read. The tab underline became a sliding pill so the eye tracks one object, and
  Review only appears when something is actually waiting.
  
  Add tests/test_matching.py: 13 assertions on the confidence bands rather than
  the exact scores. 90 tests pass across the three suites.
  
  Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

  Aryan SinghandClaude Opus 5 2026-08-05 02:10:33 -05:00
  205e0a44b8
• Add multi-user: Google OAuth, roles, quotas, admin panel

  Phase 2. The schema landed last commit; this makes it real.
  
  AUTH is now multi-provider. MUSE_AUTH takes a comma list, so github,google
  runs both. The callback URL is unchanged — /auth/callback for every provider,
  with the provider carried in the state COOKIE rather than the query string —
  so adding Google needs no edit to an already-registered GitHub app, and the
  callback can't be steered to a different provider by the redirect. With more
  than one enabled, /auth/login shows a chooser built from style attributes
  only, which the CSP already permits, so it needs no stylesheet and no extra
  hash.
  
  Google identities are the VERIFIED email. An unverified one is refused: anyone
  can put someone else's address on an account they control, and the allowlist is
  keyed on exactly that string.
  
  WHO MAY LOG IN is now two rules — the MUSE_ALLOWED_USERS bootstrap list, then
  a non-disabled users row. Inviting is adding a row; no email, no token, no
  expiry to manage. MUSE_ALLOWED_USERS stays mandatory only while the table is
  empty, so a working multi-user install isn't held hostage by an env var it has
  outgrown, but an empty database with no allowlist still refuses to start
  because nobody could ever get in. The rule is one function used at login AND
  on every request: checking only at sign-in isn't revocation, it's a delay.
  
  QUOTAS are requests per calendar month and bytes of imported audio, 0 =
  unlimited. Calendar month, not a rolling window — "12 left until the 1st" is
  something a person can plan around. Batches are checked against the whole
  batch, so a 30-track album with 5 requests left is refused up front rather
  than accepted and abandoned halfway. Storage is measured from the file
  actually written, not the size the peer advertised. Admins are exempt.
  
  ADMIN PANEL: host CPU/memory/disk read straight from /proc — no psutil, no
  compiled dependency, and in a container /proc reports the host, which is what
  you want for a homelab box. Plus library totals, slskd connection state, a
  30-day chart, per-user and per-artist breakdowns, and inline role/quota
  editing. The chart is hand-rolled SVG: a charting library would add ~150KB for
  one stacked bar chart and most of them inject <style> at runtime, which this
  app's CSP blocks.
  
  Guard rails: the last active admin cannot be demoted, disabled or deleted;
  disabling revokes sessions immediately; deleting a user keeps their jobs,
  because the history records what is in the library and why. Requests are
  private by default — users see their own, admins see all — and retrying
  someone else's job returns 404 rather than 403, since a distinct error would
  confirm the id exists.
  
  Also drops AnimatePresence mode="wait" from the tab container. It gates the
  incoming panel on the outgoing one's exit animation reporting finished, so
  anything that stalls the frame loop leaves the UI stuck on the old tab with no
  way forward — found while testing, where a backgrounded page froze navigation
  entirely. A cosmetic transition should never gate navigation.
  
  Verified: admin endpoints 200/403/403/401 for admin/user/guest/anon; last-admin
  demote, disable and delete all 409; disable revokes mid-session; quota refuses
  the 3rd of 2 and a 30-track batch, then succeeds once raised; users see only
  their own jobs; cross-user retry 404s; bad role/provider/duplicate/empty patch
  all rejected; multi-provider chooser and both redirects correct; three CSRF
  variants 400; preflight refuses unknown providers, missing secrets, and an
  empty database with no allowlist. CPU, memory and disk confirmed populated
  inside the linux/amd64 container.
  
  Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

  Aryan SinghandClaude Opus 5 2026-08-04 20:54:12 -05:00
  f3c64d4fd0
• Rebuild the UI on Next.js, and give search real metadata

  The old page was hand-written HTML/CSS/JS. That was fine for a search box and
  a list, but the roadmap here is multi-user, an admin dashboard with usage
  graphs, and an import-review queue — all of which get painful in vanilla DOM
  code. Moves to Next.js 16 / React 19 / Tailwind 4 / Framer Motion.
  
  Built as a STATIC EXPORT served by FastAPI. Running `next start` alongside
  uvicorn would add a Node runtime, a second process to supervise, and a second
  thing that can be down while the other is up. There is no use for SSR — every
  view is behind auth and renders from live JSON — so the deployment stays one
  container, one process, one healthcheck. Image is 60MB; Node only exists in
  the build stage.
  
  Search now carries what a music UI needs:
  
  - year and genre, grafted on from /album/{id} concurrently, deduplicated by
    album and cached forever since a release date is immutable
  - 30-second previews, so you can hear a track before committing a Soulseek
    search to it. Not a library player — that is Navidrome's job.
  - autocomplete over songs/albums/artists, debounced and aborted per keystroke
    so a slow response to "rad" cannot land after "radiohead"
  - album and artist pages, with `Get all` to queue a release in one request
  - the accent colour is sampled from the artwork, so the palette follows the
    music. Deezer's CDN sends ACAO:*, which is what makes canvas sampling work
    with no image proxy.
  
  /api/album/{id} deliberately calls Deezer twice: the track list embedded in
  the album response has no track_position, and using the list index instead
  misnumbers every multi-disc release — verified against the White Album, where
  disc 2 track 1 would have been filed as 18.
  
  Schema is multi-user ready ahead of the feature: users table with roles and
  quotas, requested_by on jobs, and the first login becomes admin. Auth is still
  the single-user GitHub allowlist.
  
  CSP survives all of this intact. Next emits inline hydration scripts, which
  script-src 'self' blocks; rather than per-request nonces, their SHA-256 is
  computed at startup from the built page — a static export never varies between
  requests, so hashes need no maintenance and no HTML rewriting. The one
  concession is style-src-attr 'unsafe-inline', because Framer Motion writes its
  pre-hydration state into style="" and without it every element flashes in.
  That permits style attributes only. img-src/media-src now name Deezer's CDN
  explicitly instead of allowing https: wholesale, closing an exfiltration
  channel that survived connect-src 'self'. /_next/* sits behind the session
  too — there is no local login page to style, so the bundle need not be public.
  
  Verified: unauthenticated /→302 and every /api/*→401 including the four new
  endpoints, forged state→400, forged cookie→401, misconfigured auth refuses to
  start, and the production image hydrates with zero CSP violations.
  
  Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

  Aryan SinghandClaude Opus 5 2026-08-04 14:26:31 -05:00
  3b4b68daaf