fix(auth): enforce admin and library access controls

[ReenigneArcher]

Description

Require administrator privileges for server settings, scans, metadata changes, cleanup, scheduled tasks, logs, and user management. Hide these controls from standard users and avoid requesting administrator-only data in their UI.

Enforce library grants across browsing, search, collections, person credits, metadata, artwork, subtitles, playback, and progress. An item from an inaccessible library returns 404 and cannot appear indirectly through global search or a shared collection. Empty library access lists continue to allow all signed-in users.

Restrict playback sessions to their owner, reject tokens for deleted accounts, and serialize first-user creation to prevent two unauthenticated setup requests from creating administrators. Authenticate native browser media through an HttpOnly, SameSite=Strict cookie while keeping API requests bearer-authenticated. Clear protected browsing caches on sign-out/access denial and prevent caching private API responses.

Screenshot

Issues Fixed or Closed

Roadmap Issues

Testing

• Eight API permission regression tests pass, covering anonymous requests, administrator-only operations, library grants and revocation, collections/people/counts, malformed access settings, deleted accounts, session ownership, first-user setup races, media cookies, and permitted native media/range requests.
• All 168 server integration tests were validated across the full run and targeted reruns using --no-default-features.
• npm --prefix crates/client-web test: 134 tests pass, including UI permissions, protected route loading, cache clearing, and access-denial behavior.
• npm --prefix crates/client-web run check and npm --prefix crates/client-web run build: pass.
• cargo clippy -p koko --locked --no-default-features -- -D warnings: production targets pass.
• cargo +nightly fmt --all -- --check and git diff --check: pass.

Default Rust features were not exercised locally. Expanded test-target Clippy still reports the existing await_holding_lock and needless_update warnings.

Type of Change

• feat: New feature (non-breaking change which adds functionality)
• fix: Bug fix (non-breaking change which fixes an issue)
• docs: Documentation only changes
• style: Changes that do not affect the meaning of the code (white-space, formatting, missing semicolons, etc.)
• refactor: Code change that neither fixes a bug nor adds a feature
• perf: Code change that improves performance
• test: Adding missing tests or correcting existing tests
• build: Changes that affect the build system or external dependencies
• ci: Changes to CI configuration files and scripts
• chore: Other changes that don't modify src or test files
• revert: Reverts a previous commit
• BREAKING CHANGE: Introduces a breaking change (can be combined with any type above)

Checklist

• Code follows the style guidelines of this project
• Code has been self-reviewed
• Code has been commented, particularly in hard-to-understand areas
• Code docstring/documentation-blocks for new or existing methods/components have been added or updated
• Tests have been added or updated for new or modified functionality, including regression tests for bug fixes

AI Usage

See our AI usage policy.

• AI tools were used while preparing this PR

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

❌ Patch coverage is 77.34807% with 41 lines in your changes missing coverage. Please review.
✅ Project coverage is 54.68%. Comparing base (abfaca5) to head (dbbaeec).
⚠️ Report is 1 commits behind head on master.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
crates/server/src/auth.rs	34.69%	32 Missing ⚠️
crates/server/src/web/routes/media.rs	93.67%	5 Missing ⚠️
crates/server/src/web/routes/user.rs	84.61%	2 Missing ⚠️
crates/server/src/media.rs	95.83%	1 Missing ⚠️
crates/server/src/web/routes/settings.rs	50.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #316      +/-   ##
==========================================
+ Coverage   50.70%   54.68%   +3.97%     
==========================================
  Files          40       40              
  Lines       13259    13396     +137     
==========================================
+ Hits         6723     7325     +602     
+ Misses       6536     6071     -465     

Flag	Coverage Δ
aarch64-apple-darwin	53.77% <77.34%> (+4.03%)	⬆️
aarch64-unknown-linux-gnu	53.77% <77.34%> (+4.03%)	⬆️
aarch64-unknown-linux-musl	54.23% <77.34%> (+4.07%)	⬆️
x86_64-apple-darwin	53.77% <77.34%> (+4.03%)	⬆️
x86_64-pc-windows-msvc	54.72% <77.34%> (+3.98%)	⬆️
x86_64-unknown-linux-gnu	53.77% <77.34%> (+4.03%)	⬆️
x86_64-unknown-linux-musl	54.23% <77.34%> (+4.07%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
crates/server/src/web/mod.rs	79.33% <100.00%> (+1.46%)	⬆️
crates/server/src/web/routes/auth.rs	94.59% <100.00%> (+0.65%)	⬆️
crates/server/src/media.rs	82.74% <95.83%> (+6.33%)	⬆️
crates/server/src/web/routes/settings.rs	73.00% <50.00%> (ø)
crates/server/src/web/routes/user.rs	78.17% <84.61%> (+0.90%)	⬆️
crates/server/src/web/routes/media.rs	17.36% <93.67%> (+11.51%)	⬆️
crates/server/src/auth.rs	57.26% <34.69%> (-6.94%)	⬇️

... and 7 files with indirect coverage changes

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update abfaca5...dbbaeec. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.