Server changes/Sonarr

server/internal/api/auth.go

@@ -2,24 +2,39 @@ package api
 
 import (
 	"encoding/json"
+	"errors"
 	"net/http"
 	"strings"
 
 	"github.com/ponzischeme89/memby/server/internal/cache"
+	"github.com/ponzischeme89/memby/server/internal/emby"
 	"github.com/ponzischeme89/memby/server/internal/store"
 )
 
 type loginRequest struct {
-	Username string `json:"username"`
-	Password string `json:"password"`
-	DeviceID string `json:"deviceId"`
+	Username   string `json:"username"`
+	Password   string `json:"password"`
+	DeviceID   string `json:"deviceId"`
+	DeviceName string `json:"deviceName"`
 }
 
 type loginResponse struct {
-	Token    string `json:"token"`
-	UserID   string `json:"userId"`
-	Username string `json:"username"`
-	ServerID string `json:"serverId"`
+	Token             string `json:"token"`
+	UserID            string `json:"userId"`
+	Username          string `json:"username"`
+	ServerID          string `json:"serverId"`
+	ActiveClients     int    `json:"activeClients,omitempty"`
+	MaxClientsPerUser int    `json:"maxClientsPerUser"`
+}
+
+type authPolicyResponse struct {
+	MaxClientsPerUser int `json:"maxClientsPerUser"`
+}
+
+func (s *Server) handleAuthPolicy(w http.ResponseWriter, _ *http.Request) {
+	writeJSON(w, http.StatusOK, authPolicyResponse{
+		MaxClientsPerUser: s.cfg.MaxClientsPerUser,
+	})
 }
 
 // handleLogin exchanges Emby credentials for a gateway token.
@@ -40,8 +55,21 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
 	if req.DeviceID == "" {
 		req.DeviceID = "memby-tv"
 	}
+	req.DeviceName = strings.TrimSpace(req.DeviceName)
+	if req.DeviceName == "" {
+		// Compatibility for APKs released before device naming. New clients require an
+		// editable name in their UI, but an older TV must still be able to sign in while
+		// the household rollout is in progress.
+		req.DeviceName = "Memby TV"
+	}
+	if len([]rune(req.DeviceName)) > 80 {
+		writeError(w, http.StatusBadRequest, "device name is too long")
+		return
+	}
 
-	auth, err := s.emby.Authenticate(r.Context(), req.Username, req.Password, req.DeviceID)
+	auth, err := s.emby.Authenticate(
+		r.Context(), req.Username, req.Password, req.DeviceID, req.DeviceName,
+	)
 	if err != nil {
 		// Never echo Emby's body here: a failed sign-in is the one place a wrong
 		// password could be reflected back.
@@ -64,21 +92,54 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
 		Username:   auth.User.Name,
 		ServerID:   auth.ServerID,
 		DeviceID:   req.DeviceID,
+		DeviceName: req.DeviceName,
 	}
 	if sess.Username == "" {
 		sess.Username = req.Username
 	}
-	if err := s.store.CreateSession(r.Context(), sess); err != nil {
+	replacedHash, activeClients, err := s.store.CreateSession(
+		r.Context(), sess, s.cfg.MaxClientsPerUser,
+	)
+	if errors.Is(err, store.ErrDeviceLimit) {
+		if revokeErr := s.emby.Logout(r.Context(), emby.Credentials{
+			UserID: auth.User.ID, Token: auth.AccessToken,
+			DeviceID: req.DeviceID, DeviceName: req.DeviceName,
+		}); revokeErr != nil {
+			s.log.Warn("could not retire refused emby session", "error", revokeErr)
+		}
+		s.log.Warn("device allowance reached",
+			"username", sess.Username,
+			"active_clients", activeClients,
+			"max_clients", s.cfg.MaxClientsPerUser,
+		)
+		writeJSON(w, http.StatusConflict, map[string]any{
+			"error":             "device_limit_reached",
+			"message":           "This account has reached its Memby device allowance.",
+			"activeClients":     activeClients,
+			"maxClientsPerUser": s.cfg.MaxClientsPerUser,
+		})
+		return
+	}
+	if err != nil {
+		_ = s.emby.Logout(r.Context(), emby.Credentials{
+			UserID: auth.User.ID, Token: auth.AccessToken,
+			DeviceID: req.DeviceID, DeviceName: req.DeviceName,
+		})
 		s.log.Error("session persist failed", "error", err)
 		writeError(w, http.StatusInternalServerError, "could not start a session")
 		return
 	}
+	if len(replacedHash) > 0 {
+		_ = s.cache.Delete(r.Context(), cache.SessionKey(hexHash(replacedHash)))
+	}
 
 	writeJSON(w, http.StatusOK, loginResponse{
-		Token:    token,
-		UserID:   sess.EmbyUserID,
-		Username: sess.Username,
-		ServerID: sess.ServerID,
+		Token:             token,
+		UserID:            sess.EmbyUserID,
+		Username:          sess.Username,
+		ServerID:          sess.ServerID,
+		ActiveClients:     activeClients,
+		MaxClientsPerUser: s.cfg.MaxClientsPerUser,
 	})
 }
 
@@ -94,8 +155,9 @@ func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request, sess store
 // handleSession lets the TV confirm a stored token is still good before rendering.
 func (s *Server) handleSession(w http.ResponseWriter, _ *http.Request, sess store.Session) {
 	writeJSON(w, http.StatusOK, loginResponse{
-		UserID:   sess.EmbyUserID,
-		Username: sess.Username,
-		ServerID: sess.ServerID,
+		UserID:            sess.EmbyUserID,
+		Username:          sess.Username,
+		ServerID:          sess.ServerID,
+		MaxClientsPerUser: s.cfg.MaxClientsPerUser,
 	})
 }