mirror of
https://github.com/navidrome/navidrome.git
synced 2026-10-09 02:47:29 +02:00
b76ae14286* feat(jellyfin): add Quick Connect sign-in Jellyfin clients can now sign in without a password: the client shows a 6-digit code, a signed-in user approves it, and the client redeems a secret for its access token. - core/quickconnect: in-memory store shared by both routers through wire. Codes expire after 10 minutes; a secret redeems only once (Jellyfin allows repeats for 10 minutes); at most 1000 pending requests. - Jellyfin API: Initiate, Connect, Authorize and AuthenticateWithQuickConnect. Admins may approve for another user via UserId, like Swiftfin's admin page. Initiate and redeem share the login rate limiter; Connect does not, since Finamp and Streamyfin poll it every second. - Web UI: a Quick Connect item in the user menu looks up the code and shows the app and device before approving, so a user can't be tricked into approving an unknown device blindly. - Jellyfin.QuickConnect option, on by default like Jellyfin. It only matters when the Jellyfin API is enabled. * refactor(jellyfin): tidy Quick Connect naming and route guards Group the Quick Connect routes under one requireQuickConnect guard, make the request's device a named field so req.Device.ID can't be mistaken for a request id, and rename the web API response type to quickConnectDevice. * refactor(jellyfin): remove duplicated Jellyfin date formatting function * test(jellyfin): set play count and starred in the song fixture literal * refactor(jellyfin): inline the Quick Connect redeem body and use the shared date helper * fix(jellyfin): bound the client fields Quick Connect keeps in memory Initiate is unauthenticated and keeps the Client, Device, DeviceId and Version header fields for up to ten minutes. With no header size limit, each pending request could hold about 1 MB, and even a short field kept the whole header alive because the parsed values are substrings of it. Reject fields over 512 bytes and copy the stored values. Also answer 500 instead of 401 when the redeem user lookup fails for a reason other than the user being gone. * fix(jellyfin): rate-limit Quick Connect code approval Any signed-in user could try codes without limit on the Jellyfin Authorize endpoint and the web UI lookup/authorize endpoints, and so could approve another person's pending device for their own account. Apply the same per-IP limiter as the login (AuthRequestLimit/AuthWindowLength) to both surfaces.
265 lines
12 KiB
Go
265 lines
12 KiB
Go
package jellyfin
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
"time"
|
|
|
|
"github.com/go-chi/chi/v5"
|
|
"golang.org/x/sync/singleflight"
|
|
|
|
"github.com/navidrome/navidrome/conf"
|
|
"github.com/navidrome/navidrome/core"
|
|
"github.com/navidrome/navidrome/core/artwork"
|
|
"github.com/navidrome/navidrome/core/external"
|
|
"github.com/navidrome/navidrome/core/lyrics"
|
|
"github.com/navidrome/navidrome/core/playlists"
|
|
"github.com/navidrome/navidrome/core/quickconnect"
|
|
"github.com/navidrome/navidrome/core/scrobbler"
|
|
"github.com/navidrome/navidrome/core/sonic"
|
|
"github.com/navidrome/navidrome/core/stream"
|
|
"github.com/navidrome/navidrome/log"
|
|
"github.com/navidrome/navidrome/model"
|
|
"github.com/navidrome/navidrome/server"
|
|
"github.com/navidrome/navidrome/server/events"
|
|
"github.com/navidrome/navidrome/server/jellyfin/dto"
|
|
"github.com/navidrome/navidrome/utils/cache"
|
|
)
|
|
|
|
type Router struct {
|
|
http.Handler
|
|
ds model.DataStore
|
|
artwork artwork.Artwork
|
|
streamer stream.MediaStreamer
|
|
transcodeDecider stream.TranscodeDecider
|
|
players core.Players
|
|
scrobbler scrobbler.PlayTracker
|
|
playlists playlists.Playlists
|
|
provider external.Provider
|
|
sonic sonic.Engine
|
|
lyrics lyrics.Lyrics
|
|
broker events.Broker
|
|
lyricsCache cache.SimpleCache[string, model.LyricList]
|
|
similarFlight singleflight.Group
|
|
quickConnect quickconnect.QuickConnect
|
|
serverIDVal string
|
|
}
|
|
|
|
func New(ds model.DataStore, artwork artwork.Artwork, streamer stream.MediaStreamer,
|
|
transcodeDecider stream.TranscodeDecider, players core.Players,
|
|
scrobbler scrobbler.PlayTracker, playlists playlists.Playlists, provider external.Provider,
|
|
sonicSvc sonic.Engine, lyricsSvc lyrics.Lyrics, broker events.Broker, quickConnect quickconnect.QuickConnect) *Router {
|
|
r := &Router{
|
|
ds: ds, artwork: artwork, streamer: streamer, transcodeDecider: transcodeDecider,
|
|
players: players, scrobbler: scrobbler, playlists: playlists, provider: provider,
|
|
sonic: sonicSvc, lyrics: lyricsSvc, broker: broker, quickConnect: quickConnect,
|
|
lyricsCache: cache.NewSimpleCache[string, model.LyricList](cache.Options{
|
|
SizeLimit: 1000,
|
|
DefaultTTL: 5 * time.Minute,
|
|
}),
|
|
}
|
|
r.Handler = r.routes()
|
|
return r
|
|
}
|
|
|
|
func (api *Router) routes() http.Handler {
|
|
inner := chi.NewRouter()
|
|
|
|
// Read query params case-insensitively, like real Jellyfin. Must precede all routes so every
|
|
// handler and the api_key check see folded keys.
|
|
inner.Use(normalizeQueryKeys)
|
|
|
|
// Routes are lowercase; caseInsensitivePaths lowercases the request path. Keep new routes lowercase.
|
|
|
|
// Public (no auth): handshake + login.
|
|
inner.Get("/system/info/public", api.getPublicSystemInfo)
|
|
inner.Get("/system/ping", api.ping)
|
|
inner.Post("/system/ping", api.ping)
|
|
inner.Get("/quickconnect/enabled", api.quickConnectEnabled)
|
|
// Rate-limit the password login, mirroring the native /auth/login: it's an unauthenticated
|
|
// brute-force surface, so it must share the same per-client throttle when one is configured.
|
|
login := inner.With(server.LimitLoginBody)
|
|
if conf.Server.AuthRequestLimit > 0 {
|
|
login = login.With(server.ClientIPRateLimiter(conf.Server.AuthRequestLimit, conf.Server.AuthWindowLength))
|
|
}
|
|
login.Post("/users/authenticatebyname", api.authenticateByName)
|
|
quickConnectLogin := login.With(requireQuickConnect)
|
|
quickConnectLogin.Post("/quickconnect/initiate", api.quickConnectInitiate)
|
|
quickConnectLogin.Post("/users/authenticatewithquickconnect", api.authenticateWithQuickConnect)
|
|
// Not rate-limited: Finamp and Streamyfin poll it every second while the code is shown.
|
|
inner.With(requireQuickConnect).Get("/quickconnect/connect", api.quickConnectConnect)
|
|
inner.Get("/users/public", api.getPublicUsers)
|
|
|
|
// Images are intentionally public: artwork isn't sensitive, matching Jellyfin's image handling.
|
|
// Bound concurrency like Subsonic's getCoverArt: image decode/resize is CPU- and memory-heavy,
|
|
// and an unbounded burst (a client fetching artwork across a large library) can exhaust memory.
|
|
inner.Group(func(r chi.Router) {
|
|
r.Use(server.ThrottleBacklog(conf.Server.DevArtworkMaxRequests, conf.Server.DevArtworkThrottleBacklogLimit,
|
|
conf.Server.DevArtworkThrottleBacklogTimeout))
|
|
r.Get("/items/{itemId}/images/{type}", api.getItemImage)
|
|
r.Get("/items/{itemId}/images/{type}/{index}", api.getItemImage)
|
|
r.Head("/items/{itemId}/images/{type}", api.getItemImage)
|
|
r.Head("/items/{itemId}/images/{type}/{index}", api.getItemImage)
|
|
})
|
|
|
|
inner.Group(func(r chi.Router) {
|
|
r.Use(api.authenticate)
|
|
// Register/refresh the calling device as a player on every authenticated request, like
|
|
// Subsonic's getPlayer, so Jellyfin clients show up in the players list (and scrobbling has a
|
|
// player) even before the first playback report.
|
|
r.Use(api.withPlayer)
|
|
r.Get("/system/info", api.getSystemInfo)
|
|
r.Get("/system/endpoint", api.getEndpointInfo)
|
|
r.Get("/userviews", api.getUserViews)
|
|
r.Get("/users/{userId}/views", api.getUserViews)
|
|
r.Get("/users/me", api.getCurrentUser)
|
|
r.Get("/users/{userId}", api.getCurrentUser)
|
|
// Throttled like login so a signed-in user cannot enumerate other people's pending codes.
|
|
approve := r.With(requireQuickConnect)
|
|
if conf.Server.AuthRequestLimit > 0 {
|
|
approve = approve.With(server.ClientIPRateLimiter(conf.Server.AuthRequestLimit, conf.Server.AuthWindowLength))
|
|
}
|
|
approve.Post("/quickconnect/authorize", api.quickConnectAuthorize)
|
|
|
|
// Cursor-backed collections: each streams straight from the DB, holding a connection for the
|
|
// whole client-paced response, so enough slow clients would take the entire pool and stall the
|
|
// scanner, scrobbles and the UI. Cap them at half the pool (see conf.MaxOpenConns); excess
|
|
// requests queue rather than fail.
|
|
r.Group(func(r chi.Router) {
|
|
r.Use(throttleStreams(conf.Server.Jellyfin.MaxConcurrentStreams))
|
|
r.Get("/items", api.getItems)
|
|
r.Get("/users/{userId}/items", api.getItems)
|
|
r.Get("/items/latest", api.getLatest)
|
|
r.Get("/users/{userId}/items/latest", api.getLatest)
|
|
r.Get("/artists", api.getArtists)
|
|
r.Get("/artists/albumartists", api.getAlbumArtists)
|
|
r.Get("/playlists/{playlistId}/items", api.getPlaylistItems)
|
|
})
|
|
|
|
r.Get("/items/{itemId}", api.getItem)
|
|
r.Get("/users/{userId}/items/{itemId}", api.getItem)
|
|
r.Delete("/items/{itemId}", api.deleteItem)
|
|
|
|
// /UserFavoriteItems is the current @jellyfin/sdk spelling (Jellify); the
|
|
// /Users/{userId}/FavoriteItems form is the legacy one Finamp still uses.
|
|
r.Post("/userfavoriteitems/{itemId}", api.markFavorite)
|
|
r.Delete("/userfavoriteitems/{itemId}", api.unmarkFavorite)
|
|
r.Post("/users/{userId}/favoriteitems/{itemId}", api.markFavorite)
|
|
r.Delete("/users/{userId}/favoriteitems/{itemId}", api.unmarkFavorite)
|
|
r.Post("/users/{userId}/items/{itemId}/rating", api.setRating)
|
|
r.Delete("/users/{userId}/items/{itemId}/rating", api.removeRating)
|
|
|
|
// Per-item play/favorite/rating state. Jellify uses the /UserItems form;
|
|
// /Users/{userId}/Items is the legacy spelling.
|
|
r.Get("/useritems/{itemId}/userdata", api.getUserItemData)
|
|
r.Get("/users/{userId}/items/{itemId}/userdata", api.getUserItemData)
|
|
|
|
r.Get("/artists/{itemId}/similar", api.getSimilarArtists)
|
|
r.Get("/items/{itemId}/similar", api.getSimilarItems)
|
|
r.Get("/albums/{itemId}/similar", api.getSimilarAlbums)
|
|
r.Get("/items/{itemId}/instantmix", api.getInstantMix)
|
|
r.Get("/songs/{itemId}/instantmix", api.getInstantMix)
|
|
r.Get("/albums/{itemId}/instantmix", api.getInstantMix)
|
|
r.Get("/artists/{itemId}/instantmix", api.getInstantMix)
|
|
r.Get("/playlists/{itemId}/instantmix", api.getInstantMix)
|
|
r.Get("/artists/instantmix", api.getInstantMixByQuery)
|
|
r.Get("/musicgenres/instantmix", api.getInstantMixByQuery)
|
|
r.Get("/genres", api.getGenres)
|
|
r.Get("/musicgenres", api.getGenres)
|
|
r.Get("/studios", api.getStudios)
|
|
r.Get("/items/filters", api.getQueryFiltersLegacy)
|
|
|
|
r.Post("/playlists", api.createPlaylist)
|
|
r.Get("/playlists/{playlistId}", api.getPlaylist)
|
|
r.Post("/playlists/{playlistId}", api.updatePlaylist)
|
|
r.Post("/playlists/{playlistId}/items", api.addToPlaylist)
|
|
r.Delete("/playlists/{playlistId}/items", api.removeFromPlaylist)
|
|
r.Post("/playlists/{playlistId}/items/{entryId}/move/{newIndex}", api.movePlaylistItem)
|
|
r.Get("/playlists/{playlistId}/users", api.getPlaylistUsers)
|
|
r.Get("/playlists/{playlistId}/users/{userId}", api.getPlaylistUser)
|
|
|
|
// Cover upload/delete: only playlists are writable (see postItemImage); the GET routes
|
|
// above stay public.
|
|
r.Post("/items/{itemId}/images/{type}", api.postItemImage)
|
|
r.Delete("/items/{itemId}/images/{type}", api.deleteItemImage)
|
|
|
|
r.Get("/audio/{itemId}/stream", api.streamAudio)
|
|
r.Get("/audio/{itemId}/stream.{container}", api.streamAudio)
|
|
r.Get("/audio/{itemId}/universal", api.streamUniversal)
|
|
// Fintunes probes these with HEAD for the content type before playing or downloading.
|
|
r.Head("/audio/{itemId}/stream", api.streamAudio)
|
|
r.Head("/audio/{itemId}/stream.{container}", api.streamAudio)
|
|
r.Head("/audio/{itemId}/universal", api.streamUniversal)
|
|
r.Get("/audio/{itemId}/main.m3u8", api.streamHls)
|
|
r.Get("/items/{itemId}/playbackinfo", api.getPlaybackInfo)
|
|
r.Post("/items/{itemId}/playbackinfo", api.getPlaybackInfo)
|
|
r.Get("/audio/{itemId}/lyrics", api.getLyrics)
|
|
// Direct-file endpoints: some clients (Finamp's just_audio) fetch here instead of
|
|
// /Audio/{id}/stream; /Download reuses the direct-play handler as Jellyfin serves the same file.
|
|
r.Get("/items/{itemId}/file", api.streamFile)
|
|
r.Get("/items/{itemId}/download", api.streamFile)
|
|
r.Head("/items/{itemId}/file", api.streamFile)
|
|
r.Head("/items/{itemId}/download", api.streamFile)
|
|
|
|
r.Post("/sessions/playing", api.reportPlaybackStart)
|
|
r.Post("/sessions/playing/progress", api.reportPlaybackProgress)
|
|
r.Post("/sessions/playing/stopped", api.reportPlaybackStopped)
|
|
r.Post("/sessions/playing/ping", api.acknowledge)
|
|
r.Post("/sessions/capabilities", api.acknowledge)
|
|
r.Post("/sessions/capabilities/full", api.acknowledge)
|
|
|
|
// Real-time clients (e.g. Finamp) open this right after login; without it they 404-loop-reconnect.
|
|
r.Get("/socket", api.handleSocket)
|
|
|
|
r.Get("/audiomuseai/info", api.audioMuseInfo)
|
|
r.Get("/audiomuseai/health", api.audioMuseHealth)
|
|
r.Get("/audiomuseai/similar_tracks", api.audioMuseSimilarTracks)
|
|
r.Get("/audiomuseai/find_path", api.audioMuseFindPath)
|
|
})
|
|
|
|
// Logged at Debug, not Warn/Error: clients probing for optional/legacy endpoints is expected
|
|
// traffic, and this just surfaces what's missing.
|
|
inner.NotFound(api.notFound)
|
|
inner.MethodNotAllowed(api.notFound)
|
|
|
|
// Real Jellyfin clients route case-insensitively; chi does not.
|
|
return caseInsensitivePaths(inner)
|
|
}
|
|
|
|
// ok writes payload as JSON — the single entry point for every handler. Collections are routed to
|
|
// the streaming writer, so callers needn't know whether theirs is cursor-backed. ServerId is stamped
|
|
// on any item(s): real Jellyfin always sets it, and it's constant per request.
|
|
//
|
|
// Only /Items/Latest bypasses this, for its bare-array shape (see writeItemsArray).
|
|
func (api *Router) ok(w http.ResponseWriter, r *http.Request, payload any) {
|
|
switch p := payload.(type) {
|
|
case itemsResult:
|
|
api.writeItems(w, r, p)
|
|
return
|
|
case dto.QueryResult:
|
|
api.writeItems(w, r, materialized(p))
|
|
return
|
|
case dto.BaseItemDto:
|
|
payload = stampItem(p, api.serverID(r.Context()), requestFields(r))
|
|
}
|
|
w.Header().Set("Content-Type", "application/json; charset=utf-8")
|
|
if err := json.NewEncoder(w).Encode(payload); err != nil {
|
|
log.Error(r.Context(), "Jellyfin API: error encoding response", err)
|
|
}
|
|
}
|
|
|
|
// notFound handles unmatched routes and unsupported methods, logging them so unimplemented
|
|
// endpoints surface instead of returning chi's default plain-text 404/405.
|
|
func (api *Router) notFound(w http.ResponseWriter, r *http.Request) {
|
|
log.Debug(r.Context(), "Jellyfin API: unhandled route", "method", r.Method, "path", r.URL.Path)
|
|
w.Header().Set("Content-Type", "application/json; charset=utf-8")
|
|
w.WriteHeader(http.StatusNotFound)
|
|
_, _ = w.Write([]byte(`{}`))
|
|
}
|
|
|
|
// internalError logs the real error and writes a generic 500, so internal detail (ffmpeg output,
|
|
// file paths) never reaches the client.
|
|
func (api *Router) internalError(w http.ResponseWriter, r *http.Request, err error) {
|
|
log.Error(r.Context(), "Jellyfin API: internal error", "method", r.Method, "path", r.URL.Path, err)
|
|
http.Error(w, "Internal Server Error", http.StatusInternalServerError)
|
|
}
|