claude
9e33a343ab
Some checks failed
release / build-release (push) Has been cancelled
- IChannel: creators -> sub-channels -> video posts (public listing API, search mapped) - IRequiresMediaInfoCallback -> signed proxy URLs; stream controller rewrites HLS so the AES-128 key is fetched server-side with the session cookie, segments stay on the CDN - delivery/info cached per token lifetime and throttled (~2/min) - config page: paste sails.sid + validate, extra creators, quality, search test - scripts/package.sh -> plugin folder + zip + md5 + manifest.json; Gitea release workflow - research docs, HAR analysis (HAR itself gitignored), install-pi5.sh Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
56 lines
2.1 KiB
C#
56 lines
2.1 KiB
C#
using System;
|
|
using System.Globalization;
|
|
using System.Security.Cryptography;
|
|
using System.Text;
|
|
|
|
namespace Jellyfin.Plugin.Chaosflix.Api;
|
|
|
|
/// <summary>
|
|
/// Signs the proxy URLs the channel hands out, so the endpoint only serves
|
|
/// recordings this plugin selected. Without a signature anyone who can reach
|
|
/// the server could stream arbitrary CCC recordings through it.
|
|
/// </summary>
|
|
public static class ProxySignature
|
|
{
|
|
/// <summary>Query parameter carrying the signature.</summary>
|
|
public const string QueryParameter = "t";
|
|
|
|
/// <summary>
|
|
/// Secret for this server process. It is deliberately not persisted: media
|
|
/// sources are handed out per playback, so a restart simply means the next
|
|
/// request gets a freshly signed url, and nothing has to be stored or
|
|
/// migrated.
|
|
/// </summary>
|
|
public static string Secret { get; } = Guid.NewGuid().ToString("N");
|
|
|
|
/// <summary>
|
|
/// Signs one recording. The signature covers exactly the parameters the
|
|
/// controller acts on, so none of them can be swapped afterwards.
|
|
/// </summary>
|
|
public static string Create(string eventGuid, string? recordingFolder, string? language, string? filename = null)
|
|
{
|
|
var payload = string.Create(
|
|
CultureInfo.InvariantCulture,
|
|
$"{eventGuid}\n{recordingFolder ?? string.Empty}\n{language ?? string.Empty}\n{filename ?? string.Empty}");
|
|
|
|
var hash = HMACSHA256.HashData(Encoding.UTF8.GetBytes(Secret), Encoding.UTF8.GetBytes(payload));
|
|
return Convert.ToHexStringLower(hash);
|
|
}
|
|
|
|
/// <summary>
|
|
/// Verifies a signature in constant time.
|
|
/// </summary>
|
|
public static bool Verify(string eventGuid, string? recordingFolder, string? language, string? signature, string? filename = null)
|
|
{
|
|
if (string.IsNullOrEmpty(signature))
|
|
{
|
|
return false;
|
|
}
|
|
|
|
var expected = Create(eventGuid, recordingFolder, language, filename);
|
|
return CryptographicOperations.FixedTimeEquals(
|
|
Encoding.UTF8.GetBytes(expected),
|
|
Encoding.UTF8.GetBytes(signature));
|
|
}
|
|
}
|