Plugin Subsonic

Subsonic API Plugin

Enabled by Default: Yes (Disable via SUPERNOVA_PLUGIN_SUBSONIC=false)

Purpose

The Subsonic plugin implements the industry-standard REST API created by the original Subsonic project. This effectively turns Supernova into a universal music server, allowing any third-party app (like DSub, playSub, Symfonium, etc.) to connect to it.

Technical Internals

1. Middleware Integration: It mounts its own specialized authentication middleware over the /rest/ endpoint group. This middleware supports both legacy password hexing and modern token/salt authentication required by the Subsonic spec.
2. Response Translation: The API supports returning data in either JSON or XML format depending on the client's f= query parameter. Supernova dynamically generates XML using a recursive tree builder writeXML().
3. Security:
   • Uses context.WithValue utilizing a private contextKey type to pass authenticated users down the request chain safely.
   • Streaming endpoints (/rest/stream, /rest/download) employ strict path validation. The plugin verifies that the requested file_path begins with the server's configured MEDIA_PATH environment variable. If a malicious client passes an arbitrary path, it will be blocked with a 403 Forbidden.

API Execution

• Accessible under GET /rest/*