mirror of
https://github.com/navidrome/navidrome.git
synced 2026-08-31 07:30:32 +00:00
59810c3d59
* feat(auth): add per-user token_epoch column and bump method * feat(auth): add aud and ep claims, omitted when zero * feat(auth): add CreateAPIToken for non-expiring, audience-scoped tokens * feat(auth): add CheckClaims for epoch and audience validation * feat(jellyfin): issue non-expiring, jellyfin-scoped access tokens * fix(subsonic): reject API-scoped and revoked tokens on the jwt path * fix(server): reject API-scoped and revoked tokens on the native API * fix(server): pin the token-subject guard and stop leaking test config Adds a regression spec for the DevAutoLogin/ExtAuth guard in tokenAllowed, switches its comparison to case-insensitive to match the user lookup's own COLLATE NOCASE semantics, and restores Subsonic JWT test config after each spec instead of leaking SessionTimeout. * feat(request): add a token epoch holder for handler-to-middleware signalling * refactor(server): write the refreshed JWT header after the handler runs * feat(auth): revoke all tokens for a user when their password changes * fix(server): restore Unwrap on the JWT refresh writer so SSE write deadlines apply * test(auth): pin that non-session tokens reject API access tokens * test(jellyfin): pin token scoping and epoch revocation end to end Exercises auth.CreateAPIToken and CheckClaims against the real Jellyfin router and SQLite DB: the minted token has no exp and is aud-scoped to jellyfin, and bumping token_epoch through the real UserRepository revokes an already-issued token on the next protected request. * test(nativeapi): pin the token-epoch handoff through a real password-change request Drive a self password change through the real Authenticator/JWTRefresher chain and a real SQLite-backed userRepository, so the epoch handoff between Put and the refreshed-token writer is verified end to end, not as two separately-tested halves. Also fix tokenAllowed to read the enriched ctx it was given instead of r.Context(), so its warning log carries the username. * refactor(server): drop tokenAllowed's now-unused request parameter Finding-2 already moved every use to ctx; r was dead weight. Also note in the new nativeapi test why it must stay the package's only real-DB spec: db.Db() is a process-wide singleton its cleanup closes for good. * refactor(auth): remove duplication in claim decoding and token minting * refactor(auth): group aud with the standard JWT claims * refactor(auth): read aud with the standard-claim accessor pattern * fix(log): redact every api_key spelling the Jellyfin API accepts * fix(auth): bind session tokens to the user id, not just the username * fix(auth): return the token epoch from the same atomic increment * fix(auth): bump the token epoch in the same statement as the password write * chore(auth): trim comments to the why-only budget
267 lines
8.2 KiB
Go
267 lines
8.2 KiB
Go
package stream
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
|
|
"github.com/go-chi/jwtauth/v5"
|
|
"github.com/navidrome/navidrome/core/auth"
|
|
"github.com/navidrome/navidrome/model"
|
|
"github.com/navidrome/navidrome/tests"
|
|
. "github.com/onsi/ginkgo/v2"
|
|
. "github.com/onsi/gomega"
|
|
)
|
|
|
|
var _ = Describe("Token", func() {
|
|
var (
|
|
ds *tests.MockDataStore
|
|
ff *tests.MockFFmpeg
|
|
svc TranscodeDecider
|
|
ctx context.Context
|
|
)
|
|
|
|
BeforeEach(func() {
|
|
ctx = GinkgoT().Context()
|
|
ds = &tests.MockDataStore{
|
|
MockedProperty: &tests.MockedPropertyRepo{},
|
|
MockedTranscoding: &tests.MockTranscodingRepo{},
|
|
}
|
|
ff = tests.NewMockFFmpeg("")
|
|
auth.Init(ds)
|
|
svc = NewTranscodeDecider(ds, ff)
|
|
})
|
|
|
|
Describe("Token round-trip", func() {
|
|
var (
|
|
sourceTime time.Time
|
|
impl *deciderService
|
|
)
|
|
|
|
BeforeEach(func() {
|
|
sourceTime = time.Date(2025, 6, 15, 10, 30, 0, 0, time.UTC)
|
|
impl = svc.(*deciderService)
|
|
})
|
|
|
|
It("creates and parses a direct play token", func() {
|
|
decision := &TranscodeDecision{
|
|
MediaID: "media-123",
|
|
CanDirectPlay: true,
|
|
SourceUpdatedAt: sourceTime,
|
|
}
|
|
token, err := svc.CreateTranscodeParams(decision)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
Expect(token).ToNot(BeEmpty())
|
|
|
|
params, err := impl.parseTranscodeParams(token)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
Expect(params.MediaID).To(Equal("media-123"))
|
|
Expect(params.DirectPlay).To(BeTrue())
|
|
Expect(params.TargetFormat).To(BeEmpty())
|
|
Expect(params.SourceUpdatedAt.Unix()).To(Equal(sourceTime.Unix()))
|
|
})
|
|
|
|
It("creates and parses a transcode token with kbps bitrate", func() {
|
|
decision := &TranscodeDecision{
|
|
MediaID: "media-456",
|
|
CanDirectPlay: false,
|
|
CanTranscode: true,
|
|
TargetFormat: "mp3",
|
|
TargetBitrate: 256, // kbps
|
|
TargetChannels: 2,
|
|
SourceUpdatedAt: sourceTime,
|
|
}
|
|
token, err := svc.CreateTranscodeParams(decision)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
|
|
params, err := impl.parseTranscodeParams(token)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
Expect(params.MediaID).To(Equal("media-456"))
|
|
Expect(params.DirectPlay).To(BeFalse())
|
|
Expect(params.TargetFormat).To(Equal("mp3"))
|
|
Expect(params.TargetBitrate).To(Equal(256)) // kbps
|
|
Expect(params.TargetChannels).To(Equal(2))
|
|
Expect(params.SourceUpdatedAt.Unix()).To(Equal(sourceTime.Unix()))
|
|
})
|
|
|
|
It("creates and parses a transcode token with sample rate", func() {
|
|
decision := &TranscodeDecision{
|
|
MediaID: "media-789",
|
|
CanDirectPlay: false,
|
|
CanTranscode: true,
|
|
TargetFormat: "flac",
|
|
TargetBitrate: 0,
|
|
TargetChannels: 2,
|
|
TargetSampleRate: 48000,
|
|
SourceUpdatedAt: sourceTime,
|
|
}
|
|
token, err := svc.CreateTranscodeParams(decision)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
|
|
params, err := impl.parseTranscodeParams(token)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
Expect(params.MediaID).To(Equal("media-789"))
|
|
Expect(params.DirectPlay).To(BeFalse())
|
|
Expect(params.TargetFormat).To(Equal("flac"))
|
|
Expect(params.TargetSampleRate).To(Equal(48000))
|
|
Expect(params.TargetChannels).To(Equal(2))
|
|
})
|
|
|
|
It("creates and parses a transcode token with bit depth", func() {
|
|
decision := &TranscodeDecision{
|
|
MediaID: "media-bd",
|
|
CanDirectPlay: false,
|
|
CanTranscode: true,
|
|
TargetFormat: "flac",
|
|
TargetBitrate: 0,
|
|
TargetChannels: 2,
|
|
TargetBitDepth: 24,
|
|
SourceUpdatedAt: sourceTime,
|
|
}
|
|
token, err := svc.CreateTranscodeParams(decision)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
|
|
params, err := impl.parseTranscodeParams(token)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
Expect(params.MediaID).To(Equal("media-bd"))
|
|
Expect(params.TargetBitDepth).To(Equal(24))
|
|
})
|
|
|
|
It("omits bit depth from token when 0", func() {
|
|
decision := &TranscodeDecision{
|
|
MediaID: "media-nobd",
|
|
CanDirectPlay: false,
|
|
CanTranscode: true,
|
|
TargetFormat: "mp3",
|
|
TargetBitrate: 256,
|
|
TargetBitDepth: 0,
|
|
SourceUpdatedAt: sourceTime,
|
|
}
|
|
token, err := svc.CreateTranscodeParams(decision)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
|
|
params, err := impl.parseTranscodeParams(token)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
Expect(params.TargetBitDepth).To(Equal(0))
|
|
})
|
|
|
|
It("omits sample rate from token when 0", func() {
|
|
decision := &TranscodeDecision{
|
|
MediaID: "media-100",
|
|
CanDirectPlay: false,
|
|
CanTranscode: true,
|
|
TargetFormat: "mp3",
|
|
TargetBitrate: 256,
|
|
TargetSampleRate: 0,
|
|
SourceUpdatedAt: sourceTime,
|
|
}
|
|
token, err := svc.CreateTranscodeParams(decision)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
|
|
params, err := impl.parseTranscodeParams(token)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
Expect(params.TargetSampleRate).To(Equal(0))
|
|
})
|
|
|
|
It("truncates SourceUpdatedAt to seconds", func() {
|
|
timeWithNanos := time.Date(2025, 6, 15, 10, 30, 0, 123456789, time.UTC)
|
|
decision := &TranscodeDecision{
|
|
MediaID: "media-trunc",
|
|
CanDirectPlay: true,
|
|
SourceUpdatedAt: timeWithNanos,
|
|
}
|
|
token, err := svc.CreateTranscodeParams(decision)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
|
|
params, err := impl.parseTranscodeParams(token)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
Expect(params.SourceUpdatedAt.Unix()).To(Equal(timeWithNanos.Truncate(time.Second).Unix()))
|
|
})
|
|
|
|
It("rejects an invalid token", func() {
|
|
_, err := impl.parseTranscodeParams("invalid-token")
|
|
Expect(err).To(HaveOccurred())
|
|
})
|
|
})
|
|
|
|
Describe("ResolveRequestFromToken", func() {
|
|
var sourceTime time.Time
|
|
|
|
BeforeEach(func() {
|
|
sourceTime = time.Date(2025, 6, 15, 10, 30, 0, 0, time.UTC)
|
|
})
|
|
|
|
createTokenForMedia := func(mediaID string, updatedAt time.Time) string {
|
|
decision := &TranscodeDecision{
|
|
MediaID: mediaID,
|
|
CanDirectPlay: true,
|
|
SourceUpdatedAt: updatedAt,
|
|
}
|
|
token, err := svc.CreateTranscodeParams(decision)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
return token
|
|
}
|
|
|
|
It("returns stream request for valid token", func() {
|
|
mf := &model.MediaFile{ID: "song-1", UpdatedAt: sourceTime}
|
|
token := createTokenForMedia("song-1", sourceTime)
|
|
|
|
req, err := svc.ResolveRequestFromToken(ctx, token, mf, 0)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
Expect(req.Format).To(BeEmpty()) // direct play has no target format
|
|
})
|
|
|
|
It("returns ErrTokenInvalid for invalid token", func() {
|
|
mf := &model.MediaFile{ID: "song-1", UpdatedAt: sourceTime}
|
|
_, err := svc.ResolveRequestFromToken(ctx, "bad-token", mf, 0)
|
|
Expect(err).To(MatchError(ContainSubstring(ErrTokenInvalid.Error())))
|
|
})
|
|
|
|
It("returns ErrTokenInvalid when mediaID does not match token", func() {
|
|
mf := &model.MediaFile{ID: "song-2", UpdatedAt: sourceTime}
|
|
token := createTokenForMedia("song-1", sourceTime)
|
|
|
|
_, err := svc.ResolveRequestFromToken(ctx, token, mf, 0)
|
|
Expect(err).To(MatchError(ContainSubstring(ErrTokenInvalid.Error())))
|
|
})
|
|
|
|
It("returns ErrTokenStale when media file has changed", func() {
|
|
newTime := sourceTime.Add(1 * time.Hour)
|
|
mf := &model.MediaFile{ID: "song-1", UpdatedAt: newTime}
|
|
token := createTokenForMedia("song-1", sourceTime)
|
|
|
|
_, err := svc.ResolveRequestFromToken(ctx, token, mf, 0)
|
|
Expect(err).To(MatchError(ErrTokenStale))
|
|
})
|
|
|
|
It("rejects a Jellyfin access token", func() {
|
|
mf := &model.MediaFile{ID: "song-1", UpdatedAt: sourceTime}
|
|
usr := &model.User{ID: "u1", UserName: "johndoe"}
|
|
tokenStr, err := auth.CreateAPIToken(usr, auth.AudienceJellyfin)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
|
|
_, err = svc.ResolveRequestFromToken(ctx, tokenStr, mf, 0)
|
|
Expect(err).To(MatchError(ErrTokenInvalid))
|
|
})
|
|
})
|
|
|
|
Describe("paramsFromToken", func() {
|
|
It("returns error when media ID is missing", func() {
|
|
tokenAuth := jwtauth.New("HS256", []byte("test-secret"), nil)
|
|
token, _, err := tokenAuth.Encode(map[string]any{"ua": int64(1700000000)})
|
|
Expect(err).NotTo(HaveOccurred())
|
|
|
|
_, err = paramsFromToken(token)
|
|
Expect(err).To(MatchError(ContainSubstring("missing media ID")))
|
|
})
|
|
|
|
It("returns error when source timestamp is missing", func() {
|
|
tokenAuth := jwtauth.New("HS256", []byte("test-secret"), nil)
|
|
token, _, err := tokenAuth.Encode(map[string]any{"mid": "song-5"})
|
|
Expect(err).NotTo(HaveOccurred())
|
|
|
|
_, err = paramsFromToken(token)
|
|
Expect(err).To(MatchError(ContainSubstring("missing source timestamp")))
|
|
})
|
|
})
|
|
})
|