NotS1mp/Musify
0
0
Fork 0
Code Issues 23 Pull Requests Actions Packages Projects Releases Wiki Activity

Add anonymous playback with an optional Spotify-style preview cap

Browse Source 
New Playback:AllowAnonymousListening / Playback:AnonymousFragmentSeconds
settings control whether a request without a session can stream at all,
and if so, whether it's limited to a fragment instead of the full track:

- GET /tracks/{id}/stream and GET /youtube/tracks/{videoId}/stream no
  longer require authorization outright; the handlers gate on the config
  instead, so both keep working exactly as before when it's off (the
  default).
- The fragment cap is enforced by the Streaming Gateway, not the client:
  the stream ticket now carries an optional maxBytes claim (computed from
  AnonymousFragmentSeconds and the transcoder's known bitrate), and
  TicketValidationMiddleware clamps the Range it forwards to SeaweedFS to
  stay under it — synthesizing one if the request didn't send one, and
  answering 416 outright if the requested range starts past the cap.
- A YouTube track that hasn't been provisioned server-side yet streams
  straight from YouTube's CDN, bypassing the Gateway entirely — there's no
  way to cap that, so an anonymous request for one is refused (409) instead
  of silently handing out an uncapped stream.
- ListeningHistory has a non-nullable UserId, so anonymous plays simply
  don't get recorded rather than trying to force a row through the FK.

Also fixes a real, pre-existing bug this surfaced: the AppSettings.Development.json
of the Api, Worker, and StreamingGateway all pointed StreamTicket/Workers
paths at "../../deploy/..." — one directory short of deploy/'s actual
location at the repo root relative to each project's own folder. Docker
never hit this (it mounts an absolute /keys path), so it had apparently
never been exercised via `dotnet run` before.
This commit is contained in:
Admin
2026-09-10 09:56:57 +02:00
parent ca04a81e81
commit 356e5c1101
22 changed files with 486 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/Tests/Musify.StreamingGateway.Tests/Authentication/TicketValidatorTests.cs
+43 -25
View File
@@ -33,15 +33,19 @@ namespace Musify.StreamingGateway.Tests.Authentication
}));
private string IssueToken(string prefix = "Tracks/ProcessedAudios/abc/", string issuer = Issuer, string audience = Audience,
DateTime? expires = null, DateTime? notBefore = null)
DateTime? expires = null, DateTime? notBefore = null, long? maxBytes = null)
{
var claims = new Dictionary<string, object> { ["prefix"] = prefix };
if (maxBytes is not null)
claims["maxBytes"] = maxBytes.Value.ToString();
var descriptor = new SecurityTokenDescriptor
{
Issuer = issuer,
Audience = audience,
NotBefore = notBefore ?? DateTime.UtcNow.AddMinutes(-1),
Expires = expires ?? DateTime.UtcNow.AddMinutes(5),
Claims = new Dictionary<string, object> { ["prefix"] = prefix },
Claims = claims,
SigningCredentials = new SigningCredentials(new RsaSecurityKey(rsa), SecurityAlgorithms.RsaSha256),
};
return tokenHandler.CreateToken(descriptor);
@@ -52,62 +56,76 @@ namespace Musify.StreamingGateway.Tests.Authentication
{
var token = IssueToken(prefix: "Tracks/ProcessedAudios/xyz/");
var prefix = await CreateValidator().ValidateTicketAsync(token);
var result = await CreateValidator().ValidateTicketAsync(token);
Assert.Equal("Tracks/ProcessedAudios/xyz/", prefix);
Assert.True(result.IsValid);
Assert.Equal("Tracks/ProcessedAudios/xyz/", result.Prefix);
Assert.Null(result.MaxBytes);
}
[Fact]
public async Task ValidateTicketAsync_TokenWithMaxBytesClaim_ReturnsIt()
{
var token = IssueToken(maxBytes: 480_000);
var result = await CreateValidator().ValidateTicketAsync(token);
Assert.True(result.IsValid);
Assert.Equal(480_000, result.MaxBytes);
}
[Theory]
[InlineData(null)]
[InlineData("")]
[InlineData(" ")]
public async Task ValidateTicketAsync_BlankToken_ReturnsEmptyString(string? token)
public async Task ValidateTicketAsync_BlankToken_ReturnsInvalid(string? token)
{
var prefix = await CreateValidator().ValidateTicketAsync(token);
var result = await CreateValidator().ValidateTicketAsync(token);
Assert.Equal(string.Empty, prefix);
Assert.False(result.IsValid);
Assert.Equal(string.Empty, result.Prefix);
}
[Fact]
public async Task ValidateTicketAsync_MalformedToken_ReturnsEmptyString()
public async Task ValidateTicketAsync_MalformedToken_ReturnsInvalid()
{
var prefix = await CreateValidator().ValidateTicketAsync("not-a-real-jwt");
var result = await CreateValidator().ValidateTicketAsync("not-a-real-jwt");
Assert.Equal(string.Empty, prefix);
Assert.False(result.IsValid);
}
[Fact]
public async Task ValidateTicketAsync_ExpiredToken_ReturnsEmptyString()
public async Task ValidateTicketAsync_ExpiredToken_ReturnsInvalid()
{
var token = IssueToken(expires: DateTime.UtcNow.AddMinutes(-40), notBefore: DateTime.UtcNow.AddMinutes(-50));
var prefix = await CreateValidator().ValidateTicketAsync(token);
var result = await CreateValidator().ValidateTicketAsync(token);
Assert.Equal(string.Empty, prefix);
Assert.False(result.IsValid);
}
[Fact]
public async Task ValidateTicketAsync_WrongIssuer_ReturnsEmptyString()
public async Task ValidateTicketAsync_WrongIssuer_ReturnsInvalid()
{
var token = IssueToken(issuer: "someone-else");
var prefix = await CreateValidator().ValidateTicketAsync(token);
var result = await CreateValidator().ValidateTicketAsync(token);
Assert.Equal(string.Empty, prefix);
Assert.False(result.IsValid);
}
[Fact]
public async Task ValidateTicketAsync_WrongAudience_ReturnsEmptyString()
public async Task ValidateTicketAsync_WrongAudience_ReturnsInvalid()
{
var token = IssueToken(audience: "someone-else");
var prefix = await CreateValidator().ValidateTicketAsync(token);
var result = await CreateValidator().ValidateTicketAsync(token);
Assert.Equal(string.Empty, prefix);
Assert.False(result.IsValid);
}
[Fact]
public async Task ValidateTicketAsync_SignedWithADifferentKey_ReturnsEmptyString()
public async Task ValidateTicketAsync_SignedWithADifferentKey_ReturnsInvalid()
{
using var otherKey = RSA.Create(2048);
var descriptor = new SecurityTokenDescriptor
@@ -121,13 +139,13 @@ namespace Musify.StreamingGateway.Tests.Authentication
};
var token = tokenHandler.CreateToken(descriptor);
var prefix = await CreateValidator().ValidateTicketAsync(token);
var result = await CreateValidator().ValidateTicketAsync(token);
Assert.Equal(string.Empty, prefix);
Assert.False(result.IsValid);
}
[Fact]
public async Task ValidateTicketAsync_MissingPrefixClaim_ReturnsEmptyString()
public async Task ValidateTicketAsync_MissingPrefixClaim_ReturnsInvalid()
{
var descriptor = new SecurityTokenDescriptor
{
@@ -139,9 +157,9 @@ namespace Musify.StreamingGateway.Tests.Authentication
};
var token = tokenHandler.CreateToken(descriptor);
var prefix = await CreateValidator().ValidateTicketAsync(token);
var result = await CreateValidator().ValidateTicketAsync(token);
Assert.Equal(string.Empty, prefix);
Assert.False(result.IsValid);
}
}
}
backend/Tests/Musify.StreamingGateway.Tests/Middleware/TicketValidationMiddlewareTests.cs
+74 -8
View File
@@ -36,15 +36,22 @@ namespace Musify.StreamingGateway.Tests.Middleware
File.Delete(publicKeyPath);
}
private string IssueValidToken(string prefix = Prefix) => new JsonWebTokenHandler().CreateToken(new SecurityTokenDescriptor
private string IssueValidToken(string prefix = Prefix, long? maxBytes = null)
{
Issuer = options.Issuer,
Audience = options.Audience,
NotBefore = DateTime.UtcNow.AddMinutes(-1),
Expires = DateTime.UtcNow.AddMinutes(5),
Claims = new Dictionary<string, object> { ["prefix"] = prefix },
SigningCredentials = new SigningCredentials(new RsaSecurityKey(rsa), SecurityAlgorithms.RsaSha256),
});
var claims = new Dictionary<string, object> { ["prefix"] = prefix };
if (maxBytes is not null)
claims["maxBytes"] = maxBytes.Value.ToString();
return new JsonWebTokenHandler().CreateToken(new SecurityTokenDescriptor
{
Issuer = options.Issuer,
Audience = options.Audience,
NotBefore = DateTime.UtcNow.AddMinutes(-1),
Expires = DateTime.UtcNow.AddMinutes(5),
Claims = claims,
SigningCredentials = new SigningCredentials(new RsaSecurityKey(rsa), SecurityAlgorithms.RsaSha256),
});
}
private (TicketValidationMiddleware Middleware, Func<bool> WasNextCalled) CreateMiddleware()
{
@@ -150,5 +157,64 @@ namespace Musify.StreamingGateway.Tests.Middleware
Assert.True(wasNextCalled());
}
[Fact]
public async Task InvokeAsync_TicketWithMaxBytes_NoRangeRequested_SynthesizesABoundedRange()
{
var (middleware, wasNextCalled) = CreateMiddleware();
var context = new DefaultHttpContext();
context.Request.Path = $"/media/{Prefix}/audio.m4a";
context.Request.QueryString = new QueryString($"?t={IssueValidToken(maxBytes: 480_000)}");
await middleware.InvokeAsync(context);
Assert.True(wasNextCalled());
Assert.Equal("bytes=0-479999", context.Request.Headers.Range.ToString());
}
[Fact]
public async Task InvokeAsync_TicketWithMaxBytes_RangeWithinCap_ClampsTheEndOnly()
{
var (middleware, wasNextCalled) = CreateMiddleware();
var context = new DefaultHttpContext();
context.Request.Path = $"/media/{Prefix}/audio.m4a";
context.Request.QueryString = new QueryString($"?t={IssueValidToken(maxBytes: 480_000)}");
context.Request.Headers.Range = "bytes=1000-";
await middleware.InvokeAsync(context);
Assert.True(wasNextCalled());
Assert.Equal("bytes=1000-479999", context.Request.Headers.Range.ToString());
}
[Fact]
public async Task InvokeAsync_TicketWithMaxBytes_RangeStartsAtOrPastTheCap_ReturnsRangeNotSatisfiable()
{
var (middleware, wasNextCalled) = CreateMiddleware();
var context = new DefaultHttpContext();
context.Request.Path = $"/media/{Prefix}/audio.m4a";
context.Request.QueryString = new QueryString($"?t={IssueValidToken(maxBytes: 480_000)}");
context.Request.Headers.Range = "bytes=480000-";
await middleware.InvokeAsync(context);
Assert.False(wasNextCalled());
Assert.Equal(StatusCodes.Status416RangeNotSatisfiable, context.Response.StatusCode);
}
[Fact]
public async Task InvokeAsync_TicketWithoutMaxBytes_LeavesTheRequestedRangeUntouched()
{
var (middleware, wasNextCalled) = CreateMiddleware();
var context = new DefaultHttpContext();
context.Request.Path = $"/media/{Prefix}/audio.m4a";
context.Request.QueryString = new QueryString($"?t={IssueValidToken()}");
context.Request.Headers.Range = "bytes=1000-2000";
await middleware.InvokeAsync(context);
Assert.True(wasNextCalled());
Assert.Equal("bytes=1000-2000", context.Request.Headers.Range.ToString());
}
}
}