mirror of
https://github.com/navidrome/navidrome.git
synced 2026-10-10 11:27:11 +02:00
59810c3d59* feat(auth): add per-user token_epoch column and bump method * feat(auth): add aud and ep claims, omitted when zero * feat(auth): add CreateAPIToken for non-expiring, audience-scoped tokens * feat(auth): add CheckClaims for epoch and audience validation * feat(jellyfin): issue non-expiring, jellyfin-scoped access tokens * fix(subsonic): reject API-scoped and revoked tokens on the jwt path * fix(server): reject API-scoped and revoked tokens on the native API * fix(server): pin the token-subject guard and stop leaking test config Adds a regression spec for the DevAutoLogin/ExtAuth guard in tokenAllowed, switches its comparison to case-insensitive to match the user lookup's own COLLATE NOCASE semantics, and restores Subsonic JWT test config after each spec instead of leaking SessionTimeout. * feat(request): add a token epoch holder for handler-to-middleware signalling * refactor(server): write the refreshed JWT header after the handler runs * feat(auth): revoke all tokens for a user when their password changes * fix(server): restore Unwrap on the JWT refresh writer so SSE write deadlines apply * test(auth): pin that non-session tokens reject API access tokens * test(jellyfin): pin token scoping and epoch revocation end to end Exercises auth.CreateAPIToken and CheckClaims against the real Jellyfin router and SQLite DB: the minted token has no exp and is aud-scoped to jellyfin, and bumping token_epoch through the real UserRepository revokes an already-issued token on the next protected request. * test(nativeapi): pin the token-epoch handoff through a real password-change request Drive a self password change through the real Authenticator/JWTRefresher chain and a real SQLite-backed userRepository, so the epoch handoff between Put and the refreshed-token writer is verified end to end, not as two separately-tested halves. Also fix tokenAllowed to read the enriched ctx it was given instead of r.Context(), so its warning log carries the username. * refactor(server): drop tokenAllowed's now-unused request parameter Finding-2 already moved every use to ctx; r was dead weight. Also note in the new nativeapi test why it must stay the package's only real-DB spec: db.Db() is a process-wide singleton its cleanup closes for good. * refactor(auth): remove duplication in claim decoding and token minting * refactor(auth): group aud with the standard JWT claims * refactor(auth): read aud with the standard-claim accessor pattern * fix(log): redact every api_key spelling the Jellyfin API accepts * fix(auth): bind session tokens to the user id, not just the username * fix(auth): return the token epoch from the same atomic increment * fix(auth): bump the token epoch in the same statement as the password write * chore(auth): trim comments to the why-only budget
80 lines
2.8 KiB
Go
80 lines
2.8 KiB
Go
package nativeapi
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"path/filepath"
|
|
"time"
|
|
|
|
"github.com/navidrome/navidrome/conf"
|
|
"github.com/navidrome/navidrome/conf/configtest"
|
|
"github.com/navidrome/navidrome/consts"
|
|
"github.com/navidrome/navidrome/core"
|
|
"github.com/navidrome/navidrome/core/auth"
|
|
"github.com/navidrome/navidrome/db"
|
|
"github.com/navidrome/navidrome/model"
|
|
"github.com/navidrome/navidrome/persistence"
|
|
"github.com/navidrome/navidrome/server"
|
|
"github.com/navidrome/navidrome/tests"
|
|
. "github.com/onsi/ginkgo/v2"
|
|
. "github.com/onsi/gomega"
|
|
)
|
|
|
|
type noopPluginUnloader struct{}
|
|
|
|
func (noopPluginUnloader) UnloadDisabledPlugins(context.Context) {}
|
|
|
|
// Pins that the token-epoch handoff survives a real request through the real middleware chain.
|
|
var _ = Describe("PUT /user/{id}: token refresh on self password change", func() {
|
|
var ds model.DataStore
|
|
var router http.Handler
|
|
|
|
BeforeEach(func() {
|
|
// db.Db() is a process-wide singleton that this DeferCleanup closes for the whole binary; keep this the only real-DB spec in this package.
|
|
DeferCleanup(configtest.SetupConfig())
|
|
conf.Server.EnableUserEditing = true
|
|
conf.Server.EnableSharing = false
|
|
conf.Server.SessionTimeout = time.Hour
|
|
conf.Server.DbPath = filepath.Join(GinkgoT().TempDir(), "nativeapi-user-refresh.db") + "?_journal_mode=WAL"
|
|
DeferCleanup(db.Init(GinkgoT().Context()))
|
|
|
|
ds = &tests.MockDataStore{RealDS: persistence.New(db.Db())}
|
|
auth.Init(ds)
|
|
|
|
userService := core.NewUser(ds, noopPluginUnloader{})
|
|
nativeRouter := New(ds, nil, nil, nil, tests.NewMockLibraryService(), userService, nil, nil, nil)
|
|
router = server.JWTVerifier(nativeRouter)
|
|
})
|
|
|
|
It("carries the bumped epoch in the refreshed token, not the epoch the token was minted with", func() {
|
|
usr := model.User{UserName: "selfchanger", Name: "Self Changer", NewPassword: "old-password"}
|
|
Expect(ds.User(GinkgoT().Context()).Put(&usr)).To(Succeed())
|
|
|
|
token, err := auth.CreateToken(&usr)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
|
|
body, _ := json.Marshal(map[string]any{
|
|
"userName": usr.UserName,
|
|
"name": usr.Name,
|
|
"currentPassword": "old-password",
|
|
"password": "new-password",
|
|
})
|
|
req := createAuthenticatedRequest(http.MethodPut, "/user/"+usr.ID, bytes.NewBuffer(body), token)
|
|
w := httptest.NewRecorder()
|
|
router.ServeHTTP(w, req)
|
|
Expect(w.Code).To(Equal(http.StatusOK), w.Body.String())
|
|
|
|
refreshed := w.Header().Get(consts.UIAuthorizationHeader)
|
|
Expect(refreshed).ToNot(BeEmpty())
|
|
claims, err := auth.Validate(refreshed)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
|
|
reloaded, err := ds.User(GinkgoT().Context()).Get(usr.ID)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
Expect(reloaded.TokenEpoch).To(Equal(1))
|
|
Expect(claims.Epoch).To(Equal(reloaded.TokenEpoch))
|
|
})
|
|
})
|