Floatplane channel plugin for Jellyfin 10.10.x: browse, HLS proxy, cookie session, CI release
Some checks failed
release / build-release (push) Has been cancelled
Some checks failed
release / build-release (push) Has been cancelled
- IChannel: creators -> sub-channels -> video posts (public listing API, search mapped) - IRequiresMediaInfoCallback -> signed proxy URLs; stream controller rewrites HLS so the AES-128 key is fetched server-side with the session cookie, segments stay on the CDN - delivery/info cached per token lifetime and throttled (~2/min) - config page: paste sails.sid + validate, extra creators, quality, search test - scripts/package.sh -> plugin folder + zip + md5 + manifest.json; Gitea release workflow - research docs, HAR analysis (HAR itself gitignored), install-pi5.sh Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
275
doc/research/reference-sources/fn_AuthInterceptor.kt
Normal file
275
doc/research/reference-sources/fn_AuthInterceptor.kt
Normal file
@@ -0,0 +1,275 @@
|
||||
package com.coulterpeterson.floatnative.api
|
||||
|
||||
import com.coulterpeterson.floatnative.data.TokenManager
|
||||
import kotlinx.coroutines.runBlocking
|
||||
import okhttp3.Interceptor
|
||||
import okhttp3.Response
|
||||
import retrofit2.HttpException
|
||||
import org.json.JSONObject
|
||||
import java.io.IOException
|
||||
import java.text.SimpleDateFormat
|
||||
import java.util.Locale
|
||||
|
||||
|
||||
class AuthInterceptor(
|
||||
private val tokenManager: TokenManager,
|
||||
private val dpopManager: com.coulterpeterson.floatnative.data.DPoPManager,
|
||||
private val authApiProvider: () -> OAuthApi // Lazy provider to avoid circular dependency
|
||||
) : Interceptor {
|
||||
|
||||
override fun intercept(chain: Interceptor.Chain): Response {
|
||||
val originalRequest = chain.request()
|
||||
val builder = originalRequest.newBuilder()
|
||||
|
||||
// 1. Add Headers
|
||||
val accessToken = tokenManager.accessToken
|
||||
val authCookie = tokenManager.authCookie
|
||||
|
||||
val url = originalRequest.url.toString()
|
||||
val isFloatplane = url.contains("floatplane.com") || url.contains("floatnative.coulterpeterson.com")
|
||||
|
||||
if (accessToken != null && isFloatplane) {
|
||||
// Generate DPoP Proof
|
||||
try {
|
||||
val method = originalRequest.method
|
||||
val url = originalRequest.url.toString()
|
||||
val proof = dpopManager.generateProof(method, url, accessToken)
|
||||
|
||||
builder.header("DPoP", proof)
|
||||
builder.header("Authorization", "DPoP $accessToken")
|
||||
} catch (e: Exception) {
|
||||
e.printStackTrace()
|
||||
// Fallback (though DPoP is required now)
|
||||
builder.header("Authorization", "Bearer $accessToken")
|
||||
}
|
||||
}
|
||||
|
||||
// Add Cookie if present (Sails requires this for chat, even if we have DPoP)
|
||||
if (authCookie != null) {
|
||||
builder.header("Cookie", "sails.sid=$authCookie")
|
||||
}
|
||||
|
||||
builder.header("User-Agent", "FloatNative/1.0 (Android)")
|
||||
|
||||
val finalRequest = builder.build()
|
||||
|
||||
var response: Response? = null
|
||||
try {
|
||||
response = chain.proceed(finalRequest)
|
||||
} catch (e: Exception) {
|
||||
// Check for SSL Handshake or Peer Unverified exceptions which might indicate
|
||||
// clock skew or cert issues that a fresh token *might* help with (user request),
|
||||
// or network glitches we want to retry once.
|
||||
if (e is javax.net.ssl.SSLHandshakeException || e is javax.net.ssl.SSLPeerUnverifiedException) {
|
||||
val refreshToken = tokenManager.refreshToken
|
||||
if (refreshToken != null) {
|
||||
synchronized(this) {
|
||||
try {
|
||||
// Attempt to refresh token
|
||||
val authApi = authApiProvider()
|
||||
val tokenEndpoint = "https://auth.floatplane.com/realms/floatplane/protocol/openid-connect/token"
|
||||
val refreshProof = dpopManager.generateProof("POST", tokenEndpoint)
|
||||
|
||||
// Run blocking because Interceptor is synchronous
|
||||
val tokenResponse = runBlocking {
|
||||
authApi.getToken(
|
||||
dpop = refreshProof,
|
||||
grantType = "refresh_token",
|
||||
clientId = "floatnative",
|
||||
refreshToken = refreshToken
|
||||
)
|
||||
}
|
||||
|
||||
// Save new tokens
|
||||
tokenManager.accessToken = tokenResponse.access_token
|
||||
tokenManager.refreshToken = tokenResponse.refresh_token
|
||||
|
||||
// Retry original request with new token
|
||||
val method = originalRequest.method
|
||||
val url = originalRequest.url.toString()
|
||||
val proof = dpopManager.generateProof(method, url, tokenResponse.access_token)
|
||||
|
||||
return chain.proceed(
|
||||
originalRequest.newBuilder()
|
||||
.header("DPoP", proof)
|
||||
.header("Authorization", "DPoP ${tokenResponse.access_token}")
|
||||
.build()
|
||||
)
|
||||
} catch (refreshEx: Exception) {
|
||||
android.util.Log.e("AuthInterceptor", "Refresh failed during SSL recovery. Forcing logout.", refreshEx)
|
||||
// Force logout so user can try to log in again (as requested)
|
||||
tokenManager.clearAll()
|
||||
throw e
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
// If not SSL error or no refresh token, rethrow
|
||||
throw e
|
||||
}
|
||||
|
||||
// 2. Extract Cookie from Response (if logging in via legacy or hybrid)
|
||||
val cookies = response.headers("Set-Cookie")
|
||||
for (cookie in cookies) {
|
||||
if (cookie.contains("sails.sid")) {
|
||||
// Simple parsing to get value
|
||||
val parts = cookie.split(";")
|
||||
for (part in parts) {
|
||||
val pair = part.trim().split("=")
|
||||
if (pair.size == 2 && pair[0] == "sails.sid") {
|
||||
tokenManager.authCookie = pair[1]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// 3. Handle 401 Unauthorized or 403 Forbidden
|
||||
if (response.code == 401 || response.code == 403) {
|
||||
val refreshToken = tokenManager.refreshToken
|
||||
if (refreshToken != null) {
|
||||
synchronized(this) {
|
||||
// Double check if token was updated by another thread
|
||||
val currentAccessToken = tokenManager.accessToken
|
||||
if (currentAccessToken != null && currentAccessToken != accessToken) {
|
||||
// Token was updated, retry with new token
|
||||
response.close()
|
||||
// Generate new proof for the retried request with new token
|
||||
try {
|
||||
val method = originalRequest.method
|
||||
val url = originalRequest.url.toString()
|
||||
val proof = dpopManager.generateProof(method, url, currentAccessToken)
|
||||
|
||||
return chain.proceed(
|
||||
originalRequest.newBuilder()
|
||||
.header("DPoP", proof)
|
||||
.header("Authorization", "DPoP $currentAccessToken")
|
||||
.build()
|
||||
)
|
||||
} catch (e: Exception) {
|
||||
return chain.proceed(
|
||||
originalRequest.newBuilder()
|
||||
.header("Authorization", "Bearer $currentAccessToken")
|
||||
.build()
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
// Try to refresh
|
||||
try {
|
||||
val authApi = authApiProvider()
|
||||
|
||||
// Generate DPoP proof for Token Endpoint
|
||||
val tokenEndpoint = "https://auth.floatplane.com/realms/floatplane/protocol/openid-connect/token"
|
||||
val refreshProof = dpopManager.generateProof("POST", tokenEndpoint)
|
||||
|
||||
// Run blocking because Interceptor is synchronous
|
||||
val tokenResponse = runBlocking {
|
||||
authApi.getToken(
|
||||
dpop = refreshProof,
|
||||
grantType = "refresh_token",
|
||||
clientId = "floatnative",
|
||||
refreshToken = refreshToken
|
||||
)
|
||||
}
|
||||
|
||||
// Save new tokens
|
||||
tokenManager.accessToken = tokenResponse.access_token
|
||||
tokenManager.refreshToken = tokenResponse.refresh_token
|
||||
// Update expiry if needed
|
||||
|
||||
// Retry request
|
||||
response.close()
|
||||
|
||||
// Generate DPoP proof for the retried request with NEW token
|
||||
val method = originalRequest.method
|
||||
val url = originalRequest.url.toString()
|
||||
val proof = dpopManager.generateProof(method, url, tokenResponse.access_token)
|
||||
|
||||
return chain.proceed(
|
||||
originalRequest.newBuilder()
|
||||
.header("DPoP", proof)
|
||||
.header("Authorization", "DPoP ${tokenResponse.access_token}")
|
||||
.build()
|
||||
)
|
||||
|
||||
} catch (e: Exception) {
|
||||
// Handle DPoP Time Skew for Refresh Token
|
||||
if (e is HttpException && e.code() == 400) {
|
||||
val errorBody = e.response()?.errorBody()?.string()
|
||||
if (!errorBody.isNullOrEmpty() && errorBody.contains("DPoP", ignoreCase = true)) {
|
||||
try {
|
||||
// 1. Auto-correct time
|
||||
val dateHeader = e.response()?.headers()?.get("date")
|
||||
if (dateHeader != null) {
|
||||
val sdf = SimpleDateFormat("EEE, dd MMM yyyy HH:mm:ss zzz", Locale.US)
|
||||
val serverTime = sdf.parse(dateHeader)?.time
|
||||
if (serverTime != null) {
|
||||
val deviceTime = System.currentTimeMillis()
|
||||
val offsetSeconds = (serverTime - deviceTime) / 1000
|
||||
dpopManager.timeOffsetSeconds = offsetSeconds
|
||||
android.util.Log.i("AuthInterceptor", "Auto-corrected DPoP time offset: $offsetSeconds s")
|
||||
}
|
||||
}
|
||||
|
||||
// 2. Retry Refresh
|
||||
val authApi = authApiProvider()
|
||||
val tokenEndpoint = "https://auth.floatplane.com/realms/floatplane/protocol/openid-connect/token"
|
||||
val retryProof = dpopManager.generateProof("POST", tokenEndpoint)
|
||||
|
||||
val retryTokenResponse = runBlocking {
|
||||
authApi.getToken(
|
||||
dpop = retryProof,
|
||||
grantType = "refresh_token",
|
||||
clientId = "floatnative",
|
||||
refreshToken = refreshToken
|
||||
)
|
||||
}
|
||||
|
||||
// 3. Save new tokens
|
||||
tokenManager.accessToken = retryTokenResponse.access_token
|
||||
tokenManager.refreshToken = retryTokenResponse.refresh_token
|
||||
|
||||
// 4. Retry Original Request
|
||||
response.close()
|
||||
val method = originalRequest.method
|
||||
val url = originalRequest.url.toString()
|
||||
val proof = dpopManager.generateProof(method, url, retryTokenResponse.access_token)
|
||||
|
||||
return chain.proceed(
|
||||
originalRequest.newBuilder()
|
||||
.header("DPoP", proof)
|
||||
.header("Authorization", "DPoP ${retryTokenResponse.access_token}")
|
||||
.build()
|
||||
)
|
||||
|
||||
} catch (retryEx: Exception) {
|
||||
android.util.Log.e("AuthInterceptor", "Retry refresh failed", retryEx)
|
||||
com.coulterpeterson.floatnative.utils.DebugLogManager.auth(
|
||||
"Token refresh retry failed; signing out",
|
||||
"${retryEx.javaClass.simpleName}: ${retryEx.message}"
|
||||
)
|
||||
tokenManager.clearAll()
|
||||
}
|
||||
} else {
|
||||
com.coulterpeterson.floatnative.utils.DebugLogManager.auth(
|
||||
"Token refresh failed (non-DPoP error); signing out",
|
||||
"${e.javaClass.simpleName}: ${e.message}"
|
||||
)
|
||||
tokenManager.clearAll()
|
||||
}
|
||||
} else {
|
||||
// Refresh failed, clear tokens to force re-login
|
||||
com.coulterpeterson.floatnative.utils.DebugLogManager.auth(
|
||||
"Token refresh failed; signing out",
|
||||
"${e.javaClass.simpleName}: ${e.message}"
|
||||
)
|
||||
tokenManager.clearAll()
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return response
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user