102 lines
3.0 KiB
Go
102 lines
3.0 KiB
Go
|
package api
|
||
|
|
|
||
|
|
import (
|
||
|
|
"encoding/json"
|
||
|
|
"net/http"
|
||
|
|
"strings"
|
||
|
|
|
||
|
|
"github.com/ponzischeme89/memby/server/internal/cache"
|
||
|
|
"github.com/ponzischeme89/memby/server/internal/store"
|
||
|
|
)
|
||
|
|
|
||
|
|
type loginRequest struct {
|
||
|
|
Username string `json:"username"`
|
||
|
|
Password string `json:"password"`
|
||
|
|
DeviceID string `json:"deviceId"`
|
||
|
|
}
|
||
|
|
|
||
|
|
type loginResponse struct {
|
||
|
|
Token string `json:"token"`
|
||
|
|
UserID string `json:"userId"`
|
||
|
|
Username string `json:"username"`
|
||
|
|
ServerID string `json:"serverId"`
|
||
|
|
}
|
||
|
|
|
||
|
|
// handleLogin exchanges Emby credentials for a gateway token.
|
||
|
|
//
|
||
|
|
// The Emby access token stays here: the TV only ever holds the gateway token, so
|
||
|
|
// revoking a device is a DELETE in Postgres rather than an Emby-side cleanup.
|
||
|
|
func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
|
||
|
|
var req loginRequest
|
||
|
|
if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 8<<10)).Decode(&req); err != nil {
|
||
|
|
writeError(w, http.StatusBadRequest, "malformed request body")
|
||
|
|
return
|
||
|
|
}
|
||
|
|
req.Username = strings.TrimSpace(req.Username)
|
||
|
|
if req.Username == "" {
|
||
|
|
writeError(w, http.StatusBadRequest, "username is required")
|
||
|
|
return
|
||
|
|
}
|
||
|
|
if req.DeviceID == "" {
|
||
|
|
req.DeviceID = "memby-tv"
|
||
|
|
}
|
||
|
|
|
||
|
|
auth, err := s.emby.Authenticate(r.Context(), req.Username, req.Password, req.DeviceID)
|
||
|
|
if err != nil {
|
||
|
|
// Never echo Emby's body here: a failed sign-in is the one place a wrong
|
||
|
|
// password could be reflected back.
|
||
|
|
s.log.Warn("emby authentication failed", "username", req.Username)
|
||
|
|
writeError(w, http.StatusUnauthorized, "sign-in failed")
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
token, err := newToken()
|
||
|
|
if err != nil {
|
||
|
|
s.log.Error("token generation failed", "error", err)
|
||
|
|
writeError(w, http.StatusInternalServerError, "could not issue a token")
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
sess := store.Session{
|
||
|
|
TokenHash: hashToken(token),
|
||
|
|
EmbyUserID: auth.User.ID,
|
||
|
|
EmbyToken: auth.AccessToken,
|
||
|
|
Username: auth.User.Name,
|
||
|
|
ServerID: auth.ServerID,
|
||
|
|
DeviceID: req.DeviceID,
|
||
|
|
}
|
||
|
|
if sess.Username == "" {
|
||
|
|
sess.Username = req.Username
|
||
|
|
}
|
||
|
|
if err := s.store.CreateSession(r.Context(), sess); err != nil {
|
||
|
|
s.log.Error("session persist failed", "error", err)
|
||
|
|
writeError(w, http.StatusInternalServerError, "could not start a session")
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
writeJSON(w, http.StatusOK, loginResponse{
|
||
|
|
Token: token,
|
||
|
|
UserID: sess.EmbyUserID,
|
||
|
|
Username: sess.Username,
|
||
|
|
ServerID: sess.ServerID,
|
||
|
|
})
|
||
|
|
}
|
||
|
|
|
||
|
|
func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request, sess store.Session) {
|
||
|
|
if err := s.store.DeleteSession(r.Context(), sess.TokenHash); err != nil {
|
||
|
|
s.log.Error("session delete failed", "error", err)
|
||
|
|
}
|
||
|
|
_ = s.cache.Delete(r.Context(), cache.SessionKey(hexHash(sess.TokenHash)))
|
||
|
|
_ = s.cache.InvalidateUser(r.Context(), sess.EmbyUserID)
|
||
|
|
w.WriteHeader(http.StatusNoContent)
|
||
|
|
}
|
||
|
|
|
||
|
|
// handleSession lets the TV confirm a stored token is still good before rendering.
|
||
|
|
func (s *Server) handleSession(w http.ResponseWriter, _ *http.Request, sess store.Session) {
|
||
|
|
writeJSON(w, http.StatusOK, loginResponse{
|
||
|
|
UserID: sess.EmbyUserID,
|
||
|
|
Username: sess.Username,
|
||
|
|
ServerID: sess.ServerID,
|
||
|
|
})
|
||
|
|
}
|