audiobookshelf/server
zriddle 464b720d9e Add canStream user permission to control streaming access
Adds a per-user "Can Stream" permission mirroring the existing "Can Download"
pattern. Server admins can now disable streaming for specific users, encouraging
local downloads instead. Addresses #2572.

Changes:
- User model: stream permission in mapping, defaults, and getter
- ApiKey model: stream permission in defaults
- Controller: 403 enforcement on playback session creation endpoints
- Frontend: permission toggle in admin UI, play button gated by canStream,
  download button shown when streaming disabled, message when neither allowed
- Tests: 11 Mocha tests (model + controller), 1 Cypress test (card UI)
- Localization: English strings for toggle label and fallback message

The getter uses !== false (rather than !!) so existing users without the
stream key in their permissions JSON default to allowed on upgrade.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-02 14:12:08 -06:00
..
auth Update API Key jwtAuthCheck to check user active status 2026-03-18 16:17:45 -05:00
controllers Add canStream user permission to control streaming access 2026-04-02 14:12:08 -06:00
finders Improved subtitle parsing to account for bare colon in title 2026-02-06 14:31:09 -05:00
libs Add fuse.basic.min.js in libs instead of full npm package, use lower threshold for quick matching 2025-06-13 17:23:24 -05:00
managers Improve API cache invalidation for high-churn models 2026-02-19 20:11:24 -05:00
migrations Update migration file to v2.33.0 2026-03-12 16:45:08 -05:00
models Add canStream user permission to control streaming access 2026-04-02 14:12:08 -06:00
objects Fix share playback session not including coverAspectRatio 2026-03-29 15:36:07 -05:00
providers Fix server crash on audible match #4931 2025-12-23 16:44:29 -06:00
routers Fix item_removed payload to include libraryId 2026-03-31 22:02:52 +03:00
scanner Auto-formatting 2025-12-21 14:45:04 -06:00
utils Merge pull request #5073 from kevingatera/perf/minimal-upstream-patchset 2026-03-12 16:38:26 -05:00
Auth.js Add additional debug logs for OIDC login 2025-08-15 17:23:20 -05:00
Database.js Update API Keys to be tied to a user, add apikey lru-cache, handle deactivating expired keys 2025-06-30 14:53:11 -05:00
Logger.js Simplify log level determination 2025-03-08 12:46:36 -07:00
Server.js Update for nextjs client, pass all remaining requests through to nextjs 2025-09-28 09:41:15 -05:00
SocketAuthority.js Replace cover search with streaming version 2025-10-02 13:30:03 +03:00
Watcher.js Add: generic function to ignor files 2025-02-22 12:28:51 -07:00