Add config option to globally enable/disable downloads

server/app/serve_index.go

@@ -34,6 +34,7 @@ func serveIndex(ds model.DataStore, fs http.FileSystem) http.HandlerFunc {
 			"welcomeMessage":          policy.Sanitize(conf.Server.UIWelcomeMessage),
 			"enableTranscodingConfig": conf.Server.EnableTranscodingConfig,
 			"gaTrackingId":            conf.Server.GATrackingID,
+			"enableDownloads":         conf.Server.EnableDownloads,
 			"devActivityMenu":         conf.Server.DevActivityMenu,
 		}
 		j, err := json.Marshal(appConfig)

server/app/serve_index_test.go

@@ -103,6 +103,17 @@ var _ = Describe("serveIndex", func() {
 		Expect(config).To(HaveKeyWithValue("enableTranscodingConfig", true))
 	})
 
+	It("sets the enableDownloads", func() {
+		conf.Server.EnableDownloads = true
+		r := httptest.NewRequest("GET", "/index.html", nil)
+		w := httptest.NewRecorder()
+
+		serveIndex(ds, fs)(w, r)
+
+		config := extractAppConfig(w.Body.String())
+		Expect(config).To(HaveKeyWithValue("enableDownloads", true))
+	})
+
 	It("sets the gaTrackingId", func() {
 		conf.Server.GATrackingID = "UA-12345"
 		r := httptest.NewRequest("GET", "/index.html", nil)

server/subsonic/stream.go

@@ -8,9 +8,11 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/deluan/navidrome/conf"
 	"github.com/deluan/navidrome/core"
 	"github.com/deluan/navidrome/log"
 	"github.com/deluan/navidrome/model"
+	"github.com/deluan/navidrome/model/request"
 	"github.com/deluan/navidrome/server/subsonic/responses"
 	"github.com/deluan/navidrome/utils"
 )
@@ -80,11 +82,17 @@ func (c *StreamController) Stream(w http.ResponseWriter, r *http.Request) (*resp
 
 func (c *StreamController) Download(w http.ResponseWriter, r *http.Request) (*responses.Subsonic, error) {
 	ctx := r.Context()
+	username, _ := request.UsernameFrom(ctx)
 	id, err := requiredParamString(r, "id")
 	if err != nil {
 		return nil, err
 	}
 
+	if !conf.Server.EnableDownloads {
+		log.Warn(ctx, "Downloads are disabled", "user", username, "id", id)
+		return nil, newError(responses.ErrorAuthorizationFail, "downloads are disabled")
+	}
+
 	entity, err := core.GetEntityByID(ctx, c.ds, id)
 	if err != nil {
 		return nil, err