diff --git a/.env.example b/.env.example index b9154ba..a7f37f3 100644 --- a/.env.example +++ b/.env.example @@ -16,9 +16,9 @@ ADMIN_INITIAL_PASSWORD=admin123 # Strong random JWT secret (auto-generated when empty). # MEDIASTATION_SECRETS_JWT_SECRET=please-change-me -# Optional private license server. -# MEDIASTATION_LICENSE_SERVER_URL=http://127.0.0.1:8001 -# MEDIASTATION_LICENSE_HMAC_SECRET=must-match-license-server +# Built-in license server bridge; override only when using a private MgoSever. +# MEDIASTATION_LICENSE_SERVER_URL=https://mgosever.3jzs.com +# MEDIASTATION_LICENSE_HMAC_SECRET=ms-shared-hmac-secret-key-Mgo-testing # 3rd-party scrape providers. # MEDIASTATION_SECRETS_TMDB_API_KEY= diff --git a/config.example.yaml b/config.example.yaml index ac4f012..f604bac 100644 --- a/config.example.yaml +++ b/config.example.yaml @@ -109,10 +109,10 @@ ai: max_concurrent: 3 license: - # Optional private MediaStationGo license server bridge. + # Built-in MediaStationGo license server bridge. # Open-source mode works without this and is limited to 20 users. - server_url: "" # e.g. http://127.0.0.1:8001 - hmac_secret: "" # must match LICENSE_HMAC_SECRET on the license server + server_url: "https://mgosever.3jzs.com" + hmac_secret: "ms-shared-hmac-secret-key-Mgo-testing" # must match LICENSE_HMAC_SECRET on the license server # FlareSolverr 配置（用于绕过 Cloudflare/WAF 保护） flaresolverr: diff --git a/internal/config/config.go b/internal/config/config.go index 5737737..322f832 100644 --- a/internal/config/config.go +++ b/internal/config/config.go @@ -24,6 +24,8 @@ const EnvPrefix = "MEDIASTATION" const ( defaultDatabaseMaxOpenConns = 4 defaultDatabaseMaxIdleConns = 2 + defaultLicenseServerURL = "https://mgosever.3jzs.com" + defaultLicenseHMACSecret = "ms-shared-hmac-secret-key-Mgo-testing" // #nosec G101 -- shared response-signature key for the bundled license bridge. ) // Config 是根配置聚合。 @@ -330,8 +332,8 @@ func setDefaults(v *viper.Viper) { v.SetDefault("api_config.auto_encrypt", true) v.SetDefault("api_config.default_timeout", 30) - v.SetDefault("license.server_url", "") - v.SetDefault("license.hmac_secret", "") + v.SetDefault("license.server_url", defaultLicenseServerURL) + v.SetDefault("license.hmac_secret", defaultLicenseHMACSecret) } // normalize 填充派生默认值并自愈空的关键字段。 diff --git a/internal/config/config_test.go b/internal/config/config_test.go index e3592da..2ee072d 100644 --- a/internal/config/config_test.go +++ b/internal/config/config_test.go @@ -58,6 +58,9 @@ func TestLoadDefaults(t *testing.T) { if !cfg.Organizer.SmartClassify { t.Fatalf("expected organizer smart classify enabled by default") } + if cfg.License.ServerURL != defaultLicenseServerURL || cfg.License.HMACSecret != defaultLicenseHMACSecret { + t.Fatalf("expected bundled license bridge defaults, got url=%q secret=%q", cfg.License.ServerURL, cfg.License.HMACSecret) + } // Re-loading must reuse the persisted secret on disk. cfg2, err := Load() if err != nil { @@ -87,6 +90,8 @@ func TestEnvOverride(t *testing.T) { t.Setenv("MEDIASTATION_CACHE_MEDIA_TTL_SECONDS", "30") t.Setenv("MEDIASTATION_SEARCH_BACKEND", "opensearch") t.Setenv("MEDIASTATION_SEARCH_OPENSEARCH_URL", "http://opensearch:9200") + t.Setenv("MEDIASTATION_LICENSE_SERVER_URL", "https://license.example.com") + t.Setenv("MEDIASTATION_LICENSE_HMAC_SECRET", "override-secret") cfg, err := Load() if err != nil { t.Fatalf("Load() error: %v", err) @@ -103,6 +108,9 @@ func TestEnvOverride(t *testing.T) { if cfg.Search.Backend != "opensearch" || cfg.Search.OpenSearchURL != "http://opensearch:9200" { t.Fatalf("expected opensearch config from env, got backend=%q url=%q", cfg.Search.Backend, cfg.Search.OpenSearchURL) } + if cfg.License.ServerURL != "https://license.example.com" || cfg.License.HMACSecret != "override-secret" { + t.Fatalf("expected license config from env, got url=%q secret=%q", cfg.License.ServerURL, cfg.License.HMACSecret) + } } func TestLoadAllowsExplicitSingleConnectionDatabaseConfig(t *testing.T) { diff --git a/internal/handler/license.go b/internal/handler/license.go index 12d0bd7..5f03a9b 100644 --- a/internal/handler/license.go +++ b/internal/handler/license.go @@ -114,7 +114,8 @@ func licenseStatusHandler(svc *service.Container) gin.HandlerFunc { return func(c *gin.Context) { state, _ := loadLicenseState(c.Request.Context(), svc) client, err := newLicenseClient(c.Request.Context(), svc) - if err == nil { + hasLicenseKey := strings.TrimSpace(state.LicenseKey) != "" + if err == nil && hasLicenseKey { deviceID, idErr := ensureLicenseDeviceID(c.Request.Context(), svc, state.DeviceID) if idErr == nil { deviceName, _ := svc.Repo.Setting.Get(c.Request.Context(), licenseDeviceNameSetting) @@ -142,6 +143,17 @@ func licenseStatusHandler(svc *service.Container) gin.HandlerFunc { } } } + } else if err == nil && state.Valid { + deviceID, idErr := ensureLicenseDeviceID(c.Request.Context(), svc, state.DeviceID) + if idErr == nil { + if refreshed, ok, _, getErr := refreshLicenseServerStatus(c.Request.Context(), client, state, deviceID); getErr == nil && ok { + state = refreshed + _ = persistLicenseState(c.Request.Context(), svc, state) + } else if getErr == nil { + state.Valid = false + _ = persistLicenseState(c.Request.Context(), svc, state) + } + } } active := state.Valid && !licenseStateExpired(state.ExpiryDate) c.JSON(http.StatusOK, gin.H{ @@ -179,17 +191,13 @@ func RunLicenseHeartbeatLoop(ctx context.Context, svc *service.Container) { if svc == nil { return } - run := func() { - state, sent, err := maybeSendLicenseHeartbeat(ctx, svc, licenseHeartbeatInterval) - if err != nil { - if svc.Log != nil { - svc.Log.Warn("license heartbeat failed", zap.Error(err)) - } - return - } - if sent && svc.Log != nil { - svc.Log.Info("license heartbeat sent", zap.String("device_id", state.DeviceID)) - } + run := func(interval time.Duration) { + state, sent, err := maybeSendLicenseHeartbeat(ctx, svc, interval) + logLicenseHeartbeatResult(svc, state, sent, err) + } + runStartup := func() { + state, sent, err := maybeSendStartupLicenseHeartbeat(ctx, svc) + logLicenseHeartbeatResult(svc, state, sent, err) } timer := time.NewTimer(licenseHeartbeatStartupDelay) @@ -198,7 +206,7 @@ func RunLicenseHeartbeatLoop(ctx context.Context, svc *service.Container) { case <-ctx.Done(): return case <-timer.C: - run() + runStartup() } ticker := time.NewTicker(licenseHeartbeatCheckInterval) @@ -208,11 +216,35 @@ func RunLicenseHeartbeatLoop(ctx context.Context, svc *service.Container) { case <-ctx.Done(): return case <-ticker.C: - run() + run(licenseHeartbeatInterval) } } } +func logLicenseHeartbeatResult(svc *service.Container, state service.LicenseActivationState, sent bool, err error) { + if svc == nil || svc.Log == nil { + return + } + if err != nil { + svc.Log.Warn("license heartbeat failed", zap.Error(err)) + return + } + if sent { + svc.Log.Info("license heartbeat sent", zap.String("device_id", state.DeviceID)) + } +} + +func maybeSendStartupLicenseHeartbeat(ctx context.Context, svc *service.Container) (service.LicenseActivationState, bool, error) { + state, err := loadLicenseState(ctx, svc) + if err != nil { + return state, false, nil + } + if strings.TrimSpace(state.LicenseKey) == "" { + return state, false, nil + } + return maybeSendLicenseHeartbeat(ctx, svc, 0) +} + func maybeSendLicenseHeartbeat(ctx context.Context, svc *service.Container, interval time.Duration) (service.LicenseActivationState, bool, error) { state, err := loadLicenseState(ctx, svc) if err != nil { @@ -247,7 +279,7 @@ func maybeSendLicenseHeartbeat(ctx context.Context, svc *service.Container, inte } func licenseHeartbeatEligible(state service.LicenseActivationState) bool { - return strings.TrimSpace(state.LicenseKey) != "" || state.Valid + return strings.TrimSpace(state.LicenseKey) != "" } func licenseHeartbeatDue(state service.LicenseActivationState, interval time.Duration) bool { diff --git a/internal/handler/license_test.go b/internal/handler/license_test.go index 4f110bd..8eaf63d 100644 --- a/internal/handler/license_test.go +++ b/internal/handler/license_test.go @@ -157,6 +157,102 @@ func TestLicenseHeartbeatDueUsesTwelveHourWindow(t *testing.T) { } } +func TestStartupLicenseHeartbeatIgnoresTwelveHourWindow(t *testing.T) { + heartbeatCount := 0 + maxUsers := 40 + upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + switch r.URL.Path { + case "/api/v1/heartbeat": + heartbeatCount++ + resp := licenseServerSignedResp{ + Valid: true, + LicenseType: "subscription", + MaxDevices: 2, + MaxUsers: &maxUsers, + NextHeartbeat: time.Now().Add(time.Hour).Format(time.RFC3339), + } + resp.Signature = signLicenseTestPayload("test-secret", resp) + w.Header().Set("Content-Type", "application/json") + _ = json.NewEncoder(w).Encode(resp) + case "/api/v1/status/device-1": + w.Header().Set("Content-Type", "application/json") + _, _ = w.Write([]byte(`{ + "valid": true, + "license_type": "subscription", + "max_devices": 2, + "max_users": 40, + "unlimited_users": false, + "device_name": "NAS", + "is_active": true + }`)) + default: + t.Fatalf("unexpected upstream path %s", r.URL.Path) + } + })) + defer upstream.Close() + + svc := newLicenseHandlerTestService(t) + if err := svc.Repo.Setting.Set(t.Context(), licenseServerURLSetting, upstream.URL); err != nil { + t.Fatal(err) + } + if err := svc.Repo.Setting.Set(t.Context(), licenseHMACSecretSetting, "test-secret"); err != nil { + t.Fatal(err) + } + state := service.LicenseActivationState{ + Valid: true, + LicenseKey: "MS-ABCD-EFGH-JKLM-NPQR", + DeviceID: "device-1", + DeviceName: "NAS", + UpdatedAt: time.Now().Format(time.RFC3339), + } + if err := persistLicenseState(t.Context(), svc, state); err != nil { + t.Fatal(err) + } + + refreshed, sent, err := maybeSendStartupLicenseHeartbeat(t.Context(), svc) + if err != nil { + t.Fatalf("startup heartbeat: %v", err) + } + if !sent || heartbeatCount != 1 { + t.Fatalf("startup heartbeat should be sent once, sent=%v count=%d", sent, heartbeatCount) + } + if refreshed.MaxUsers == nil || *refreshed.MaxUsers != 40 { + t.Fatalf("startup heartbeat should refresh licensed user capacity, got %+v", refreshed) + } +} + +func TestStartupLicenseHeartbeatSkipsStateWithoutStoredKey(t *testing.T) { + heartbeatCount := 0 + upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + heartbeatCount++ + w.WriteHeader(http.StatusInternalServerError) + })) + defer upstream.Close() + + svc := newLicenseHandlerTestService(t) + if err := svc.Repo.Setting.Set(t.Context(), licenseServerURLSetting, upstream.URL); err != nil { + t.Fatal(err) + } + if err := svc.Repo.Setting.Set(t.Context(), licenseHMACSecretSetting, "test-secret"); err != nil { + t.Fatal(err) + } + if err := persistLicenseState(t.Context(), svc, service.LicenseActivationState{ + Valid: true, + DeviceID: "device-1", + UpdatedAt: time.Now().Format(time.RFC3339), + }); err != nil { + t.Fatal(err) + } + + _, sent, err := maybeSendStartupLicenseHeartbeat(t.Context(), svc) + if err != nil { + t.Fatalf("startup heartbeat should skip without error, got %v", err) + } + if sent || heartbeatCount != 0 { + t.Fatalf("startup heartbeat without stored license key should be skipped, sent=%v count=%d", sent, heartbeatCount) + } +} + func TestLicenseHeartbeatEligibleRequiresActivationState(t *testing.T) { if licenseHeartbeatEligible(service.LicenseActivationState{DeviceID: "device-only"}) { t.Fatalf("device id alone should not trigger automatic license heartbeat") @@ -164,8 +260,34 @@ func TestLicenseHeartbeatEligibleRequiresActivationState(t *testing.T) { if !licenseHeartbeatEligible(service.LicenseActivationState{LicenseKey: "MS-KEY"}) { t.Fatalf("stored license key should trigger automatic license heartbeat") } - if !licenseHeartbeatEligible(service.LicenseActivationState{Valid: true}) { - t.Fatalf("valid license state should trigger automatic license heartbeat") + if licenseHeartbeatEligible(service.LicenseActivationState{Valid: true}) { + t.Fatalf("valid state without stored license key should not trigger automatic license heartbeat") + } +} + +func TestLicenseStatusSkipsUnlicensedHeartbeatWithDefaultServer(t *testing.T) { + upstreamCalls := 0 + upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + upstreamCalls++ + w.WriteHeader(http.StatusInternalServerError) + })) + defer upstream.Close() + + svc := newLicenseHandlerTestService(t) + svc.Cfg.License.ServerURL = upstream.URL + svc.Cfg.License.HMACSecret = "test-secret" + + router := gin.New() + router.GET("/license/status", licenseStatusHandler(svc)) + req := httptest.NewRequest(http.MethodGet, "/license/status", nil) + w := httptest.NewRecorder() + router.ServeHTTP(w, req) + + if w.Code != http.StatusOK { + t.Fatalf("status = %d body=%s", w.Code, w.Body.String()) + } + if upstreamCalls != 0 { + t.Fatalf("unlicensed status should not contact license server, got %d calls", upstreamCalls) } } diff --git a/web/src/pages/settingsGroupGeneral.ts b/web/src/pages/settingsGroupGeneral.ts index 4c6807f..cdb8d03 100644 --- a/web/src/pages/settingsGroupGeneral.ts +++ b/web/src/pages/settingsGroupGeneral.ts @@ -116,7 +116,7 @@ export const licenseSettingsGroup: SettingGroup = { key: 'license.server_url', label: 'License Server 地址', type: 'text', - placeholder: 'http://127.0.0.1:8001', + placeholder: 'https://mgosever.3jzs.com', }, { key: 'license.hmac_secret',