Sansan
090e794460
Security - Serve character images through os.Root so names like ../ can't escape the characters folder - Sync start and /sync/reset are POST only (legacy and /api/v1) - /api/v1/token/cleanup requires a token, password compared in constant time, tokens no longer logged - Echo's rate limiter replaces the custom one; TRUSTED_PROXIES enables X-Forwarded-For for reverse proxies Crashes and races - Sync state lives in SyncService with atomics and a mutex instead of unsynchronised globals (fixes concurrent map writes during full sync) - Only one sync can run; /api/v1 sync and music routes are locked during sync like the legacy ones - No log.Fatal outside startup: errors become 4xx/5xx responses - Search uses an in-order character match instead of unescaped regexes - Empty queue / no songs return 404 instead of panicking or looping Behaviour - Sync result is computed once and stays the same between polls - Swagger and /openapi serve the embedded spec - Shutdown stops HTTP before closing the database - Expired tokens are deleted with a context that outlives the request - Files are served with Range support and correct content types; audio has no write deadline Performance - Migration 000006 adds soundtrack.fingerprint (names, sizes, mtimes) so unchanged folders are skipped without reading any files - Songs are reconciled per soundtrack with one query plus needed writes; renames keep play counts - Moved MUSIC_PATH updates soundtrack and song paths - .id cleanup only runs for changed soundtracks or a full sync - Classic random uses one SQL query; Gitea release lookups are cached with a timeout Structure - internal/config reads all environment variables once - sqlc emits a Querier interface; backend globals become services injected into handlers - One route registration shared by legacy and /api/v1 - Removed dead code (dbHelper.go, unused middleware, duplicate Gitea functions, embedded Swagger UI copy) and lib/pq - templ and swag pinned as go tools
62 lines
1.8 KiB
Go
62 lines
1.8 KiB
Go
package server
|
|
|
|
import (
|
|
"errors"
|
|
"net/http"
|
|
"os"
|
|
"path/filepath"
|
|
"time"
|
|
|
|
"music-server/internal/backend"
|
|
"music-server/internal/logging"
|
|
|
|
"github.com/labstack/echo/v5"
|
|
"go.uber.org/zap"
|
|
)
|
|
|
|
// serveFile sends a file with support for Range requests and caching headers.
|
|
// contentType may be empty to detect it from the file extension.
|
|
func serveFile(c *echo.Context, f *os.File, contentType string) error {
|
|
defer f.Close()
|
|
info, err := f.Stat()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if info.IsDir() {
|
|
return echo.NewHTTPError(http.StatusNotFound, "Not Found")
|
|
}
|
|
if contentType != "" {
|
|
c.Response().Header().Set(echo.HeaderContentType, contentType)
|
|
}
|
|
http.ServeContent(c.Response(), c.Request(), filepath.Base(f.Name()), info.ModTime(), f)
|
|
return nil
|
|
}
|
|
|
|
// serveSong streams a song. The write deadline is lifted because songs can take long to send to slow clients.
|
|
func serveSong(c *echo.Context, path string, err error) error {
|
|
if err != nil {
|
|
return songError(err)
|
|
}
|
|
f, err := os.Open(path)
|
|
if err != nil {
|
|
return echo.NewHTTPError(http.StatusNotFound, "Not Found")
|
|
}
|
|
_ = http.NewResponseController(c.Response()).SetWriteDeadline(time.Time{})
|
|
return serveFile(c, f, "audio/mpeg")
|
|
}
|
|
|
|
// songError maps backend errors to HTTP errors.
|
|
func songError(err error) error {
|
|
switch {
|
|
case errors.Is(err, backend.ErrQueueEmpty), errors.Is(err, backend.ErrNoSongs), errors.Is(err, backend.ErrNotFound):
|
|
return echo.NewHTTPError(http.StatusNotFound, err.Error())
|
|
case errors.Is(err, backend.ErrInvalidName):
|
|
return echo.NewHTTPError(http.StatusBadRequest, err.Error())
|
|
case errors.Is(err, backend.ErrUpstream):
|
|
return echo.NewHTTPError(http.StatusBadGateway, err.Error())
|
|
default:
|
|
logging.GetLogger().Error("Request failed", zap.Error(err))
|
|
return echo.NewHTTPError(http.StatusInternalServerError, "Internal Server Error")
|
|
}
|
|
}
|