Add a config toggle to enable/disable the YouTube Music source

- YouTubeConfiguration.Enabled (default true, Infrastructure): single
  switch for the whole source
- DisabledYouTubeMusicService: null-object IYouTubeMusicService that
  fails every call with Forbidden, registered instead of the real one
  when disabled (AddYouTubeMusicService) so no client is ever built
- AppSettings.json (Api + Worker): document YouTube.Enabled explicitly;
  overridable via YouTube__Enabled env var like every other section
- CurrentUser.cs: small unrelated cleanup, collapse the IsAuthenticated
  computation to a single null-coalescing expression

Search, albums, stream resolution and adding a new YouTube track all
surface as 403 Forbidden through the existing ErrorOr -> HTTP mapping.
Daily mix generation already treated a YouTube search failure as "no
YouTube candidates" and keeps working with local-only candidates —
added a test locking that in. Already-downloaded YouTube tracks are
unaffected since playback never goes through IYouTubeMusicService.

257/257 tests passing (7 new), 0 build warnings.

backend/Core/Musify.Infrastructure/Configuration/YouTubeConfiguration.cs

@@ -6,6 +6,11 @@ namespace Musify.Infrastructure.Configuration
     {
         public const string SectionName = "YouTube";
 
+        /// <summary>Turns the whole YouTube Music source on or off: search, albums, streaming
+        /// and adding new YouTube tracks all fail with a clear error while this is <c>false</c>,
+        /// and mix generation silently skips YouTube candidates instead of failing.</summary>
+        public bool Enabled { get; set; } = true;
+
         [Required]
         public string GeographicalLocation { get; set; } = "US";
 

backend/Core/Musify.Infrastructure/Services/DisabledYouTubeMusicService.cs

@@ -0,0 +1,37 @@
+using ErrorOr;
+using Musify.Application.Contracts;
+
+namespace Musify.Infrastructure.Services
+{
+    /// <summary>Stands in for <see cref="IYouTubeMusicService"/> when
+    /// <see cref="Musify.Infrastructure.Configuration.YouTubeConfiguration.Enabled"/> is <c>false</c>,
+    /// so the source can be turned off without a client ever being constructed. Every read fails
+    /// with the same <see cref="ErrorType.Forbidden"/> error; callers already treat a failed
+    /// YouTube call as "unavailable" (an HTTP error for direct requests, a skipped candidate for
+    /// mix generation), so nothing downstream needs to know the source is disabled specifically.</summary>
+    public sealed class DisabledYouTubeMusicService : IYouTubeMusicService
+    {
+        private static readonly Error DisabledError =
+            Error.Forbidden(description: "The YouTube Music source is disabled.");
+
+        public Task<ErrorOr<YouTubeSearchResult>> SearchSongsAsync(string query, string continuationToken, CancellationToken cancellationToken) =>
+            Task.FromResult<ErrorOr<YouTubeSearchResult>>(DisabledError);
+
+        public Task<ErrorOr<YouTubeAlbumSearchResult>> SearchAlbumsAsync(string query, string continuationToken, CancellationToken cancellationToken) =>
+            Task.FromResult<ErrorOr<YouTubeAlbumSearchResult>>(DisabledError);
+
+        public Task<ErrorOr<YouTubeAlbumDetail>> GetAlbumAsync(string albumId, CancellationToken cancellationToken) =>
+            Task.FromResult<ErrorOr<YouTubeAlbumDetail>>(DisabledError);
+
+        public Task<ErrorOr<YouTubeStreamInfo>> GetAudioStreamAsync(string videoId, CancellationToken cancellationToken) =>
+            Task.FromResult<ErrorOr<YouTubeStreamInfo>>(DisabledError);
+
+        public Task<ErrorOr<YouTubeSongResult>> GetSongAsync(string videoId, CancellationToken cancellationToken) =>
+            Task.FromResult<ErrorOr<YouTubeSongResult>>(DisabledError);
+
+        // Never reached in practice: every caller only reaches this after a successful search or
+        // song lookup above, neither of which can succeed while disabled. Passing the URL through
+        // unchanged is the safest thing to do if it's ever called anyway.
+        public string ResolveArtworkUrl(string thumbnailUrl) => thumbnailUrl;
+    }
+}

backend/Core/Musify.Infrastructure/Services/ServicesDependencyInjection.cs

@@ -1,8 +1,10 @@
 using Amazon.S3;
 using Hangfire;
 using Hangfire.PostgreSql;
+using Microsoft.Extensions.Caching.Memory;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
 using Musify.Application.Configuration;
 using Musify.Infrastructure.Configuration;
@@ -102,7 +104,17 @@ namespace Musify.Infrastructure.Services
             serviceDescriptors.AddValidatedOptions<YouTubeConfiguration>(configuration, YouTubeConfiguration.SectionName);
 
             serviceDescriptors.AddMemoryCache();
-            serviceDescriptors.AddSingleton<IYouTubeMusicService, YouTubeMusicService>();
+            serviceDescriptors.AddSingleton<IYouTubeMusicService>(serviceProvider =>
+            {
+                var youTubeConfiguration = serviceProvider.GetRequiredService<YouTubeConfiguration>();
+                if (!youTubeConfiguration.Enabled)
+                    return new DisabledYouTubeMusicService();
+
+                return new YouTubeMusicService(
+                    youTubeConfiguration,
+                    serviceProvider.GetRequiredService<IMemoryCache>(),
+                    serviceProvider.GetRequiredService<ILogger<YouTubeMusicService>>());
+            } );
             return serviceDescriptors;
         }
 

backend/Hosts/Musify.Api/AppSettings.json

@@ -49,6 +49,7 @@
         "OtlpEndpoint": ""
     },
     "YouTube": {
+        "Enabled": true,
         "GeographicalLocation": "US",
         "StreamUrlCacheSeconds": 1800,
         "SearchContinuationCacheSeconds": 600,

backend/Hosts/Musify.Api/Authentication/CurrentUser.cs

@@ -8,8 +8,7 @@ public sealed class CurrentUser : IBindableFromHttpContext<CurrentUser>
     private CurrentUser(ClaimsPrincipal principal)
     {
         Principal = principal;
-        var isAuthenticated = principal.Identity?.IsAuthenticated;
-        IsAuthenticated = isAuthenticated.HasValue && isAuthenticated.Value;
+        IsAuthenticated = principal.Identity?.IsAuthenticated ?? false;
 
         var rawId = principal.FindFirstValue(ClaimTypes.NameIdentifier);
         if (long.TryParse(rawId, out var id) && id != 0)

backend/Hosts/Musify.Worker/AppSettings.json

@@ -26,6 +26,9 @@
     "ApplicationStorage": {
         "Bucket": ""
     },
+    "YouTube": {
+        "Enabled": true
+    },
     "Mix": {
         "ArtistMixCount": 3,
         "ItemsPerMix": 12,

backend/Tests/Musify.Application.Tests/Mixes/GenerateMixesForUserCommandHandlerTests.cs

@@ -1,8 +1,10 @@
+using ErrorOr;
 using Microsoft.EntityFrameworkCore;
 using Musify.Application.Contracts;
 using Musify.Application.Mixes;
 using Musify.Application.Tests.TestSupport;
 using Musify.Domain.Entities;
+using Musify.Domain.ValueObjects;
 using NSubstitute;
 using Xunit;
 
@@ -72,4 +74,33 @@ public sealed class GenerateMixesForUserCommandHandlerTests : HandlerTestBase
         Assert.DoesNotContain(mixes, mix => mix.Title == "Stale Mix");
         Assert.Empty(await Database.MixItems.Where(item => item.MixId == staleMix.Id).ToListAsync(TestContext.Current.CancellationToken));
     }
+
+    [Fact]
+    public async Task Handle_YouTubeSourceUnavailable_StillCreatesMixesFromLocalCandidatesOnly()
+    {
+        // Simulates IYouTubeMusicService.SearchSongsAsync as it behaves when the YouTube source is
+        // disabled (DisabledYouTubeMusicService, see Infrastructure): every call fails. Mix
+        // generation must degrade to local-only candidates instead of failing the whole command.
+        youTubeMusicService
+            .SearchSongsAsync(Arg.Any<string>(), Arg.Any<string>(), Arg.Any<CancellationToken>())
+            .Returns(Error.Forbidden(description: "The YouTube Music source is disabled."));
+
+        var user = TestEntities.User();
+        var artist = TestEntities.Artist("Seed Artist");
+        var listenedTrack = TestEntities.ExternalTrack(externalId: "listened", title: "Listened Track");
+        var otherTrackByArtist = TestEntities.ExternalTrack(externalId: "not-listened", title: "Other Track");
+
+        await SeedAsync(
+            user, artist, listenedTrack, otherTrackByArtist,
+            new TrackArtist { TrackId = listenedTrack.Id, ArtistId = artist.Id, Position = 0 },
+            new TrackArtist { TrackId = otherTrackByArtist.Id, ArtistId = artist.Id, Position = 0 },
+            TestEntities.ListeningHistory(user.Id, listenedTrack.Id));
+
+        var result = await CreateHandler().Handle(new GenerateMixesForUserCommand(user.Id), TestContext.Current.CancellationToken);
+
+        Assert.False(result.IsError);
+        var items = await Database.MixItems.ToListAsync(TestContext.Current.CancellationToken);
+        Assert.NotEmpty(items);
+        Assert.All(items, item => Assert.Equal(MixItemSource.Musify, item.Source));
+    }
 }

backend/Tests/Musify.Infrastructure.Tests/Services/DisabledYouTubeMusicServiceTests.cs

@@ -0,0 +1,58 @@
+using ErrorOr;
+using Musify.Infrastructure.Services;
+using Xunit;
+
+namespace Musify.Infrastructure.Tests.Services;
+
+public sealed class DisabledYouTubeMusicServiceTests
+{
+    private readonly DisabledYouTubeMusicService service = new();
+
+    [Fact]
+    public async Task SearchSongsAsync_ReturnsForbidden()
+    {
+        var result = await service.SearchSongsAsync("query", string.Empty, TestContext.Current.CancellationToken);
+
+        Assert.Equal(ErrorType.Forbidden, result.FirstError.Type);
+    }
+
+    [Fact]
+    public async Task SearchAlbumsAsync_ReturnsForbidden()
+    {
+        var result = await service.SearchAlbumsAsync("query", string.Empty, TestContext.Current.CancellationToken);
+
+        Assert.Equal(ErrorType.Forbidden, result.FirstError.Type);
+    }
+
+    [Fact]
+    public async Task GetAlbumAsync_ReturnsForbidden()
+    {
+        var result = await service.GetAlbumAsync("album-1", TestContext.Current.CancellationToken);
+
+        Assert.Equal(ErrorType.Forbidden, result.FirstError.Type);
+    }
+
+    [Fact]
+    public async Task GetAudioStreamAsync_ReturnsForbidden()
+    {
+        var result = await service.GetAudioStreamAsync("video-1", TestContext.Current.CancellationToken);
+
+        Assert.Equal(ErrorType.Forbidden, result.FirstError.Type);
+    }
+
+    [Fact]
+    public async Task GetSongAsync_ReturnsForbidden()
+    {
+        var result = await service.GetSongAsync("video-1", TestContext.Current.CancellationToken);
+
+        Assert.Equal(ErrorType.Forbidden, result.FirstError.Type);
+    }
+
+    [Fact]
+    public void ResolveArtworkUrl_ReturnsTheUrlUnchanged()
+    {
+        var result = service.ResolveArtworkUrl("https://img.example/thumb.jpg");
+
+        Assert.Equal("https://img.example/thumb.jpg", result);
+    }
+}