Do not force username to always be lowercase in the DB

server/subsonic/middlewares.go

@@ -120,7 +120,7 @@ func validateUser(ctx context.Context, ds model.DataStore, username, pass, token
 	switch {
 	case jwt != "":
 		claims, err := auth.Validate(jwt)
-		valid = err == nil && claims["sub"] == username
+		valid = err == nil && claims["sub"] == user.UserName
 	case pass != "":
 		if strings.HasPrefix(pass, "enc:") {
 			if dec, err := hex.DecodeString(pass[4:]); err == nil {

server/subsonic/middlewares_test.go

@@ -282,7 +282,9 @@ var _ = Describe("Middlewares", func() {
 			})
 
 			It("fails if JWT token sub is different than username", func() {
-				_, err := validateUser(context.TODO(), ds, "not_admin", "", "", "", validToken)
+				u := &model.User{UserName: "hacker"}
+				validToken, _ = auth.CreateToken(u)
+				_, err := validateUser(context.TODO(), ds, "admin", "", "", "", validToken)
 				Expect(err).To(MatchError(model.ErrInvalidAuth))
 			})
 		})