Connecting your account, please wait...
-/tracks/<track_id>/stream
- {title}" - ) - except Exception as e: - LOG.error(f"Pyrogram upload failed: {e}") - return - - if not msg: - LOG.error("Failed to upload to Telegram (msg is null).") - return - - media = msg.audio or msg.document - if not media: - LOG.error("Uploaded message has no audio or document attribute.") - return - - # 6. Save to MongoDB - track_id = media.file_unique_id - - try: - me = await bot.get_me() - bot_id = str(me.id) - except Exception: - bot_id = "default" - - # Match the provided sample document structure - doc = { - "_id": track_id, - "source_chat_id": channel_id, - "source_message_id": msg.id, - "audio": { - "title": title, - "artist": performer, - "performer": performer, - "duration_sec": float(duration), - "type": ext, - "yt_id": video_id, - "yt_url": url, - "album": "YouTube", - "album_id": "album_youtube" - }, - "telegram": { - "file_id": media.file_id, - "mime_type": _normalize_mime_type(getattr(media, "mime_type", "audio/mpeg")), - "file_size": media.file_size, - "file_ids": { - bot_id: media.file_id - } - }, - "spotify": { - "cover_url": thumbnail_url, - "cover_source": "youtube" - }, - "fingerprint": f"{title.lower()}|{performer.lower()}|youtube|{int(duration)}", - "created_at": time.time(), - "updated_at": time.time(), - "deleted": False - } - - await col.insert_one(doc) - LOG.info(f"Successfully processed YouTube audio: {title} (Track ID: {track_id}, Msg ID: {msg.id})") - - # 7. Look for lyrics in background - try: - asyncio.create_task(get_track_lyrics(track_id)) - except Exception as e: - LOG.warning(f"Failed to trigger lyrics fetch: {e}") - - except Exception as e: - LOG.error(f"Error in background YouTube process: {e}") - finally: - # Cleanup local files - for p in [final_filepath, thumbnail_path]: - if p and os.path.exists(p): - try: - os.remove(p) - except Exception as e: - LOG.debug(f"Failed to cleanup {p}: {e}") - -@router.post("/download") -async def download_youtube_track( - req: YTDownloadRequest, - background_tasks: BackgroundTasks, - user_id: int = Depends(require_user_id) -): - """ - Trigger a YouTube audio download with cookie support and thumbnail optimization. - The process runs in the background. - """ - if not req.url: - raise HTTPException(status_code=400, detail="YouTube URL is required") - - from stream.core.source_filter import ( - FilterMode, - get_filter_mode, - is_source_allowed, - is_source_banned, - ) - - if await is_source_banned(user_id): - raise HTTPException(status_code=403, detail="User is banned from adding tracks") - - mode = get_filter_mode() - if mode == FilterMode.HYBRID: - if not await is_source_allowed(user_id): - raise HTTPException( - status_code=403, - detail="User is not in allowed contributors collection (hybrid mode)", - ) - - background_tasks.add_task(process_yt_download, req.url, user_id) - return { - "ok": True, - "message": "YouTube audio download started in background", - "url": req.url, - } diff --git a/Api/schemas/__init__.py b/Api/schemas/__init__.py deleted file mode 100644 index 8b13789..0000000 --- a/Api/schemas/__init__.py +++ /dev/null @@ -1 +0,0 @@ - diff --git a/Api/schemas/auth.py b/Api/schemas/auth.py deleted file mode 100644 index 3ac9f4d..0000000 --- a/Api/schemas/auth.py +++ /dev/null @@ -1,97 +0,0 @@ -from pydantic import BaseModel - - -class TgLoginRequest(BaseModel): - init_data: str - username: str | None = None - password: str | None = None - invite_code: str | None = None - - -class PasswordLoginRequest(BaseModel): - username: str - password: str - - -class SetCredentialsRequest(BaseModel): - username: str - password: str - - -class SetCookieRequest(BaseModel): - token: str - - -class OwnerPasswordLoginRequest(BaseModel): - password: str - - -class SetOwnerPasswordRequest(BaseModel): - password: str - - -class ChangeOwnerPasswordRequest(BaseModel): - password: str - - -class FCMTokenRequest(BaseModel): - fcm_token: str - -class RegisterRequest(BaseModel): - userid: int - username: str - password: str - invite_code: str | None = None - -class ValidateOTPRequest(BaseModel): - userid: int - otp: str - - -class TelegramWidgetLoginRequest(BaseModel): - model_config = {"extra": "allow"} - - id: int - first_name: str | None = None - last_name: str | None = None - username: str | None = None - photo_url: str | None = None - auth_date: int - hash: str - invite_code: str | None = None - - -class TelegramTokenLoginRequest(BaseModel): - id_token: str - invite_code: str | None = None - - -class TelegramBotSessionRequest(BaseModel): - invite_code: str | None = None - - -class DiscordIntegrationSchema(BaseModel): - model_config = {"extra": "allow"} - enabled: bool = False - token: str = "" - mode: str = "gateway" - client_id: str = "1547543416143876167" - daemon_url: str = "ws://127.0.0.1:6472" - show_artwork: bool = True - - -class LastfmIntegrationSchema(BaseModel): - model_config = {"extra": "allow"} - enabled: bool = False - api_key: str = "" - api_secret: str = "" - session_key: str = "" - username: str = "" - scrobble_at: float = 0.5 - now_playing: bool = True - - -class IntegrationsUpdateRequest(BaseModel): - discord: DiscordIntegrationSchema | None = None - lastfm: LastfmIntegrationSchema | None = None - diff --git a/Api/schemas/browse.py b/Api/schemas/browse.py deleted file mode 100644 index ad5db24..0000000 --- a/Api/schemas/browse.py +++ /dev/null @@ -1,32 +0,0 @@ -from typing import Any - -from pydantic import BaseModel, ConfigDict, Field - -class BrowseItem(BaseModel): - model_config = ConfigDict(populate_by_name=True, ser_json_by_alias=False) - - id: str = Field(alias="_id") - source_chat_id: int | None = None - source_message_id: int | None = None - topic_id: int | None = None - topic_name: str | None = None - title: str | None = None - artist: str | None = None - album: str | None = None - album_id: str | None = None - duration_sec: int | None = None - type: str | None = None - sampling_rate_hz: int | None = None - spotify_url: str | None = None - cover_url: str | None = None - titles: dict[str, Any] | None = None - created_at: float | None = None - updated_at: float | None = None - liked: bool = False - -class BrowseResponse(BaseModel): - page: int - per_page: int - total: int - items: list[BrowseItem] - cover_url: str | None = None diff --git a/Api/schemas/favourites.py b/Api/schemas/favourites.py deleted file mode 100644 index d88507a..0000000 --- a/Api/schemas/favourites.py +++ /dev/null @@ -1,35 +0,0 @@ -from pydantic import BaseModel - -from Api.schemas.track import TrackResponse - - -class FavouriteCreate(BaseModel): - track_id: str - - -class ArtistFavouriteCreate(BaseModel): - artist_id: str | None = None - id: str | None = None - artistId: str | None = None - - -class FavouriteItem(BaseModel): - track: TrackResponse - created_at: float | None = None - - -class FavouritesResponse(BaseModel): - page: int - per_page: int - total: int - items: list[FavouriteItem] - last_updated_at: float | None = None - - -class FavouriteIdsResponse(BaseModel): - page: int - per_page: int - total: int - ids: list[str] - exists: bool - last_updated_at: float | None = None diff --git a/Api/schemas/friends.py b/Api/schemas/friends.py deleted file mode 100644 index 17255f5..0000000 --- a/Api/schemas/friends.py +++ /dev/null @@ -1,19 +0,0 @@ -from pydantic import BaseModel -from typing import Optional - -class FriendRequestPayload(BaseModel): - to: int - -class AcceptRequestPayload(BaseModel): - userId: int - -class InviteJamPayload(BaseModel): - toUserId: int - jamId: str - -class SettingsPayload(BaseModel): - share_listening: Optional[str] = None - allow_jam_invites: Optional[bool] = None - -class FcmTokenPayload(BaseModel): - token: str diff --git a/Api/schemas/playlists.py b/Api/schemas/playlists.py deleted file mode 100644 index 377b975..0000000 --- a/Api/schemas/playlists.py +++ /dev/null @@ -1,80 +0,0 @@ -from pydantic import BaseModel - -from Api.schemas.track import TrackResponse - - -class PlaylistCreate(BaseModel): - name: str - - -class PlaylistRename(BaseModel): - name: str - - -class PlaylistItem(BaseModel): - playlist_id: str - name: str - thumbnails: list[str] = [] - cover_url: str | None = None - normal_thumbnail: str | None = None - cover_id: str | None = None - created_at: float | None = None - updated_at: float | None = None - - -class PlaylistsResponse(BaseModel): - items: list[PlaylistItem] - - -class PlaylistTrackAdd(BaseModel): - track_id: str | list[str] | None = None - track_ids: list[str] | None = None - - -class PlaylistTracksResponse(BaseModel): - page: int - per_page: int - total: int - items: list[TrackResponse] - - -class AvailablePlaylistItem(BaseModel): - id: str - kind: str - name: str - thumbnails: list[str] = [] - thumbnail_url: str | None = None - normal_thumbnail: str | None = None - endpoint: str - requires_auth: bool = False - - -class AvailablePlaylistsResponse(BaseModel): - items: list[AvailablePlaylistItem] - - -class PlaylistShareResponse(BaseModel): - playlist_id: str - name: str - cover_url: str | None = None - normal_thumbnail: str | None = None - tracks: list[TrackResponse] - created_at: float | None = None - - -class UserAlbumAdd(BaseModel): - album_id: str | list[str] | None = None - album_ids: list[str] | None = None - - -class UserAlbumItem(BaseModel): - album_id: str - album: dict | None = None - saved_at: float | None = None - - -class UserAlbumsResponse(BaseModel): - page: int - per_page: int - total: int - items: list[UserAlbumItem] diff --git a/Api/schemas/topics.py b/Api/schemas/topics.py deleted file mode 100644 index 00a86fd..0000000 --- a/Api/schemas/topics.py +++ /dev/null @@ -1,21 +0,0 @@ -from pydantic import BaseModel - - -class TopicItem(BaseModel): - name: str - topic_name: str - topic_id: int | None = None - count: int = 0 - cover_url: str | None = None - thumbnail_url: str | None = None - normal_thumbnail: str | None = None - thumbnails: list[str] = [] - source_chat_id: int | None = None - endpoint: str - - -class TopicsResponse(BaseModel): - ok: bool = True - total: int - items: list[TopicItem] - topics: list[str] diff --git a/Api/schemas/track.py b/Api/schemas/track.py deleted file mode 100644 index 755b1a6..0000000 --- a/Api/schemas/track.py +++ /dev/null @@ -1,20 +0,0 @@ -from typing import Any - -from pydantic import BaseModel, ConfigDict, Field - -class TrackResponse(BaseModel): - model_config = ConfigDict(populate_by_name=True, ser_json_by_alias=True) - - id: str = Field(alias="_id") - source_chat_id: int | None = None - source_message_id: int | None = None - telegram: dict[str, Any] | None = None - audio: dict[str, Any] | None = None - spotify: dict[str, Any] | None = None - titles: dict[str, Any] | None = None - content_hash: str | None = None - fingerprint: str | None = None - created_at: float | None = None - updated_at: float | None = None - liked: bool = False - diff --git a/Api/services/__init__.py b/Api/services/__init__.py deleted file mode 100644 index 8b13789..0000000 --- a/Api/services/__init__.py +++ /dev/null @@ -1 +0,0 @@ - diff --git a/Api/services/access_control.py b/Api/services/access_control.py deleted file mode 100644 index 9fd81d3..0000000 --- a/Api/services/access_control.py +++ /dev/null @@ -1,614 +0,0 @@ -""" -Access control — registration policy, account locking, session revocation and -Telegram chat-membership gating. - -Storage - auth_config/_id="access_policy" {registration_mode, enforce_membership, required_chats[], lock_message} - users.{status, token_version, lock_reason, locked_at, locked_by} - invite_codes {_id: code, created_by, created_at, max_uses, uses, expires_at, used_by[], note} - registration_allowlist {_id: user_id, added_by, added_at, note} - -Fast path - Every authenticated request consults ``get_user_access`` which is memoised for 30 s per user, - so locking a user / bumping token_version cuts every device off within seconds without a DB - round-trip per request. -""" -from __future__ import annotations - -import asyncio -import secrets -import string -import time -from typing import Any, Literal, Optional - -from stream.database.MongoDb import db_handler -from stream.helpers.logger import LOGGER - -LOG = LOGGER(__name__) - -RegistrationMode = Literal["open", "invite", "allowlist", "closed"] -UserStatus = Literal["active", "locked", "restricted"] -REGISTRATION_MODES: tuple[str, ...] = ("open", "invite", "allowlist", "closed") - -POLICY_ID = "access_policy" -_POLICY_TTL = 15.0 -_ACCESS_TTL = 30.0 -_MEMBERSHIP_TTL = 10 * 60.0 - -_policy_cache: dict[str, Any] = {"value": None, "expires": 0.0} -_access_cache: dict[int, tuple[float, dict[str, Any]]] = {} -_membership_cache: dict[int, tuple[float, bool, list[dict[str, Any]]]] = {} -_lock = asyncio.Lock() - - -def _col(name: str): - return db_handler.get_collection(name).collection - - -def _now() -> float: - return time.time() - - -# --------------------------------------------------------------------------- policy - - -def default_policy() -> dict[str, Any]: - return { - "registration_mode": "open", - "enforce_membership": False, - "required_chats": [], # [{chat_id:int, title:str, invite_link:str|None}] - "lock_message": "Your account has been locked. Contact an administrator if you think this is a mistake.", - "updated_at": 0, - } - - -async def get_policy(force: bool = False) -> dict[str, Any]: - now = _now() - if not force and _policy_cache["value"] is not None and _policy_cache["expires"] > now: - return _policy_cache["value"] - doc = None - try: - doc = await _col("auth_config").find_one({"_id": POLICY_ID}) - except Exception as exc: - LOG.warning(f"[access] policy read failed: {exc}") - policy = {**default_policy(), **{k: v for k, v in (doc or {}).items() if k != "_id"}} - if policy.get("registration_mode") not in REGISTRATION_MODES: - policy["registration_mode"] = "open" - _policy_cache["value"] = policy - _policy_cache["expires"] = now + _POLICY_TTL - return policy - - -async def update_policy(patch: dict[str, Any], by: int | None = None) -> dict[str, Any]: - clean: dict[str, Any] = {} - if "registration_mode" in patch: - mode = str(patch["registration_mode"] or "").lower() - if mode not in REGISTRATION_MODES: - raise ValueError("registration_mode must be one of open, invite, allowlist, closed") - clean["registration_mode"] = mode - if "enforce_membership" in patch: - clean["enforce_membership"] = bool(patch["enforce_membership"]) - if "lock_message" in patch and patch["lock_message"] is not None: - clean["lock_message"] = str(patch["lock_message"])[:400] - if "required_chats" in patch and patch["required_chats"] is not None: - chats = [] - for c in patch["required_chats"]: - try: - cid = int(c["chat_id"]) if isinstance(c, dict) else int(c) - except Exception: - continue - is_priv = bool(c.get("is_private")) if isinstance(c, dict) else False - chats.append( - { - "chat_id": cid, - "title": (str(c.get("title")) if isinstance(c, dict) and c.get("title") else None), - "invite_link": None if is_priv else (str(c.get("invite_link")) if isinstance(c, dict) and c.get("invite_link") else None), - "is_private": is_priv, - } - ) - clean["required_chats"] = chats - clean["updated_at"] = _now() - if by: - clean["updated_by"] = int(by) - await _col("auth_config").update_one({"_id": POLICY_ID}, {"$set": clean}, upsert=True) - _policy_cache["expires"] = 0.0 - _membership_cache.clear() - return await get_policy(force=True) - - -def public_policy(policy: dict[str, Any]) -> dict[str, Any]: - """What the signup/login screens are allowed to know.""" - return { - "registration_mode": policy["registration_mode"], - "enforce_membership": bool(policy.get("enforce_membership")), - "required_chats": [ - { - "title": c.get("title") or str(c["chat_id"]), - "invite_link": None if c.get("is_private") else c.get("invite_link"), - "is_private": bool(c.get("is_private")), - } - for c in policy.get("required_chats", []) - ], - } - - -# --------------------------------------------------------------------------- required chats - - -async def add_required_chat( - chat_id: int, - title: str | None = None, - invite_link: str | None = None, - is_private: bool = False, -) -> dict[str, Any]: - policy = await get_policy(force=True) - chats = [c for c in policy.get("required_chats", []) if int(c["chat_id"]) != int(chat_id)] - if not is_private: - if not title or not invite_link: - fetched = await describe_chat(chat_id) - title = title or fetched.get("title") - invite_link = invite_link or fetched.get("invite_link") - else: - if not title: - fetched = await describe_chat(chat_id) - title = fetched.get("title") - invite_link = None - chats.append({ - "chat_id": int(chat_id), - "title": title, - "invite_link": invite_link if not is_private else None, - "is_private": bool(is_private), - }) - return await update_policy({"required_chats": chats}) - - -async def remove_required_chat(chat_id: int) -> dict[str, Any]: - policy = await get_policy(force=True) - chats = [c for c in policy.get("required_chats", []) if int(c["chat_id"]) != int(chat_id)] - return await update_policy({"required_chats": chats}) - - -async def describe_chat(chat_id: int) -> dict[str, Any]: - """Best-effort title + invite link via the bot (needs the bot inside the chat).""" - out: dict[str, Any] = {"chat_id": int(chat_id), "title": None, "invite_link": None} - try: - from stream import bot - - if not bot: - return out - chat = await bot.get_chat(int(chat_id)) - out["title"] = getattr(chat, "title", None) or getattr(chat, "first_name", None) - username = getattr(chat, "username", None) - if username: - out["invite_link"] = f"https://t.me/{username}" - else: - out["invite_link"] = getattr(chat, "invite_link", None) - if not out["invite_link"]: - try: - out["invite_link"] = await bot.export_chat_invite_link(int(chat_id)) - except Exception: - pass - except Exception as exc: - LOG.debug(f"[access] describe_chat({chat_id}) failed: {exc}") - return out - - -# --------------------------------------------------------------------------- membership - - -_NOT_MEMBER = {"left", "kicked", "banned", "restricted_left"} - - -def _status_name(member) -> str: - st = getattr(member, "status", None) - name = getattr(st, "name", None) or str(st or "") - return name.lower() - - -def is_admin_id(user_id: int) -> bool: - try: - from stream.core.config_manager import Config - owner = getattr(Config, "OWNER_ID", 0) - sudos = getattr(Config, "SUDO_USERS", []) or [] - uid = int(user_id) - if owner and uid == int(owner): - return True - for s in sudos: - try: - if uid == int(s): - return True - except Exception: - pass - return False - except Exception: - return False - - -async def is_membership_bypassed(user_id: int) -> bool: - """True if user is admin/owner or has been granted an individual membership bypass.""" - if is_admin_id(user_id): - return True - doc = await _col("membership_bypass").find_one({"_id": int(user_id)}) - return doc is not None - - -async def bypass_add(user_id: int, by: int | None = None, note: str | None = None) -> None: - """Exempt a user from mandatory channel membership checks.""" - await _col("membership_bypass").update_one( - {"_id": int(user_id)}, - {"$set": {"added_by": by, "added_at": _now(), "note": note}}, - upsert=True, - ) - invalidate_membership(user_id) - try: - user = await _col("users").find_one({"_id": int(user_id)}, {"status": 1}) - if user and user.get("status") == "restricted": - await set_user_status(user_id, "active") - except Exception: - pass - - -async def bypass_remove(user_id: int) -> bool: - """Revoke a user's channel membership exemption.""" - res = await _col("membership_bypass").delete_one({"_id": int(user_id)}) - invalidate_membership(user_id) - return res.deleted_count > 0 - - -async def bypass_list() -> list[dict[str, Any]]: - """List all users exempt from channel membership.""" - out = [] - async for d in _col("membership_bypass").find({}).sort("added_at", -1).limit(500): - out.append({ - "user_id": int(d["_id"]), - "added_by": d.get("added_by"), - "added_at": d.get("added_at"), - "note": d.get("note"), - }) - return out - - -async def check_membership(user_id: int, force: bool = False) -> tuple[bool, list[dict[str, Any]]]: - """(ok, missing_chats). Cached 10 min per user; membership events invalidate it.""" - policy = await get_policy() - chats = policy.get("required_chats", []) - if not policy.get("enforce_membership") or not chats: - return True, [] - if await is_membership_bypassed(user_id): - return True, [] - now = _now() - cached = _membership_cache.get(int(user_id)) - if cached and not force and cached[0] > now: - return cached[1], cached[2] - missing: list[dict[str, Any]] = [] - try: - from stream import bot - except Exception: - bot = None - if not bot: - # can't verify → fail open but log; admins should keep the bot running - LOG.warning("[access] membership check skipped: bot not running") - return True, [] - for c in chats: - try: - member = await bot.get_chat_member(int(c["chat_id"]), int(user_id)) - if _status_name(member) in _NOT_MEMBER: - missing.append(c) - except Exception as exc: - # USER_NOT_PARTICIPANT etc. → not a member; other errors also count as missing - LOG.debug(f"[access] get_chat_member({c['chat_id']}, {user_id}): {exc}") - missing.append(c) - ok = not missing - _membership_cache[int(user_id)] = (now + _MEMBERSHIP_TTL, ok, missing) - return ok, missing - - -def invalidate_membership(user_id: int) -> None: - _membership_cache.pop(int(user_id), None) - - -def public_chats(chats: list[dict[str, Any]]) -> list[dict[str, Any]]: - return [ - { - "title": c.get("title") or "Required chat", - "invite_link": None if c.get("is_private") else c.get("invite_link"), - "is_private": bool(c.get("is_private")), - } - for c in chats - ] - - -# --------------------------------------------------------------------------- user status - - -async def get_user_access(user_id: int, force: bool = False) -> dict[str, Any]: - """{status, token_version, lock_reason} — memoised for 30 s.""" - uid = int(user_id) - now = _now() - hit = _access_cache.get(uid) - if hit and not force and hit[0] > now: - return hit[1] - doc = None - try: - doc = await _col("users").find_one({"_id": uid}, {"status": 1, "token_version": 1, "lock_reason": 1}) - except Exception as exc: - LOG.warning(f"[access] user read failed: {exc}") - info = { - "status": (doc or {}).get("status") or "active", - "token_version": int((doc or {}).get("token_version") or 0), - "lock_reason": (doc or {}).get("lock_reason"), - } - _access_cache[uid] = (now + _ACCESS_TTL, info) - return info - - -def invalidate_access(user_id: int | None = None) -> None: - if user_id is None: - _access_cache.clear() - else: - _access_cache.pop(int(user_id), None) - - -async def set_user_status(user_id: int, status: UserStatus, reason: str | None = None, by: int | None = None, revoke_sessions: bool = True) -> dict[str, Any]: - uid = int(user_id) - update: dict[str, Any] = {"status": status, "updated_at": _now()} - if status == "active": - update["lock_reason"] = None - update["locked_at"] = None - update["locked_by"] = None - else: - update["lock_reason"] = (reason or ("Left a required Telegram chat" if status == "restricted" else "Locked by an administrator"))[:300] - update["locked_at"] = _now() - update["locked_by"] = int(by) if by else None - ops: dict[str, Any] = {"$set": update} - if revoke_sessions and status != "active": - ops["$inc"] = {"token_version": 1} - await _col("users").update_one({"_id": uid}, ops, upsert=True) - invalidate_access(uid) - invalidate_membership(uid) - return await get_user_access(uid, force=True) - - -async def revoke_sessions(user_id: int) -> int: - """Bump token_version → every existing token for the user becomes invalid.""" - uid = int(user_id) - await _col("users").update_one({"_id": uid}, {"$inc": {"token_version": 1}, "$set": {"updated_at": _now()}}, upsert=True) - invalidate_access(uid) - return (await get_user_access(uid, force=True))["token_version"] - - -class AccessDenied(Exception): - def __init__(self, code: str, message: str, extra: dict[str, Any] | None = None, status_code: int = 403): - super().__init__(message) - self.code = code - self.message = message - self.extra = extra or {} - self.status_code = status_code - - def payload(self) -> dict[str, Any]: - return {"ok": False, "detail": self.code, "message": self.message, **self.extra} - - -async def assert_can_use(user_id: int, token_version: int | None) -> None: - """Raise AccessDenied if the account is locked/restricted or the token was revoked. - - Status is checked first so a locked user sees *why* (403 + reason) instead of a bare sign-out; - the token_version check only applies to accounts that are otherwise active. - """ - info = await get_user_access(user_id) - status = info["status"] - if status == "locked": - policy = await get_policy() - raise AccessDenied("account_locked", info.get("lock_reason") or policy["lock_message"], {"reason": info.get("lock_reason")}) - if status == "restricted": - policy = await get_policy() - raise AccessDenied( - "membership_required", - info.get("lock_reason") or "Join the required Telegram chat to continue.", - {"reason": info.get("lock_reason"), "required_chats": public_chats(policy.get("required_chats", []))}, - ) - if token_version is not None and int(token_version) < int(info["token_version"]): - raise AccessDenied("session_revoked", "Your session was signed out. Please sign in again.", status_code=401) - if token_version is None and int(info["token_version"]) > 0: - # legacy token minted before versioning on an account that has since been revoked/locked - raise AccessDenied("session_revoked", "Your session was signed out. Please sign in again.", status_code=401) - - -async def assert_can_login(user_id: int) -> None: - """Login-time gate: status + live membership check (restores a restricted user who rejoined).""" - info = await get_user_access(user_id, force=True) - if info["status"] == "locked": - policy = await get_policy() - raise AccessDenied("account_locked", info.get("lock_reason") or policy["lock_message"], {"reason": info.get("lock_reason")}) - ok, missing = await check_membership(user_id, force=True) - if not ok: - if info["status"] != "restricted": - await set_user_status(user_id, "restricted", "Left a required Telegram chat", revoke_sessions=False) - raise AccessDenied("membership_required", "Join the required Telegram chat to continue.", {"required_chats": public_chats(missing)}) - if info["status"] == "restricted": - await set_user_status(user_id, "active") - - -async def reverify_user(user_id: int) -> dict[str, Any]: - """User-triggered “I've joined — verify”. Lifts a membership restriction if satisfied.""" - ok, missing = await check_membership(user_id, force=True) - info = await get_user_access(user_id, force=True) - if ok and info["status"] == "restricted": - info = await set_user_status(user_id, "active") - elif not ok and info["status"] == "active": - info = await set_user_status(user_id, "restricted", "Left a required Telegram chat", revoke_sessions=False) - return {"ok": ok, "status": info["status"], "required_chats": public_chats(missing)} - - -# --------------------------------------------------------------------------- registration gate - - -async def assert_can_register(user_id: int, invite_code: str | None = None) -> dict[str, Any]: - """Validate the registration policy. Returns context (e.g. consumed invite) for the caller.""" - policy = await get_policy() - mode = policy["registration_mode"] - ctx: dict[str, Any] = {"mode": mode} - if mode == "closed": - raise AccessDenied("registration_closed", "Registrations are currently closed.") - if mode == "allowlist": - allowed = await _col("registration_allowlist").find_one({"_id": int(user_id)}) - if not allowed: - raise AccessDenied("not_allowlisted", "This Telegram account is not on the allow list.") - if mode == "invite": - code = (invite_code or "").strip().upper() - if not code: - raise AccessDenied("invite_required", "An invite code is required to register.", status_code=400) - inv = await _col("invite_codes").find_one({"_id": code}) - if not inv: - raise AccessDenied("invite_invalid", "That invite code is not valid.", status_code=400) - if inv.get("revoked_at"): - raise AccessDenied("invite_invalid", "That invite code was revoked.", status_code=400) - if inv.get("expires_at") and float(inv["expires_at"]) < _now(): - raise AccessDenied("invite_expired", "That invite code has expired.", status_code=400) - if int(inv.get("max_uses") or 0) and int(inv.get("uses") or 0) >= int(inv["max_uses"]): - raise AccessDenied("invite_exhausted", "That invite code has already been used.", status_code=400) - ctx["invite_code"] = code - ok, missing = await check_membership(user_id, force=True) - if not ok: - raise AccessDenied("membership_required", "Join the required Telegram chat before registering.", {"required_chats": public_chats(missing)}) - return ctx - - -async def consume_invite(code: str, user_id: int) -> None: - """Atomic: only succeeds while uses < max_uses (or unlimited).""" - c = (code or "").strip().upper() - if not c: - return - res = await _col("invite_codes").update_one( - {"_id": c, "revoked_at": None, "$or": [{"max_uses": 0}, {"max_uses": None}, {"$expr": {"$lt": ["$uses", "$max_uses"]}}]}, - {"$inc": {"uses": 1}, "$addToSet": {"used_by": int(user_id)}, "$set": {"last_used_at": _now()}}, - ) - if res.matched_count == 0: - raise AccessDenied("invite_exhausted", "That invite code has already been used.", status_code=400) - - -# --------------------------------------------------------------------------- invites & allowlist - - -def _gen_code(n: int = 8) -> str: - alphabet = string.ascii_uppercase + string.digits - alphabet = alphabet.replace("O", "").replace("0", "").replace("I", "").replace("1", "") - return "".join(secrets.choice(alphabet) for _ in range(n)) - - -async def create_invite(by: int, max_uses: int = 1, ttl_days: int | None = 7, note: str | None = None) -> dict[str, Any]: - code = _gen_code() - doc = { - "_id": code, - "created_by": int(by), - "created_at": _now(), - "max_uses": max(0, int(max_uses)), - "uses": 0, - "used_by": [], - "expires_at": (_now() + int(ttl_days) * 86400) if ttl_days else None, - "revoked_at": None, - "note": (note or "")[:120] or None, - } - await _col("invite_codes").insert_one(doc) - return _invite_public(doc) - - -def _invite_public(d: dict[str, Any]) -> dict[str, Any]: - return { - "code": d["_id"], - "created_by": d.get("created_by"), - "created_at": d.get("created_at"), - "max_uses": d.get("max_uses") or 0, - "uses": d.get("uses") or 0, - "used_by": d.get("used_by") or [], - "expires_at": d.get("expires_at"), - "revoked_at": d.get("revoked_at"), - "note": d.get("note"), - } - - -async def list_invites(include_dead: bool = False) -> list[dict[str, Any]]: - out = [] - async for d in _col("invite_codes").find({}).sort("created_at", -1).limit(200): - pub = _invite_public(d) - dead = bool(pub["revoked_at"]) or (pub["expires_at"] and pub["expires_at"] < _now()) or (pub["max_uses"] and pub["uses"] >= pub["max_uses"]) - if include_dead or not dead: - out.append(pub) - return out - - -async def revoke_invite(code: str) -> bool: - res = await _col("invite_codes").update_one({"_id": (code or "").strip().upper(), "revoked_at": None}, {"$set": {"revoked_at": _now()}}) - return res.modified_count > 0 - - -async def allowlist_add(user_id: int, by: int | None = None, note: str | None = None) -> None: - await _col("registration_allowlist").update_one({"_id": int(user_id)}, {"$set": {"added_by": by, "added_at": _now(), "note": note}}, upsert=True) - - -async def allowlist_remove(user_id: int) -> bool: - res = await _col("registration_allowlist").delete_one({"_id": int(user_id)}) - return res.deleted_count > 0 - - -async def allowlist_list() -> list[dict[str, Any]]: - out = [] - async for d in _col("registration_allowlist").find({}).sort("added_at", -1).limit(500): - out.append({"user_id": int(d["_id"]), "added_by": d.get("added_by"), "added_at": d.get("added_at"), "note": d.get("note")}) - return out - - -# --------------------------------------------------------------------------- users (admin) - - -async def list_users(query: str | None = None, status: str | None = None, limit: int = 100, skip: int = 0) -> dict[str, Any]: - q: dict[str, Any] = {"password": {"$exists": True}} - if status in ("active", "locked", "restricted"): - q["status"] = status if status != "active" else {"$in": ["active", None]} - if query: - qs = str(query).strip() - ors: list[dict[str, Any]] = [{"username": {"$regex": qs, "$options": "i"}}, {"first_name": {"$regex": qs, "$options": "i"}}, {"telegram.username": {"$regex": qs, "$options": "i"}}] - if qs.isdigit(): - ors.append({"_id": int(qs)}) - q["$or"] = ors - col = _col("users") - total = await col.count_documents(q) - items = [] - cursor = col.find(q, {"username": 1, "first_name": 1, "profile_url": 1, "photo_url": 1, "telegram": 1, "status": 1, "lock_reason": 1, "locked_at": 1, "token_version": 1, "created_at": 1, "updated_at": 1}).sort("created_at", -1).skip(int(skip)).limit(int(limit)) - async for d in cursor: - items.append( - { - "user_id": int(d["_id"]), - "username": d.get("username"), - "first_name": d.get("first_name"), - "profile_url": d.get("profile_url") or d.get("photo_url"), - "telegram_username": (d.get("telegram") or {}).get("username") if isinstance(d.get("telegram"), dict) else None, - "status": d.get("status") or "active", - "lock_reason": d.get("lock_reason"), - "locked_at": d.get("locked_at"), - "token_version": int(d.get("token_version") or 0), - "created_at": d.get("created_at"), - } - ) - return {"total": total, "items": items} - - -async def reverify_all(limit: int = 2000) -> dict[str, int]: - """Admin sweep: re-check membership for every registered user (rate-friendly, sequential).""" - policy = await get_policy(force=True) - if not policy.get("enforce_membership") or not policy.get("required_chats"): - return {"checked": 0, "restricted": 0, "restored": 0} - checked = restricted = restored = 0 - async for d in _col("users").find({"password": {"$exists": True}}, {"_id": 1, "status": 1}).limit(limit): - uid = int(d["_id"]) - checked += 1 - ok, _missing = await check_membership(uid, force=True) - status = d.get("status") or "active" - if not ok and status == "active": - await set_user_status(uid, "restricted", "Left a required Telegram chat", revoke_sessions=False) - restricted += 1 - elif ok and status == "restricted": - await set_user_status(uid, "active") - restored += 1 - await asyncio.sleep(0.05) - return {"checked": checked, "restricted": restricted, "restored": restored} diff --git a/Api/services/discord_remote_auth.py b/Api/services/discord_remote_auth.py deleted file mode 100644 index 18b590f..0000000 --- a/Api/services/discord_remote_auth.py +++ /dev/null @@ -1,284 +0,0 @@ -""" -Discord Remote Auth (QR Code Login) Service. - -Implements the Discord Remote Auth Gateway protocol (v2) over WebSocket: -- Connects to wss://remote-auth-gateway.discord.gg/?v=2 with Origin: https://discord.com -- Generates an ephemeral RSA-2048 keypair -- Handles the hello -> init -> nonce_proof challenge -- Produces the QR code fingerprint URL (https://discord.com/ra/
- 
-
StreamX is a self-hosted music platform that manage your personal library and YouTube Music into one fast, modern experience across Android, web
-Stream, download, and organize your music with ease — from albums and artists to playlists and live jam sessions with friends.
-No ads. No tracking. Just complete control.
- -
-
- 
-
-
A Go server for streaming music from Telegram. It stores track details in MongoDB and serves the WebX music player.
-StreamX is split into three projects that ship one experience: + -- `stream`: the root backend, API, Telegram ingit add . -gestion layer, sharing routes, and deployment entrypoint -- `StreamX/`: the Android app -- `StreamXWeb/`: the React web client +StreamXBot's Go version, called StreamGO. The previous Python source is on [`legacy/python`](https://github.com/StreamXProject/StreamXBot/tree/legacy/python). -The result is a full self-hosted music platform with private infrastructure, cross-device playback, social features, share links, and polished clients on both mobile and web. +- Search tracks, artists, and albums. +- Save playlists and favourites. +- View lyrics, listening history, and recaps. +- Manage music sources and user access through a Telegram bot. -## Features +## Run locally -### Playback And Library +You need Go 1.25 or newer, MongoDB, FFmpeg, and MediaInfo. -- fast playback with queue controls, play next, repeat, shuffle, and rich full-player interactions -- favourites, saved albums, custom playlists, shared playlists, and top-played flows -- album, artist, track, and playlist navigation across both backend and provider-native content -- seamless switching between the StreamX backend library and the YouTube provider inside the app -- YouTube track syncing so songs discovered on YouTube can be brought into StreamX -- offline downloads with download management and remove-download actions -- expanded player views with metadata, next queue, lyrics, and quick actions - -### Lyrics, Discovery, And UI - -- synced lyrics and dedicated lyrics view -- artist pages, album pages, playlist pages, and search-driven discovery -- direct YouTube search, provider-native YouTube browse flows, and quick provider switching on Android -- customizable UI with polished cards, home sections, dark mode, and AMOLED-style presentation -- polished Compose-based UI with full-screen player, bottom sheets, and modern navigation - -### Social And Sharing - -- collaborative jam sessions with synchronized playback and queue updates -- jam invites, join flows, cooldown handling, and push notifications -- friends, presence, listening activity, and share-listening controls -- share links for playlists, albums, tracks, and jams - -## Screenshots - -| 1 | 2 | 3 | -| --- | --- | --- | -|  |  |  | - -| 4 | 5 | 6 | -| --- | --- | --- | -|  |  |  | - -| 7 | 8 | 9 | -| --- | --- | --- | -|  |  |  | - -| 10 | 11 | 12 | -| --- | --- | --- | -|  |  |  | - -| 13 | 14 | | -| --- | --- | --- | -|  |  | | - -## Project Layout - -| Project | Role | Stack | Docs | -| --- | --- | --- | --- | -| `stream` | Backend, API, sharing, deployment | Python, FastAPI, MongoDB, Telegram, Firebase Admin | [README.md](./README.md) | -| `StreamX/` | Android app | Kotlin, Jetpack Compose, Media3, Firebase Messaging | [StreamX/README.md](./StreamX/README.md) | -| `StreamXWeb/` | Web app | React, Vite, TypeScript | [StreamXWeb/README.md](./StreamXWeb/README.md) | - -## Releases - -- Android APK builds are published in the root repo's [Releases](https://github.com/MisfiT2020/StreamXBot/releases) -- `StreamXWeb` is built and served by the backend in normal production deployments -- backend deployment is source-based or Docker-based depending on your environment - -## Quick Start - -### 1. Start the backend - -```bash -python -m venv .venv -.venv\Scripts\activate -pip install -r requirements.txt -copy sample_config.py config.py -python -m stream -``` - -Or with Docker: - -```bash -docker compose up --build -``` - -### 2. Build the Android app - -```bash -cd StreamX -.\gradlew.bat :app:assembleDebug -.\gradlew.bat :app:installDebug -``` - -Before the first build, place `google-services.json` at `StreamX/app/google-services.json`. - -### 3. Run the web app locally - -```bash -cd StreamXWeb -npm install -npm run dev -``` - -For production, `StreamXWeb` is usually not deployed separately. The backend Dockerfile already builds and serves it. - -## Backend Overview - -This root project powers: - -- auth, playlists, favourites, albums, tracks, friends, jams, and notifications -- Telegram ingestion and admin tooling -- media streaming endpoints -- playlist, album, track, and jam share routes -- production serving of the built web app - -Main entrypoint: - -```bash -python -m stream -``` - -You can run it in: - -- API-only=True mode disables the bot's runtime, which is useful for testing - -## Deployment - -### Local Python - -Requirements: - -- Python 3.11+ - -Run: - -```bash -python -m venv .venv -.venv\Scripts\activate -pip install --upgrade pip -pip install -r requirements.txt -copy sample_config.py config.py -python -m stream +```sh +cp .env.example .env ``` -### Docker - -The root `Dockerfile` already: - -1. builds `WebX` -2. installs Python dependencies in a virtual environment -3. copies backend code -4. copies the built web `dist/` -5. starts the app directly via `python3 -m stream` - -Run: - -```bash -docker compose up --build -d -``` +Edit `.env` and set: -### Render - -This repo can be used for other service (free) such as koyeb. - -Typical Render flow: - -1. create a Docker web service -2. point it at this repo -3. set `CONFIG_GIST` to a raw URL that returns your full `config.py` -4. deploy - -One-click shortcut: - -- [Deploy to Render](https://render.com/deploy?repo=https://github.com/MisfiT2020/StreamXBot) - -Health check: - -```text -GET /health -``` - -## Tutorials - -| Topic | Video | -| --- | --- | -| VPS Setup | [YouTube](https://www.youtube.com/watch?v=n36uEef8VrE) | -| Render / Koyeb / Other Platforms | [YouTube](https://www.youtube.com/watch?v=A6kBOLGAbnk) | - -## Main Config - -Use `sample_config.py` as the template for `config.py`. - -### Core values for most full installs - -| Key | Purpose | -| --- | --- | -| `BOT_TOKEN` | Telegram bot token | -| `API_ID` | Telegram API ID | -| `API_HASH` | Telegram API hash | -| `MONGO_URI` | MongoDB connection string | -| `DATABASE_NAME` | MongoDB database name | -| `OWNER_ID` | Telegram owner ID | -| `SECRET_KEY` | Session signing and Firebase credential decoding | -| `CHANNEL_ID` | Main Telegram source channel | -| `FILTER_MODE` | `0` indexes only `CHANNEL_ID`; `1` indexes media from any chat, group, or forum topic the bot can read | - -### Common optional values - -| Key | Purpose | +| Variable | Value | | --- | --- | -| `FIREBASE_CREDENTIALS` | Encoded Firebase Admin service account | -| `CORS_ORIGINS` | Allowed frontend origins | -| `COOKIE_SECURE` | Secure cookie flag for HTTPS | -| `COOKIE_SAMESITE` | Cross-site cookie policy | -| `SPOTIFY_CLIENT_ID` / `SPOTIFY_CLIENT_SECRET` | Spotify metadata integration | -| `SESSION_STRING` | Optional userbot session | -| `SOURCE_CHANNEL_IDS` | Additional Telegram source channels | -| `DUMP_CHANNEL_ID` | Optional dump channel | -| `LRCLIB` / `MUSIXMATCH` | Lyrics provider toggles | -| `MULTI_CLIENTS`, `MULTI_CLIENTS_1...` | Extra Telegram clients or tokens | - -### API-only mode - -If you only want the API: - -```python -ONLY_API = True +| `MONGO_URI` | Your MongoDB connection string | +| `API_ID`, `API_HASH` | Your Telegram API credentials | +| `BOT_TOKEN` | Your Telegram bot token | +| `CHANNEL_ID` | The channel or group to read music from | +| `OWNER_ID` | Your Telegram user ID | +| `SECRET_KEY` | A long, random secret for login tokens | + +Add the bot to your music channel or group. From the project folder, install and run: + +```sh +go install ./cmd/server +server ``` -In that mode the important requirements are: - -- `MONGO_URI` -- `DATABASE_NAME` -- `SECRET_KEY` - -## Firebase Setup For The Backend - -The backend uses Firebase Admin to send push notifications. This is different from the Android device token. +Make sure your Go bin folder (`go env GOBIN`, or `$(go env GOPATH)/bin` if unset) is in your `PATH`. Run `server` from the folder containing `.env`. -### What you need +The server runs at [localhost:8000](http://localhost:8000). Send audio to the configured channel or group to add tracks. Send `/help` to the bot for commands. -You need a Firebase service account JSON from: +To use the web player, place a WebX build in `dist/` with `dist/index.html` present. Cloudflare R2 is optional for storing artwork; its settings are in `.env.example`. -1. Firebase Console -2. Project settings -3. Service accounts -4. Generate new private key +## Docker -Save that file as `service_account.json` in the root of this repo. +Use the same `.env`, with a `MONGO_URI` the container can reach. Compose runs only StreamGO; MongoDB must run separately. -### How to use `encode_firebase.py` - -This repo includes `encode_firebase.py` so you can store an encoded value in `config.py` instead of raw JSON. - -Steps: - -1. put the downloaded file at `service_account.json` -2. make sure `SECRET_KEY` is already set in `config.py` -3. run: - -```bash -python encode_firebase.py -``` - -4. copy the printed output into: - -```python -FIREBASE_CREDENTIALS = "..." -``` - -### Alternate Firebase env option - -The backend also supports: - -```text -FIREBASE_CRED_B64 +```sh +docker compose up -d --build ``` -That should be plain base64 of the raw Firebase service account JSON. - -### Firebase value checklist - -| Item | Used by | Where you get it | -| --- | --- | --- | -| `service_account.json` / `FIREBASE_CREDENTIALS` / `FIREBASE_CRED_B64` | Backend push sending | Firebase Console -> Project settings -> Service accounts | -| `google-services.json` | Android app build setup | Firebase Console -> Project settings -> Your apps -> Android | -| FCM device token | Individual Android device | Generated automatically by the app | - -Do not paste the device FCM token into backend config. The Android client obtains it automatically and registers it after login. - -## YouTube Cookies - -Backend-side YouTube extraction looks for: - -```text -cookies/yt.txt -``` - -Use it when you need stronger `yt-dlp` access for restricted or rate-limited content. - -### How to prepare it - -1. log in to YouTube in a desktop browser -2. export cookies in Netscape format -3. save the file as `cookies/yt.txt` - -Notes: - -- keep the file private and never commit it -- you can upload the cookies directly via telegram bot using /sudo > cookies > save cookies as yt.txt and upload. +The image builds and includes WebX. Set environment variables in your hosting service when deploying on Render or Heroku. -## Support +## Moving from Python -- Support group: [t.me/RaidenEISupport](https://t.me/RaidenEISupport) +Go is being reviewed on `dev/go-migration`. Keep running Python until login, track indexing, streaming, and your web and Android clients have been checked. -## Thanks +Back up MongoDB and test with a copy first; Go runs database updates at startup. Keep your existing `DATABASE_NAME` (Python used `StreamX`; Go defaults to `Stream`). Copy settings into `.env` or your host's environment variables. Go does not load `config.py` or `CONFIG_GIST`. -- Metrolist for innertube & reference +Some Python features and settings have not been ported, including jams, friends, and presence. `SESSION_STRING` is currently unused by the Go Telegram client. Check any setup using a user account, `SOURCE_CHANNEL_IDS`, YouTube, Firebase, or Spotify before switching. -## Project Docs +## API -- Root backend and deployment: [README.md](./README.md) -- Android app: [StreamX/README.md](./StreamX/README.md) -- Web app: [StreamXWeb/README.md](./StreamXWeb/README.md) +- [API docs](http://localhost:8000/docs) +- [OpenAPI spec](http://localhost:8000/openapi.json) +- [Service status](http://localhost:8000/health) diff --git a/cmd/server/main.go b/cmd/server/main.go new file mode 100644 index 0000000..957cb89 --- /dev/null +++ b/cmd/server/main.go @@ -0,0 +1,185 @@ +package main + +import ( + "context" + "errors" + "fmt" + "net/http" + "os" + "os/signal" + "syscall" + "time" + + "streamgo/internal/config" + "streamgo/internal/database" + "streamgo/internal/logger" + "streamgo/internal/repository" + "streamgo/internal/server" + "streamgo/internal/services" + "streamgo/internal/telegram" + telegramcmd "streamgo/internal/telegram/cmd" + + "go.mongodb.org/mongo-driver/v2/bson" +) + +var log = logger.New("main") + +func main() { + fmt.Println("==================================================") + fmt.Println(" StreamGO - High Performance Media API ") + fmt.Println("==================================================") + + cfg := config.Load() + log.Infof("loaded config: PORT=%s, DB=%s, API_LOGS=%v", cfg.Port, cfg.DatabaseName, cfg.APILogs) + + cfgMgr := config.NewManager(cfg) + + ctx, cancel := context.WithCancel(context.Background()) + defer cancel() + + var dbClient *database.Client + if cfg.MongoURI != "" { + dbCtx, dbCancel := context.WithTimeout(ctx, 10*time.Second) + client, err := database.Connect(dbCtx, cfg.MongoURI, cfg.DatabaseName) + dbCancel() + if err != nil { + log.Warnf("MongoDB connection failed: %v", err) + log.Warn("Continuing with MongoDB in disabled state...") + } else { + dbClient = client + defer func() { + closeCtx, closeCancel := context.WithTimeout(context.Background(), 5*time.Second) + defer closeCancel() + _ = dbClient.Close(closeCtx) + }() + + // Synchronize dynamic bot settings from MongoDB collection botsettings (doc: bot_config) + syncCtx, syncCancel := context.WithTimeout(ctx, 10*time.Second) + if err := cfgMgr.LoadFromDB(syncCtx, dbClient.Database); err != nil { + log.Warnf("Failed to sync bot_config from MongoDB: %v", err) + } + syncCancel() + } + } + + coverSearch := services.NewCoverSearchService() + lyricsSvc := services.NewLyricsEnrichmentService(cfg) + dedupSvc := services.NewDedupService(dbClient) + accessFilter := services.NewAccessFilter(cfg, dbClient) + cfgMgr.OnUpdate(func(key string, val any) { + if key == "FILTER_MODE" { + if m, ok := val.(int); ok { + accessFilter.SetMode(m) + } + } + }) + + r2Storage := services.NewR2StorageService(cfg) + enrichSvc := services.NewEnrichmentService(dbClient, coverSearch, lyricsSvc) + if r2Storage.IsConfigured() { + enrichSvc.SetR2Storage(r2Storage) + log.Infof("Cloudflare R2 storage configured for artwork (bucket: %s)", cfg.R2BucketName) + } else { + log.Info("Cloudflare R2 not configured; using free online artwork enrichment (iTunes/Deezer)") + } + + if dbClient != nil { + workers := cfg.EnrichmentWorkers + if workers <= 0 { + workers = 2 + } + enrichSvc.Start(ctx, workers) + + // Fix any existing tracks where audio format was saved as "m4a" but has lossless bit depth (ALAC) + go func() { + migCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second) + defer cancel() + col := dbClient.Database.Collection("audioTracks") + res, err := col.UpdateMany(migCtx, bson.M{ + "audio.type": "m4a", + "audio.bit_depth": bson.M{"$gt": 0}, + }, bson.M{ + "$set": bson.M{"audio.type": "alac"}, + }) + if err == nil && res.ModifiedCount > 0 { + log.Infof("[migration] Normalized %d lossless ALAC track(s) from 'm4a' to 'alac'", res.ModifiedCount) + } + }() + } + + var tgService *telegram.Service + if cfg.ApiID > 0 && cfg.ApiHash != "" { + svc, err := telegram.New(cfg) + if err != nil { + log.Warnf("Failed to initialize Telegram service: %v", err) + } else { + tgService = svc + enrichSvc.SetDownloader(tgService) + listener := telegram.NewIngestionListener(cfg, dbClient, accessFilter, dedupSvc, enrichSvc.TriggerEnrich) + listener.SetTelegramService(tgService) + + var authSvc *services.AuthService + var accessSvc *services.AccessControlService + var trackSvc *services.TrackService + + if dbClient != nil { + userRepo := repository.NewUserRepository(dbClient) + accessRepo := repository.NewAccessControlRepository(dbClient) + trackRepo := repository.NewTrackRepository(dbClient) + authSvc = services.NewAuthService(cfg, userRepo) + authSvc.SetAccessControlRepository(accessRepo) + accessSvc = services.NewAccessControlService(accessRepo) + trackSvc = services.NewTrackService(trackRepo) + } + + cmdHandler := telegramcmd.New(cfgMgr, dbClient, tgService, listener, authSvc, accessSvc, accessFilter, trackSvc) + cmdHandler.SetupDispatcher(&tgService.Dispatcher) + + log.Info("Starting Telegram MTProto multi-client pool in background...") + go func() { + if err := tgService.Start(ctx); err != nil { + log.Errorf("Telegram client start failed: %v", err) + } + }() + defer tgService.Stop() + } + } else { + log.Info("Telegram credentials (API_ID/API_HASH) not configured; skipping Telegram init.") + } + + srv := server.New(cfg, dbClient, tgService, accessFilter) + httpServer := &http.Server{ + Addr: fmt.Sprintf(":%s", cfg.Port), + Handler: srv.Router, + ReadTimeout: 30 * time.Second, + WriteTimeout: 0, + IdleTimeout: 120 * time.Second, + } + + go func() { + log.Infof("HTTP server listening on http://0.0.0.0:%s", cfg.Port) + if err := httpServer.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) { + log.Fatalf("HTTP server error: %v", err) + } + }() + + signal.Ignore(syscall.SIGHUP) + quit := make(chan os.Signal, 1) + signal.Notify(quit, syscall.SIGINT, syscall.SIGTERM) + sig := <-quit + + log.Infof("received shutdown signal (%s), starting graceful shutdown...", sig) + cancel() // Concurrently signals background workers (enrichment, telegram) to abort + + shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 10*time.Second) + defer shutdownCancel() + + if err := httpServer.Shutdown(shutdownCtx); err != nil { + log.Errorf("HTTP server forced shutdown error: %v", err) + } else { + log.Info("HTTP server shutdown cleanly.") + } + + enrichSvc.Stop() + log.Info("StreamGO stopped. Goodbye!") +} diff --git a/config.py b/config.py deleted file mode 100644 index 9c0d714..0000000 --- a/config.py +++ /dev/null @@ -1,180 +0,0 @@ -import json -import os -import re -from pathlib import Path - -_env_path = Path(__file__).resolve().parent / ".env" -try: - from dotenv import load_dotenv - - if _env_path.exists(): - load_dotenv(dotenv_path=_env_path, override=False) - else: - load_dotenv(override=False) -except ImportError: - if _env_path.exists(): - with open(_env_path, "r", encoding="utf-8") as _f: - for _line in _f: - _line = _line.strip() - if not _line or _line.startswith("#") or "=" not in _line: - continue - _k, _, _v = _line.partition("=") - _k = _k.strip() - _v = _v.strip() - if (_v.startswith('"') and _v.endswith('"')) or (_v.startswith("'") and _v.endswith("'")): - _v = _v[1:-1] - if _k and _k not in os.environ: - os.environ[_k] = _v - - -def _get_str(key: str, default: str = "") -> str: - val = os.getenv(key) - if val is None: - return default - return str(val).strip() - - -def _get_int(key: str, default: int = 0) -> int: - val = os.getenv(key) - if val is None or not str(val).strip(): - return default - try: - return int(str(val).strip()) - except (TypeError, ValueError): - return default - - -def _get_bool(key: str, default: bool = False) -> bool: - val = os.getenv(key) - if val is None or not str(val).strip(): - return default - return str(val).strip().lower() in ("true", "1", "yes", "y", "on") - - -def _get_list_int(key: str, default: list | None = None) -> list[int]: - if default is None: - default = [] - val = os.getenv(key) - if val is None or not str(val).strip(): - return default - s = str(val).strip() - if s.startswith("["): - try: - parsed = json.loads(s) - if isinstance(parsed, list): - return [int(x) for x in parsed if str(x).strip().lstrip("-").isdigit()] - except Exception: - pass - parts = re.split(r"[\s,]+", s) - out = [int(p) for p in parts if p.strip().lstrip("-").isdigit()] - return out if out else default - - -def _get_id_or_list(key: str, default: int | list = 0) -> int | list: - val = os.getenv(key) - if val is None or not str(val).strip(): - return default - s = str(val).strip() - if s.startswith("["): - try: - parsed = json.loads(s) - if isinstance(parsed, list): - return [int(x) for x in parsed if str(x).strip().lstrip("-").isdigit()] - except Exception: - pass - try: - return int(s) - except (TypeError, ValueError): - return default - - -def _get_filter_mode(key: str, default: int = 1) -> int | str: - val = os.getenv(key) - if val is None or not str(val).strip(): - return default - s = str(val).strip() - if s.isdigit(): - return int(s) - return s - - -def _get_chat_topic(key: str, default: int = 0) -> int | str: - val = os.getenv(key) - if val is None or not str(val).strip(): - return default - s = str(val).strip() - if s.lower() == "all": - return "all" - try: - return int(s) - except (TypeError, ValueError): - return s - - -# Core -BOT_TOKEN = _get_str("BOT_TOKEN") -API_ID = _get_int("API_ID", 0) -API_HASH = _get_str("API_HASH") -MONGO_URI = _get_str("MONGO_URI") -DATABASE_NAME = _get_str("DATABASE_NAME", "StreamX") -OWNER_ID = _get_id_or_list("OWNER_ID", 0) -SUDO_USERS = _get_list_int("SUDO_USERS", []) -SECRET_KEY = _get_str("SECRET_KEY") -GITHUB_TOKEN = _get_str("GITHUB_TOKEN") -ONLY_API = _get_bool("ONLY_API", False) - -# Firebase -FIREBASE_CREDENTIALS = _get_str("FIREBASE_CREDENTIALS") - -# Debug -DEBUG = _get_bool("DEBUG", False) - -# Thumbnail Generation -COLLEGE = _get_bool("COLLEGE", True) -TEXT_COLOR = _get_str("TEXT_COLOR", "#FFFFFF") -YOUTUBE_COVER_SEARCH = _get_bool("YOUTUBE_COVER_SEARCH", True) - -# API & Web -CORS_ORIGIN = _get_str("CORS_ORIGIN", "*") -CORS_ORIGINS = _get_str("CORS_ORIGINS", CORS_ORIGIN) -COOKIE_SECURE = _get_bool("COOKIE_SECURE", True) -COOKIE_SAMESITE = _get_str("COOKIE_SAMESITE", "none") - -# Userbot -SESSION_STRING = _get_str("SESSION_STRING") -SOURCE_CHANNEL_IDS = _get_list_int("SOURCE_CHANNEL_IDS", []) -CHAT_TOPIC = _get_chat_topic("CHAT_TOPIC", 0) -USERBOT_COOLDOWN_SEC = float(os.getenv("USERBOT_COOLDOWN_SEC", "0.2")) -USERBOT_BATCH_SIZE = int(os.getenv("USERBOT_BATCH_SIZE", "50")) -USERBOT_BATCH_COOLDOWN_SEC = float(os.getenv("USERBOT_BATCH_COOLDOWN_SEC", "1.0")) -USERBOT_DUMP_MODE = str(os.getenv("USERBOT_DUMP_MODE", "FORWARD") or "FORWARD").strip().upper() -USERBOT_CAPTION_MODE = str(os.getenv("USERBOT_CAPTION_MODE", "LAST") or "LAST").strip().upper() -ENRICHMENT_WORKERS = int(os.getenv("ENRICHMENT_WORKERS", os.getenv("PROCESSING_CONTENT", "2"))) - -# Misc -CHANNEL_ID = _get_int("CHANNEL_ID", 0) -DUMP_CHANNEL_ID = _get_int("DUMP_CHANNEL_ID", 0) -FILTER_MODE = _get_filter_mode("FILTER_MODE", 1) -COLLABORATOR_ID = _get_list_int("COLLABORATOR_ID", []) -COLLABORATOR_IDS = _get_list_int("COLLABORATOR_IDS", COLLABORATOR_ID) - -# Lyrics API -LRCLIB = _get_bool("LRCLIB", False) -MUSIXMATCH = _get_bool("MUSIXMATCH", True) -BETTERLYRICS = _get_bool("BETTERLYRICS", True) -KUGOU = _get_bool("KUGOU", True) - -# Spotify -SPOTIFY_CLIENT_ID = _get_str("SPOTIFY_CLIENT_ID") -SPOTIFY_CLIENT_SECRET = _get_str("SPOTIFY_CLIENT_SECRET") - -# Multi-Clients -MULTI_CLIENTS = _get_bool("MULTI_CLIENTS", False) -MULTI_CLIENTS_1 = _get_str("MULTI_CLIENTS_1") -MULTI_CLIENTS_2 = _get_str("MULTI_CLIENTS_2") -MULTI_CLIENTS_3 = _get_str("MULTI_CLIENTS_3") -MULTI_CLIENTS_4 = _get_str("MULTI_CLIENTS_4") - -for _env_k, _env_v in os.environ.items(): - if _env_k.startswith("MULTI_CLIENTS_") and _env_k not in globals(): - globals()[_env_k] = _env_v \ No newline at end of file diff --git a/docker-compose.yml b/docker-compose.yml index 551e7b7..7c929e6 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -4,17 +4,11 @@ services: build: context: . dockerfile: Dockerfile - env_file: - .env - ports: - "${PORT:-8000}:${PORT:-8000}" - volumes: - - ./.env:/app/.env:ro - - ./cookies:/app/cookies - ./stream_media:/app/stream_media - - ./dist:/app/dist:ro - - restart: on-failure \ No newline at end of file + - ./cookies:/app/cookies + restart: unless-stopped diff --git a/go.mod b/go.mod new file mode 100644 index 0000000..75891f8 --- /dev/null +++ b/go.mod @@ -0,0 +1,58 @@ +module streamgo + +go 1.25.0 + +require ( + github.com/coder/websocket v1.8.15 + github.com/go-chi/chi/v5 v5.3.2 + github.com/go-chi/cors v1.2.2 + github.com/golang-jwt/jwt/v5 v5.3.1 + github.com/gotd/td v0.162.0 + github.com/joho/godotenv v1.5.1 + go.mongodb.org/mongo-driver/v2 v2.9.1 + golang.org/x/crypto v0.54.0 + golang.org/x/text v0.40.0 +) + +require ( + github.com/andybalholm/brotli v1.2.1 + github.com/cenkalti/backoff/v4 v4.3.0 + github.com/cespare/xxhash/v2 v2.3.0 + github.com/dlclark/regexp2 v1.12.0 + github.com/fatih/color v1.19.0 + github.com/ghodss/yaml v1.0.0 + github.com/go-faster/errors v0.8.0 + github.com/go-faster/jx v1.2.0 + github.com/go-faster/xor v1.0.0 + github.com/go-faster/yaml v0.4.6 + github.com/google/uuid v1.6.0 + github.com/gotd/ige v0.3.0 + github.com/gotd/log v0.1.0 + github.com/gotd/neo v0.1.5 + github.com/klauspost/compress v1.19.2 + github.com/mattn/go-colorable v0.1.15 + github.com/mattn/go-isatty v0.0.22 + github.com/ogen-go/ogen v1.23.0 + github.com/refraction-networking/utls v1.8.2 + github.com/segmentio/asm v1.2.1 + github.com/shopspring/decimal v1.4.0 + github.com/xdg-go/pbkdf2 v1.0.0 + github.com/xdg-go/scram v1.2.0 + github.com/xdg-go/stringprep v1.0.4 + github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 + github.com/yuin/goldmark v1.8.5 + go.opentelemetry.io/otel v1.44.0 + go.opentelemetry.io/otel/metric v1.44.0 + go.opentelemetry.io/otel/trace v1.44.0 + go.uber.org/atomic v1.11.0 + go.uber.org/multierr v1.11.0 + go.uber.org/zap v1.28.0 + golang.org/x/exp v0.0.0-20230725093048-515e97ebf090 + golang.org/x/mod v0.38.0 + golang.org/x/net v0.57.0 + golang.org/x/sync v0.22.0 + golang.org/x/sys v0.47.0 + golang.org/x/tools v0.48.0 + gopkg.in/yaml.v2 v2.4.0 + rsc.io/qr v0.2.0 +) diff --git a/go.sum b/go.sum new file mode 100644 index 0000000..2a016dd --- /dev/null +++ b/go.sum @@ -0,0 +1,156 @@ +github.com/andybalholm/brotli v1.2.1 h1:R+f5xP285VArJDRgowrfb9DqL18yVK0gKAW/F+eTWro= +github.com/andybalholm/brotli v1.2.1/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY= +github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8= +github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE= +github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= +github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= +github.com/coder/websocket v1.8.15 h1:6B2JPeOGlpff2Uz6vOEH1Vzpi0iUz20A+lPVhPHtNUA= +github.com/coder/websocket v1.8.15/go.mod h1:NX3SzP+inril6yawo5CQXx8+fk145lPDC6pumgx0mVg= +github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= +github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8= +github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8= +github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w= +github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE= +github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk= +github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04= +github.com/go-chi/chi/v5 v5.3.2 h1:5YQkICvTCSZ25hoRsyJazN0scjzKGiu4VAUc7H1o1nY= +github.com/go-chi/chi/v5 v5.3.2/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto= +github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE= +github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58= +github.com/go-faster/errors v0.8.0 h1:9T9eJrM+72dFk7n4DfhuaDDe6cyuFCSW2oNUkN77Yqc= +github.com/go-faster/errors v0.8.0/go.mod h1:5ySTjWFiphBs07IKuiL69nxdfd5+fzh1u7FPGZP2quo= +github.com/go-faster/jx v1.2.0 h1:T2YHJPrFaYu21fJtUxC9GzmluKu8rVIFDwwGBKTDseI= +github.com/go-faster/jx v1.2.0/go.mod h1:UWLOVDmMG597a5tBFPLIWJdUxz5/2emOpfsj9Neg0PE= +github.com/go-faster/xor v1.0.0 h1:2o8vTOgErSGHP3/7XwA5ib1FTtUsNtwCoLLBjl31X38= +github.com/go-faster/xor v1.0.0/go.mod h1:x5CaDY9UKErKzqfRfFZdfu+OSTfoZny3w5Ak7UxcipQ= +github.com/go-faster/yaml v0.4.6 h1:lOK/EhI04gCpPgPhgt0bChS6bvw7G3WwI8xxVe0sw9I= +github.com/go-faster/yaml v0.4.6/go.mod h1:390dRIvV4zbnO7qC9FGo6YYutc+wyyUSHBgbXL52eXk= +github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= +github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= +github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= +github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY= +github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE= +github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= +github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= +github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= +github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/gotd/ige v0.3.0 h1:4f6LEHWsVDLBG0bT9wWG2/9TZb5aWm265G8ZlTXmRRU= +github.com/gotd/ige v0.3.0/go.mod h1:FE9bTaQtvfArizAcZuI4sS6gXaEUBmixdUufVHoCKac= +github.com/gotd/log v0.1.0 h1:4LJUEvafD1xtBwx2QkrlzFnRgbYXTlWqJPDi8BvrLbU= +github.com/gotd/log v0.1.0/go.mod h1:5ilhdu1Ux0QvDY/FF3Ojfw24Ws3SlCtyLwOpXy8KYXs= +github.com/gotd/log/logzap v0.1.1 h1:O6l7d8HUbODe+UMcrM47eXYDwdJ6RNmpQejLjrlcEIQ= +github.com/gotd/log/logzap v0.1.1/go.mod h1:5ObZkITbfhbsBOLzBkzmMk9QxXc0eNQpimau7zRL+Y8= +github.com/gotd/neo v0.1.5 h1:oj0iQfMbGClP8xI59x7fE/uHoTJD7NZH9oV1WNuPukQ= +github.com/gotd/neo v0.1.5/go.mod h1:9A2a4bn9zL6FADufBdt7tZt+WMhvZoc5gWXihOPoiBQ= +github.com/gotd/td v0.162.0 h1:3pUzBsEbb0I5QquvfSkXihkVBXI+QTtdd/upijjUbkw= +github.com/gotd/td v0.162.0/go.mod h1:ZsGbErIos7XHF7HL0VlsjL6mmX4b1JpinHfDb7gOdvs= +github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0= +github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4= +github.com/klauspost/compress v1.19.2 h1:hMRETovs/pu/dVWN7zIT1PGG8t509MwT6bO7XSi26R8= +github.com/klauspost/compress v1.19.2/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI= +github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI= +github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= +github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY= +github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= +github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4= +github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4= +github.com/ogen-go/ogen v1.23.0 h1:QaWeKm2KZ2zy7NkqqO1Vdl5idNqlG+svxdgwVAX+zbo= +github.com/ogen-go/ogen v1.23.0/go.mod h1:bwwvC3AmCV+LrL5lazyQwwof90402mdcSyI0FOzzpfM= +github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= +github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/refraction-networking/utls v1.8.2 h1:j4Q1gJj0xngdeH+Ox/qND11aEfhpgoEvV+S9iJ2IdQo= +github.com/refraction-networking/utls v1.8.2/go.mod h1:jkSOEkLqn+S/jtpEHPOsVv/4V4EVnelwbMQl4vCWXAM= +github.com/segmentio/asm v1.2.1 h1:DTNbBqs57ioxAD4PrArqftgypG4/qNpXoJx8TVXxPR0= +github.com/segmentio/asm v1.2.1/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs= +github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k= +github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME= +github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= +github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= +github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c= +github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI= +github.com/xdg-go/scram v1.2.0 h1:bYKF2AEwG5rqd1BumT4gAnvwU/M9nBp2pTSxeZw7Wvs= +github.com/xdg-go/scram v1.2.0/go.mod h1:3dlrS0iBaWKYVt2ZfA4cj48umJZ+cAEbR6/SjLA88I8= +github.com/xdg-go/stringprep v1.0.4 h1:XLI/Ng3O1Atzq0oBs3TWm+5ZVgkq2aqdlvP9JtoZ6c8= +github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM= +github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU= +github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E= +github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM= +github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI= +github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= +github.com/yuin/goldmark v1.8.5 h1:r6N5afV5qj/5S4UTch8agZHJ8UxNCMwX7WjkkJam2NA= +github.com/yuin/goldmark v1.8.5/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg= +go.mongodb.org/mongo-driver/v2 v2.9.1 h1:jewiFs2m1/VOQp8qhFshX6hWZ+EAXDhZHXExAUMcOgQ= +go.mongodb.org/mongo-driver/v2 v2.9.1/go.mod h1:SHKN0IWkKmEVGHLjXnni6s4wPKX4v86FTgOeJJFuXcA= +go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= +go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= +go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= +go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= +go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= +go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= +go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= +go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= +go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE= +go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0= +go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= +go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= +go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0= +go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y= +go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo= +go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q= +go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= +go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= +golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= +golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= +golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= +golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= +golang.org/x/exp v0.0.0-20230725093048-515e97ebf090 h1:Di6/M8l0O2lCLc6VVRWhgCiApHV8MnQurBnFSHsQtNY= +golang.org/x/exp v0.0.0-20230725093048-515e97ebf090/go.mod h1:FXUEEKJgO7OQYeo8N01OfiKP8RXMtf6e8aTskBGqWdc= +golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= +golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= +golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= +golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= +golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= +golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= +golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= +golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= +golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= +golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= +golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= +golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= +golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= +golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ= +golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= +golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= +golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= +golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= +golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= +golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= +golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo= +gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= +gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= +gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= +gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +nhooyr.io/websocket v1.8.17 h1:KEVeLJkUywCKVsnLIDlD/5gtayKp8VoCkksHCGGfT9Y= +nhooyr.io/websocket v1.8.17/go.mod h1:rN9OFWIUwuxg4fR5tELlYC04bXYowCP9GX47ivo2l+c= +rsc.io/qr v0.2.0 h1:6vBLea5/NRMVTz8V66gipeLycZMl/+UlFmk8DvqQ6WY= +rsc.io/qr v0.2.0/go.mod h1:IF+uZjkb9fqyeF/4tlBoynqmQxUoPfWEKh921coOuXs= diff --git a/internal/api/handlers/access_control.go b/internal/api/handlers/access_control.go new file mode 100644 index 0000000..abf8e97 --- /dev/null +++ b/internal/api/handlers/access_control.go @@ -0,0 +1,620 @@ +package handlers + +import ( + "encoding/json" + "fmt" + "io" + "net/http" + "strconv" + "strings" + "time" + + "github.com/go-chi/chi/v5" + + "streamgo/internal/api" + "streamgo/internal/api/middleware" + "streamgo/internal/config" + "streamgo/internal/models" + "streamgo/internal/services" +) + +// AccessControlHandler handles administrative access policy, Telegram membership, invites, and user control. +type AccessControlHandler struct { + accessSvc *services.AccessControlService + authSvc *services.AuthService + cfg *config.Config + httpClient *http.Client +} + +// NewAccessControlHandler creates an AccessControlHandler. +func NewAccessControlHandler(accessSvc *services.AccessControlService, authSvc *services.AuthService, cfg *config.Config) *AccessControlHandler { + return &AccessControlHandler{ + accessSvc: accessSvc, + authSvc: authSvc, + cfg: cfg, + httpClient: &http.Client{Timeout: 8 * time.Second}, + } +} + +// Routes mounts /admin/access endpoints. +func (h *AccessControlHandler) Routes(r chi.Router) { + optionalAuth := middleware.OptionalAuth(h.authSvc) + + r.Route("/admin/access", func(sub chi.Router) { + sub.Use(optionalAuth) + + // Policy + sub.Get("/policy", h.GetPolicy) + sub.Patch("/policy", h.PatchPolicy) + + // Required Telegram chats + sub.Post("/required-chats", h.AddRequiredChat) + sub.Delete("/required-chats/{chat_id}", h.RemoveRequiredChat) + sub.Delete("/required-chats", h.RemoveRequiredChat) + + // Invite codes + sub.Get("/invites", h.ListInvites) + sub.Post("/invites", h.CreateInvite) + sub.Delete("/invites/{code}", h.RevokeInvite) + sub.Delete("/invites", h.RevokeInvite) + + // Allowlist + sub.Get("/allowlist", h.ListAllowlist) + sub.Post("/allowlist", h.AddAllowlist) + sub.Delete("/allowlist/{user_id}", h.RemoveAllowlist) + sub.Delete("/allowlist", h.RemoveAllowlist) + + // Bypass + sub.Get("/bypass", h.ListBypass) + sub.Post("/bypass", h.AddBypass) + sub.Delete("/bypass/{user_id}", h.RemoveBypass) + sub.Delete("/bypass", h.RemoveBypass) + + // User accounts + sub.Get("/users", h.ListUsers) + sub.Post("/users/{id}/lock", h.LockUser) + sub.Post("/users/{id}/unlock", h.UnlockUser) + sub.Post("/users/{id}/revoke-sessions", h.RevokeSessions) + + // Reverify Telegram membership + sub.Post("/reverify", h.Reverify) + }) +} + +// checkAdmin verifies that the caller has admin permissions (owner, sudo, or valid guest password). +func (h *AccessControlHandler) checkAdmin(r *http.Request) (int64, error) { + if middleware.IsGuest(r.Context()) { + return 0, nil + } + + userID, ok := middleware.GetUserID(r.Context()) + if !ok || userID <= 0 { + return 0, fmt.Errorf("authentication required") + } + + if len(h.cfg.OwnerIDs) == 0 && len(h.cfg.SudoUsers) == 0 { + return userID, nil + } + + for _, oid := range h.cfg.OwnerIDs { + if oid == userID { + return userID, nil + } + } + for _, sid := range h.cfg.SudoUsers { + if sid == userID { + return userID, nil + } + } + + return 0, fmt.Errorf("forbidden: administrator privileges required") +} + +// GetPolicy handles GET /admin/access/policy. +func (h *AccessControlHandler) GetPolicy(w http.ResponseWriter, r *http.Request) { + if _, err := h.checkAdmin(r); err != nil { + api.RespondError(w, http.StatusForbidden, err.Error()) + return + } + + policy, err := h.accessSvc.GetPolicy(r.Context()) + if err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "policy": policy, + }) +} + +// PatchPolicy handles PATCH /admin/access/policy. +func (h *AccessControlHandler) PatchPolicy(w http.ResponseWriter, r *http.Request) { + adminID, err := h.checkAdmin(r) + if err != nil { + api.RespondError(w, http.StatusForbidden, err.Error()) + return + } + + var patch models.PolicyPatch + if err := json.NewDecoder(r.Body).Decode(&patch); err != nil { + api.RespondError(w, http.StatusBadRequest, "invalid json payload") + return + } + + updated, err := h.accessSvc.UpdatePolicy(r.Context(), patch, adminID) + if err != nil { + api.RespondError(w, http.StatusBadRequest, err.Error()) + return + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "policy": updated, + }) +} + +// AddRequiredChat handles POST /admin/access/required-chats. +func (h *AccessControlHandler) AddRequiredChat(w http.ResponseWriter, r *http.Request) { + if _, err := h.checkAdmin(r); err != nil { + api.RespondError(w, http.StatusForbidden, err.Error()) + return + } + + var chat models.RequiredChat + if err := json.NewDecoder(r.Body).Decode(&chat); err != nil || chat.ChatID == 0 { + api.RespondError(w, http.StatusBadRequest, "chat_id is required") + return + } + + policy, err := h.accessSvc.AddRequiredChat(r.Context(), chat) + if err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "required_chats": policy.RequiredChats, + }) +} + +// RemoveRequiredChat handles DELETE /admin/access/required-chats/{chat_id}. +func (h *AccessControlHandler) RemoveRequiredChat(w http.ResponseWriter, r *http.Request) { + if _, err := h.checkAdmin(r); err != nil { + api.RespondError(w, http.StatusForbidden, err.Error()) + return + } + + chatIDStr := chi.URLParam(r, "chat_id") + if chatIDStr == "" { + chatIDStr = r.URL.Query().Get("chat_id") + } + + chatID, _ := strconv.ParseInt(chatIDStr, 10, 64) + if chatID == 0 { + api.RespondError(w, http.StatusBadRequest, "chat_id is required") + return + } + + policy, err := h.accessSvc.RemoveRequiredChat(r.Context(), chatID) + if err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "required_chats": policy.RequiredChats, + }) +} + +// ListInvites handles GET /admin/access/invites. +func (h *AccessControlHandler) ListInvites(w http.ResponseWriter, r *http.Request) { + if _, err := h.checkAdmin(r); err != nil { + api.RespondError(w, http.StatusForbidden, err.Error()) + return + } + + includeDead := api.ParseQueryBool(r, "include_dead", false) + invites, err := h.accessSvc.ListInvites(r.Context(), includeDead) + if err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "invites": invites, + }) +} + +// CreateInvite handles POST /admin/access/invites. +func (h *AccessControlHandler) CreateInvite(w http.ResponseWriter, r *http.Request) { + adminID, err := h.checkAdmin(r) + if err != nil { + api.RespondError(w, http.StatusForbidden, err.Error()) + return + } + + var req models.InviteCreateRequest + _ = json.NewDecoder(r.Body).Decode(&req) + + inv, err := h.accessSvc.CreateInvite(r.Context(), adminID, req.MaxUses, req.TTLDays, req.Note) + if err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "invite": inv, + }) +} + +// RevokeInvite handles DELETE /admin/access/invites/{code}. +func (h *AccessControlHandler) RevokeInvite(w http.ResponseWriter, r *http.Request) { + if _, err := h.checkAdmin(r); err != nil { + api.RespondError(w, http.StatusForbidden, err.Error()) + return + } + + code := chi.URLParam(r, "code") + if code == "" { + code = r.URL.Query().Get("code") + } + code = strings.ToUpper(strings.TrimSpace(code)) + if code == "" { + api.RespondError(w, http.StatusBadRequest, "invite code is required") + return + } + + revoked := h.accessSvc.RevokeInvite(r.Context(), code) + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "revoked": revoked, + "code": code, + }) +} + +// ListAllowlist handles GET /admin/access/allowlist. +func (h *AccessControlHandler) ListAllowlist(w http.ResponseWriter, r *http.Request) { + if _, err := h.checkAdmin(r); err != nil { + api.RespondError(w, http.StatusForbidden, err.Error()) + return + } + + list, err := h.accessSvc.ListAllowlist(r.Context()) + if err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "allowlist": list, + }) +} + +// AddAllowlist handles POST /admin/access/allowlist. +func (h *AccessControlHandler) AddAllowlist(w http.ResponseWriter, r *http.Request) { + adminID, err := h.checkAdmin(r) + if err != nil { + api.RespondError(w, http.StatusForbidden, err.Error()) + return + } + + var req models.AllowlistRequest + if err := json.NewDecoder(r.Body).Decode(&req); err != nil || req.UserID <= 0 { + api.RespondError(w, http.StatusBadRequest, "valid user_id is required") + return + } + + if err := h.accessSvc.AddToAllowlist(r.Context(), req.UserID, adminID, req.Note); err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "user_id": req.UserID, + "message": "User added to allowlist", + }) +} + +// RemoveAllowlist handles DELETE /admin/access/allowlist/{user_id}. +func (h *AccessControlHandler) RemoveAllowlist(w http.ResponseWriter, r *http.Request) { + if _, err := h.checkAdmin(r); err != nil { + api.RespondError(w, http.StatusForbidden, err.Error()) + return + } + + uidStr := chi.URLParam(r, "user_id") + if uidStr == "" { + uidStr = r.URL.Query().Get("user_id") + } + uid, _ := strconv.ParseInt(uidStr, 10, 64) + if uid <= 0 { + api.RespondError(w, http.StatusBadRequest, "valid user_id is required") + return + } + + removed := h.accessSvc.RemoveFromAllowlist(r.Context(), uid) + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "removed": removed, + "user_id": uid, + }) +} + +// ListBypass handles GET /admin/access/bypass. +func (h *AccessControlHandler) ListBypass(w http.ResponseWriter, r *http.Request) { + if _, err := h.checkAdmin(r); err != nil { + api.RespondError(w, http.StatusForbidden, err.Error()) + return + } + + list, err := h.accessSvc.ListBypass(r.Context()) + if err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "bypass": list, + }) +} + +// AddBypass handles POST /admin/access/bypass. +func (h *AccessControlHandler) AddBypass(w http.ResponseWriter, r *http.Request) { + adminID, err := h.checkAdmin(r) + if err != nil { + api.RespondError(w, http.StatusForbidden, err.Error()) + return + } + + var req models.AllowlistRequest + if err := json.NewDecoder(r.Body).Decode(&req); err != nil || req.UserID <= 0 { + api.RespondError(w, http.StatusBadRequest, "valid user_id is required") + return + } + + if err := h.accessSvc.AddToBypass(r.Context(), req.UserID, adminID, req.Note); err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "user_id": req.UserID, + "message": "User added to bypass list", + }) +} + +// RemoveBypass handles DELETE /admin/access/bypass/{user_id}. +func (h *AccessControlHandler) RemoveBypass(w http.ResponseWriter, r *http.Request) { + if _, err := h.checkAdmin(r); err != nil { + api.RespondError(w, http.StatusForbidden, err.Error()) + return + } + + uidStr := chi.URLParam(r, "user_id") + if uidStr == "" { + uidStr = r.URL.Query().Get("user_id") + } + uid, _ := strconv.ParseInt(uidStr, 10, 64) + if uid <= 0 { + api.RespondError(w, http.StatusBadRequest, "valid user_id is required") + return + } + + removed := h.accessSvc.RemoveFromBypass(r.Context(), uid) + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "removed": removed, + "user_id": uid, + }) +} + +// ListUsers handles GET /admin/access/users. +func (h *AccessControlHandler) ListUsers(w http.ResponseWriter, r *http.Request) { + if _, err := h.checkAdmin(r); err != nil { + api.RespondError(w, http.StatusForbidden, err.Error()) + return + } + + query := r.URL.Query().Get("q") + status := r.URL.Query().Get("status") + limit := api.ParseQueryInt(r, "limit", 50) + skip := api.ParseQueryInt(r, "skip", 0) + + resp, err := h.accessSvc.ListUsers(r.Context(), query, status, limit, skip) + if err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "data": resp, + }) +} + +// LockUser handles POST /admin/access/users/{id}/lock. +func (h *AccessControlHandler) LockUser(w http.ResponseWriter, r *http.Request) { + adminID, err := h.checkAdmin(r) + if err != nil { + api.RespondError(w, http.StatusForbidden, err.Error()) + return + } + + idStr := chi.URLParam(r, "id") + userID, _ := strconv.ParseInt(idStr, 10, 64) + if userID <= 0 { + api.RespondError(w, http.StatusBadRequest, "valid user id is required") + return + } + + var req models.LockUserRequest + _ = json.NewDecoder(r.Body).Decode(&req) + if req.Reason == "" { + req.Reason = "Account locked by administrator" + } + + if err := h.accessSvc.LockUser(r.Context(), userID, req.Reason, adminID, req.RevokeSessions); err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "user_id": userID, + "status": "locked", + "reason": req.Reason, + }) +} + +// UnlockUser handles POST /admin/access/users/{id}/unlock. +func (h *AccessControlHandler) UnlockUser(w http.ResponseWriter, r *http.Request) { + if _, err := h.checkAdmin(r); err != nil { + api.RespondError(w, http.StatusForbidden, err.Error()) + return + } + + idStr := chi.URLParam(r, "id") + userID, _ := strconv.ParseInt(idStr, 10, 64) + if userID <= 0 { + api.RespondError(w, http.StatusBadRequest, "valid user id is required") + return + } + + if err := h.accessSvc.UnlockUser(r.Context(), userID); err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "user_id": userID, + "status": "active", + }) +} + +// RevokeSessions handles POST /admin/access/users/{id}/revoke-sessions. +func (h *AccessControlHandler) RevokeSessions(w http.ResponseWriter, r *http.Request) { + if _, err := h.checkAdmin(r); err != nil { + api.RespondError(w, http.StatusForbidden, err.Error()) + return + } + + idStr := chi.URLParam(r, "id") + userID, _ := strconv.ParseInt(idStr, 10, 64) + if userID <= 0 { + api.RespondError(w, http.StatusBadRequest, "valid user id is required") + return + } + + version, err := h.accessSvc.RevokeSessions(r.Context(), userID) + if err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "user_id": userID, + "token_version": version, + "message": "All active sessions revoked successfully", + }) +} + +// Reverify handles POST /admin/access/reverify. +// Checks membership status of a given user (or caller) in configured required Telegram chats. +func (h *AccessControlHandler) Reverify(w http.ResponseWriter, r *http.Request) { + var targetUserID int64 + var req struct { + UserID int64 `json:"user_id"` + } + _ = json.NewDecoder(r.Body).Decode(&req) + if req.UserID > 0 { + targetUserID = req.UserID + } else if uidStr := r.URL.Query().Get("user_id"); uidStr != "" { + targetUserID, _ = strconv.ParseInt(uidStr, 10, 64) + } else if uid, ok := middleware.GetUserID(r.Context()); ok { + targetUserID = uid + } + + policy, err := h.accessSvc.GetPolicy(r.Context()) + if err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + + type ChatStatus struct { + ChatID int64 `json:"chat_id"` + Title string `json:"title,omitempty"` + IsMember bool `json:"is_member"` + Status string `json:"status"` + InviteLink string `json:"invite_link,omitempty"` + } + + results := make([]ChatStatus, 0, len(policy.RequiredChats)) + allPassed := true + + for _, chat := range policy.RequiredChats { + st := ChatStatus{ + ChatID: chat.ChatID, + Title: chat.Title, + InviteLink: chat.InviteLink, + Status: "unknown", + } + + if h.cfg.BotToken != "" && targetUserID > 0 { + url := fmt.Sprintf("https://api.telegram.org/bot%s/getChatMember?chat_id=%d&user_id=%d", + h.cfg.BotToken, chat.ChatID, targetUserID) + resp, err := h.httpClient.Get(url) + if err == nil && resp != nil { + defer resp.Body.Close() + bodyBytes, _ := io.ReadAll(resp.Body) + var tgResp struct { + OK bool `json:"ok"` + Result struct { + Status string `json:"status"` + } `json:"result"` + } + if json.Unmarshal(bodyBytes, &tgResp) == nil && tgResp.OK { + st.Status = tgResp.Result.Status + if st.Status == "member" || st.Status == "administrator" || st.Status == "creator" { + st.IsMember = true + } else { + st.IsMember = false + allPassed = false + } + } else { + st.Status = "error_or_not_found" + allPassed = false + } + } else { + st.Status = "check_unreachable" + allPassed = false + } + } else { + // No bot token configured or user ID 0, mark as bypass/mock passed + st.IsMember = true + st.Status = "bypassed_no_bot_token" + } + + results = append(results, st) + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "user_id": targetUserID, + "verified": allPassed, + "enforced": policy.EnforceMembership, + "chats": results, + "chat_count": len(results), + }) +} diff --git a/internal/api/handlers/albums.go b/internal/api/handlers/albums.go new file mode 100644 index 0000000..24cf474 --- /dev/null +++ b/internal/api/handlers/albums.go @@ -0,0 +1,97 @@ +package handlers + +import ( + "net/http" + "strings" + + "github.com/go-chi/chi/v5" + + "streamgo/internal/api" + "streamgo/internal/services" +) + +// AlbumHandler handles HTTP endpoints for albums. +type AlbumHandler struct { + svc *services.ArtistAlbumService +} + +// NewAlbumHandler creates an AlbumHandler instance. +func NewAlbumHandler(svc *services.ArtistAlbumService) *AlbumHandler { + return &AlbumHandler{svc: svc} +} + +// Routes mounts album endpoints on Chi router. +func (h *AlbumHandler) Routes(r chi.Router) { + r.Get("/albums", h.List) + r.Get("/albums/{id}", h.GetByID) + r.Get("/albums/{id}/tracks", h.GetTracks) +} + +// List handles GET /albums with pagination and optional artist filter. +func (h *AlbumHandler) List(w http.ResponseWriter, r *http.Request) { + page := api.ParseQueryInt(r, "page", 1) + perPage := api.ParseQueryInt(r, "per_page", 50) + if limit := api.ParseQueryInt(r, "limit", 0); limit > 0 { + perPage = limit + } + refresh := api.ParseQueryBool(r, "refresh", false) + artistFilter := strings.TrimSpace(r.URL.Query().Get("artist")) + + resp, err := h.svc.ListAlbums(r.Context(), page, perPage, artistFilter, refresh) + if err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + + api.RespondJSON(w, http.StatusOK, resp) +} + +// GetByID handles GET /albums/{id}. +func (h *AlbumHandler) GetByID(w http.ResponseWriter, r *http.Request) { + id := strings.TrimSpace(chi.URLParam(r, "id")) + if id == "" { + api.RespondError(w, http.StatusBadRequest, "album id is required") + return + } + + detail, err := h.svc.GetAlbumDetail(r.Context(), id) + if err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + if detail == nil { + api.RespondError(w, http.StatusNotFound, "album not found") + return + } + + api.RespondJSON(w, http.StatusOK, detail) +} + +// GetTracks handles GET /albums/{id}/tracks. +func (h *AlbumHandler) GetTracks(w http.ResponseWriter, r *http.Request) { + id := strings.TrimSpace(chi.URLParam(r, "id")) + if id == "" { + api.RespondError(w, http.StatusBadRequest, "album id is required") + return + } + + page := api.ParseQueryInt(r, "page", 1) + perPage := api.ParseQueryInt(r, "per_page", 50) + if limit := api.ParseQueryInt(r, "limit", 0); limit > 0 { + perPage = limit + } + + tracks, total, err := h.svc.GetAlbumTracksPaginated(r.Context(), id, page, perPage) + if err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "page": page, + "per_page": perPage, + "total": total, + "items": tracks, + }) +} diff --git a/internal/api/handlers/artists.go b/internal/api/handlers/artists.go new file mode 100644 index 0000000..e7a09e7 --- /dev/null +++ b/internal/api/handlers/artists.go @@ -0,0 +1,96 @@ +package handlers + +import ( + "net/http" + "strings" + + "github.com/go-chi/chi/v5" + + "streamgo/internal/api" + "streamgo/internal/services" +) + +// ArtistHandler handles endpoints for artist discovery and profiles. +type ArtistHandler struct { + svc *services.ArtistAlbumService +} + +// NewArtistHandler creates an ArtistHandler instance. +func NewArtistHandler(svc *services.ArtistAlbumService) *ArtistHandler { + return &ArtistHandler{svc: svc} +} + +// Routes mounts artist endpoints on the Chi router. +func (h *ArtistHandler) Routes(r chi.Router) { + r.Get("/artists", h.List) + r.Get("/artists/{id}", h.GetByID) + r.Get("/artists/{id}/tracks", h.GetTracks) +} + +// List handles GET /artists with pagination. +func (h *ArtistHandler) List(w http.ResponseWriter, r *http.Request) { + page := api.ParseQueryInt(r, "page", 1) + perPage := api.ParseQueryInt(r, "per_page", 50) + if limit := api.ParseQueryInt(r, "limit", 0); limit > 0 { + perPage = limit + } + refresh := api.ParseQueryBool(r, "refresh", false) + + resp, err := h.svc.ListArtists(r.Context(), page, perPage, refresh) + if err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + + api.RespondJSON(w, http.StatusOK, resp) +} + +// GetByID handles GET /artists/{id}. +func (h *ArtistHandler) GetByID(w http.ResponseWriter, r *http.Request) { + id := strings.TrimSpace(chi.URLParam(r, "id")) + if id == "" { + api.RespondError(w, http.StatusBadRequest, "artist id is required") + return + } + + detail, err := h.svc.GetArtistDetail(r.Context(), id) + if err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + if detail == nil { + api.RespondError(w, http.StatusNotFound, "artist not found") + return + } + + api.RespondJSON(w, http.StatusOK, detail) +} + +// GetTracks handles GET /artists/{id}/tracks. +func (h *ArtistHandler) GetTracks(w http.ResponseWriter, r *http.Request) { + id := strings.TrimSpace(chi.URLParam(r, "id")) + if id == "" { + api.RespondError(w, http.StatusBadRequest, "artist id is required") + return + } + + page := api.ParseQueryInt(r, "page", 1) + perPage := api.ParseQueryInt(r, "per_page", 50) + if limit := api.ParseQueryInt(r, "limit", 0); limit > 0 { + perPage = limit + } + + tracks, total, err := h.svc.GetArtistTracksPaginated(r.Context(), id, page, perPage) + if err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "page": page, + "per_page": perPage, + "total": total, + "items": tracks, + }) +} diff --git a/internal/api/handlers/auth.go b/internal/api/handlers/auth.go new file mode 100644 index 0000000..9595282 --- /dev/null +++ b/internal/api/handlers/auth.go @@ -0,0 +1,1023 @@ +package handlers + +import ( + "encoding/json" + "fmt" + "net/http" + "net/url" + "strconv" + "strings" + + "github.com/go-chi/chi/v5" + + "streamgo/internal/api" + "streamgo/internal/api/middleware" + "streamgo/internal/config" + "streamgo/internal/models" + "streamgo/internal/services" +) + +// AuthHandler handles authentication routes for Telegram WebApp, widgets, OAuth, and password login/register. +type AuthHandler struct { + cfg *config.Config + authSvc *services.AuthService +} + +// NewAuthHandler creates an AuthHandler instance. +func NewAuthHandler(cfg *config.Config, authSvc *services.AuthService) *AuthHandler { + return &AuthHandler{ + cfg: cfg, + authSvc: authSvc, + } +} + +// Routes registers authentication endpoints on Chi router. +func (h *AuthHandler) Routes(r chi.Router) { + // Telegram WebApp & Web routes + r.Post("/auth/telegram", h.TelegramLogin) + r.Post("/auth/tg/login", h.TgLogin) + r.Post("/webapp/verify", h.TelegramLogin) + + // Password login & Register + r.Post("/auth/login", h.UniversalLogin) + r.Post("/auth/register", h.Register) + r.Post("/auth/create", h.DirectRegister) + r.Post("/auth/validate", h.ValidateOTP) + + // Server / Guest password & Setup endpoints + r.Get("/auth/setup/status", h.SetupStatus) + r.Post("/auth/setup", h.SetupPassword) + r.Post("/auth/password", h.ServerPasswordLogin) + r.Post("/auth/password/change", h.ChangePassword) + + // Cookie & session management + r.Post("/auth/cookie", h.SetCookie) + r.Post("/auth/logout", h.Logout) + + // Telegram Login Widget & Token validation + r.Post("/auth/telegram/widget", h.WidgetLogin) + r.Post("/auth/telegram/validate-token", h.ValidateToken) + + // Telegram OAuth / OIDC endpoints + r.Get("/auth/telegram/config", h.Config) + r.Get("/webapp/config", h.Config) + r.Get("/auth/telegram/start", h.TelegramStart) + r.Get("/auth/telegram/callback", h.TelegramCallback) + + // Direct Telegram Bot App Session login + r.Post("/auth/telegram/bot-session", h.CreateBotSession) + r.Get("/auth/telegram/bot-session/status", h.CheckBotSessionStatus) + + // Authenticated profile, credentials, and integrations routes + r.Group(func(sub chi.Router) { + sub.Use(middleware.RequireAuth(h.authSvc)) + sub.Get("/auth/me", h.Me) + sub.Post("/auth/credentials", h.SetCredentials) + sub.Post("/auth/integrations", h.UpdateIntegrations) + sub.Post("/auth/fcm-token", h.UpdateFCMToken) + }) +} + +// UniversalLogin handles POST /auth/login, supporting both password login and WebApp initData. +func (h *AuthHandler) UniversalLogin(w http.ResponseWriter, r *http.Request) { + var body map[string]any + if err := json.NewDecoder(r.Body).Decode(&body); err != nil { + api.RespondError(w, http.StatusBadRequest, "invalid request body") + return + } + + // 1. If init_data is present, process as Telegram WebApp login + if initData, ok := body["init_data"].(string); ok && strings.TrimSpace(initData) != "" { + req := models.TgLoginRequest{ + InitData: initData, + } + if u, ok := body["username"].(string); ok { + req.Username = u + } + if p, ok := body["password"].(string); ok { + req.Password = p + } + if inv, ok := body["invite_code"].(string); ok { + req.InviteCode = inv + } + + resp, err := h.authSvc.TgLogin(r.Context(), req) + if err != nil { + api.RespondError(w, http.StatusUnauthorized, err.Error()) + return + } + if r.URL.Query().Get("set_cookie") == "true" || r.URL.Query().Get("set_cookie") == "1" { + h.authSvc.SetAuthCookie(w, resp.Token) + } + api.RespondJSON(w, http.StatusOK, resp) + return + } + + // 2. Standard username + password login + username, _ := body["username"].(string) + password, _ := body["password"].(string) + if strings.TrimSpace(username) == "" || strings.TrimSpace(password) == "" { + api.RespondError(w, http.StatusBadRequest, "username and password are required") + return + } + + resp, err := h.authSvc.LoginWithPassword(r.Context(), username, password) + if err != nil { + if strings.Contains(err.Error(), "invalid username") { + api.RespondError(w, http.StatusBadRequest, err.Error()) + } else { + api.RespondError(w, http.StatusUnauthorized, err.Error()) + } + return + } + + if r.URL.Query().Get("set_cookie") == "true" || r.URL.Query().Get("set_cookie") == "1" { + h.authSvc.SetAuthCookie(w, resp.Token) + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "user_id": resp.UserID, + "token": resp.Token, + "first_name": resp.FirstName, + "username": resp.Username, + "profile_url": resp.ProfileURL, + "photo_url": resp.PhotoURL, + }) +} + +// TelegramLogin handles POST /auth/telegram and /webapp/verify. +func (h *AuthHandler) TelegramLogin(w http.ResponseWriter, r *http.Request) { + var initData string + + contentType := r.Header.Get("Content-Type") + if strings.Contains(contentType, "application/x-www-form-urlencoded") || strings.Contains(contentType, "multipart/form-data") { + _ = r.ParseForm() + initData = r.FormValue("init_data") + if initData == "" { + initData = r.FormValue("initData") + } + } else { + var payload models.TelegramWebAppRequest + if err := json.NewDecoder(r.Body).Decode(&payload); err == nil { + initData = payload.InitData + } + } + + initData = strings.TrimSpace(initData) + if initData == "" { + api.RespondError(w, http.StatusBadRequest, "init_data is required") + return + } + + resp, err := h.authSvc.AuthenticateTelegram(r.Context(), initData) + if err != nil { + api.RespondError(w, http.StatusUnauthorized, err.Error()) + return + } + + if r.URL.Query().Get("set_cookie") == "true" || r.URL.Query().Get("set_cookie") == "1" { + h.authSvc.SetAuthCookie(w, resp.Token) + } + + api.RespondJSON(w, http.StatusOK, resp) +} + +// TgLogin handles POST /auth/tg/login. +func (h *AuthHandler) TgLogin(w http.ResponseWriter, r *http.Request) { + var payload models.TgLoginRequest + if err := json.NewDecoder(r.Body).Decode(&payload); err != nil { + api.RespondError(w, http.StatusBadRequest, "invalid request payload") + return + } + + resp, err := h.authSvc.TgLogin(r.Context(), payload) + if err != nil { + if strings.Contains(err.Error(), "username already taken") { + api.RespondError(w, http.StatusConflict, err.Error()) + } else if strings.Contains(err.Error(), "invalid username") { + api.RespondError(w, http.StatusBadRequest, err.Error()) + } else { + api.RespondError(w, http.StatusUnauthorized, err.Error()) + } + return + } + + if r.URL.Query().Get("set_cookie") == "true" || r.URL.Query().Get("set_cookie") == "1" { + h.authSvc.SetAuthCookie(w, resp.Token) + } + + api.RespondJSON(w, http.StatusOK, resp) +} + +// Register handles POST /auth/register, supporting both direct account creation and Telegram OTP. +func (h *AuthHandler) Register(w http.ResponseWriter, r *http.Request) { + var payload models.RegisterRequest + if err := json.NewDecoder(r.Body).Decode(&payload); err != nil { + api.RespondError(w, http.StatusBadRequest, "invalid request body") + return + } + h.doRegister(w, r, payload) +} + +// DirectRegister handles POST /auth/create as an explicit route for direct user creation. +func (h *AuthHandler) DirectRegister(w http.ResponseWriter, r *http.Request) { + var payload models.RegisterRequest + if err := json.NewDecoder(r.Body).Decode(&payload); err != nil { + api.RespondError(w, http.StatusBadRequest, "invalid request body") + return + } + payload.UserID = 0 + h.doRegister(w, r, payload) +} + +func (h *AuthHandler) doRegister(w http.ResponseWriter, r *http.Request, payload models.RegisterRequest) { + resp, err := h.authSvc.RegisterAccount(r.Context(), payload) + if err != nil { + msg := err.Error() + if strings.Contains(strings.ToLower(msg), "already registered") || strings.Contains(strings.ToLower(msg), "already taken") { + api.RespondError(w, http.StatusConflict, msg) + } else if strings.Contains(msg, "invalid username") || strings.Contains(msg, "invalid user id") || strings.Contains(msg, "invite_") { + api.RespondError(w, http.StatusBadRequest, msg) + } else if strings.Contains(msg, "registration_closed") || strings.Contains(msg, "not_allowlisted") || strings.Contains(msg, "membership_required") { + api.RespondError(w, http.StatusForbidden, msg) + } else { + api.RespondError(w, http.StatusInternalServerError, msg) + } + return + } + + // If direct registration created the account, an auth token is issued immediately + if resp.Token != "" { + if r.URL.Query().Get("set_cookie") == "true" || r.URL.Query().Get("set_cookie") == "1" { + h.authSvc.SetAuthCookie(w, resp.Token) + } + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "user_id": resp.UserID, + "token": resp.Token, + "username": resp.Username, + "first_name": resp.FirstName, + "profile_url": resp.ProfileURL, + "photo_url": resp.PhotoURL, + }) + return + } + + // Telegram OTP registration pending + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "message": "OTP sent", + "user_id": resp.UserID, + "username": resp.Username, + "first_name": resp.FirstName, + "profile_url": resp.ProfileURL, + "photo_url": resp.PhotoURL, + }) +} + + +// ValidateOTP handles POST /auth/validate by verifying OTP code and activating account. +func (h *AuthHandler) ValidateOTP(w http.ResponseWriter, r *http.Request) { + var payload models.ValidateOTPRequest + if err := json.NewDecoder(r.Body).Decode(&payload); err != nil { + api.RespondError(w, http.StatusBadRequest, "invalid request body") + return + } + + resp, err := h.authSvc.ValidateOTP(r.Context(), payload) + if err != nil { + msg := err.Error() + if strings.Contains(msg, "no pending registration") || strings.Contains(msg, "invite_") { + api.RespondError(w, http.StatusBadRequest, msg) + } else if strings.Contains(msg, "invalid OTP") || strings.Contains(msg, "session_revoked") { + api.RespondError(w, http.StatusUnauthorized, msg) + } else if strings.Contains(msg, "registration_closed") || strings.Contains(msg, "not_allowlisted") || strings.Contains(msg, "membership_required") { + api.RespondError(w, http.StatusForbidden, msg) + } else { + api.RespondError(w, http.StatusInternalServerError, msg) + } + return + } + + if r.URL.Query().Get("set_cookie") == "true" || r.URL.Query().Get("set_cookie") == "1" { + h.authSvc.SetAuthCookie(w, resp.Token) + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "user_id": resp.UserID, + "username": resp.Username, + "token": resp.Token, + "first_name": resp.FirstName, + "profile_url": resp.ProfileURL, + "photo_url": resp.PhotoURL, + }) +} + +// SetCredentials handles POST /auth/credentials for updating credentials. +func (h *AuthHandler) SetCredentials(w http.ResponseWriter, r *http.Request) { + userID, ok := middleware.GetUserID(r.Context()) + if !ok || userID <= 0 { + api.RespondError(w, http.StatusUnauthorized, "Unauthorized") + return + } + + var payload models.SetCredentialsRequest + if err := json.NewDecoder(r.Body).Decode(&payload); err != nil { + api.RespondError(w, http.StatusBadRequest, "invalid request body") + return + } + + if err := h.authSvc.UpdateCredentials(r.Context(), userID, payload.Username, payload.Password); err != nil { + if strings.Contains(err.Error(), "username already taken") { + api.RespondError(w, http.StatusConflict, err.Error()) + } else { + api.RespondError(w, http.StatusBadRequest, err.Error()) + } + return + } + + api.RespondJSON(w, http.StatusOK, map[string]any{"ok": true}) +} + +// UpdateIntegrations handles POST /auth/integrations. +func (h *AuthHandler) UpdateIntegrations(w http.ResponseWriter, r *http.Request) { + userID, ok := middleware.GetUserID(r.Context()) + if !ok || userID <= 0 { + api.RespondError(w, http.StatusUnauthorized, "Unauthorized") + return + } + + var req models.IntegrationsUpdateRequest + if err := json.NewDecoder(r.Body).Decode(&req); err != nil { + api.RespondError(w, http.StatusBadRequest, "invalid request body") + return + } + + integrations, err := h.authSvc.UpdateIntegrations(r.Context(), userID, req) + if err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "integrations": integrations, + }) +} + +// SetCookie handles POST /auth/cookie to set the auth_token cookie. +func (h *AuthHandler) SetCookie(w http.ResponseWriter, r *http.Request) { + var payload models.SetCookieRequest + if err := json.NewDecoder(r.Body).Decode(&payload); err != nil { + api.RespondError(w, http.StatusBadRequest, "invalid request body") + return + } + + token := strings.TrimSpace(payload.Token) + if token == "" { + api.RespondError(w, http.StatusBadRequest, "token is required") + return + } + + uid, err := h.authSvc.VerifyToken(token) + if err != nil { + api.RespondError(w, http.StatusUnauthorized, "invalid auth token") + return + } + + h.authSvc.SetAuthCookie(w, token) + api.RespondJSON(w, http.StatusOK, map[string]any{"ok": true, "user_id": uid}) +} + +// Logout handles POST /auth/logout. +func (h *AuthHandler) Logout(w http.ResponseWriter, r *http.Request) { + h.authSvc.ClearAuthCookie(w) + api.RespondJSON(w, http.StatusOK, map[string]any{"ok": true}) +} + +// WidgetLogin handles POST /auth/telegram/widget. +func (h *AuthHandler) WidgetLogin(w http.ResponseWriter, r *http.Request) { + var payload models.TelegramWidgetRequest + if err := json.NewDecoder(r.Body).Decode(&payload); err != nil { + api.RespondError(w, http.StatusBadRequest, "invalid widget payload") + return + } + + resp, err := h.authSvc.AuthenticateWidget(r.Context(), payload) + if err != nil { + api.RespondError(w, http.StatusUnauthorized, err.Error()) + return + } + + if r.URL.Query().Get("set_cookie") == "true" || r.URL.Query().Get("set_cookie") == "1" { + h.authSvc.SetAuthCookie(w, resp.Token) + } + + api.RespondJSON(w, http.StatusOK, resp) +} + +// ValidateToken handles POST /auth/telegram/validate-token. +func (h *AuthHandler) ValidateToken(w http.ResponseWriter, r *http.Request) { + var payload models.TelegramTokenLoginRequest + if err := json.NewDecoder(r.Body).Decode(&payload); err != nil { + api.RespondError(w, http.StatusBadRequest, "invalid request body") + return + } + + tokenVal := strings.TrimSpace(payload.IDToken) + if tokenVal == "" { + tokenVal = strings.TrimSpace(payload.Token) + } + if tokenVal == "" { + api.RespondError(w, http.StatusBadRequest, "id_token is required") + return + } + + user, token, err := h.authSvc.ValidateOIDCIDToken(r.Context(), tokenVal, payload.InviteCode) + if err != nil { + api.RespondError(w, http.StatusUnauthorized, fmt.Sprintf("invalid telegram ID token: %v", err)) + return + } + + if r.URL.Query().Get("set_cookie") != "false" { + h.authSvc.SetAuthCookie(w, token) + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "user_id": user.ID, + "token": token, + "first_name": user.FirstName, + "username": user.Username, + "profile_url": user.ProfileURL, + "photo_url": user.PhotoURL, + }) +} + +// Me handles GET /auth/me. +func (h *AuthHandler) Me(w http.ResponseWriter, r *http.Request) { + if middleware.IsGuest(r.Context()) { + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "guest": true, + "user": nil, + }) + return + } + + userID, ok := middleware.GetUserID(r.Context()) + if !ok || userID <= 0 { + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "guest": true, + "user": nil, + }) + return + } + + user, err := h.authSvc.GetUserByID(r.Context(), userID) + if err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + if user == nil { + api.RespondError(w, http.StatusNotFound, "user not found") + return + } + + role := "user" + for _, oid := range h.cfg.OwnerIDs { + if oid == userID { + role = "owner" + break + } + } + if role == "user" { + for _, sid := range h.cfg.SudoUsers { + if sid == userID { + role = "sudo" + break + } + } + } + + isAdmin := role == "owner" || role == "sudo" + + userMap := map[string]any{ + "_id": user.ID, + "id": user.ID, + "user_id": user.ID, + "userid": user.ID, + "username": user.Username, + "first_name": user.FirstName, + "profile_url": user.ProfileURL, + "photo_url": user.PhotoURL, + "telegram": user.Telegram, + "status": user.Status, + "role": role, + "is_admin": isAdmin, + "created_at": user.CreatedAt, + "updated_at": user.UpdatedAt, + "integrations": user.Integrations, + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "user": userMap, + }) +} + +// SetupStatus handles GET /auth/setup/status. +func (h *AuthHandler) SetupStatus(w http.ResponseWriter, r *http.Request) { + resp, err := h.authSvc.GetSetupStatus(r.Context()) + if err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + api.RespondJSON(w, http.StatusOK, resp) +} + +// SetupPassword handles POST /auth/setup. +func (h *AuthHandler) SetupPassword(w http.ResponseWriter, r *http.Request) { + var payload models.SetupPasswordRequest + if err := json.NewDecoder(r.Body).Decode(&payload); err != nil { + api.RespondError(w, http.StatusBadRequest, "invalid request body") + return + } + + token, err := h.authSvc.SetupOwnerPassword(r.Context(), payload.Password) + if err != nil { + if strings.Contains(err.Error(), "already completed") { + api.RespondError(w, http.StatusForbidden, err.Error()) + } else { + api.RespondError(w, http.StatusBadRequest, err.Error()) + } + return + } + + if r.URL.Query().Get("set_cookie") == "true" || r.URL.Query().Get("set_cookie") == "1" { + h.authSvc.SetAuthCookie(w, token) + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "token": token, + }) +} + +// ServerPasswordLogin handles POST /auth/password. +func (h *AuthHandler) ServerPasswordLogin(w http.ResponseWriter, r *http.Request) { + var body map[string]any + if err := json.NewDecoder(r.Body).Decode(&body); err != nil { + api.RespondError(w, http.StatusBadRequest, "invalid request body") + return + } + + username, _ := body["username"].(string) + password, _ := body["password"].(string) + + // If username is provided and not "guest", treat as user login with password (matching Swagger schema) + if strings.TrimSpace(username) != "" && !strings.EqualFold(strings.TrimSpace(username), "guest") { + if strings.TrimSpace(password) == "" { + api.RespondError(w, http.StatusBadRequest, "password is required") + return + } + + resp, err := h.authSvc.LoginWithPassword(r.Context(), username, password) + if err != nil { + if strings.Contains(err.Error(), "invalid username") { + api.RespondError(w, http.StatusBadRequest, err.Error()) + } else { + api.RespondError(w, http.StatusUnauthorized, err.Error()) + } + return + } + + if r.URL.Query().Get("set_cookie") == "true" || r.URL.Query().Get("set_cookie") == "1" { + h.authSvc.SetAuthCookie(w, resp.Token) + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "user_id": resp.UserID, + "token": resp.Token, + "first_name": resp.FirstName, + "username": resp.Username, + "profile_url": resp.ProfileURL, + "photo_url": resp.PhotoURL, + }) + return + } + + token, err := h.authSvc.LoginWithServerPassword(r.Context(), password) + if err != nil { + api.RespondError(w, http.StatusUnauthorized, err.Error()) + return + } + + if r.URL.Query().Get("set_cookie") == "true" || r.URL.Query().Get("set_cookie") == "1" { + h.authSvc.SetAuthCookie(w, token) + } + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "token": token, + }) +} + +// ChangePassword handles POST /auth/password/change. +func (h *AuthHandler) ChangePassword(w http.ResponseWriter, r *http.Request) { + userID, _ := middleware.GetUserID(r.Context()) + var payload models.SetupPasswordRequest + if err := json.NewDecoder(r.Body).Decode(&payload); err != nil { + api.RespondError(w, http.StatusBadRequest, "invalid request body") + return + } + + if err := h.authSvc.ChangeOwnerPassword(r.Context(), payload.Password, userID); err != nil { + api.RespondError(w, http.StatusBadRequest, err.Error()) + return + } + + api.RespondJSON(w, http.StatusOK, map[string]any{"ok": true}) +} + +// Config handles GET /auth/telegram/config and GET /webapp/config. +func (h *AuthHandler) Config(w http.ResponseWriter, r *http.Request) { + clientID := h.authSvc.GetTelegramClientID() + botUsername := h.authSvc.GetBotUsername(r.Context()) + enabled := clientID != "" || botUsername != "" + + api.RespondJSON(w, http.StatusOK, map[string]any{ + "ok": true, + "enabled": enabled, + "client_id": clientID, + "bot_id": clientID, + "bot_username": botUsername, + "has_auth": true, + }) +} + +// TelegramStart handles GET /auth/telegram/start. +func (h *AuthHandler) TelegramStart(w http.ResponseWriter, r *http.Request) { + redirect := r.URL.Query().Get("redirect") + if redirect == "" || !strings.HasPrefix(redirect, "/") || strings.HasPrefix(redirect, "//") { + redirect = "/" + } + + frontendURL := r.URL.Query().Get("frontend_url") + frontendBase := getFrontendBaseURL(r, frontendURL, h.cfg) + callbackURI := getTelegramRedirectURI(r, h.cfg, frontendBase) + inviteCode := strings.TrimSpace(r.URL.Query().Get("invite_code")) + + authURL, err := h.authSvc.StartTelegramOIDC(r.Context(), callbackURI, frontendBase, redirect, inviteCode) + if err != nil { + api.RespondError(w, http.StatusInternalServerError, err.Error()) + return + } + + http.Redirect(w, r, authURL, http.StatusFound) +} + +// TelegramCallback handles GET /auth/telegram/callback. +func (h *AuthHandler) TelegramCallback(w http.ResponseWriter, r *http.Request) { + q := r.URL.Query() + frontendBase := getFrontendBaseURL(r, "", h.cfg) + + // 1. Provider error + if errVal := q.Get("error"); errVal != "" { + errDesc := q.Get("error_description") + if errDesc == "" { + errDesc = errVal + } + http.Redirect(w, r, fmt.Sprintf("%s/login?error=%s", frontendBase, url.QueryEscape(errVal)), http.StatusFound) + return + } + + // 2. Direct Widget Query Callback (?hash=...&id=...) + if q.Get("hash") != "" && q.Get("id") != "" { + id, err := strconv.ParseInt(q.Get("id"), 10, 64) + if err == nil && id > 0 { + authDate, _ := strconv.ParseInt(q.Get("auth_date"), 10, 64) + widgetReq := models.TelegramWidgetRequest{ + ID: id, + FirstName: q.Get("first_name"), + LastName: q.Get("last_name"), + Username: q.Get("username"), + PhotoURL: q.Get("photo_url"), + AuthDate: authDate, + Hash: q.Get("hash"), + } + resp, err := h.authSvc.AuthenticateWidget(r.Context(), widgetReq) + if err == nil { + h.authSvc.SetAuthCookie(w, resp.Token) + renderSuccessPopup(w, resp.Token, resp.UserID, resp.FirstName, resp.Username, resp.PhotoURL, frontendBase+"/") + return + } + } + http.Redirect(w, r, fmt.Sprintf("%s/login?error=invalid_widget_signature", frontendBase), http.StatusFound) + return + } + + // 3. OIDC code exchange (?code=...&state=...) + code := q.Get("code") + state := q.Get("state") + if code != "" && state != "" { + user, token, destPath, err := h.authSvc.ExchangeOIDCCode(r.Context(), code, state) + if err != nil { + http.Redirect(w, r, fmt.Sprintf("%s/login?error=%s", frontendBase, url.QueryEscape(err.Error())), http.StatusFound) + return + } + + h.authSvc.SetAuthCookie(w, token) + redirectTarget := fmt.Sprintf("%s/login?token=%s&redirect=%s", frontendBase, url.QueryEscape(token), url.QueryEscape(destPath)) + renderSuccessPopup(w, token, user.ID, user.FirstName, user.Username, user.PhotoURL, redirectTarget) + return + } + + // 4. Hash fragment fallback (for clients where Telegram returned fragment #tgAuthResult or #id_token) + renderFragmentFallbackHTML(w) +} + +func renderSuccessPopup(w http.ResponseWriter, token string, userID int64, firstName, username, photoURL, redirectTarget string) { + safeFirstName, _ := json.Marshal(firstName) + safeUsername, _ := json.Marshal(username) + safePhoto, _ := json.Marshal(photoURL) + safeTarget, _ := json.Marshal(redirectTarget) + + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusOK) + fmt.Fprintf(w, ` +`, token, userID, string(safeFirstName), string(safeUsername), string(safePhoto), string(safeTarget), string(safeTarget)) +} + +func renderFragmentFallbackHTML(w http.ResponseWriter) { + w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.WriteHeader(http.StatusOK) + fmt.Fprint(w, ` + + + + +Connecting your account, please wait...
+
- 
- 
-