Limit access to Jukebox for admins only (configurable).

Closes #2849

conf/configuration.go

@@ -143,9 +143,10 @@ type prometheusOptions struct {
 type AudioDeviceDefinition []string
 
 type jukeboxOptions struct {
-	Enabled bool
-	Devices []AudioDeviceDefinition
-	Default string
+	Enabled   bool
+	Devices   []AudioDeviceDefinition
+	Default   string
+	AdminOnly bool
 }
 
 var (
@@ -340,6 +341,7 @@ func init() {
 	viper.SetDefault("jukebox.enabled", false)
 	viper.SetDefault("jukebox.devices", []AudioDeviceDefinition{})
 	viper.SetDefault("jukebox.default", "")
+	viper.SetDefault("jukebox.adminonly", true)
 
 	viper.SetDefault("scanner.extractor", consts.DefaultScannerExtractor)
 	viper.SetDefault("scanner.genreseparators", ";/,")

server/subsonic/jukebox.go

@@ -4,6 +4,7 @@ import (
 	"net/http"
 	"strconv"
 
+	"github.com/navidrome/navidrome/conf"
 	"github.com/navidrome/navidrome/core/playback"
 	"github.com/navidrome/navidrome/log"
 	"github.com/navidrome/navidrome/server/subsonic/responses"
@@ -29,6 +30,14 @@ func (api *Router) JukeboxControl(r *http.Request) (*responses.Subsonic, error)
 	user := getUser(ctx)
 	p := req.Params(r)
 
+	if !conf.Server.Jukebox.Enabled {
+		return nil, newError(responses.ErrorGeneric, "Jukebox is disabled")
+	}
+
+	if conf.Server.Jukebox.AdminOnly && !user.IsAdmin {
+		return nil, newError(responses.ErrorAuthorizationFail, "Jukebox is admin only")
+	}
+
 	actionString, err := p.String("action")
 	if err != nil {
 		return nil, err

server/subsonic/users.go

@@ -40,7 +40,9 @@ func (api *Router) GetUsers(r *http.Request) (*responses.Subsonic, error) {
 	user.ScrobblingEnabled = true
 	user.DownloadRole = conf.Server.EnableDownloads
 	user.ShareRole = conf.Server.EnableSharing
-	user.JukeboxRole = conf.Server.Jukebox.Enabled
+	if conf.Server.Jukebox.Enabled {
+		user.JukeboxRole = !conf.Server.Jukebox.AdminOnly || loggedUser.IsAdmin
+	}
 	response := newResponse()
 	response.Users = &responses.Users{User: []responses.User{user}}
 	return response, nil