diff --git a/internal/handler/emby_playback_cloud_routes_test.go b/internal/handler/emby_playback_cloud_routes_test.go new file mode 100644 index 0000000..b8baa4c --- /dev/null +++ b/internal/handler/emby_playback_cloud_routes_test.go @@ -0,0 +1,223 @@ +package handler + +import ( + "net/http" + "net/http/httptest" + "strings" + "testing" + + "github.com/gin-gonic/gin" + "github.com/glebarez/sqlite" + "go.uber.org/zap" + "gorm.io/gorm" + + "github.com/ShukeBta/MediaStationGo/internal/config" + "github.com/ShukeBta/MediaStationGo/internal/middleware" + "github.com/ShukeBta/MediaStationGo/internal/model" + "github.com/ShukeBta/MediaStationGo/internal/repository" + "github.com/ShukeBta/MediaStationGo/internal/service" +) + +func TestEmbyVideoStreamUsesSTRMWhenRedirectProxyDisabled(t *testing.T) { + gin.SetMode(gin.TestMode) + db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{}) + if err != nil { + t.Fatalf("open db: %v", err) + } + if err := db.AutoMigrate(model.AllModels()...); err != nil { + t.Fatalf("migrate: %v", err) + } + repos := repository.New(db) + if err := repos.Setting.Set(t.Context(), service.CloudPlaybackModeSettingKey, service.CloudPlaybackModeSTRM); err != nil { + t.Fatalf("set cloud playback mode: %v", err) + } + if err := repos.Setting.Set(t.Context(), service.CloudPlaybackSTRMEnabledSettingKey, "true"); err != nil { + t.Fatalf("enable strm playback: %v", err) + } + if err := repos.Setting.Set(t.Context(), service.CloudPlaybackRedirectEnabledSettingKey, "false"); err != nil { + t.Fatalf("disable redirect playback: %v", err) + } + if err := repos.User.Create(t.Context(), &model.User{ + Base: model.Base{ID: "user-1"}, + Username: "tester", + PasswordHash: "x", + Role: "admin", + Tier: "plus", + IsActive: true, + }); err != nil { + t.Fatalf("create user: %v", err) + } + lib := model.Library{Name: "OpenList", Path: "cloud://openlist/Movies", Type: "movie", Enabled: true} + if err := repos.Library.Create(t.Context(), &lib); err != nil { + t.Fatalf("create library: %v", err) + } + if err := db.Create(&model.Media{ + Base: model.Base{ID: "cloud-1"}, + LibraryID: lib.ID, + Title: "Cloud Movie", + Path: "cloud://openlist/Movies/Movie.mkv", + STRMURL: "/api/cloud/play/openlist?ref=%2FMovies%2FMovie.mkv", + Container: "mkv", + }).Error; err != nil { + t.Fatalf("create media: %v", err) + } + + const secret = "test-secret" + router := gin.New() + cfg := &config.Config{Secrets: config.SecretsConfig{JWTSecret: secret}} + registerEmbyRoutes(router, secret, &service.Container{ + Repo: repos, + Emby: service.NewEmbyService(cfg, zap.NewNop(), repos), + Stream: service.NewStreamService(cfg, zap.NewNop(), repos, nil), + }) + + token := signedTestToken(t, secret) + req := httptest.NewRequest(http.MethodGet, "/videos/cloud-1/stream?api_key="+token, nil) + w := httptest.NewRecorder() + router.ServeHTTP(w, req) + + if w.Code != http.StatusFound { + t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String()) + } + loc := w.Header().Get("Location") + if !strings.Contains(loc, "/api/stream/cloud-1") || !strings.Contains(loc, "api_key=") { + t.Fatalf("STRM mode should redirect /Videos fallback to tokenized /api/stream, got %q", loc) + } + if got := w.Header().Get("Cache-Control"); !strings.Contains(got, "no-store") { + t.Fatalf("STRM fallback redirect Cache-Control = %q, want no-store", got) + } + if strings.Contains(loc, "/api/cloud/play/") { + t.Fatalf("STRM mode should not expose cloud play directly from /Videos fallback: %q", loc) + } +} + +func TestEmbyVideoStreamIssuesTokenForSessionFallbackSTRMRedirect(t *testing.T) { + gin.SetMode(gin.TestMode) + db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{}) + if err != nil { + t.Fatalf("open db: %v", err) + } + if err := db.AutoMigrate(model.AllModels()...); err != nil { + t.Fatalf("migrate: %v", err) + } + repos := repository.New(db) + if err := repos.Setting.Set(t.Context(), service.CloudPlaybackModeSettingKey, service.CloudPlaybackModeSTRM); err != nil { + t.Fatalf("set cloud playback mode: %v", err) + } + if err := repos.Setting.Set(t.Context(), service.CloudPlaybackSTRMEnabledSettingKey, "true"); err != nil { + t.Fatalf("enable strm playback: %v", err) + } + if err := repos.Setting.Set(t.Context(), service.CloudPlaybackRedirectEnabledSettingKey, "false"); err != nil { + t.Fatalf("disable redirect playback: %v", err) + } + user := model.User{ + Base: model.Base{ID: "user-1"}, + Username: "tester", + PasswordHash: "x", + Role: "admin", + Tier: "plus", + IsActive: true, + } + if err := repos.User.Create(t.Context(), &user); err != nil { + t.Fatalf("create user: %v", err) + } + lib := model.Library{Name: "OpenList", Path: "cloud://openlist/Movies", Type: "movie", Enabled: true} + if err := repos.Library.Create(t.Context(), &lib); err != nil { + t.Fatalf("create library: %v", err) + } + if err := db.Create(&model.Media{ + Base: model.Base{ID: "cloud-1"}, + LibraryID: lib.ID, + Title: "Cloud Movie", + Path: "cloud://openlist/Movies/Movie.mkv", + STRMURL: "/api/cloud/play/openlist?ref=%2FMovies%2FMovie.mkv", + Container: "mkv", + }).Error; err != nil { + t.Fatalf("create media: %v", err) + } + + const secret = "test-secret" + cfg := &config.Config{Secrets: config.SecretsConfig{JWTSecret: secret}} + svc := &service.Container{ + Repo: repos, + Auth: service.NewAuthService(cfg, zap.NewNop(), repos, nil, nil), + Emby: service.NewEmbyService(cfg, zap.NewNop(), repos), + Stream: service.NewStreamService(cfg, zap.NewNop(), repos, nil), + } + router := gin.New() + router.GET("/videos/:id/stream", func(c *gin.Context) { + c.Set(middleware.CtxUserID, user.ID) + c.Set(middleware.CtxUserRole, user.Role) + embyVideoStreamHandler(svc, service.CloudPlaybackModeRedirectProxy)(c) + }) + + req := httptest.NewRequest(http.MethodGet, "/videos/cloud-1/stream", nil) + w := httptest.NewRecorder() + router.ServeHTTP(w, req) + + if w.Code != http.StatusFound { + t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String()) + } + loc := w.Header().Get("Location") + if !strings.Contains(loc, "/api/stream/cloud-1") || !strings.Contains(loc, "api_key=") { + t.Fatalf("session fallback redirect should include api_key for /api/stream, got %q", loc) + } +} + +func TestEmbyVideoStreamRedirectKeepsMediaBrowserAuthorizationToken(t *testing.T) { + gin.SetMode(gin.TestMode) + db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{}) + if err != nil { + t.Fatalf("open db: %v", err) + } + if err := db.AutoMigrate(model.AllModels()...); err != nil { + t.Fatalf("migrate: %v", err) + } + repos := repository.New(db) + if err := repos.User.Create(t.Context(), &model.User{ + Base: model.Base{ID: "user-1"}, + Username: "tester", + PasswordHash: "x", + Role: "admin", + Tier: "plus", + IsActive: true, + }); err != nil { + t.Fatalf("create user: %v", err) + } + lib := model.Library{Name: "OpenList", Path: "cloud://openlist/Movies", Type: "movie", Enabled: true} + if err := repos.Library.Create(t.Context(), &lib); err != nil { + t.Fatalf("create library: %v", err) + } + if err := db.Create(&model.Media{ + Base: model.Base{ID: "cloud-1"}, + LibraryID: lib.ID, + Title: "Cloud Movie", + Path: "cloud://openlist/Movies/Movie.mkv", + STRMURL: "/api/cloud/play/openlist?ref=%2FMovies%2FMovie.mkv", + Container: "mkv", + }).Error; err != nil { + t.Fatalf("create media: %v", err) + } + + const secret = "test-secret" + router := gin.New() + registerEmbyRoutes(router, secret, &service.Container{ + Repo: repos, + Emby: service.NewEmbyService(&config.Config{}, zap.NewNop(), repos), + Stream: service.NewStreamService(&config.Config{}, zap.NewNop(), repos, nil), + }) + + token := signedTestToken(t, secret) + req := httptest.NewRequest(http.MethodGet, "/videos/cloud-1/stream", nil) + req.Header.Set("X-MediaBrowser-Authorization", `MediaBrowser Client="Infuse", Device="PC", Token="`+token+`"`) + w := httptest.NewRecorder() + router.ServeHTTP(w, req) + + if w.Code != http.StatusFound { + t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String()) + } + loc := w.Header().Get("Location") + if !strings.Contains(loc, "/api/cloud/play/openlist?") || !strings.Contains(loc, "token=") { + t.Fatalf("redirect Location should target tokenized cloud play endpoint, got %q", loc) + } +} diff --git a/internal/handler/emby_playback_info_routes_test.go b/internal/handler/emby_playback_info_routes_test.go new file mode 100644 index 0000000..1cf4f41 --- /dev/null +++ b/internal/handler/emby_playback_info_routes_test.go @@ -0,0 +1,245 @@ +package handler + +import ( + "encoding/json" + "net/http" + "net/http/httptest" + "path/filepath" + "strings" + "testing" + + "github.com/gin-gonic/gin" + "github.com/glebarez/sqlite" + "go.uber.org/zap" + "gorm.io/gorm" + + "github.com/ShukeBta/MediaStationGo/internal/config" + "github.com/ShukeBta/MediaStationGo/internal/model" + "github.com/ShukeBta/MediaStationGo/internal/repository" + "github.com/ShukeBta/MediaStationGo/internal/service" +) + +func TestEmbyLowercasePlaybackInfoRouteReturnsJSON(t *testing.T) { + gin.SetMode(gin.TestMode) + db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{}) + if err != nil { + t.Fatalf("open db: %v", err) + } + if err := db.AutoMigrate(model.AllModels()...); err != nil { + t.Fatalf("migrate: %v", err) + } + repos := repository.New(db) + if err := repos.User.Create(t.Context(), &model.User{ + Base: model.Base{ID: "user-1"}, + Username: "tester", + PasswordHash: "x", + Role: "admin", + Tier: "plus", + IsActive: true, + }); err != nil { + t.Fatalf("create user: %v", err) + } + lib := model.Library{Name: "电影", Path: t.TempDir(), Type: "movie", Enabled: true} + if err := repos.Library.Create(t.Context(), &lib); err != nil { + t.Fatalf("create library: %v", err) + } + if err := db.Create(&model.Media{ + Base: model.Base{ID: "media-1"}, + LibraryID: lib.ID, + Title: "Lowercase Playback", + Path: filepath.Join(lib.Path, "lowercase-playback.mp4"), + Container: "mp4", + }).Error; err != nil { + t.Fatalf("create media: %v", err) + } + + const secret = "test-secret" + router := gin.New() + registerEmbyRoutes(router, secret, &service.Container{ + Repo: repos, + Emby: service.NewEmbyService(&config.Config{}, zap.NewNop(), repos), + }) + + req := httptest.NewRequest(http.MethodGet, "/users/user-1/items/media-1/playbackinfo", nil) + req.Header.Set("X-Emby-Token", signedTestToken(t, secret)) + w := httptest.NewRecorder() + router.ServeHTTP(w, req) + + if w.Code != http.StatusOK { + t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String()) + } + var body map[string]any + if err := json.Unmarshal(w.Body.Bytes(), &body); err != nil { + t.Fatalf("decode playback info: %v", err) + } + if _, ok := body["MediaSources"]; !ok { + t.Fatalf("missing MediaSources: %#v", body) + } + sources, ok := body["MediaSources"].([]any) + if !ok || len(sources) == 0 { + t.Fatalf("unexpected MediaSources: %#v", body["MediaSources"]) + } + source, ok := sources[0].(map[string]any) + if !ok { + t.Fatalf("unexpected MediaSource: %#v", sources[0]) + } + directURL, _ := source["DirectStreamUrl"].(string) + if !strings.Contains(directURL, "api_key=") { + t.Fatalf("DirectStreamUrl should carry api_key for clients that do not repeat auth headers: %#v", source) + } + transcodeURL, _ := source["TranscodingUrl"].(string) + if transcodeURL != "" && !strings.Contains(transcodeURL, "api_key=") { + t.Fatalf("TranscodingUrl should carry api_key: %#v", source) + } +} + +func TestEmbyPlaybackInfoDoesNotExposeTokenInCloudPath(t *testing.T) { + gin.SetMode(gin.TestMode) + db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{}) + if err != nil { + t.Fatalf("open db: %v", err) + } + if err := db.AutoMigrate(model.AllModels()...); err != nil { + t.Fatalf("migrate: %v", err) + } + repos := repository.New(db) + if err := repos.Setting.Set(t.Context(), service.CloudPlaybackModeSettingKey, service.CloudPlaybackModeSTRM); err != nil { + t.Fatalf("set cloud playback mode: %v", err) + } + if err := repos.User.Create(t.Context(), &model.User{ + Base: model.Base{ID: "user-1"}, + Username: "tester", + PasswordHash: "x", + Role: "admin", + Tier: "plus", + IsActive: true, + }); err != nil { + t.Fatalf("create user: %v", err) + } + lib := model.Library{Name: "OpenList", Path: "cloud://openlist/Movies", Type: "movie", Enabled: true} + if err := repos.Library.Create(t.Context(), &lib); err != nil { + t.Fatalf("create library: %v", err) + } + if err := db.Create(&model.Media{ + Base: model.Base{ID: "cloud-1"}, + LibraryID: lib.ID, + Title: "Cloud Movie", + Path: "cloud://openlist/Movies/Movie.mkv", + STRMURL: "/api/cloud/play/openlist?ref=%2FMovies%2FMovie.mkv", + Container: "mkv", + }).Error; err != nil { + t.Fatalf("create media: %v", err) + } + + const secret = "test-secret" + router := gin.New() + registerEmbyRoutes(router, secret, &service.Container{ + Repo: repos, + Emby: service.NewEmbyService(&config.Config{}, zap.NewNop(), repos), + }) + + req := httptest.NewRequest(http.MethodGet, "/users/user-1/items/cloud-1/playbackinfo", nil) + req.Header.Set("X-Emby-Token", signedTestToken(t, secret)) + w := httptest.NewRecorder() + router.ServeHTTP(w, req) + + if w.Code != http.StatusOK { + t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String()) + } + var body map[string]any + if err := json.Unmarshal(w.Body.Bytes(), &body); err != nil { + t.Fatalf("decode playback info: %v", err) + } + source := body["MediaSources"].([]any)[0].(map[string]any) + pathURL, _ := source["Path"].(string) + if pathURL != "/api/stream/cloud-1" { + t.Fatalf("cloud Path should stay as non-tokenized display stream URL, got %#v", source) + } + if strings.Contains(pathURL, "api_key=") || strings.Contains(pathURL, "token=") { + t.Fatalf("cloud Path must not expose auth key/token: %#v", source) + } + if strings.Contains(pathURL, "/api/cloud/play/") { + t.Fatalf("cloud Path should not expose naked cloud play URL: %#v", source) + } + directURL, _ := source["DirectStreamUrl"].(string) + if !strings.HasPrefix(directURL, "/api/stream/cloud-1") || !strings.Contains(directURL, "api_key=") { + t.Fatalf("DirectStreamUrl should stay tokenized: %#v", source) + } + if source["SupportsDirectPlay"] != true { + t.Fatalf("cloud media should advertise DirectPlay when tokenized Path is playable: %#v", source) + } + if source["SupportsTranscoding"] != false { + t.Fatalf("cloud media should not advertise host transcoding: %#v", source) + } +} + +func TestEmbyItemsDoNotExposeTokenInEmbeddedCloudPath(t *testing.T) { + gin.SetMode(gin.TestMode) + db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{}) + if err != nil { + t.Fatalf("open db: %v", err) + } + if err := db.AutoMigrate(model.AllModels()...); err != nil { + t.Fatalf("migrate: %v", err) + } + repos := repository.New(db) + if err := repos.Setting.Set(t.Context(), service.CloudPlaybackModeSettingKey, service.CloudPlaybackModeSTRM); err != nil { + t.Fatalf("set cloud playback mode: %v", err) + } + if err := repos.User.Create(t.Context(), &model.User{ + Base: model.Base{ID: "user-1"}, + Username: "tester", + PasswordHash: "x", + Role: "admin", + Tier: "plus", + IsActive: true, + }); err != nil { + t.Fatalf("create user: %v", err) + } + lib := model.Library{Name: "OpenList", Path: "cloud://openlist/Movies", Type: "movie", Enabled: true} + if err := repos.Library.Create(t.Context(), &lib); err != nil { + t.Fatalf("create library: %v", err) + } + if err := db.Create(&model.Media{ + Base: model.Base{ID: "cloud-1"}, + LibraryID: lib.ID, + Title: "Cloud Movie", + Path: "cloud://openlist/Movies/Movie.mkv", + STRMURL: "/api/cloud/play/openlist?ref=%2FMovies%2FMovie.mkv", + Container: "mkv", + }).Error; err != nil { + t.Fatalf("create media: %v", err) + } + + const secret = "test-secret" + token := signedTestToken(t, secret) + router := gin.New() + registerEmbyRoutes(router, secret, &service.Container{ + Repo: repos, + Emby: service.NewEmbyService(&config.Config{}, zap.NewNop(), repos), + }) + + req := httptest.NewRequest(http.MethodGet, "/emby/Users/user-1/Items?IncludeItemTypes=Movie&Recursive=true&Limit=5&X-Emby-Token="+token, nil) + w := httptest.NewRecorder() + router.ServeHTTP(w, req) + + if w.Code != http.StatusOK { + t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String()) + } + var body map[string]any + if err := json.Unmarshal(w.Body.Bytes(), &body); err != nil { + t.Fatalf("decode items: %v", err) + } + items := body["Items"].([]any) + if len(items) != 1 { + t.Fatalf("unexpected items: %#v", body["Items"]) + } + source := items[0].(map[string]any)["MediaSources"].([]any)[0].(map[string]any) + pathURL, _ := source["Path"].(string) + if pathURL != "/api/stream/cloud-1" { + t.Fatalf("embedded cloud Path should stay as non-tokenized display stream URL, got %#v", source) + } + if strings.Contains(pathURL, "api_key=") || strings.Contains(pathURL, "token=") { + t.Fatalf("embedded cloud Path must not expose auth key/token: %#v", source) + } +} diff --git a/internal/handler/emby_playback_routes_test.go b/internal/handler/emby_playback_routes_test.go index e915a73..59b0b01 100644 --- a/internal/handler/emby_playback_routes_test.go +++ b/internal/handler/emby_playback_routes_test.go @@ -1,12 +1,10 @@ package handler import ( - "encoding/json" "net/http" "net/http/httptest" "os" "path/filepath" - "strings" "testing" "github.com/gin-gonic/gin" @@ -15,383 +13,11 @@ import ( "gorm.io/gorm" "github.com/ShukeBta/MediaStationGo/internal/config" - "github.com/ShukeBta/MediaStationGo/internal/middleware" "github.com/ShukeBta/MediaStationGo/internal/model" "github.com/ShukeBta/MediaStationGo/internal/repository" "github.com/ShukeBta/MediaStationGo/internal/service" ) -func TestEmbyLowercasePlaybackInfoRouteReturnsJSON(t *testing.T) { - gin.SetMode(gin.TestMode) - db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{}) - if err != nil { - t.Fatalf("open db: %v", err) - } - if err := db.AutoMigrate(model.AllModels()...); err != nil { - t.Fatalf("migrate: %v", err) - } - repos := repository.New(db) - if err := repos.User.Create(t.Context(), &model.User{ - Base: model.Base{ID: "user-1"}, - Username: "tester", - PasswordHash: "x", - Role: "admin", - Tier: "plus", - IsActive: true, - }); err != nil { - t.Fatalf("create user: %v", err) - } - lib := model.Library{Name: "电影", Path: t.TempDir(), Type: "movie", Enabled: true} - if err := repos.Library.Create(t.Context(), &lib); err != nil { - t.Fatalf("create library: %v", err) - } - if err := db.Create(&model.Media{ - Base: model.Base{ID: "media-1"}, - LibraryID: lib.ID, - Title: "Lowercase Playback", - Path: filepath.Join(lib.Path, "lowercase-playback.mp4"), - Container: "mp4", - }).Error; err != nil { - t.Fatalf("create media: %v", err) - } - - const secret = "test-secret" - router := gin.New() - registerEmbyRoutes(router, secret, &service.Container{ - Repo: repos, - Emby: service.NewEmbyService(&config.Config{}, zap.NewNop(), repos), - }) - - req := httptest.NewRequest(http.MethodGet, "/users/user-1/items/media-1/playbackinfo", nil) - req.Header.Set("X-Emby-Token", signedTestToken(t, secret)) - w := httptest.NewRecorder() - router.ServeHTTP(w, req) - - if w.Code != http.StatusOK { - t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String()) - } - var body map[string]any - if err := json.Unmarshal(w.Body.Bytes(), &body); err != nil { - t.Fatalf("decode playback info: %v", err) - } - if _, ok := body["MediaSources"]; !ok { - t.Fatalf("missing MediaSources: %#v", body) - } - sources, ok := body["MediaSources"].([]any) - if !ok || len(sources) == 0 { - t.Fatalf("unexpected MediaSources: %#v", body["MediaSources"]) - } - source, ok := sources[0].(map[string]any) - if !ok { - t.Fatalf("unexpected MediaSource: %#v", sources[0]) - } - directURL, _ := source["DirectStreamUrl"].(string) - if !strings.Contains(directURL, "api_key=") { - t.Fatalf("DirectStreamUrl should carry api_key for clients that do not repeat auth headers: %#v", source) - } - transcodeURL, _ := source["TranscodingUrl"].(string) - if transcodeURL != "" && !strings.Contains(transcodeURL, "api_key=") { - t.Fatalf("TranscodingUrl should carry api_key: %#v", source) - } -} - -func TestEmbyPlaybackInfoDoesNotExposeTokenInCloudPath(t *testing.T) { - gin.SetMode(gin.TestMode) - db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{}) - if err != nil { - t.Fatalf("open db: %v", err) - } - if err := db.AutoMigrate(model.AllModels()...); err != nil { - t.Fatalf("migrate: %v", err) - } - repos := repository.New(db) - if err := repos.Setting.Set(t.Context(), service.CloudPlaybackModeSettingKey, service.CloudPlaybackModeSTRM); err != nil { - t.Fatalf("set cloud playback mode: %v", err) - } - if err := repos.User.Create(t.Context(), &model.User{ - Base: model.Base{ID: "user-1"}, - Username: "tester", - PasswordHash: "x", - Role: "admin", - Tier: "plus", - IsActive: true, - }); err != nil { - t.Fatalf("create user: %v", err) - } - lib := model.Library{Name: "OpenList", Path: "cloud://openlist/Movies", Type: "movie", Enabled: true} - if err := repos.Library.Create(t.Context(), &lib); err != nil { - t.Fatalf("create library: %v", err) - } - if err := db.Create(&model.Media{ - Base: model.Base{ID: "cloud-1"}, - LibraryID: lib.ID, - Title: "Cloud Movie", - Path: "cloud://openlist/Movies/Movie.mkv", - STRMURL: "/api/cloud/play/openlist?ref=%2FMovies%2FMovie.mkv", - Container: "mkv", - }).Error; err != nil { - t.Fatalf("create media: %v", err) - } - - const secret = "test-secret" - router := gin.New() - registerEmbyRoutes(router, secret, &service.Container{ - Repo: repos, - Emby: service.NewEmbyService(&config.Config{}, zap.NewNop(), repos), - }) - - req := httptest.NewRequest(http.MethodGet, "/users/user-1/items/cloud-1/playbackinfo", nil) - req.Header.Set("X-Emby-Token", signedTestToken(t, secret)) - w := httptest.NewRecorder() - router.ServeHTTP(w, req) - - if w.Code != http.StatusOK { - t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String()) - } - var body map[string]any - if err := json.Unmarshal(w.Body.Bytes(), &body); err != nil { - t.Fatalf("decode playback info: %v", err) - } - source := body["MediaSources"].([]any)[0].(map[string]any) - pathURL, _ := source["Path"].(string) - if pathURL != "/api/stream/cloud-1" { - t.Fatalf("cloud Path should stay as non-tokenized display stream URL, got %#v", source) - } - if strings.Contains(pathURL, "api_key=") || strings.Contains(pathURL, "token=") { - t.Fatalf("cloud Path must not expose auth key/token: %#v", source) - } - if strings.Contains(pathURL, "/api/cloud/play/") { - t.Fatalf("cloud Path should not expose naked cloud play URL: %#v", source) - } - directURL, _ := source["DirectStreamUrl"].(string) - if !strings.HasPrefix(directURL, "/api/stream/cloud-1") || !strings.Contains(directURL, "api_key=") { - t.Fatalf("DirectStreamUrl should stay tokenized: %#v", source) - } - if source["SupportsDirectPlay"] != true { - t.Fatalf("cloud media should advertise DirectPlay when tokenized Path is playable: %#v", source) - } - if source["SupportsTranscoding"] != false { - t.Fatalf("cloud media should not advertise host transcoding: %#v", source) - } -} - -func TestEmbyItemsDoNotExposeTokenInEmbeddedCloudPath(t *testing.T) { - gin.SetMode(gin.TestMode) - db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{}) - if err != nil { - t.Fatalf("open db: %v", err) - } - if err := db.AutoMigrate(model.AllModels()...); err != nil { - t.Fatalf("migrate: %v", err) - } - repos := repository.New(db) - if err := repos.Setting.Set(t.Context(), service.CloudPlaybackModeSettingKey, service.CloudPlaybackModeSTRM); err != nil { - t.Fatalf("set cloud playback mode: %v", err) - } - if err := repos.User.Create(t.Context(), &model.User{ - Base: model.Base{ID: "user-1"}, - Username: "tester", - PasswordHash: "x", - Role: "admin", - Tier: "plus", - IsActive: true, - }); err != nil { - t.Fatalf("create user: %v", err) - } - lib := model.Library{Name: "OpenList", Path: "cloud://openlist/Movies", Type: "movie", Enabled: true} - if err := repos.Library.Create(t.Context(), &lib); err != nil { - t.Fatalf("create library: %v", err) - } - if err := db.Create(&model.Media{ - Base: model.Base{ID: "cloud-1"}, - LibraryID: lib.ID, - Title: "Cloud Movie", - Path: "cloud://openlist/Movies/Movie.mkv", - STRMURL: "/api/cloud/play/openlist?ref=%2FMovies%2FMovie.mkv", - Container: "mkv", - }).Error; err != nil { - t.Fatalf("create media: %v", err) - } - - const secret = "test-secret" - token := signedTestToken(t, secret) - router := gin.New() - registerEmbyRoutes(router, secret, &service.Container{ - Repo: repos, - Emby: service.NewEmbyService(&config.Config{}, zap.NewNop(), repos), - }) - - req := httptest.NewRequest(http.MethodGet, "/emby/Users/user-1/Items?IncludeItemTypes=Movie&Recursive=true&Limit=5&X-Emby-Token="+token, nil) - w := httptest.NewRecorder() - router.ServeHTTP(w, req) - - if w.Code != http.StatusOK { - t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String()) - } - var body map[string]any - if err := json.Unmarshal(w.Body.Bytes(), &body); err != nil { - t.Fatalf("decode items: %v", err) - } - items := body["Items"].([]any) - if len(items) != 1 { - t.Fatalf("unexpected items: %#v", body["Items"]) - } - source := items[0].(map[string]any)["MediaSources"].([]any)[0].(map[string]any) - pathURL, _ := source["Path"].(string) - if pathURL != "/api/stream/cloud-1" { - t.Fatalf("embedded cloud Path should stay as non-tokenized display stream URL, got %#v", source) - } - if strings.Contains(pathURL, "api_key=") || strings.Contains(pathURL, "token=") { - t.Fatalf("embedded cloud Path must not expose auth key/token: %#v", source) - } -} - -func TestEmbyVideoStreamUsesSTRMWhenRedirectProxyDisabled(t *testing.T) { - gin.SetMode(gin.TestMode) - db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{}) - if err != nil { - t.Fatalf("open db: %v", err) - } - if err := db.AutoMigrate(model.AllModels()...); err != nil { - t.Fatalf("migrate: %v", err) - } - repos := repository.New(db) - if err := repos.Setting.Set(t.Context(), service.CloudPlaybackModeSettingKey, service.CloudPlaybackModeSTRM); err != nil { - t.Fatalf("set cloud playback mode: %v", err) - } - if err := repos.Setting.Set(t.Context(), service.CloudPlaybackSTRMEnabledSettingKey, "true"); err != nil { - t.Fatalf("enable strm playback: %v", err) - } - if err := repos.Setting.Set(t.Context(), service.CloudPlaybackRedirectEnabledSettingKey, "false"); err != nil { - t.Fatalf("disable redirect playback: %v", err) - } - if err := repos.User.Create(t.Context(), &model.User{ - Base: model.Base{ID: "user-1"}, - Username: "tester", - PasswordHash: "x", - Role: "admin", - Tier: "plus", - IsActive: true, - }); err != nil { - t.Fatalf("create user: %v", err) - } - lib := model.Library{Name: "OpenList", Path: "cloud://openlist/Movies", Type: "movie", Enabled: true} - if err := repos.Library.Create(t.Context(), &lib); err != nil { - t.Fatalf("create library: %v", err) - } - if err := db.Create(&model.Media{ - Base: model.Base{ID: "cloud-1"}, - LibraryID: lib.ID, - Title: "Cloud Movie", - Path: "cloud://openlist/Movies/Movie.mkv", - STRMURL: "/api/cloud/play/openlist?ref=%2FMovies%2FMovie.mkv", - Container: "mkv", - }).Error; err != nil { - t.Fatalf("create media: %v", err) - } - - const secret = "test-secret" - router := gin.New() - cfg := &config.Config{Secrets: config.SecretsConfig{JWTSecret: secret}} - registerEmbyRoutes(router, secret, &service.Container{ - Repo: repos, - Emby: service.NewEmbyService(cfg, zap.NewNop(), repos), - Stream: service.NewStreamService(cfg, zap.NewNop(), repos, nil), - }) - - token := signedTestToken(t, secret) - req := httptest.NewRequest(http.MethodGet, "/videos/cloud-1/stream?api_key="+token, nil) - w := httptest.NewRecorder() - router.ServeHTTP(w, req) - - if w.Code != http.StatusFound { - t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String()) - } - loc := w.Header().Get("Location") - if !strings.Contains(loc, "/api/stream/cloud-1") || !strings.Contains(loc, "api_key=") { - t.Fatalf("STRM mode should redirect /Videos fallback to tokenized /api/stream, got %q", loc) - } - if got := w.Header().Get("Cache-Control"); !strings.Contains(got, "no-store") { - t.Fatalf("STRM fallback redirect Cache-Control = %q, want no-store", got) - } - if strings.Contains(loc, "/api/cloud/play/") { - t.Fatalf("STRM mode should not expose cloud play directly from /Videos fallback: %q", loc) - } -} - -func TestEmbyVideoStreamIssuesTokenForSessionFallbackSTRMRedirect(t *testing.T) { - gin.SetMode(gin.TestMode) - db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{}) - if err != nil { - t.Fatalf("open db: %v", err) - } - if err := db.AutoMigrate(model.AllModels()...); err != nil { - t.Fatalf("migrate: %v", err) - } - repos := repository.New(db) - if err := repos.Setting.Set(t.Context(), service.CloudPlaybackModeSettingKey, service.CloudPlaybackModeSTRM); err != nil { - t.Fatalf("set cloud playback mode: %v", err) - } - if err := repos.Setting.Set(t.Context(), service.CloudPlaybackSTRMEnabledSettingKey, "true"); err != nil { - t.Fatalf("enable strm playback: %v", err) - } - if err := repos.Setting.Set(t.Context(), service.CloudPlaybackRedirectEnabledSettingKey, "false"); err != nil { - t.Fatalf("disable redirect playback: %v", err) - } - user := model.User{ - Base: model.Base{ID: "user-1"}, - Username: "tester", - PasswordHash: "x", - Role: "admin", - Tier: "plus", - IsActive: true, - } - if err := repos.User.Create(t.Context(), &user); err != nil { - t.Fatalf("create user: %v", err) - } - lib := model.Library{Name: "OpenList", Path: "cloud://openlist/Movies", Type: "movie", Enabled: true} - if err := repos.Library.Create(t.Context(), &lib); err != nil { - t.Fatalf("create library: %v", err) - } - if err := db.Create(&model.Media{ - Base: model.Base{ID: "cloud-1"}, - LibraryID: lib.ID, - Title: "Cloud Movie", - Path: "cloud://openlist/Movies/Movie.mkv", - STRMURL: "/api/cloud/play/openlist?ref=%2FMovies%2FMovie.mkv", - Container: "mkv", - }).Error; err != nil { - t.Fatalf("create media: %v", err) - } - - const secret = "test-secret" - cfg := &config.Config{Secrets: config.SecretsConfig{JWTSecret: secret}} - svc := &service.Container{ - Repo: repos, - Auth: service.NewAuthService(cfg, zap.NewNop(), repos, nil, nil), - Emby: service.NewEmbyService(cfg, zap.NewNop(), repos), - Stream: service.NewStreamService(cfg, zap.NewNop(), repos, nil), - } - router := gin.New() - router.GET("/videos/:id/stream", func(c *gin.Context) { - c.Set(middleware.CtxUserID, user.ID) - c.Set(middleware.CtxUserRole, user.Role) - embyVideoStreamHandler(svc, service.CloudPlaybackModeRedirectProxy)(c) - }) - - req := httptest.NewRequest(http.MethodGet, "/videos/cloud-1/stream", nil) - w := httptest.NewRecorder() - router.ServeHTTP(w, req) - - if w.Code != http.StatusFound { - t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String()) - } - loc := w.Header().Get("Location") - if !strings.Contains(loc, "/api/stream/cloud-1") || !strings.Contains(loc, "api_key=") { - t.Fatalf("session fallback redirect should include api_key for /api/stream, got %q", loc) - } -} - func TestEmbyLowercaseVideoStreamRouteServesMedia(t *testing.T) { gin.SetMode(gin.TestMode) db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{}) @@ -510,64 +136,6 @@ func TestEmbyPrefixedAPIStreamRouteServesMedia(t *testing.T) { } } -func TestEmbyVideoStreamRedirectKeepsMediaBrowserAuthorizationToken(t *testing.T) { - gin.SetMode(gin.TestMode) - db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{}) - if err != nil { - t.Fatalf("open db: %v", err) - } - if err := db.AutoMigrate(model.AllModels()...); err != nil { - t.Fatalf("migrate: %v", err) - } - repos := repository.New(db) - if err := repos.User.Create(t.Context(), &model.User{ - Base: model.Base{ID: "user-1"}, - Username: "tester", - PasswordHash: "x", - Role: "admin", - Tier: "plus", - IsActive: true, - }); err != nil { - t.Fatalf("create user: %v", err) - } - lib := model.Library{Name: "OpenList", Path: "cloud://openlist/Movies", Type: "movie", Enabled: true} - if err := repos.Library.Create(t.Context(), &lib); err != nil { - t.Fatalf("create library: %v", err) - } - if err := db.Create(&model.Media{ - Base: model.Base{ID: "cloud-1"}, - LibraryID: lib.ID, - Title: "Cloud Movie", - Path: "cloud://openlist/Movies/Movie.mkv", - STRMURL: "/api/cloud/play/openlist?ref=%2FMovies%2FMovie.mkv", - Container: "mkv", - }).Error; err != nil { - t.Fatalf("create media: %v", err) - } - - const secret = "test-secret" - router := gin.New() - registerEmbyRoutes(router, secret, &service.Container{ - Repo: repos, - Emby: service.NewEmbyService(&config.Config{}, zap.NewNop(), repos), - Stream: service.NewStreamService(&config.Config{}, zap.NewNop(), repos, nil), - }) - - token := signedTestToken(t, secret) - req := httptest.NewRequest(http.MethodGet, "/videos/cloud-1/stream", nil) - req.Header.Set("X-MediaBrowser-Authorization", `MediaBrowser Client="Infuse", Device="PC", Token="`+token+`"`) - w := httptest.NewRecorder() - router.ServeHTTP(w, req) - - if w.Code != http.StatusFound { - t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String()) - } - loc := w.Header().Get("Location") - if !strings.Contains(loc, "/api/cloud/play/openlist?") || !strings.Contains(loc, "token=") { - t.Fatalf("redirect Location should target tokenized cloud play endpoint, got %q", loc) - } -} - func TestEmbyLowercaseOriginalHeadRouteServesHeaders(t *testing.T) { gin.SetMode(gin.TestMode) db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})