2019-11-01 18:38:54 +01:00
|
|
|
#pragma warning disable CS1591
|
|
|
|
|
2014-11-15 03:31:03 +01:00
|
|
|
using System;
|
|
|
|
using System.Collections.Generic;
|
2019-09-02 08:19:29 +02:00
|
|
|
using System.Net;
|
2021-05-21 05:56:59 +02:00
|
|
|
using System.Threading.Tasks;
|
2022-05-21 04:49:25 +02:00
|
|
|
using MediaBrowser.Controller;
|
2018-09-12 19:26:21 +02:00
|
|
|
using MediaBrowser.Controller.Library;
|
2019-01-13 20:20:41 +01:00
|
|
|
using MediaBrowser.Controller.Net;
|
2020-06-15 21:21:18 +02:00
|
|
|
using Microsoft.AspNetCore.Http;
|
2021-10-04 15:43:40 +02:00
|
|
|
using Microsoft.EntityFrameworkCore;
|
2019-03-05 19:20:28 +01:00
|
|
|
using Microsoft.Net.Http.Headers;
|
2014-07-02 06:57:18 +02:00
|
|
|
|
2021-05-21 05:56:59 +02:00
|
|
|
namespace Jellyfin.Server.Implementations.Security
|
2014-07-02 06:57:18 +02:00
|
|
|
{
|
|
|
|
public class AuthorizationContext : IAuthorizationContext
|
|
|
|
{
|
2023-01-16 18:14:44 +01:00
|
|
|
private readonly IDbContextFactory<JellyfinDbContext> _jellyfinDbProvider;
|
2018-09-12 19:26:21 +02:00
|
|
|
private readonly IUserManager _userManager;
|
2022-05-21 04:49:25 +02:00
|
|
|
private readonly IServerApplicationHost _serverApplicationHost;
|
2014-11-15 03:31:03 +01:00
|
|
|
|
2022-05-21 04:49:25 +02:00
|
|
|
public AuthorizationContext(
|
2023-01-16 18:14:44 +01:00
|
|
|
IDbContextFactory<JellyfinDbContext> jellyfinDb,
|
2022-05-21 04:49:25 +02:00
|
|
|
IUserManager userManager,
|
|
|
|
IServerApplicationHost serverApplicationHost)
|
2014-11-15 03:31:03 +01:00
|
|
|
{
|
2021-06-18 23:06:38 +02:00
|
|
|
_jellyfinDbProvider = jellyfinDb;
|
2018-09-12 19:26:21 +02:00
|
|
|
_userManager = userManager;
|
2022-05-21 04:49:25 +02:00
|
|
|
_serverApplicationHost = serverApplicationHost;
|
2014-11-15 03:31:03 +01:00
|
|
|
}
|
|
|
|
|
2021-05-21 05:56:59 +02:00
|
|
|
public Task<AuthorizationInfo> GetAuthorizationInfo(HttpContext requestContext)
|
2014-11-15 03:31:03 +01:00
|
|
|
{
|
2022-12-05 15:01:13 +01:00
|
|
|
if (requestContext.Request.HttpContext.Items.TryGetValue("AuthorizationInfo", out var cached) && cached is not null)
|
2014-11-15 03:31:03 +01:00
|
|
|
{
|
2021-10-03 05:43:05 +02:00
|
|
|
return Task.FromResult((AuthorizationInfo)cached); // Cache should never contain null
|
2014-11-15 03:31:03 +01:00
|
|
|
}
|
|
|
|
|
2014-07-02 06:57:18 +02:00
|
|
|
return GetAuthorization(requestContext);
|
|
|
|
}
|
|
|
|
|
2021-05-21 05:56:59 +02:00
|
|
|
public async Task<AuthorizationInfo> GetAuthorizationInfo(HttpRequest requestContext)
|
2020-06-15 21:21:18 +02:00
|
|
|
{
|
|
|
|
var auth = GetAuthorizationDictionary(requestContext);
|
2021-05-21 05:56:59 +02:00
|
|
|
var authInfo = await GetAuthorizationInfoFromDictionary(auth, requestContext.Headers, requestContext.Query).ConfigureAwait(false);
|
2020-06-15 21:21:18 +02:00
|
|
|
return authInfo;
|
|
|
|
}
|
|
|
|
|
2014-07-02 06:57:18 +02:00
|
|
|
/// <summary>
|
|
|
|
/// Gets the authorization.
|
|
|
|
/// </summary>
|
2023-10-04 16:18:14 +02:00
|
|
|
/// <param name="httpContext">The HTTP req.</param>
|
2014-07-02 06:57:18 +02:00
|
|
|
/// <returns>Dictionary{System.StringSystem.String}.</returns>
|
2023-10-04 16:18:14 +02:00
|
|
|
private async Task<AuthorizationInfo> GetAuthorization(HttpContext httpContext)
|
2014-07-02 06:57:18 +02:00
|
|
|
{
|
2023-10-04 16:18:14 +02:00
|
|
|
var authInfo = await GetAuthorizationInfo(httpContext.Request).ConfigureAwait(false);
|
2014-07-02 06:57:18 +02:00
|
|
|
|
2023-10-04 16:18:14 +02:00
|
|
|
httpContext.Request.HttpContext.Items["AuthorizationInfo"] = authInfo;
|
2020-06-15 21:21:18 +02:00
|
|
|
return authInfo;
|
|
|
|
}
|
|
|
|
|
2021-05-21 05:56:59 +02:00
|
|
|
private async Task<AuthorizationInfo> GetAuthorizationInfoFromDictionary(
|
|
|
|
IReadOnlyDictionary<string, string>? auth,
|
|
|
|
IHeaderDictionary headers,
|
|
|
|
IQueryCollection queryString)
|
2020-06-15 21:21:18 +02:00
|
|
|
{
|
2021-05-20 21:28:18 +02:00
|
|
|
string? deviceId = null;
|
2021-05-21 05:56:59 +02:00
|
|
|
string? deviceName = null;
|
2021-05-20 21:28:18 +02:00
|
|
|
string? client = null;
|
|
|
|
string? version = null;
|
|
|
|
string? token = null;
|
2014-07-02 06:57:18 +02:00
|
|
|
|
2022-12-05 15:01:13 +01:00
|
|
|
if (auth is not null)
|
2014-07-02 06:57:18 +02:00
|
|
|
{
|
|
|
|
auth.TryGetValue("DeviceId", out deviceId);
|
2021-05-21 05:56:59 +02:00
|
|
|
auth.TryGetValue("Device", out deviceName);
|
2014-07-02 06:57:18 +02:00
|
|
|
auth.TryGetValue("Client", out client);
|
|
|
|
auth.TryGetValue("Version", out version);
|
2017-01-13 22:05:12 +01:00
|
|
|
auth.TryGetValue("Token", out token);
|
2014-07-02 06:57:18 +02:00
|
|
|
}
|
|
|
|
|
2020-06-15 21:21:18 +02:00
|
|
|
if (string.IsNullOrEmpty(token))
|
|
|
|
{
|
|
|
|
token = headers["X-Emby-Token"];
|
2017-01-13 22:05:12 +01:00
|
|
|
}
|
2014-07-04 04:22:57 +02:00
|
|
|
|
2018-09-12 19:26:21 +02:00
|
|
|
if (string.IsNullOrEmpty(token))
|
2015-10-05 00:04:56 +02:00
|
|
|
{
|
2020-06-15 21:21:18 +02:00
|
|
|
token = headers["X-MediaBrowser-Token"];
|
2015-10-05 00:04:56 +02:00
|
|
|
}
|
2020-06-15 21:21:18 +02:00
|
|
|
|
2018-09-12 19:26:21 +02:00
|
|
|
if (string.IsNullOrEmpty(token))
|
2014-07-04 04:22:57 +02:00
|
|
|
{
|
2020-06-15 21:21:18 +02:00
|
|
|
token = queryString["ApiKey"];
|
2014-07-04 04:22:57 +02:00
|
|
|
}
|
|
|
|
|
2020-06-17 00:45:17 +02:00
|
|
|
// TODO deprecate this query parameter.
|
2020-06-15 21:21:18 +02:00
|
|
|
if (string.IsNullOrEmpty(token))
|
|
|
|
{
|
|
|
|
token = queryString["api_key"];
|
|
|
|
}
|
|
|
|
|
|
|
|
var authInfo = new AuthorizationInfo
|
2014-07-02 06:57:18 +02:00
|
|
|
{
|
|
|
|
Client = client,
|
2021-05-21 05:56:59 +02:00
|
|
|
Device = deviceName,
|
2014-07-02 06:57:18 +02:00
|
|
|
DeviceId = deviceId,
|
2014-07-02 20:34:08 +02:00
|
|
|
Version = version,
|
2020-11-08 16:10:33 +01:00
|
|
|
Token = token,
|
2020-12-01 22:47:42 +01:00
|
|
|
IsAuthenticated = false,
|
|
|
|
HasToken = false
|
2014-07-02 06:57:18 +02:00
|
|
|
};
|
2014-11-15 03:31:03 +01:00
|
|
|
|
2020-10-15 01:58:33 +02:00
|
|
|
if (string.IsNullOrWhiteSpace(token))
|
2014-11-15 03:31:03 +01:00
|
|
|
{
|
2020-10-15 01:58:33 +02:00
|
|
|
// Request doesn't contain a token.
|
2020-11-08 16:10:33 +01:00
|
|
|
return authInfo;
|
2020-10-15 01:58:33 +02:00
|
|
|
}
|
2014-11-15 03:31:03 +01:00
|
|
|
|
2020-12-01 22:47:42 +01:00
|
|
|
authInfo.HasToken = true;
|
2022-10-21 11:55:32 +02:00
|
|
|
var dbContext = await _jellyfinDbProvider.CreateDbContextAsync().ConfigureAwait(false);
|
|
|
|
await using (dbContext.ConfigureAwait(false))
|
2020-11-08 16:10:33 +01:00
|
|
|
{
|
2022-10-21 11:55:32 +02:00
|
|
|
var device = await dbContext.Devices.FirstOrDefaultAsync(d => d.AccessToken == token).ConfigureAwait(false);
|
2017-10-17 21:50:10 +02:00
|
|
|
|
2022-12-05 15:01:13 +01:00
|
|
|
if (device is not null)
|
2020-10-15 01:58:33 +02:00
|
|
|
{
|
2022-10-21 11:55:32 +02:00
|
|
|
authInfo.IsAuthenticated = true;
|
|
|
|
var updateToken = false;
|
2017-10-17 21:50:10 +02:00
|
|
|
|
2022-10-21 11:55:32 +02:00
|
|
|
// TODO: Remove these checks for IsNullOrWhiteSpace
|
|
|
|
if (string.IsNullOrWhiteSpace(authInfo.Client))
|
2017-10-17 21:50:10 +02:00
|
|
|
{
|
2022-10-21 11:55:32 +02:00
|
|
|
authInfo.Client = device.AppName;
|
2018-09-12 19:26:21 +02:00
|
|
|
}
|
|
|
|
|
2022-10-21 11:55:32 +02:00
|
|
|
if (string.IsNullOrWhiteSpace(authInfo.DeviceId))
|
2018-09-12 19:26:21 +02:00
|
|
|
{
|
2022-10-21 11:55:32 +02:00
|
|
|
authInfo.DeviceId = device.DeviceId;
|
2018-09-12 19:26:21 +02:00
|
|
|
}
|
|
|
|
|
2022-10-21 11:55:32 +02:00
|
|
|
// Temporary. TODO - allow clients to specify that the token has been shared with a casting device
|
|
|
|
var allowTokenInfoUpdate = !authInfo.Client.Contains("chromecast", StringComparison.OrdinalIgnoreCase);
|
2017-10-17 21:50:10 +02:00
|
|
|
|
2022-10-21 11:55:32 +02:00
|
|
|
if (string.IsNullOrWhiteSpace(authInfo.Device))
|
2021-11-11 06:43:43 +01:00
|
|
|
{
|
2022-10-21 11:55:32 +02:00
|
|
|
authInfo.Device = device.DeviceName;
|
2021-11-11 06:43:43 +01:00
|
|
|
}
|
2022-10-21 11:55:32 +02:00
|
|
|
else if (!string.Equals(authInfo.Device, device.DeviceName, StringComparison.OrdinalIgnoreCase))
|
2021-11-11 06:43:43 +01:00
|
|
|
{
|
2022-10-21 11:55:32 +02:00
|
|
|
if (allowTokenInfoUpdate)
|
|
|
|
{
|
|
|
|
updateToken = true;
|
|
|
|
device.DeviceName = authInfo.Device;
|
|
|
|
}
|
2021-11-11 06:43:43 +01:00
|
|
|
}
|
|
|
|
|
2021-11-12 22:23:58 +01:00
|
|
|
if (string.IsNullOrWhiteSpace(authInfo.Version))
|
2021-11-11 06:43:43 +01:00
|
|
|
{
|
2022-10-21 11:55:32 +02:00
|
|
|
authInfo.Version = device.AppVersion;
|
|
|
|
}
|
|
|
|
else if (!string.Equals(authInfo.Version, device.AppVersion, StringComparison.OrdinalIgnoreCase))
|
|
|
|
{
|
|
|
|
if (allowTokenInfoUpdate)
|
|
|
|
{
|
|
|
|
updateToken = true;
|
|
|
|
device.AppVersion = authInfo.Version;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if ((DateTime.UtcNow - device.DateLastActivity).TotalMinutes > 3)
|
|
|
|
{
|
|
|
|
device.DateLastActivity = DateTime.UtcNow;
|
|
|
|
updateToken = true;
|
2021-11-11 06:43:43 +01:00
|
|
|
}
|
2021-11-11 17:03:27 +01:00
|
|
|
|
2022-10-21 11:55:32 +02:00
|
|
|
authInfo.User = _userManager.GetUserById(device.UserId);
|
|
|
|
|
|
|
|
if (updateToken)
|
|
|
|
{
|
|
|
|
dbContext.Devices.Update(device);
|
|
|
|
await dbContext.SaveChangesAsync().ConfigureAwait(false);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
var key = await dbContext.ApiKeys.FirstOrDefaultAsync(apiKey => apiKey.AccessToken == token).ConfigureAwait(false);
|
2022-12-05 15:01:13 +01:00
|
|
|
if (key is not null)
|
2022-10-21 11:55:32 +02:00
|
|
|
{
|
|
|
|
authInfo.IsAuthenticated = true;
|
|
|
|
authInfo.Client = key.Name;
|
|
|
|
authInfo.Token = key.AccessToken;
|
|
|
|
if (string.IsNullOrWhiteSpace(authInfo.DeviceId))
|
|
|
|
{
|
|
|
|
authInfo.DeviceId = _serverApplicationHost.SystemId;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (string.IsNullOrWhiteSpace(authInfo.Device))
|
|
|
|
{
|
|
|
|
authInfo.Device = _serverApplicationHost.Name;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (string.IsNullOrWhiteSpace(authInfo.Version))
|
|
|
|
{
|
|
|
|
authInfo.Version = _serverApplicationHost.ApplicationVersionString;
|
|
|
|
}
|
|
|
|
|
|
|
|
authInfo.IsApiKey = true;
|
|
|
|
}
|
2014-11-15 03:31:03 +01:00
|
|
|
}
|
|
|
|
|
2022-10-21 11:55:32 +02:00
|
|
|
return authInfo;
|
|
|
|
}
|
2014-07-02 06:57:18 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
/// <summary>
|
|
|
|
/// Gets the auth.
|
|
|
|
/// </summary>
|
2023-10-04 16:18:14 +02:00
|
|
|
/// <param name="httpReq">The HTTP request.</param>
|
2020-06-15 21:21:18 +02:00
|
|
|
/// <returns>Dictionary{System.StringSystem.String}.</returns>
|
2021-05-21 06:19:54 +02:00
|
|
|
private static Dictionary<string, string>? GetAuthorizationDictionary(HttpRequest httpReq)
|
2020-06-15 21:21:18 +02:00
|
|
|
{
|
2020-06-17 14:52:15 +02:00
|
|
|
var auth = httpReq.Headers["X-Emby-Authorization"];
|
2015-07-03 13:51:45 +02:00
|
|
|
|
2018-09-12 19:26:21 +02:00
|
|
|
if (string.IsNullOrEmpty(auth))
|
2015-07-03 13:51:45 +02:00
|
|
|
{
|
2019-03-05 19:20:28 +01:00
|
|
|
auth = httpReq.Headers[HeaderNames.Authorization];
|
2015-07-03 13:51:45 +02:00
|
|
|
}
|
2014-07-02 06:57:18 +02:00
|
|
|
|
2021-05-21 06:09:11 +02:00
|
|
|
return auth.Count > 0 ? GetAuthorization(auth[0]) : null;
|
2014-07-02 06:57:18 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
/// <summary>
|
|
|
|
/// Gets the authorization.
|
|
|
|
/// </summary>
|
|
|
|
/// <param name="authorizationHeader">The authorization header.</param>
|
|
|
|
/// <returns>Dictionary{System.StringSystem.String}.</returns>
|
2021-05-21 06:19:54 +02:00
|
|
|
private static Dictionary<string, string>? GetAuthorization(ReadOnlySpan<char> authorizationHeader)
|
2014-07-02 06:57:18 +02:00
|
|
|
{
|
2021-05-16 14:49:11 +02:00
|
|
|
var firstSpace = authorizationHeader.IndexOf(' ');
|
2014-07-02 06:57:18 +02:00
|
|
|
|
2021-05-16 14:49:11 +02:00
|
|
|
// There should be at least two parts
|
|
|
|
if (firstSpace == -1)
|
2019-09-02 08:19:29 +02:00
|
|
|
{
|
|
|
|
return null;
|
|
|
|
}
|
2014-07-02 06:57:18 +02:00
|
|
|
|
2021-05-16 14:49:11 +02:00
|
|
|
var name = authorizationHeader[..firstSpace];
|
2017-01-13 22:05:12 +01:00
|
|
|
|
2021-05-16 14:49:11 +02:00
|
|
|
if (!name.Equals("MediaBrowser", StringComparison.OrdinalIgnoreCase)
|
2021-05-16 15:27:31 +02:00
|
|
|
&& !name.Equals("Emby", StringComparison.OrdinalIgnoreCase))
|
2014-07-02 06:57:18 +02:00
|
|
|
{
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
|
2021-02-26 15:30:00 +01:00
|
|
|
// Remove up until the first space
|
2021-06-03 17:37:42 +02:00
|
|
|
authorizationHeader = authorizationHeader[(firstSpace + 1)..];
|
2021-06-03 17:43:50 +02:00
|
|
|
return GetParts(authorizationHeader);
|
2020-12-14 14:05:53 +01:00
|
|
|
}
|
2020-12-15 21:01:42 +01:00
|
|
|
|
2020-12-15 21:06:47 +01:00
|
|
|
/// <summary>
|
|
|
|
/// Get the authorization header components.
|
|
|
|
/// </summary>
|
2021-06-03 17:07:25 +02:00
|
|
|
/// <param name="authorizationHeader">The authorization header.</param>
|
2021-06-03 17:45:22 +02:00
|
|
|
/// <returns>Dictionary{System.StringSystem.String}.</returns>
|
2021-06-03 17:43:50 +02:00
|
|
|
public static Dictionary<string, string> GetParts(ReadOnlySpan<char> authorizationHeader)
|
2020-12-15 21:01:42 +01:00
|
|
|
{
|
2021-02-26 15:30:00 +01:00
|
|
|
var result = new Dictionary<string, string>();
|
2020-12-15 21:01:42 +01:00
|
|
|
var escaped = false;
|
2021-01-02 18:18:47 +01:00
|
|
|
int start = 0;
|
2021-02-26 15:30:00 +01:00
|
|
|
string key = string.Empty;
|
|
|
|
|
2021-06-03 17:10:19 +02:00
|
|
|
int i;
|
2021-06-03 17:12:16 +02:00
|
|
|
for (i = 0; i < authorizationHeader.Length; i++)
|
2020-12-15 21:01:42 +01:00
|
|
|
{
|
2021-06-03 17:12:16 +02:00
|
|
|
var token = authorizationHeader[i];
|
2021-06-03 17:10:19 +02:00
|
|
|
if (token == '"' || token == ',')
|
2020-12-15 21:01:42 +01:00
|
|
|
{
|
2021-01-02 18:18:47 +01:00
|
|
|
// Applying a XOR logic to evaluate whether it is opening or closing a value
|
|
|
|
escaped = (!escaped) == (token == '"');
|
|
|
|
if (token == ',' && !escaped)
|
2020-12-15 21:01:42 +01:00
|
|
|
{
|
2021-01-02 18:18:47 +01:00
|
|
|
// Meeting a comma after a closing escape char means the value is complete
|
|
|
|
if (start < i)
|
2020-12-15 21:01:42 +01:00
|
|
|
{
|
2021-06-03 17:43:50 +02:00
|
|
|
result[key] = WebUtility.UrlDecode(authorizationHeader[start..i].Trim('"').ToString());
|
2021-02-26 15:30:00 +01:00
|
|
|
key = string.Empty;
|
2020-12-15 21:01:42 +01:00
|
|
|
}
|
2021-01-02 18:18:47 +01:00
|
|
|
|
|
|
|
start = i + 1;
|
2020-12-15 21:01:42 +01:00
|
|
|
}
|
|
|
|
}
|
2021-02-26 15:30:00 +01:00
|
|
|
else if (!escaped && token == '=')
|
|
|
|
{
|
2021-09-03 23:56:19 +02:00
|
|
|
key = authorizationHeader[start.. i].Trim().ToString();
|
2021-02-26 15:30:00 +01:00
|
|
|
start = i + 1;
|
|
|
|
}
|
2020-12-15 21:01:42 +01:00
|
|
|
}
|
2021-01-02 18:18:47 +01:00
|
|
|
|
2020-12-15 21:01:42 +01:00
|
|
|
// Add last value
|
2021-01-02 18:18:47 +01:00
|
|
|
if (start < i)
|
|
|
|
{
|
2021-06-03 17:43:50 +02:00
|
|
|
result[key] = WebUtility.UrlDecode(authorizationHeader[start..i].Trim('"').ToString());
|
2021-01-02 18:18:47 +01:00
|
|
|
}
|
2020-12-15 21:01:42 +01:00
|
|
|
|
2021-02-26 15:30:00 +01:00
|
|
|
return result;
|
2020-12-15 21:01:42 +01:00
|
|
|
}
|
2014-07-02 06:57:18 +02:00
|
|
|
}
|
|
|
|
}
|