From f9aaa1a1fe66457e3b48f74b62a9bd8369305743 Mon Sep 17 00:00:00 2001 From: XShine555 Date: Sat, 30 May 2026 02:16:37 +0200 Subject: [PATCH 1/9] Add .gitattributes and .gitignore. --- .gitattributes | 63 +++++++++ .gitignore | 363 +++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 426 insertions(+) create mode 100644 .gitattributes create mode 100644 .gitignore diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..1ff0c42 --- /dev/null +++ b/.gitattributes @@ -0,0 +1,63 @@ +############################################################################### +# Set default behavior to automatically normalize line endings. +############################################################################### +* text=auto + +############################################################################### +# Set default behavior for command prompt diff. +# +# This is need for earlier builds of msysgit that does not have it on by +# default for csharp files. +# Note: This is only used by command line +############################################################################### +#*.cs diff=csharp + +############################################################################### +# Set the merge driver for project and solution files +# +# Merging from the command prompt will add diff markers to the files if there +# are conflicts (Merging from VS is not affected by the settings below, in VS +# the diff markers are never inserted). Diff markers may cause the following +# file extensions to fail to load in VS. An alternative would be to treat +# these files as binary and thus will always conflict and require user +# intervention with every merge. To do so, just uncomment the entries below +############################################################################### +#*.sln merge=binary +#*.csproj merge=binary +#*.vbproj merge=binary +#*.vcxproj merge=binary +#*.vcproj merge=binary +#*.dbproj merge=binary +#*.fsproj merge=binary +#*.lsproj merge=binary +#*.wixproj merge=binary +#*.modelproj merge=binary +#*.sqlproj merge=binary +#*.wwaproj merge=binary + +############################################################################### +# behavior for image files +# +# image files are treated as binary by default. +############################################################################### +#*.jpg binary +#*.png binary +#*.gif binary + +############################################################################### +# diff behavior for common document formats +# +# Convert binary document formats to text before diffing them. This feature +# is only available from the command line. Turn it on by uncommenting the +# entries below. +############################################################################### +#*.doc diff=astextplain +#*.DOC diff=astextplain +#*.docx diff=astextplain +#*.DOCX diff=astextplain +#*.dot diff=astextplain +#*.DOT diff=astextplain +#*.pdf diff=astextplain +#*.PDF diff=astextplain +#*.rtf diff=astextplain +#*.RTF diff=astextplain diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..9491a2f --- /dev/null +++ b/.gitignore @@ -0,0 +1,363 @@ +## Ignore Visual Studio temporary files, build results, and +## files generated by popular Visual Studio add-ons. +## +## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore + +# User-specific files +*.rsuser +*.suo +*.user +*.userosscache +*.sln.docstates + +# User-specific files (MonoDevelop/Xamarin Studio) +*.userprefs + +# Mono auto generated files +mono_crash.* + +# Build results +[Dd]ebug/ +[Dd]ebugPublic/ +[Rr]elease/ +[Rr]eleases/ +x64/ +x86/ +[Ww][Ii][Nn]32/ +[Aa][Rr][Mm]/ +[Aa][Rr][Mm]64/ +bld/ +[Bb]in/ +[Oo]bj/ +[Oo]ut/ +[Ll]og/ +[Ll]ogs/ + +# Visual Studio 2015/2017 cache/options directory +.vs/ +# Uncomment if you have tasks that create the project's static files in wwwroot +#wwwroot/ + +# Visual Studio 2017 auto generated files +Generated\ Files/ + +# MSTest test Results +[Tt]est[Rr]esult*/ +[Bb]uild[Ll]og.* + +# NUnit +*.VisualState.xml +TestResult.xml +nunit-*.xml + +# Build Results of an ATL Project +[Dd]ebugPS/ +[Rr]eleasePS/ +dlldata.c + +# Benchmark Results +BenchmarkDotNet.Artifacts/ + +# .NET Core +project.lock.json +project.fragment.lock.json +artifacts/ + +# ASP.NET Scaffolding +ScaffoldingReadMe.txt + +# StyleCop +StyleCopReport.xml + +# Files built by Visual Studio +*_i.c +*_p.c +*_h.h +*.ilk +*.meta +*.obj +*.iobj +*.pch +*.pdb +*.ipdb +*.pgc +*.pgd +*.rsp +*.sbr +*.tlb +*.tli +*.tlh +*.tmp +*.tmp_proj +*_wpftmp.csproj +*.log +*.vspscc +*.vssscc +.builds +*.pidb +*.svclog +*.scc + +# Chutzpah Test files +_Chutzpah* + +# Visual C++ cache files +ipch/ +*.aps +*.ncb +*.opendb +*.opensdf +*.sdf +*.cachefile +*.VC.db +*.VC.VC.opendb + +# Visual Studio profiler +*.psess +*.vsp +*.vspx +*.sap + +# Visual Studio Trace Files +*.e2e + +# TFS 2012 Local Workspace +$tf/ + +# Guidance Automation Toolkit +*.gpState + +# ReSharper is a .NET coding add-in +_ReSharper*/ +*.[Rr]e[Ss]harper +*.DotSettings.user + +# TeamCity is a build add-in +_TeamCity* + +# DotCover is a Code Coverage Tool +*.dotCover + +# AxoCover is a Code Coverage Tool +.axoCover/* +!.axoCover/settings.json + +# Coverlet is a free, cross platform Code Coverage Tool +coverage*.json +coverage*.xml +coverage*.info + +# Visual Studio code coverage results +*.coverage +*.coveragexml + +# NCrunch +_NCrunch_* +.*crunch*.local.xml +nCrunchTemp_* + +# MightyMoose +*.mm.* +AutoTest.Net/ + +# Web workbench (sass) +.sass-cache/ + +# Installshield output folder +[Ee]xpress/ + +# DocProject is a documentation generator add-in +DocProject/buildhelp/ +DocProject/Help/*.HxT +DocProject/Help/*.HxC +DocProject/Help/*.hhc +DocProject/Help/*.hhk +DocProject/Help/*.hhp +DocProject/Help/Html2 +DocProject/Help/html + +# Click-Once directory +publish/ + +# Publish Web Output +*.[Pp]ublish.xml +*.azurePubxml +# Note: Comment the next line if you want to checkin your web deploy settings, +# but database connection strings (with potential passwords) will be unencrypted +*.pubxml +*.publishproj + +# Microsoft Azure Web App publish settings. Comment the next line if you want to +# checkin your Azure Web App publish settings, but sensitive information contained +# in these scripts will be unencrypted +PublishScripts/ + +# NuGet Packages +*.nupkg +# NuGet Symbol Packages +*.snupkg +# The packages folder can be ignored because of Package Restore +**/[Pp]ackages/* +# except build/, which is used as an MSBuild target. +!**/[Pp]ackages/build/ +# Uncomment if necessary however generally it will be regenerated when needed +#!**/[Pp]ackages/repositories.config +# NuGet v3's project.json files produces more ignorable files +*.nuget.props +*.nuget.targets + +# Microsoft Azure Build Output +csx/ +*.build.csdef + +# Microsoft Azure Emulator +ecf/ +rcf/ + +# Windows Store app package directories and files +AppPackages/ +BundleArtifacts/ +Package.StoreAssociation.xml +_pkginfo.txt +*.appx +*.appxbundle +*.appxupload + +# Visual Studio cache files +# files ending in .cache can be ignored +*.[Cc]ache +# but keep track of directories ending in .cache +!?*.[Cc]ache/ + +# Others +ClientBin/ +~$* +*~ +*.dbmdl +*.dbproj.schemaview +*.jfm +*.pfx +*.publishsettings +orleans.codegen.cs + +# Including strong name files can present a security risk +# (https://github.com/github/gitignore/pull/2483#issue-259490424) +#*.snk + +# Since there are multiple workflows, uncomment next line to ignore bower_components +# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622) +#bower_components/ + +# RIA/Silverlight projects +Generated_Code/ + +# Backup & report files from converting an old project file +# to a newer Visual Studio version. Backup files are not needed, +# because we have git ;-) +_UpgradeReport_Files/ +Backup*/ +UpgradeLog*.XML +UpgradeLog*.htm +ServiceFabricBackup/ +*.rptproj.bak + +# SQL Server files +*.mdf +*.ldf +*.ndf + +# Business Intelligence projects +*.rdl.data +*.bim.layout +*.bim_*.settings +*.rptproj.rsuser +*- [Bb]ackup.rdl +*- [Bb]ackup ([0-9]).rdl +*- [Bb]ackup ([0-9][0-9]).rdl + +# Microsoft Fakes +FakesAssemblies/ + +# GhostDoc plugin setting file +*.GhostDoc.xml + +# Node.js Tools for Visual Studio +.ntvs_analysis.dat +node_modules/ + +# Visual Studio 6 build log +*.plg + +# Visual Studio 6 workspace options file +*.opt + +# Visual Studio 6 auto-generated workspace file (contains which files were open etc.) +*.vbw + +# Visual Studio LightSwitch build output +**/*.HTMLClient/GeneratedArtifacts +**/*.DesktopClient/GeneratedArtifacts +**/*.DesktopClient/ModelManifest.xml +**/*.Server/GeneratedArtifacts +**/*.Server/ModelManifest.xml +_Pvt_Extensions + +# Paket dependency manager +.paket/paket.exe +paket-files/ + +# FAKE - F# Make +.fake/ + +# CodeRush personal settings +.cr/personal + +# Python Tools for Visual Studio (PTVS) +__pycache__/ +*.pyc + +# Cake - Uncomment if you are using it +# tools/** +# !tools/packages.config + +# Tabs Studio +*.tss + +# Telerik's JustMock configuration file +*.jmconfig + +# BizTalk build output +*.btp.cs +*.btm.cs +*.odx.cs +*.xsd.cs + +# OpenCover UI analysis results +OpenCover/ + +# Azure Stream Analytics local run output +ASALocalRun/ + +# MSBuild Binary and Structured Log +*.binlog + +# NVidia Nsight GPU debugger configuration file +*.nvuser + +# MFractors (Xamarin productivity tool) working folder +.mfractor/ + +# Local History for Visual Studio +.localhistory/ + +# BeatPulse healthcheck temp database +healthchecksdb + +# Backup folder for Package Reference Convert tool in Visual Studio 2017 +MigrationBackup/ + +# Ionide (cross platform F# VS Code tools) working folder +.ionide/ + +# Fody - auto-generated XML schema +FodyWeavers.xsd \ No newline at end of file From f20391391ad0fa30b7ff68252ac8d794a0a2f4cc Mon Sep 17 00:00:00 2001 From: XShine555 Date: Sat, 30 May 2026 02:16:39 +0200 Subject: [PATCH 2/9] Add project files. --- Musify.StreamingGateway.slnx | 3 + .../Authentication/TicketValidator.cs | 52 +++++++++++++++++ .../StreamTicketValidationOptions.cs | 21 +++++++ .../Middleware/TicketValidationMiddleware.cs | 57 +++++++++++++++++++ StreamingGateway/Program.cs | 35 ++++++++++++ .../Properties/launchSettings.json | 14 +++++ StreamingGateway/StreamingGateway.csproj | 16 ++++++ StreamingGateway/appsettings.json | 41 +++++++++++++ 8 files changed, 239 insertions(+) create mode 100644 Musify.StreamingGateway.slnx create mode 100644 StreamingGateway/Authentication/TicketValidator.cs create mode 100644 StreamingGateway/Configuration/StreamTicketValidationOptions.cs create mode 100644 StreamingGateway/Middleware/TicketValidationMiddleware.cs create mode 100644 StreamingGateway/Program.cs create mode 100644 StreamingGateway/Properties/launchSettings.json create mode 100644 StreamingGateway/StreamingGateway.csproj create mode 100644 StreamingGateway/appsettings.json diff --git a/Musify.StreamingGateway.slnx b/Musify.StreamingGateway.slnx new file mode 100644 index 0000000..3626bbd --- /dev/null +++ b/Musify.StreamingGateway.slnx @@ -0,0 +1,3 @@ + + + diff --git a/StreamingGateway/Authentication/TicketValidator.cs b/StreamingGateway/Authentication/TicketValidator.cs new file mode 100644 index 0000000..5556e42 --- /dev/null +++ b/StreamingGateway/Authentication/TicketValidator.cs @@ -0,0 +1,52 @@ +using System.Security.Cryptography; +using Microsoft.Extensions.Options; +using Microsoft.IdentityModel.JsonWebTokens; +using Microsoft.IdentityModel.Tokens; +using Musify.StreamingGateway.Configuration; + +namespace Musify.StreamingGateway.Authentication; + +public sealed class TicketValidator : IDisposable +{ + private readonly StreamTicketValidationOptions options; + private readonly RSA rsa; + private readonly TokenValidationParameters validationParameters; + private readonly JsonWebTokenHandler handler = new(); + + public TicketValidator(IOptions options) + { + this.options = options.Value; + + rsa = RSA.Create(); + rsa.ImportFromPem(File.ReadAllText(this.options.PublicKeyPath)); + + validationParameters = new TokenValidationParameters + { + ValidateIssuer = true, + ValidIssuer = this.options.Issuer, + ValidateAudience = true, + ValidAudience = this.options.Audience, + ValidateLifetime = true, + ValidateIssuerSigningKey = true, + IssuerSigningKey = new RsaSecurityKey(rsa), + ValidAlgorithms = [SecurityAlgorithms.RsaSha256], + ClockSkew = TimeSpan.FromSeconds(30), + }; + } + + public async Task TryGetPrefixAsync(string? token) + { + if (string.IsNullOrWhiteSpace(token)) + return null; + + var result = await handler.ValidateTokenAsync(token, validationParameters); + if (!result.IsValid) + return null; + + return result.Claims.TryGetValue("prefix", out var prefix) + ? prefix as string + : null; + } + + public void Dispose() => rsa.Dispose(); +} diff --git a/StreamingGateway/Configuration/StreamTicketValidationOptions.cs b/StreamingGateway/Configuration/StreamTicketValidationOptions.cs new file mode 100644 index 0000000..7599c06 --- /dev/null +++ b/StreamingGateway/Configuration/StreamTicketValidationOptions.cs @@ -0,0 +1,21 @@ +using System.ComponentModel.DataAnnotations; + +namespace Musify.StreamingGateway.Configuration; + +public sealed class StreamTicketValidationOptions +{ + public const string SectionName = "StreamTicket"; + + [Required] + public required string PublicKeyPath { get; set; } + + [Required] + public string Audience { get; set; } = "media-gateway"; + + [Required] + public string Issuer { get; set; } = "musify-webapi"; + + public string QueryParameterName { get; set; } = "t"; + + public string MediaPathPrefix { get; set; } = "/media"; +} diff --git a/StreamingGateway/Middleware/TicketValidationMiddleware.cs b/StreamingGateway/Middleware/TicketValidationMiddleware.cs new file mode 100644 index 0000000..cba1fc3 --- /dev/null +++ b/StreamingGateway/Middleware/TicketValidationMiddleware.cs @@ -0,0 +1,57 @@ +using Microsoft.Extensions.Options; +using Musify.StreamingGateway.Authentication; +using Musify.StreamingGateway.Configuration; + +namespace Musify.StreamingGateway.Middleware; + +public sealed class TicketValidationMiddleware( + RequestDelegate next, + TicketValidator ticketValidator, + IOptions options, + ILogger logger) +{ + private readonly StreamTicketValidationOptions options = options.Value; + + public async Task InvokeAsync(HttpContext context) + { + var path = context.Request.Path; + + if (!path.StartsWithSegments(options.MediaPathPrefix, out var remaining)) + { + await next(context); + return; + } + + var token = context.Request.Query[options.QueryParameterName].ToString(); + var prefix = await ticketValidator.TryGetPrefixAsync(token); + + if (prefix is null) + { + logger.LogWarning("Rejected media request {Path}: missing or invalid ticket", path); + context.Response.StatusCode = StatusCodes.Status401Unauthorized; + return; + } + + var objectKey = remaining.Value?.TrimStart('/') ?? string.Empty; + if (!objectKey.StartsWith(prefix, StringComparison.Ordinal)) + { + logger.LogWarning("Rejected media request {ObjectKey}: outside authorized prefix {Prefix}", objectKey, prefix); + context.Response.StatusCode = StatusCodes.Status403Forbidden; + return; + } + + StripQueryParameter(context, options.QueryParameterName); + + await next(context); + } + + private static void StripQueryParameter(HttpContext context, string name) + { + var remaining = context.Request.Query + .Where(pair => !string.Equals(pair.Key, name, StringComparison.Ordinal)) + .SelectMany(pair => pair.Value.Select(value => new KeyValuePair(pair.Key, value))) + .ToList(); + + context.Request.QueryString = QueryString.Create(remaining); + } +} diff --git a/StreamingGateway/Program.cs b/StreamingGateway/Program.cs new file mode 100644 index 0000000..4e03270 --- /dev/null +++ b/StreamingGateway/Program.cs @@ -0,0 +1,35 @@ +using Musify.StreamingGateway.Authentication; +using Musify.StreamingGateway.Configuration; +using Musify.StreamingGateway.Middleware; + +var builder = WebApplication.CreateBuilder(args); + +builder.Services + .AddOptions() + .Bind(builder.Configuration.GetRequiredSection(StreamTicketValidationOptions.SectionName)) + .ValidateDataAnnotations() + .ValidateOnStart(); + +builder.Services.AddSingleton(); + +const string corsPolicy = "media-clients"; +var allowedOrigins = builder.Configuration.GetSection("Cors:AllowedOrigins").Get() ?? []; +builder.Services.AddCors(options => options.AddPolicy(corsPolicy, policy => policy + .WithOrigins(allowedOrigins) + .AllowAnyHeader() + .WithMethods("GET", "HEAD") + .WithExposedHeaders("Content-Range", "Accept-Ranges", "Content-Length"))); + +builder.Services + .AddReverseProxy() + .LoadFromConfig(builder.Configuration.GetSection("ReverseProxy")); + +var app = builder.Build(); + +app.MapGet("/health", () => Results.Ok("healthy")); + +app.UseCors(corsPolicy); +app.UseMiddleware(); +app.MapReverseProxy(); + +app.Run(); diff --git a/StreamingGateway/Properties/launchSettings.json b/StreamingGateway/Properties/launchSettings.json new file mode 100644 index 0000000..eaf1884 --- /dev/null +++ b/StreamingGateway/Properties/launchSettings.json @@ -0,0 +1,14 @@ +{ + "$schema": "https://json.schemastore.org/launchsettings.json", + "profiles": { + "StreamingGateway": { + "commandName": "Project", + "dotnetRunMessages": true, + "launchBrowser": false, + "applicationUrl": "http://localhost:8081", + "environmentVariables": { + "ASPNETCORE_ENVIRONMENT": "Development" + } + } + } +} diff --git a/StreamingGateway/StreamingGateway.csproj b/StreamingGateway/StreamingGateway.csproj new file mode 100644 index 0000000..bc16ead --- /dev/null +++ b/StreamingGateway/StreamingGateway.csproj @@ -0,0 +1,16 @@ + + + + net10.0 + enable + enable + Musify.StreamingGateway + media-gateway-2f1c9b6a-7d3e-4c0a-9a21-0b8e5d4c3f10 + + + + + + + + diff --git a/StreamingGateway/appsettings.json b/StreamingGateway/appsettings.json new file mode 100644 index 0000000..85e3e89 --- /dev/null +++ b/StreamingGateway/appsettings.json @@ -0,0 +1,41 @@ +{ + "Logging": { + "LogLevel": { + "Default": "Information", + "Microsoft.AspNetCore": "Warning", + "Yarp": "Information" + } + }, + "AllowedHosts": "*", + + "StreamTicket": { + "PublicKeyPath": "D:\\weed\\stream_public.pem", + "Audience": "media-gateway", + "Issuer": "musify-webapi", + "QueryParameterName": "t", + "MediaPathPrefix": "/media" + }, + + "Cors": { + "AllowedOrigins": [ "http://localhost:5173", "http://localhost:3000" ] + }, + + "ReverseProxy": { + "Routes": { + "media": { + "ClusterId": "seaweed-filer", + "Match": { "Path": "/media/{**rest}" }, + "Transforms": [ + { "PathPattern": "/buckets/webapi-storage/{**rest}" } + ] + } + }, + "Clusters": { + "seaweed-filer": { + "Destinations": { + "filer": { "Address": "http://localhost:8888/" } + } + } + } + } +} From 47bff00268839daaad8236e892c6120f352abf0a Mon Sep 17 00:00:00 2001 From: XShine555 Date: Sat, 30 May 2026 02:24:55 +0200 Subject: [PATCH 3/9] Changes --- .../Authentication/TicketValidator.cs | 49 +++++++++++-------- .../Middleware/TicketValidationMiddleware.cs | 6 ++- StreamingGateway/StreamingGateway.csproj | 1 + 3 files changed, 34 insertions(+), 22 deletions(-) diff --git a/StreamingGateway/Authentication/TicketValidator.cs b/StreamingGateway/Authentication/TicketValidator.cs index 5556e42..b3fb469 100644 --- a/StreamingGateway/Authentication/TicketValidator.cs +++ b/StreamingGateway/Authentication/TicketValidator.cs @@ -1,4 +1,6 @@ +using System.Security.Claims; using System.Security.Cryptography; +using Ardalis.Result; using Microsoft.Extensions.Options; using Microsoft.IdentityModel.JsonWebTokens; using Microsoft.IdentityModel.Tokens; @@ -8,45 +10,52 @@ namespace Musify.StreamingGateway.Authentication; public sealed class TicketValidator : IDisposable { - private readonly StreamTicketValidationOptions options; - private readonly RSA rsa; - private readonly TokenValidationParameters validationParameters; - private readonly JsonWebTokenHandler handler = new(); + private readonly StreamTicketValidationOptions _options; + private readonly RSA _rsa; + private readonly TokenValidationParameters _validationParameters; + private readonly JsonWebTokenHandler _handler = new(); public TicketValidator(IOptions options) { - this.options = options.Value; + _options = options.Value; - rsa = RSA.Create(); - rsa.ImportFromPem(File.ReadAllText(this.options.PublicKeyPath)); + _rsa = RSA.Create(); + _rsa.ImportFromPem(File.ReadAllText(_options.PublicKeyPath)); - validationParameters = new TokenValidationParameters + _validationParameters = new TokenValidationParameters { ValidateIssuer = true, - ValidIssuer = this.options.Issuer, + ValidIssuer = _options.Issuer, ValidateAudience = true, - ValidAudience = this.options.Audience, + ValidAudience = _options.Audience, ValidateLifetime = true, ValidateIssuerSigningKey = true, - IssuerSigningKey = new RsaSecurityKey(rsa), + IssuerSigningKey = new RsaSecurityKey(_rsa), ValidAlgorithms = [SecurityAlgorithms.RsaSha256], ClockSkew = TimeSpan.FromSeconds(30), }; } - public async Task TryGetPrefixAsync(string? token) + public async Task> ValidateTicketAsync(string? token) { if (string.IsNullOrWhiteSpace(token)) - return null; + return Result.Unauthorized(); - var result = await handler.ValidateTokenAsync(token, validationParameters); - if (!result.IsValid) - return null; + var result = await _handler.ValidateTokenAsync(token, _validationParameters); + if (result.IsValid) + return Result.Unauthorized(); - return result.Claims.TryGetValue("prefix", out var prefix) - ? prefix as string - : null; + if (!result.Claims.TryGetValue("prefix", out var claim)) + return Result.Unauthorized(); + + if (claim is not string prefix) + return Result.Unauthorized(); + + if (string.IsNullOrEmpty(prefix)) + return Result.Unauthorized(); + + return Result.Success(prefix); } - public void Dispose() => rsa.Dispose(); + public void Dispose() => _rsa.Dispose(); } diff --git a/StreamingGateway/Middleware/TicketValidationMiddleware.cs b/StreamingGateway/Middleware/TicketValidationMiddleware.cs index cba1fc3..e4ebbcf 100644 --- a/StreamingGateway/Middleware/TicketValidationMiddleware.cs +++ b/StreamingGateway/Middleware/TicketValidationMiddleware.cs @@ -23,15 +23,17 @@ public sealed class TicketValidationMiddleware( } var token = context.Request.Query[options.QueryParameterName].ToString(); - var prefix = await ticketValidator.TryGetPrefixAsync(token); + var validation = await ticketValidator.ValidateTicketAsync(token); - if (prefix is null) + if (!validation.IsSuccess) { logger.LogWarning("Rejected media request {Path}: missing or invalid ticket", path); context.Response.StatusCode = StatusCodes.Status401Unauthorized; return; } + var prefix = validation.Value; + var objectKey = remaining.Value?.TrimStart('/') ?? string.Empty; if (!objectKey.StartsWith(prefix, StringComparison.Ordinal)) { diff --git a/StreamingGateway/StreamingGateway.csproj b/StreamingGateway/StreamingGateway.csproj index bc16ead..7b7346b 100644 --- a/StreamingGateway/StreamingGateway.csproj +++ b/StreamingGateway/StreamingGateway.csproj @@ -9,6 +9,7 @@ + From 67d340fcaa6b3cc29d79999da4c3b9258567536e Mon Sep 17 00:00:00 2001 From: XShine555 Date: Sat, 30 May 2026 02:26:33 +0200 Subject: [PATCH 4/9] BugFix --- StreamingGateway/Authentication/TicketValidator.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/StreamingGateway/Authentication/TicketValidator.cs b/StreamingGateway/Authentication/TicketValidator.cs index b3fb469..9bdf23f 100644 --- a/StreamingGateway/Authentication/TicketValidator.cs +++ b/StreamingGateway/Authentication/TicketValidator.cs @@ -42,7 +42,7 @@ public sealed class TicketValidator : IDisposable return Result.Unauthorized(); var result = await _handler.ValidateTokenAsync(token, _validationParameters); - if (result.IsValid) + if (!result.IsValid) return Result.Unauthorized(); if (!result.Claims.TryGetValue("prefix", out var claim)) From dc1d3c2269e3a62e946981a99fa47ceb60d8228e Mon Sep 17 00:00:00 2001 From: XShine555 Date: Sat, 30 May 2026 02:27:12 +0200 Subject: [PATCH 5/9] Remove unused using --- StreamingGateway/Authentication/TicketValidator.cs | 1 - 1 file changed, 1 deletion(-) diff --git a/StreamingGateway/Authentication/TicketValidator.cs b/StreamingGateway/Authentication/TicketValidator.cs index 9bdf23f..dd0cf12 100644 --- a/StreamingGateway/Authentication/TicketValidator.cs +++ b/StreamingGateway/Authentication/TicketValidator.cs @@ -1,4 +1,3 @@ -using System.Security.Claims; using System.Security.Cryptography; using Ardalis.Result; using Microsoft.Extensions.Options; From 834d7a25c10366243177267c390769258fe859b8 Mon Sep 17 00:00:00 2001 From: XShine555 Date: Sat, 30 May 2026 02:30:18 +0200 Subject: [PATCH 6/9] Use development --- StreamingGateway/appsettings.Development.json | 32 ++++++++++++++++++ StreamingGateway/appsettings.json | 33 +------------------ 2 files changed, 33 insertions(+), 32 deletions(-) create mode 100644 StreamingGateway/appsettings.Development.json diff --git a/StreamingGateway/appsettings.Development.json b/StreamingGateway/appsettings.Development.json new file mode 100644 index 0000000..f18846a --- /dev/null +++ b/StreamingGateway/appsettings.Development.json @@ -0,0 +1,32 @@ +{ + "StreamTicket": { + "PublicKeyPath": "D:\\weed\\stream_public.pem", + "Audience": "media-gateway", + "Issuer": "musify-webapi", + "QueryParameterName": "t", + "MediaPathPrefix": "/media" + }, + + "Cors": { + "AllowedOrigins": [ "http://localhost:5173", "http://localhost:3000" ] + }, + + "ReverseProxy": { + "Routes": { + "media": { + "ClusterId": "seaweed-filer", + "Match": { "Path": "/media/{**rest}" }, + "Transforms": [ + { "PathPattern": "/buckets/webapi-storage/{**rest}" } + ] + } + }, + "Clusters": { + "seaweed-filer": { + "Destinations": { + "filer": { "Address": "http://localhost:8888/" } + } + } + } + } +} diff --git a/StreamingGateway/appsettings.json b/StreamingGateway/appsettings.json index 85e3e89..c382627 100644 --- a/StreamingGateway/appsettings.json +++ b/StreamingGateway/appsettings.json @@ -6,36 +6,5 @@ "Yarp": "Information" } }, - "AllowedHosts": "*", - - "StreamTicket": { - "PublicKeyPath": "D:\\weed\\stream_public.pem", - "Audience": "media-gateway", - "Issuer": "musify-webapi", - "QueryParameterName": "t", - "MediaPathPrefix": "/media" - }, - - "Cors": { - "AllowedOrigins": [ "http://localhost:5173", "http://localhost:3000" ] - }, - - "ReverseProxy": { - "Routes": { - "media": { - "ClusterId": "seaweed-filer", - "Match": { "Path": "/media/{**rest}" }, - "Transforms": [ - { "PathPattern": "/buckets/webapi-storage/{**rest}" } - ] - } - }, - "Clusters": { - "seaweed-filer": { - "Destinations": { - "filer": { "Address": "http://localhost:8888/" } - } - } - } - } + "AllowedHosts": "*" } From 03d9fa054f02bcc9e547449da3a932037155fc98 Mon Sep 17 00:00:00 2001 From: XShine555 Date: Sun, 31 May 2026 19:25:15 +0200 Subject: [PATCH 7/9] Allow any CORS origin in Development --- StreamingGateway/Program.cs | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/StreamingGateway/Program.cs b/StreamingGateway/Program.cs index 4e03270..101bfb4 100644 --- a/StreamingGateway/Program.cs +++ b/StreamingGateway/Program.cs @@ -14,11 +14,17 @@ builder.Services.AddSingleton(); const string corsPolicy = "media-clients"; var allowedOrigins = builder.Configuration.GetSection("Cors:AllowedOrigins").Get() ?? []; -builder.Services.AddCors(options => options.AddPolicy(corsPolicy, policy => policy - .WithOrigins(allowedOrigins) - .AllowAnyHeader() - .WithMethods("GET", "HEAD") - .WithExposedHeaders("Content-Range", "Accept-Ranges", "Content-Length"))); +builder.Services.AddCors(options => options.AddPolicy(corsPolicy, policy => +{ + if (builder.Environment.IsDevelopment()) + policy.AllowAnyOrigin(); + else + policy.WithOrigins(allowedOrigins); + + policy.AllowAnyHeader() + .WithMethods("GET", "HEAD") + .WithExposedHeaders("Content-Range", "Accept-Ranges", "Content-Length"); +})); builder.Services .AddReverseProxy() From 55c73cbb3dd0cb5b315701e45f93b0d7ee3404ea Mon Sep 17 00:00:00 2001 From: XShine555 Date: Mon, 1 Jun 2026 20:50:46 +0200 Subject: [PATCH 8/9] Changes --- StreamingGateway/Middleware/TicketValidationMiddleware.cs | 1 - StreamingGateway/Program.cs | 7 ++++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/StreamingGateway/Middleware/TicketValidationMiddleware.cs b/StreamingGateway/Middleware/TicketValidationMiddleware.cs index e4ebbcf..64df76b 100644 --- a/StreamingGateway/Middleware/TicketValidationMiddleware.cs +++ b/StreamingGateway/Middleware/TicketValidationMiddleware.cs @@ -43,7 +43,6 @@ public sealed class TicketValidationMiddleware( } StripQueryParameter(context, options.QueryParameterName); - await next(context); } diff --git a/StreamingGateway/Program.cs b/StreamingGateway/Program.cs index 101bfb4..0ee5a1c 100644 --- a/StreamingGateway/Program.cs +++ b/StreamingGateway/Program.cs @@ -2,7 +2,7 @@ using Musify.StreamingGateway.Authentication; using Musify.StreamingGateway.Configuration; using Musify.StreamingGateway.Middleware; -var builder = WebApplication.CreateBuilder(args); +var builder = WebApplication.CreateBuilder(); builder.Services .AddOptions() @@ -24,7 +24,7 @@ builder.Services.AddCors(options => options.AddPolicy(corsPolicy, policy => policy.AllowAnyHeader() .WithMethods("GET", "HEAD") .WithExposedHeaders("Content-Range", "Accept-Ranges", "Content-Length"); -})); +} )); builder.Services .AddReverseProxy() @@ -32,7 +32,8 @@ builder.Services var app = builder.Build(); -app.MapGet("/health", () => Results.Ok("healthy")); +app.MapGet("/health", () => Results.Ok("healthy")) + .WithSummary("Health Check Endpoint"); app.UseCors(corsPolicy); app.UseMiddleware(); From a8ff05892dc55b13f54cbbf1da41572177cc20a0 Mon Sep 17 00:00:00 2001 From: XShine555 Date: Tue, 2 Jun 2026 19:05:19 +0200 Subject: [PATCH 9/9] Serve audio .m4a by range; remove DASH manifest rewriting --- .../Configuration/StreamTicketValidationOptions.cs | 2 ++ StreamingGateway/Middleware/TicketValidationMiddleware.cs | 5 +++++ 2 files changed, 7 insertions(+) diff --git a/StreamingGateway/Configuration/StreamTicketValidationOptions.cs b/StreamingGateway/Configuration/StreamTicketValidationOptions.cs index 7599c06..8f21c17 100644 --- a/StreamingGateway/Configuration/StreamTicketValidationOptions.cs +++ b/StreamingGateway/Configuration/StreamTicketValidationOptions.cs @@ -17,5 +17,7 @@ public sealed class StreamTicketValidationOptions public string QueryParameterName { get; set; } = "t"; + public string HeaderName { get; set; } = "X-Stream-Ticket"; + public string MediaPathPrefix { get; set; } = "/media"; } diff --git a/StreamingGateway/Middleware/TicketValidationMiddleware.cs b/StreamingGateway/Middleware/TicketValidationMiddleware.cs index 64df76b..b282d39 100644 --- a/StreamingGateway/Middleware/TicketValidationMiddleware.cs +++ b/StreamingGateway/Middleware/TicketValidationMiddleware.cs @@ -23,6 +23,11 @@ public sealed class TicketValidationMiddleware( } var token = context.Request.Query[options.QueryParameterName].ToString(); + if (string.IsNullOrEmpty(token)) + { + token = context.Request.Headers[options.HeaderName].ToString(); + } + var validation = await ticketValidator.ValidateTicketAsync(token); if (!validation.IsSuccess)