@amoshydra/davison 0.0.4 → 0.1.0

package/README.md

@@ -74,13 +74,22 @@ services:
 
 ### WebDAV
 
-The WebDAV server is available at `/webdav` (e.g., `http://192.168.0.x:4534/webdav/`). It mirrors your music folder structure. No authentication required.
+The WebDAV server is available at `/webdav` (e.g., `http://<your-server-ip>:4534/webdav/`). It mirrors your music folder structure.
+
+#### Authentication
+
+Disabled by default. To require Basic authentication, set the `DAVISON_WEBDAV_USER` and `DAVISON_WEBDAV_PASS` environment variables:
+
+```bash
+DAVISON_WEBDAV_USER=davison DAVISON_WEBDAV_PASS="your-password" npx davison --path /music
+```
+
+Environment variables are recommended over CLI flags because they do not appear in process listings (`ps aux`) or shell history. When authentication is enabled, the server logs `WebDAV auth enabled for user "<username>"` on startup.
 
 To use with Music Assistant:
 1. Add a **WebDAV** provider
 2. URL: `http://<your-server-ip>:4534/webdav/`
-3. Leave username/password blank
-4. Content type: `music`
+3. Username/Password: set them if you configured auth, leave blank otherwise
 
 ### Sonos
 
@@ -101,30 +110,30 @@ The dev server hot-reloads on file changes.
 
 ```
                    ┌──────────────────────┐
-                   │    Web Browser        │
-                   │  (React + Vite)       │
+                   │    Web Browser       │
+                   │  (React + Vite)      │
                    └──────────┬───────────┘
                               │ HTTP (port 4534)
                    ┌──────────▼───────────┐
-                   │   Express Server      │
-                   │  ┌─────────────────┐  │
-                   │  │ REST API (/api) │  │
-                   │  │ Queue Manager   │  │
-                   │  │ Sonos Controller│  │
-                   │  │ Playlist Store  │  │
-                   │  ├─────────────────┤  │
-                   │  │ WebDAV (/webdav)│  │
-                   │  │ (Nephele VFS)   │  │
-                   │  └─────────────────┘  │
+                   │   Express Server     │
+                   │  ┌─────────────────┐ │
+                   │  │ REST API (/api) │ │
+                   │  │ Queue Manager   │ │
+                   │  │ Sonos Controller│ │
+                   │  │ Playlist Store  │ │
+                   │  ├─────────────────┤ │
+                   │  │ WebDAV (/webdav)│ │
+                   │  │ (Nephele VFS)   │ │
+                   │  └─────────────────┘ │
                    └──────────┬───────────┘
                               │
           ┌───────────────────┼───────────────────┐
           │                   │                   │
-   ┌──────▼──────┐    ┌──────▼──────┐    ┌───────▼──────┐
-   │  Sonos       │    │ Music Files │    │ Music        │
-   │  Speakers    │    │  (on disk)  │    │ Assistant    │
-   │  (UPnP/HTTP) │    │             │    │ (via WebDAV) │
-   └─────────────┘    └─────────────┘    └──────────────┘
+   ┌──────▼──────┐     ┌──────▼──────┐    ┌───────▼──────┐
+   │ Sonos       │     │ Music Files │    │ Music        │
+   │ Speakers    │     │  (on disk)  │    │ Assistant    │
+   │ (UPnP/HTTP) │     │             │    │ (via WebDAV) │
+   └─────────────┘     └─────────────┘    └──────────────┘
 ```
 
 ## License

package/dist-server/config.js

@@ -19,6 +19,8 @@ export const config = {
     port: 4534,
     host: detectLanIp(),
     musicPaths: [],
+    webdavUser: '',
+    webdavPass: '',
     dataDir: path.resolve(import.meta.dirname, '..', 'data'),
     playlistsFile: path.resolve(import.meta.dirname, '..', 'data', 'playlists.json'),
 };

package/dist-server/index.js

@@ -18,10 +18,13 @@ program
     .option('--host <address>', 'Server LAN address (auto-detected if omitted)')
     .parse(process.argv);
 const options = program.opts();
-config.port = parseInt(options.port, 10) || 3000;
+config.port = parseInt(options.port, 10) || 4534;
 if (options.host)
     config.host = options.host;
 config.musicPaths = options.path || [];
+// WebDAV credentials from environment (not CLI — avoids ps leak)
+config.webdavUser = process.env.DAVISON_WEBDAV_USER || '';
+config.webdavPass = process.env.DAVISON_WEBDAV_PASS || '';
 // Resolve relative paths against original cwd before main() may chdir
 const originalCwd = process.cwd();
 config.musicPaths = config.musicPaths.map((p) => isAbsolute(p) ? p : resolve(originalCwd, p));

package/dist-server/services/webdav.js

@@ -1,9 +1,10 @@
 import createServer from 'nephele';
-import { ResourceNotFoundError, BadGatewayError, ForbiddenError } from 'nephele/dist/Errors/index.js';
+import { ResourceNotFoundError, BadGatewayError, ForbiddenError, UnauthorizedError } from 'nephele/dist/Errors/index.js';
 import { createReadStream } from 'node:fs';
 import { stat } from 'node:fs/promises';
 import path from 'node:path';
 import { getMusicLibrary } from './music-discovery.js';
+import { config } from '../config.js';
 import os from 'node:os';
 import mime from 'mime';
 function buildDirs(tracks) {
@@ -369,13 +370,25 @@ export function initWebdav() {
     const tracks = getMusicLibrary();
     const tree = buildDirs(tracks);
     const adapter = new VirtualAdapter(tree);
-    class NoAuth {
-        async authenticate() { return { username: 'sonos' }; }
+    if (config.webdavUser) {
+        console.log(`WebDAV auth enabled for user "${config.webdavUser}"`);
+    }
+    class WebdavAuth {
+        async authenticate(request) {
+            if (config.webdavUser) {
+                const auth = request.headers.authorization || '';
+                const expected = 'Basic ' + Buffer.from(`${config.webdavUser}:${config.webdavPass}`).toString('base64');
+                if (auth !== expected) {
+                    throw new UnauthorizedError();
+                }
+            }
+            return { username: config.webdavUser || 'davison' };
+        }
         async cleanAuthentication() { }
     }
     _webdavApp = createServer({
         adapter: adapter,
-        authenticator: new NoAuth(),
+        authenticator: new WebdavAuth(),
     });
     return _webdavApp;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amoshydra/davison",
-  "version": "0.0.4",
+  "version": "0.1.0",
   "description": "WebDAV music server + Sonos controller. npx @amoshydra/davison --path /music",
   "type": "module",
   "bin": {
@@ -23,7 +23,8 @@
     "patches/",
     "package.json",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "vite.config.ts"
   ],
   "dependencies": {
     "commander": "^12.1.0",
@@ -32,7 +33,6 @@
     "music-metadata": "^10.6.0",
     "nephele": "1.0.0-alpha.67",
     "sonos": "^1.14.3",
-    "uuid": "^10.0.0",
     "vite-express": "^0.22.1"
   },
   "devDependencies": {

package/vite.config.ts

@@ -0,0 +1,9 @@
+import { defineConfig } from 'vite'
+import react from '@vitejs/plugin-react'
+
+export default defineConfig({
+  plugins: [react()],
+  build: {
+    outDir: 'dist',
+  },
+})