From 0073d7d6125025b414e7628e7f30ab9df0943896 Mon Sep 17 00:00:00 2001
From: saopig1 <4x7sw862st@gmail.com>
Date: Thu, 25 Jun 2026 11:51:41 +0800
Subject: [PATCH] feat(music): lock quality read from guests

---
 src/web/api/music.ts                        | 3 ++-
 src/web/api/permissions-enforcement.test.ts | 7 +++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/web/api/music.ts b/src/web/api/music.ts
index 1e8a1a5..3a0f682 100644
--- a/src/web/api/music.ts
+++ b/src/web/api/music.ts
@@ -3,6 +3,7 @@ import type { MusicProvider } from "../../music/provider.js";
 import { YouTubeProvider } from "../../music/youtube.js";
 import type { Logger } from "../../logger.js";
 import { requirePermission } from "../middleware/requirePermission.js";
+import { requireNotGuest } from "../middleware/requireNotGuest.js";
 
 export function createMusicRouter(
   neteaseProvider: MusicProvider,
@@ -209,7 +210,7 @@ export function createMusicRouter(
   });
 
   // Get current quality
-  router.get("/quality", (_req, res) => {
+  router.get("/quality", requireNotGuest, (_req, res) => {
     res.json({
       netease: neteaseProvider.getQuality(),
       qq: qqProvider.getQuality(),
diff --git a/src/web/api/permissions-enforcement.test.ts b/src/web/api/permissions-enforcement.test.ts
index bd2104a..4593393 100644
--- a/src/web/api/permissions-enforcement.test.ts
+++ b/src/web/api/permissions-enforcement.test.ts
@@ -188,6 +188,13 @@ describe("permission enforcement on action routes", () => {
       const res = await request(app).post("/api/music/quality").send({ quality: "high" });
       expect(res.status).not.toBe(403);
     });
+
+    it("GET /api/music/quality is 403 for guests, allowed for members", async () => {
+      const guestApp = makeApp(guest());
+      expect((await request(guestApp).get("/api/music/quality")).status).toBe(403);
+      const memberApp = makeApp(member([], "all"));
+      expect((await request(memberApp).get("/api/music/quality")).status).toBe(200);
+    });
   });
 
   describe("read-only routes stay open", () => {