d672583830
Share a download by a capability URL (/watch/{token}) that anyone can play on a login-free page —
distinct from the registered-user ACL share. Per-link controls: optional expiry, allow-download
toggle (stream-only vs downloadable), optional argon2 password. Revoke = delete.
- migration 0042 + DownloadLink model; app/downloads/links.py (token, HMAC grant sign/verify)
- owner endpoints (POST/GET/PATCH/DELETE links) + /recipients for the internal user picker
- public router (no auth): watch meta / password unlock→signed grant / range-aware file serve
(inline vs attachment); unlock is rate-limited; meta verifies the file exists on disk
Verified end-to-end: 206 range, inline vs attachment, wrong-password 403, tampered-grant 403.
109 lines
5.1 KiB
Python
109 lines
5.1 KiB
Python
"""Public, login-free surface for shared download links (the `/watch/{token}` player page).
|
|
|
|
These routes are deliberately OUTSIDE the auth/`require_human` gate — the unguessable token IS the
|
|
credential (a capability URL). They only ever expose one file's stream + minimal metadata, never
|
|
the app or any account data. Password-protected links exchange the password once at `/unlock` for
|
|
a short-lived signed grant that the media URL carries (a `<video src>` can't send a header).
|
|
"""
|
|
from pathlib import Path
|
|
|
|
from fastapi import APIRouter, Depends, HTTPException
|
|
from fastapi.responses import FileResponse
|
|
from sqlalchemy import select
|
|
from sqlalchemy.orm import Session
|
|
|
|
from app.config import settings
|
|
from app.db import get_db
|
|
from app.downloads import links as linksmod
|
|
from app.downloads import storage
|
|
from app.models import DownloadJob, DownloadLink, MediaAsset
|
|
from app.ratelimit import RateLimiter
|
|
from app.security import verify_password
|
|
|
|
router = APIRouter(prefix="/api/public", tags=["public"])
|
|
|
|
# Slow password guessing per link (the token itself is 192-bit, so it needs no throttle).
|
|
_unlock_limit = RateLimiter(max_events=10, window_seconds=300)
|
|
|
|
|
|
def _link_or_404(db: Session, token: str) -> DownloadLink:
|
|
link = db.execute(
|
|
select(DownloadLink).where(DownloadLink.token == token)
|
|
).scalar_one_or_none()
|
|
if link is None or linksmod.is_expired(link):
|
|
raise HTTPException(status_code=404, detail="This link is no longer available.")
|
|
return link
|
|
|
|
|
|
def _ready_asset(db: Session, link: DownloadLink) -> MediaAsset:
|
|
job = db.get(DownloadJob, link.job_id)
|
|
asset = db.get(MediaAsset, job.asset_id) if job and job.asset_id else None
|
|
if asset is None or asset.status != "ready" or not asset.rel_path:
|
|
raise HTTPException(status_code=404, detail="This video is no longer available.")
|
|
# Verify the file is actually on disk here (not just flagged ready), so the watch page never
|
|
# loads a player for a missing file — meta and file agree.
|
|
path = storage.abs_path(settings.download_root, asset.rel_path).resolve()
|
|
root = Path(settings.download_root).resolve()
|
|
if root not in path.parents or not path.exists():
|
|
raise HTTPException(status_code=404, detail="This video is no longer available.")
|
|
return asset
|
|
|
|
|
|
def _file_url(token: str, grant: str | None = None) -> str:
|
|
base = f"/api/public/watch/{token}/file"
|
|
return f"{base}?g={grant}" if grant else base
|
|
|
|
|
|
@router.get("/watch/{token}")
|
|
def watch_meta(token: str, db: Session = Depends(get_db)) -> dict:
|
|
"""Public metadata for the watch page. For a password link, returns only `needs_password`
|
|
until the viewer unlocks it (no title/thumbnail leak)."""
|
|
link = _link_or_404(db, token)
|
|
if link.password_hash:
|
|
return {"needs_password": True}
|
|
asset = _ready_asset(db, link)
|
|
link.view_count += 1
|
|
db.commit()
|
|
return {"needs_password": False, **linksmod.public_meta(link, asset, _file_url(token))}
|
|
|
|
|
|
@router.post("/watch/{token}/unlock")
|
|
def watch_unlock(token: str, payload: dict, db: Session = Depends(get_db)) -> dict:
|
|
"""Exchange the link password for a signed grant carried by the media URL."""
|
|
if not _unlock_limit.allow(token):
|
|
raise HTTPException(status_code=429, detail="Too many attempts. Try again later.")
|
|
link = _link_or_404(db, token)
|
|
if not link.password_hash:
|
|
# Not a password link — nothing to unlock; just hand back the plain meta.
|
|
asset = _ready_asset(db, link)
|
|
return {"needs_password": False, **linksmod.public_meta(link, asset, _file_url(token))}
|
|
if not verify_password((payload.get("password") or ""), link.password_hash):
|
|
raise HTTPException(status_code=403, detail="Wrong password.")
|
|
asset = _ready_asset(db, link)
|
|
link.view_count += 1
|
|
db.commit()
|
|
grant = linksmod.make_grant(token)
|
|
return {"needs_password": False, **linksmod.public_meta(link, asset, _file_url(token, grant))}
|
|
|
|
|
|
@router.get("/watch/{token}/file")
|
|
def watch_file(token: str, g: str | None = None, db: Session = Depends(get_db)):
|
|
"""Range-aware stream of the shared file. Inline by default (plays in the page); an
|
|
`allow_download` link serves it as an attachment. Password links require a valid grant."""
|
|
link = _link_or_404(db, token)
|
|
if link.password_hash and not linksmod.check_grant(token, g):
|
|
raise HTTPException(status_code=403, detail="This link needs a password.")
|
|
asset = _ready_asset(db, link)
|
|
path = storage.abs_path(settings.download_root, asset.rel_path).resolve()
|
|
root = Path(settings.download_root).resolve()
|
|
if root not in path.parents or not path.exists():
|
|
raise HTTPException(status_code=404, detail="This video is no longer available.")
|
|
|
|
ext = asset.container or path.suffix.lstrip(".")
|
|
base = storage.display_filename(asset.title or "video")
|
|
if base.lower().endswith(f".{ext.lower()}"):
|
|
base = base[: -(len(ext) + 1)]
|
|
filename = f"{base}.{ext}"
|
|
disposition = "attachment" if link.allow_download else "inline"
|
|
# Starlette's FileResponse honours the Range header (206) for seeking/scrubbing.
|
|
return FileResponse(path, filename=filename, content_disposition_type=disposition)
|