Proxy

Infrastructure/Configuration/StreamTicketConfiguration.cs

@@ -0,0 +1,21 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Musify.Infrastructure.Configuration
+{
+    public class StreamTicketConfiguration
+    {
+        public const string SectionName = "StreamTicket";
+
+        [Required]
+        public required string PrivateKeyPath { get; set; }
+
+        [Required]
+        public string Audience { get; set; } = "media-gateway";
+
+        [Required]
+        public string Issuer { get; set; } = "musify-webapi";
+
+        [Range(60, 86400)]
+        public int TicketTtlSeconds { get; set; } = 3600;
+    }
+}

Infrastructure/Infrastructure.csproj

@@ -26,6 +26,7 @@
     <PackageReference Include="Microsoft.Extensions.Configuration.FileExtensions" Version="10.0.8" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="10.0.8" />
     <PackageReference Include="Microsoft.Extensions.Configuration.UserSecrets" Version="10.0.8" />
+    <PackageReference Include="Microsoft.IdentityModel.JsonWebTokens" Version="8.14.0" />
     <PackageReference Include="MimeMapping" Version="4.0.0" />
     <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.2" />
     <PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.15.3" />

Infrastructure/Services/ServicesDependencyInjection.cs

@@ -71,6 +71,20 @@ namespace Musify.Infrastructure.Services
             return serviceDescriptors;
         }
 
+        public static IServiceCollection AddStreamTicketService(this IServiceCollection serviceDescriptors, IConfiguration configuration)
+        {
+            serviceDescriptors
+                .AddOptionsWithValidateOnStart<StreamTicketConfiguration>()
+                .Bind(configuration.GetRequiredSection(StreamTicketConfiguration.SectionName))
+                .ValidateDataAnnotations();
+
+            serviceDescriptors.AddSingleton(serviceProvider =>
+                serviceProvider.GetRequiredService<IOptions<StreamTicketConfiguration>>().Value);
+
+            serviceDescriptors.AddSingleton<IStreamTicketService, StreamTicketService>();
+            return serviceDescriptors;
+        }
+
         public static IServiceCollection AddAudioTranscoder(this IServiceCollection serviceDescriptors, IConfiguration configuration)
         {
             serviceDescriptors

Infrastructure/Services/StreamTicketService.cs

@@ -0,0 +1,52 @@
+using System.Security.Cryptography;
+using Microsoft.IdentityModel.JsonWebTokens;
+using Microsoft.IdentityModel.Tokens;
+using Musify.Application.Contracts;
+using Musify.Infrastructure.Configuration;
+
+namespace Musify.Infrastructure.Services
+{
+    public sealed class StreamTicketService : IStreamTicketService, IDisposable
+    {
+        private readonly StreamTicketConfiguration configuration;
+        private readonly RSA rsa;
+        private readonly SigningCredentials signingCredentials;
+        private readonly JsonWebTokenHandler tokenHandler = new();
+
+        public StreamTicketService(StreamTicketConfiguration configuration)
+        {
+            this.configuration = configuration;
+
+            rsa = RSA.Create();
+            rsa.ImportFromPem(File.ReadAllText(configuration.PrivateKeyPath));
+
+            var key = new RsaSecurityKey(rsa);
+            signingCredentials = new SigningCredentials(key, SecurityAlgorithms.RsaSha256);
+        }
+
+        public StreamTicket IssueTicket(Guid userId, string keyPrefix)
+        {
+            var now = DateTimeOffset.UtcNow;
+
+            var descriptor = new SecurityTokenDescriptor
+            {
+                Issuer = configuration.Issuer,
+                Audience = configuration.Audience,
+                IssuedAt = now.UtcDateTime,
+                NotBefore = now.UtcDateTime,
+                Expires = now.AddSeconds(configuration.TicketTtlSeconds).UtcDateTime,
+                Claims = new Dictionary<string, object>
+                {
+                    ["sub"] = userId.ToString(),
+                    ["prefix"] = keyPrefix,
+                },
+                SigningCredentials = signingCredentials,
+            };
+
+            var token = tokenHandler.CreateToken(descriptor);
+            return new StreamTicket(token, configuration.TicketTtlSeconds);
+        }
+
+        public void Dispose() => rsa.Dispose();
+    }
+}