Users & permissions

Tunetorch is made for several people, such as a family, a shared flat or a group of friends. Every account has its own playlists, favourites, settings and statistics, and exactly the permissions it needs.

You'll find the administration in the Server settings on the Users tab (right after “Overview”). It's open to admins only.

Creating accounts

When creating an account, you set the username and password, the permissions, whether the account is restricted, and for restricted accounts the supervisors responsible.

In the list, each account also shows when it last signed in (“never” if nobody has signed in since it was created).

All or nothing. Permissions, restriction and supervisors are only set after the account has been created. If something goes wrong along the way (connection lost, server restarted), Tunetorch undoes the creation instead of leaving behind an account that's different from what you intended. The message tells you what went wrong, and your entries stay in the form. So you can try again straight away, but with a different name: the account that was taken back is marked for deletion, and its name stays taken until it's deleted for good (see “Deleting accounts” below).

How many accounts are possible depends on the edition: up to 3 in the free edition, up to 99 with Tunetorch Pro.

The permissions

An account without additional permissions can listen to music, look after playlists and favourites, change its settings and view its statistics. For most housemates that's all they need.

Tunetorch enforces a few rules:

• Only the owner (see below) grants the Admin permission. Any admin can give up their own admin permission; Tunetorch asks once more.
• The last admin can't have the permission revoked.
• A restricted account can't have any further permissions.

There's no separate “Manage users” permission. Only admins manage accounts.

The owner

Exactly one account stands above the admins: the server's owner. That's the account the server was set up with (strictly: the oldest admin), or the one ownership was transferred to. In the list it carries the Owner badge.

• Only the owner changes admin accounts — permissions, name, password, restricting and deleting. Another admin sees the buttons on an admin account greyed out. Everyone edits their own account themselves.
• All admins manage ordinary accounts as usual.
• The owner also manages Tunetorch Pro.
• Transfer ownership: the owner finds a crown icon on every other admin account. Afterwards they're an ordinary admin, and only the new owner can hand ownership back.
• If the owner gives up their admin permission or deletes their account, ownership passes to the oldest remaining admin. The dialog names them beforehand.

Why: if all admins were equal, any of them could lock the owner out — revoke their admin permission, change their password or delete their account. The price: if the owner can no longer be reached, no other admin can replace them. That's what the route via the server is for:

docker exec -it tunetorch tt besitzer              # shows the owner
docker exec -it tunetorch tt besitzer <username>   # transfers ownership

Ownership can only be transferred to an active admin account.

Restricted accounts (children and guests)

You can mark an account as restricted. It then only sees the music that has been explicitly shared with it. The server checks this, not just the interface: library, home page, search, statistics and Android Auto only show shared content, and the server doesn't even deliver the music or cover art of blocked content. You can't get round it via the address bar either.

Supervisors instead of the admin

What's shared isn't decided by the admin. When creating the account, the admin assigns at least one supervisor, and the supervisors then make the actual selection.

A supervisor finds the entry “Edit <name>” in their user menu. There, in expandable lists, they decide what the account may listen to:

The three ways can be combined. A summary shows the selection indented as Artist › Album › Track, so you can check the result at a glance. It shows exactly what the server shares too, guest appearances included.

Sharing by artist applies to individual tracks. On a compilation with 20 tracks, exactly the one track by the shared artist becomes visible, not the whole album. Collaboration albums and guest appearances count too.

The idea behind it: the decision should lie with whoever knows the music and can judge it, and that isn't necessarily the person with the admin permissions.

Passwords

• Everyone changes their own password under User settings → Account. That takes the current password — an open session alone isn't enough.
• An admin can set a new password for any other account. Their own they change in the settings like everyone else.
• A new password signs the account out everywhere else. Wherever it's still signed in (another device, another browser, the app), the session ends at the latest when the short access token expires. If you change your password because someone else had access, that locks them out.
• Mandatory change: as long as the default admin still has the preset password, which anyone can know, a notice locks the whole app. After the change the lock is gone, and the default password can't be set again.

You stay signed in via two protected cookies. How long they're valid is set by the admin (see Security & backup).

Resetting the admin password

If the owner has forgotten the password of another admin account, they give it a new one in the user administration. If nobody who's allowed to can get in any more — the lost account is the owner itself, or the owner can't be reached — it's done via the server, directly in the running container and without touching the database:

docker exec -it tunetorch tt admin-reset <username>

The command asks once more and then resets the account to the preset password BITTE_ÄNDERE_MICH.

Sign in straight away afterwards. The first time you sign in, Tunetorch asks for a new password. Until then the account has a password everyone knows. On a server that can be reached from the internet, do it immediately and don't leave it overnight.

If you no longer know the exact username, enter any name. With a wrong name, the command lists all existing admins.

What the command deliberately doesn't do

• It only works for admin accounts. An admin resets the password of a normal account in the user administration; you don't need access to the server for that.
• It doesn't sign anyone out. Whoever is signed in stays signed in until their session expires.

Is that a security hole? No. Anyone allowed to run docker exec on the server could just as well edit the database directly. The command can't be reached over the network.

Deleting accounts

Deleting your own account

Everyone can delete their own account under User settings → Account, after a confirmation. The account is marked for deletion and signed out immediately. It can't be used to sign in any more after that.

The last admin (and the last user of all) can't delete themselves.

Deleting as an admin

In an account's detail view, an admin can delete it, with an additional confirmation. Here too, it's only marked at first.

The retention period

Accounts and tracks marked for deletion can't be used any more straight away, but they're only deleted for good after an adjustable period (default 28 days). Until then, an admin can take the deletion back or carry it out immediately under Server settings → Marked for deletion.

The username stays taken until it's deleted for good. If you want to give it out again, you get a message that explains this, instead of a puzzling “already exists”.

Playlists, favourites, settings and the personal history disappear with the account. All that's left is the anonymous counter of how often a track was played. It allows no conclusions about individual people.

Where to go next

• Server administration
• Security & backup