mirror of
https://github.com/SoPat712/allstarr.git
synced 2026-02-10 16:08:39 -05:00
Release v1.0.0 - Production Ready
Major Features: - Spotify playlist injection with missing tracks search - Transparent proxy authentication system - WebSocket session management for external tracks - Manual track mapping and favorites system - Lyrics support (Spotify + LRCLib) with prefetching - Admin dashboard with analytics and configuration - Performance optimizations with health checks and endpoint racing - Comprehensive caching and memory management Performance Improvements: - Quick health checks (3s timeout) before trying endpoints - Health check results cached for 30 seconds - 5 minute timeout for large artist responses - Background Odesli conversion after streaming starts - Parallel lyrics prefetching - Endpoint benchmarking and racing - 16 SquidWTF endpoints with load balancing Reliability: - Automatic endpoint fallback and failover - Token expiration handling - Concurrent request optimization - Memory leak fixes - Proper session cleanup User Experience: - Web UI for configuration and playlist management - Real-time progress tracking - API analytics dashboard - Manual track mapping interface - Playlist statistics and health monitoring
This commit is contained in:
@@ -2,239 +2,44 @@ using Microsoft.AspNetCore.Mvc;
|
||||
using Microsoft.AspNetCore.Mvc.Filters;
|
||||
using Microsoft.Extensions.Options;
|
||||
using allstarr.Models.Settings;
|
||||
using System.Text.Json;
|
||||
using System.Text.RegularExpressions;
|
||||
|
||||
namespace allstarr.Filters;
|
||||
|
||||
/// <summary>
|
||||
/// Authentication filter for Jellyfin API endpoints.
|
||||
/// Validates client credentials against configured username and API key.
|
||||
/// Clients can authenticate via:
|
||||
/// - Authorization header: MediaBrowser Token="apikey"
|
||||
/// - X-Emby-Token header
|
||||
/// - Query parameter: api_key
|
||||
/// - JSON body (for login endpoints): Username/Pw fields
|
||||
/// REMOVED: Authentication filter for Jellyfin API endpoints.
|
||||
///
|
||||
/// This filter has been removed because Allstarr acts as a TRANSPARENT PROXY.
|
||||
/// Clients authenticate directly with Jellyfin through the proxy, not with the proxy itself.
|
||||
///
|
||||
/// Authentication flow:
|
||||
/// 1. Client sends credentials to /Users/AuthenticateByName
|
||||
/// 2. Proxy forwards request to Jellyfin (no validation)
|
||||
/// 3. Jellyfin validates credentials and returns AccessToken
|
||||
/// 4. Client uses AccessToken in subsequent requests
|
||||
/// 5. Proxy forwards token to Jellyfin for validation
|
||||
///
|
||||
/// The proxy NEVER validates credentials or tokens - that's Jellyfin's job.
|
||||
/// The proxy only forwards authentication headers transparently.
|
||||
///
|
||||
/// If you need to restrict access to the proxy itself, use network-level controls
|
||||
/// (firewall, VPN, reverse proxy with auth) instead of application-level auth.
|
||||
/// </summary>
|
||||
public partial class JellyfinAuthFilter : IAsyncActionFilter
|
||||
public class JellyfinAuthFilter : IAsyncActionFilter
|
||||
{
|
||||
private readonly JellyfinSettings _settings;
|
||||
private readonly ILogger<JellyfinAuthFilter> _logger;
|
||||
|
||||
public JellyfinAuthFilter(
|
||||
IOptions<JellyfinSettings> settings,
|
||||
ILogger<JellyfinAuthFilter> logger)
|
||||
public JellyfinAuthFilter(ILogger<JellyfinAuthFilter> logger)
|
||||
{
|
||||
_settings = settings.Value;
|
||||
_logger = logger;
|
||||
}
|
||||
|
||||
public async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
|
||||
{
|
||||
// Skip auth if no credentials configured (open mode)
|
||||
if (string.IsNullOrEmpty(_settings.ClientUsername) || string.IsNullOrEmpty(_settings.ApiKey))
|
||||
{
|
||||
_logger.LogDebug("Auth skipped - no client credentials configured");
|
||||
await next();
|
||||
return;
|
||||
}
|
||||
|
||||
var request = context.HttpContext.Request;
|
||||
// This filter is now a no-op - all authentication is handled by Jellyfin
|
||||
// Keeping the class for backwards compatibility but it does nothing
|
||||
|
||||
_logger.LogTrace("JellyfinAuthFilter: Transparent proxy mode - no authentication check");
|
||||
|
||||
// Try to extract credentials from various sources
|
||||
var (username, token) = await ExtractCredentialsAsync(request);
|
||||
|
||||
// Validate credentials
|
||||
if (!ValidateCredentials(username, token))
|
||||
{
|
||||
_logger.LogWarning("Authentication failed for user '{Username}' from {IP}",
|
||||
username ?? "unknown",
|
||||
context.HttpContext.Connection.RemoteIpAddress);
|
||||
|
||||
context.Result = new UnauthorizedObjectResult(new
|
||||
{
|
||||
error = "Invalid credentials",
|
||||
message = "Authentication required. Provide valid username and API key."
|
||||
});
|
||||
return;
|
||||
}
|
||||
|
||||
_logger.LogDebug("Authentication successful for user '{Username}'", username);
|
||||
await next();
|
||||
}
|
||||
|
||||
private async Task<(string? username, string? token)> ExtractCredentialsAsync(HttpRequest request)
|
||||
{
|
||||
string? username = null;
|
||||
string? token = null;
|
||||
|
||||
// 1. Check Authorization header (MediaBrowser format)
|
||||
if (request.Headers.TryGetValue("Authorization", out var authHeader))
|
||||
{
|
||||
var authValue = authHeader.ToString();
|
||||
|
||||
// Parse MediaBrowser auth header: MediaBrowser Client="...", Token="..."
|
||||
if (authValue.StartsWith("MediaBrowser", StringComparison.OrdinalIgnoreCase))
|
||||
{
|
||||
token = ExtractTokenFromMediaBrowser(authValue);
|
||||
username = ExtractUserIdFromMediaBrowser(authValue);
|
||||
}
|
||||
// Basic auth: Basic base64(username:password)
|
||||
else if (authValue.StartsWith("Basic ", StringComparison.OrdinalIgnoreCase))
|
||||
{
|
||||
(username, token) = ParseBasicAuth(authValue);
|
||||
}
|
||||
}
|
||||
|
||||
// 2. Check X-Emby-Token header
|
||||
if (string.IsNullOrEmpty(token) && request.Headers.TryGetValue("X-Emby-Token", out var embyToken))
|
||||
{
|
||||
token = embyToken.ToString();
|
||||
}
|
||||
|
||||
// 3. Check X-MediaBrowser-Token header
|
||||
if (string.IsNullOrEmpty(token) && request.Headers.TryGetValue("X-MediaBrowser-Token", out var mbToken))
|
||||
{
|
||||
token = mbToken.ToString();
|
||||
}
|
||||
|
||||
// 4. Check X-Emby-Authorization header (alternative format)
|
||||
if (string.IsNullOrEmpty(token) && request.Headers.TryGetValue("X-Emby-Authorization", out var embyAuth))
|
||||
{
|
||||
token = ExtractTokenFromMediaBrowser(embyAuth.ToString());
|
||||
if (string.IsNullOrEmpty(username))
|
||||
{
|
||||
username = ExtractUserIdFromMediaBrowser(embyAuth.ToString());
|
||||
}
|
||||
}
|
||||
|
||||
// 5. Check query parameters
|
||||
if (string.IsNullOrEmpty(token))
|
||||
{
|
||||
token = request.Query["api_key"].FirstOrDefault()
|
||||
?? request.Query["ApiKey"].FirstOrDefault()
|
||||
?? request.Query["X-Emby-Token"].FirstOrDefault();
|
||||
}
|
||||
|
||||
if (string.IsNullOrEmpty(username))
|
||||
{
|
||||
username = request.Query["userId"].FirstOrDefault()
|
||||
?? request.Query["UserId"].FirstOrDefault()
|
||||
?? request.Query["u"].FirstOrDefault();
|
||||
}
|
||||
|
||||
// 6. Check JSON body for login endpoints (Jellyfin: Username/Pw, Navidrome: username/password)
|
||||
if ((string.IsNullOrEmpty(username) || string.IsNullOrEmpty(token)) &&
|
||||
request.ContentType?.Contains("application/json", StringComparison.OrdinalIgnoreCase) == true &&
|
||||
request.ContentLength > 0)
|
||||
{
|
||||
var (bodyUsername, bodyPassword) = await ExtractCredentialsFromBodyAsync(request);
|
||||
if (string.IsNullOrEmpty(username)) username = bodyUsername;
|
||||
if (string.IsNullOrEmpty(token)) token = bodyPassword;
|
||||
}
|
||||
|
||||
return (username, token);
|
||||
}
|
||||
|
||||
private async Task<(string? username, string? password)> ExtractCredentialsFromBodyAsync(HttpRequest request)
|
||||
{
|
||||
try
|
||||
{
|
||||
request.EnableBuffering();
|
||||
request.Body.Position = 0;
|
||||
|
||||
using var reader = new StreamReader(request.Body, leaveOpen: true);
|
||||
var body = await reader.ReadToEndAsync();
|
||||
request.Body.Position = 0;
|
||||
|
||||
if (string.IsNullOrEmpty(body)) return (null, null);
|
||||
|
||||
using var doc = JsonDocument.Parse(body);
|
||||
var root = doc.RootElement;
|
||||
|
||||
// Try Jellyfin format: Username, Pw
|
||||
string? username = null;
|
||||
string? password = null;
|
||||
|
||||
if (root.TryGetProperty("Username", out var usernameProp))
|
||||
username = usernameProp.GetString();
|
||||
else if (root.TryGetProperty("username", out var usernameLowerProp))
|
||||
username = usernameLowerProp.GetString();
|
||||
|
||||
if (root.TryGetProperty("Pw", out var pwProp))
|
||||
password = pwProp.GetString();
|
||||
else if (root.TryGetProperty("pw", out var pwLowerProp))
|
||||
password = pwLowerProp.GetString();
|
||||
else if (root.TryGetProperty("Password", out var passwordProp))
|
||||
password = passwordProp.GetString();
|
||||
else if (root.TryGetProperty("password", out var passwordLowerProp))
|
||||
password = passwordLowerProp.GetString();
|
||||
|
||||
return (username, password);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
_logger.LogDebug(ex, "Failed to parse credentials from request body");
|
||||
return (null, null);
|
||||
}
|
||||
}
|
||||
|
||||
private string? ExtractTokenFromMediaBrowser(string header)
|
||||
{
|
||||
var match = TokenRegex().Match(header);
|
||||
return match.Success ? match.Groups[1].Value : null;
|
||||
}
|
||||
|
||||
private string? ExtractUserIdFromMediaBrowser(string header)
|
||||
{
|
||||
var match = UserIdRegex().Match(header);
|
||||
return match.Success ? match.Groups[1].Value : null;
|
||||
}
|
||||
|
||||
private static (string? username, string? password) ParseBasicAuth(string authHeader)
|
||||
{
|
||||
try
|
||||
{
|
||||
var base64 = authHeader["Basic ".Length..].Trim();
|
||||
var bytes = Convert.FromBase64String(base64);
|
||||
var credentials = System.Text.Encoding.UTF8.GetString(bytes);
|
||||
var parts = credentials.Split(':', 2);
|
||||
|
||||
return parts.Length == 2 ? (parts[0], parts[1]) : (null, null);
|
||||
}
|
||||
catch
|
||||
{
|
||||
return (null, null);
|
||||
}
|
||||
}
|
||||
|
||||
private bool ValidateCredentials(string? username, string? token)
|
||||
{
|
||||
// Must have token (API key used as password)
|
||||
if (string.IsNullOrEmpty(token))
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
// Token must match API key
|
||||
if (!string.Equals(token, _settings.ApiKey, StringComparison.Ordinal))
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
// If username provided, it must match configured client username
|
||||
if (!string.IsNullOrEmpty(username) &&
|
||||
!string.Equals(username, _settings.ClientUsername, StringComparison.OrdinalIgnoreCase))
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
[GeneratedRegex(@"Token=""([^""]+)""", RegexOptions.IgnoreCase)]
|
||||
private static partial Regex TokenRegex();
|
||||
|
||||
[GeneratedRegex(@"UserId=""([^""]+)""", RegexOptions.IgnoreCase)]
|
||||
private static partial Regex UserIdRegex();
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user