t1c.dev
forked from
rocksky.app/rocksky
A decentralized music tracking and discovery platform built on AT Protocol 🎵
Merge pull request #13 from tsirysndr/fix/listenbrainz-auth
fix(listenbrainz/auth): improve bearer token validation for secure API access
authored by
GitHub
748a874a
ff5772a6
+31
-1
+24
crates/scrobbler/src/auth.rs
+24
crates/scrobbler/src/auth.rs
···
10
10
11
11
use crate::cache::Cache;
12
12
use crate::repo;
13
+
use crate::rocksky::ROCKSKY_API;
13
14
use crate::signature::generate_signature;
14
15
use crate::xata::user::User;
15
16
···
149
150
let user: User = serde_json::from_str(&user)
150
151
.map_err(|e| Error::msg(format!("Failed to deserialize user: {}", e)))?;
151
152
Ok(user.xata_id)
153
+
}
154
+
155
+
pub async fn validate_bearer_token(pool: &Pool<Postgres>, token: &str) -> Result<(), Error> {
156
+
let user = repo::user::get_user_by_apikey(pool, token).await?;
157
+
if user.is_none() {
158
+
return Err(Error::msg("Invalid token"));
159
+
}
160
+
161
+
let user = user.unwrap();
162
+
let jwt = generate_token(&user.did)?;
163
+
let client = reqwest::Client::new();
164
+
165
+
client
166
+
.get(&format!(
167
+
"{}/xrpc/app.rocksky.actor.getProfile",
168
+
ROCKSKY_API
169
+
))
170
+
.bearer_auth(jwt)
171
+
.send()
172
+
.await?
173
+
.error_for_status()?;
174
+
175
+
Ok(())
152
176
}
153
177
154
178
#[cfg(test)]
+6
crates/scrobbler/src/listenbrainz/handlers.rs
+6
crates/scrobbler/src/listenbrainz/handlers.rs
···
4
4
use sqlx::{Pool, Postgres};
5
5
6
6
use crate::{
7
+
auth::validate_bearer_token,
7
8
cache::Cache,
8
9
listenbrainz::{
9
10
core::{
···
55
56
if token.is_empty() {
56
57
return Ok(HttpResponse::Unauthorized().finish());
57
58
}
59
+
60
+
let pool = data.get_ref();
61
+
validate_bearer_token(pool, token)
62
+
.await
63
+
.map_err(|e| actix_web::error::ErrorUnauthorized(format!("Invalid token: {}", e)))?;
58
64
59
65
let payload = read_payload!(payload);
60
66
let body = String::from_utf8_lossy(&payload);
+1
-1
crates/scrobbler/src/rocksky.rs
+1
-1
crates/scrobbler/src/rocksky.rs
···
3
3
4
4
use crate::{auth::generate_token, cache::Cache, types::Track};
5
5
6
-
const ROCKSKY_API: &str = "https://api.rocksky.app";
6
+
pub const ROCKSKY_API: &str = "https://api.rocksky.app";
7
7
8
8
pub async fn scrobble(cache: &Cache, did: &str, track: Track, timestamp: u64) -> Result<(), Error> {
9
9
let key = format!(