public/jellyfin-plugin-sharelinks
1
0
Bifurcation 0
Code Tickets Demandes d'ajout Actions Paquets Projets Publications 1 Wiki Activité

stop storing guest passwords, mint sessions server side

Parcourir la source 
The old flow encrypted the guest password on disk next to its own key,
then sent it to the guest in the bootstrap HTML anyway. Now redemption
mints the session with ISessionManager.AuthenticateDirect and the page
only ever carries the session token. The guest account still gets a
random password nobody knows, so blank login stays impossible, but no
password is stored or sent anywhere anymore. Cleanup now defaults to
every 30 minutes instead of daily at 4am so expired guests die fast.
Cette révision appartient à :
Franciskid
2026-07-08 00:50:20 +02:00
Parent 2f3c4a8213
révision f2b523be97
5 fichiers modifiés avec 41 ajouts et 122 suppressions
Télécharger le Fichier Patch Télécharger le Fichier des Différences Développer tous les fichiers Réduire tous les fichiers
Jellyfin.Plugin.ShareLinks/Models/ShareLinkRecord.cs
-3
Voir le fichier
@@ -56,9 +56,6 @@ public sealed class ShareLinkRecord
/// <summary>Gets or sets a value indicating whether the link may be used once only.</summary>
public bool OneUse { get; set; } = true;
/// <summary>Gets or sets the encrypted guest password, if one has been generated.</summary>
public string? GuestPasswordEncrypted { get; set; }
/// <summary>Gets or sets a value indicating whether metadata was touched during cleanup.</summary>
public bool MetadataTouched { get; set; }
Jellyfin.Plugin.ShareLinks/Services/ShareLinkRedemptionService.cs
+29 -60
Voir le fichier
@@ -4,8 +4,10 @@ using System.Threading;
using System.Threading.Tasks;
using Jellyfin.Plugin.ShareLinks.Models;
using Jellyfin.Plugin.ShareLinks.Storage;
using MediaBrowser.Controller.Authentication;
using MediaBrowser.Controller.Entities;
using MediaBrowser.Controller.Library;
using MediaBrowser.Controller.Session;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.Logging;
@@ -20,6 +22,7 @@ public sealed class ShareLinkRedemptionService
private readonly ItemTagService _itemTagService;
private readonly JellyfinGuestUserService _guestUserService;
private readonly ShareLinkCleanupService _cleanupService;
private readonly ISessionManager _sessionManager;
private readonly ILogger<ShareLinkRedemptionService> _logger;
/// <summary>Initializes a new instance of the <see cref="ShareLinkRedemptionService"/> class.</summary>
@@ -30,6 +33,7 @@ public sealed class ShareLinkRedemptionService
ItemTagService itemTagService,
JellyfinGuestUserService guestUserService,
ShareLinkCleanupService cleanupService,
ISessionManager sessionManager,
ILogger<ShareLinkRedemptionService> logger)
{
_libraryManager = libraryManager;
@@ -38,6 +42,7 @@ public sealed class ShareLinkRedemptionService
_itemTagService = itemTagService;
_guestUserService = guestUserService;
_cleanupService = cleanupService;
_sessionManager = sessionManager;
_logger = logger;
}
@@ -101,17 +106,33 @@ public sealed class ShareLinkRedemptionService
record.CleanupError = null;
await _store.UpdateAsync(record, cancellationToken).ConfigureAwait(false);
var password = await GetOrCreatePasswordAsync(record, cancellationToken).ConfigureAwait(false);
// The account still needs a password so it can never be authenticated with a blank
// login; it is generated fresh on every redemption and is never stored or sent
// anywhere. The browser only ever receives a server-minted session token.
var password = JellyfinGuestUserService.GeneratePassword();
if (string.IsNullOrWhiteSpace(record.GuestUserName))
{
record.GuestUserName = JellyfinGuestUserService.BuildGuestUsername(record);
}
AuthenticationResult authResult;
try
{
var user = await _guestUserService.EnsureGuestUserAsync(record, password, cancellationToken).ConfigureAwait(false);
record.GuestUserId = user.Id;
record.GuestUserName = user.Username;
authResult = await _sessionManager.AuthenticateDirect(new AuthenticationRequest
{
Username = record.GuestUserName,
UserId = record.GuestUserId.Value,
App = "ShareLinks",
AppVersion = "1.0.0",
DeviceId = record.DeviceId,
DeviceName = "ShareLinks",
RemoteEndPoint = request.HttpContext.Connection.RemoteIpAddress?.ToString()
}).ConfigureAwait(false);
record.RedeemedAtUtc ??= now;
record.Status = ShareLinkStatus.Redeemed;
record.CleanupError = null;
@@ -127,29 +148,7 @@ public sealed class ShareLinkRedemptionService
return null;
}
return BuildBootstrapHtml(request, record, password, itemId);
}
private async Task<string> GetOrCreatePasswordAsync(ShareLinkRecord record, CancellationToken cancellationToken)
{
if (!string.IsNullOrWhiteSpace(record.GuestPasswordEncrypted))
{
try
{
return await _tokenService.UnprotectStringAsync(record.GuestPasswordEncrypted, cancellationToken).ConfigureAwait(false);
}
catch (Exception ex)
{
_logger.LogWarning(ex, "ShareLinks: stored guest password could not be decrypted for record {RecordId}; generating a replacement.", record.Id);
}
}
var password = JellyfinGuestUserService.GeneratePassword();
record.GuestPasswordEncrypted = await _tokenService.ProtectStringAsync(password, cancellationToken).ConfigureAwait(false);
record.Status = ShareLinkStatus.Redeeming;
record.CleanupError = null;
await _store.UpdateAsync(record, cancellationToken).ConfigureAwait(false);
return password;
return BuildBootstrapHtml(request, authResult, itemId);
}
private async Task HandleTerminalRecordAsync(ShareLinkRecord record, ShareLinkStatus terminalStatus, string reason, CancellationToken cancellationToken)
@@ -180,24 +179,14 @@ public sealed class ShareLinkRedemptionService
}
}
private static string BuildBootstrapHtml(HttpRequest request, ShareLinkRecord record, string password, Guid itemId)
private static string BuildBootstrapHtml(HttpRequest request, AuthenticationResult authResult, Guid itemId)
{
var pathBase = request.PathBase.Value ?? string.Empty;
var authUrl = $"{pathBase}/Users/AuthenticateByName";
var redirectUrl = $"{pathBase}/web/index.html#/details?id={Uri.EscapeDataString(itemId.ToString("D"))}";
var username = record.GuestUserName ?? JellyfinGuestUserService.BuildGuestUsername(record);
var deviceId = record.DeviceId ?? string.Empty;
var authJson = JsonSerializer.Serialize(new
{
Username = username,
Pw = password
});
var authUrlJson = JsonSerializer.Serialize(authUrl);
var accessTokenJson = JsonSerializer.Serialize(authResult.AccessToken);
var userIdJson = JsonSerializer.Serialize(authResult.User.Id.ToString("N"));
var redirectUrlJson = JsonSerializer.Serialize(redirectUrl);
var usernameJson = JsonSerializer.Serialize(username);
var deviceIdJson = JsonSerializer.Serialize(deviceId);
var infoUrlJson = JsonSerializer.Serialize($"{pathBase}/System/Info/Public");
var pathBaseJson = JsonSerializer.Serialize(pathBase);
@@ -221,31 +210,11 @@ public sealed class ShareLinkRedemptionService
</main>
<script>
(async () => {
const authUrl = {{authUrlJson}};
const redirectUrl = {{redirectUrlJson}};
const username = {{usernameJson}};
const deviceId = {{deviceIdJson}} || crypto.randomUUID().replace(/-/g, "");
const accessToken = {{accessTokenJson}};
const userId = {{userIdJson}};
document.getElementById("status").textContent = "Authenticating " + username + ".";
const response = await fetch(authUrl, {
method: "POST",
credentials: "same-origin",
headers: {
"Content-Type": "application/json",
"Accept": "application/json",
"X-Emby-Authorization": `MediaBrowser Client="ShareLinks", Device="ShareLinks", DeviceId="${deviceId}", Version="1.0.0"`
},
body: JSON.stringify({{authJson}})
});
if (!response.ok) {
throw new Error(`Authentication failed (${response.status})`);
}
const auth = await response.json();
const accessToken = auth.AccessToken ?? auth.accessToken ?? "";
const userId = auth.User?.Id ?? auth.user?.Id ?? auth.UserId ?? auth.userId ?? "";
document.getElementById("status").textContent = "Opening your title.";
const info = await fetch({{infoUrlJson}}, {
credentials: "same-origin",
Jellyfin.Plugin.ShareLinks/Services/ShareTokenService.cs
-55
Voir le fichier
@@ -88,61 +88,6 @@ public sealed class ShareTokenService
Encoding.UTF8.GetBytes(expectedHash));
}
/// <summary>Encrypts sensitive text using the shared plugin secret.</summary>
public async Task<string> ProtectStringAsync(string value, CancellationToken cancellationToken = default)
{
if (value is null)
{
throw new ArgumentNullException(nameof(value));
}
var secret = await GetSecretAsync(cancellationToken).ConfigureAwait(false);
var plaintext = Encoding.UTF8.GetBytes(value);
var nonce = new byte[12];
RandomNumberGenerator.Fill(nonce);
var cipher = new byte[plaintext.Length];
var tag = new byte[16];
using (var aes = new AesGcm(secret, 16))
{
aes.Encrypt(nonce, plaintext, cipher, tag);
}
var payload = new byte[nonce.Length + cipher.Length + tag.Length];
Buffer.BlockCopy(nonce, 0, payload, 0, nonce.Length);
Buffer.BlockCopy(cipher, 0, payload, nonce.Length, cipher.Length);
Buffer.BlockCopy(tag, 0, payload, nonce.Length + cipher.Length, tag.Length);
return Base64UrlEncode(payload);
}
/// <summary>Decrypts a sensitive string protected by <see cref="ProtectStringAsync"/>.</summary>
public async Task<string> UnprotectStringAsync(string protectedValue, CancellationToken cancellationToken = default)
{
if (string.IsNullOrWhiteSpace(protectedValue))
{
throw new ArgumentException("Protected value cannot be empty.", nameof(protectedValue));
}
var payload = Base64UrlDecode(protectedValue);
if (payload.Length < 12 + 16)
{
throw new CryptographicException("Protected payload is invalid.");
}
var secret = await GetSecretAsync(cancellationToken).ConfigureAwait(false);
var nonce = payload[..12];
var tag = payload[^16..];
var cipher = payload[12..^16];
var plaintext = new byte[cipher.Length];
using (var aes = new AesGcm(secret, 16))
{
aes.Decrypt(nonce, cipher, tag, plaintext);
}
return Encoding.UTF8.GetString(plaintext);
}
private async Task<byte[]> GetSecretAsync(CancellationToken cancellationToken)
{
if (_secretKey is not null)
Jellyfin.Plugin.ShareLinks/Tasks/CleanupShareLinksScheduledTask.cs
+5 -4
Voir le fichier
@@ -8,7 +8,8 @@ using MediaBrowser.Model.Tasks;
namespace Jellyfin.Plugin.ShareLinks.Tasks;
/// <summary>
/// Scheduled cleanup shell for later link-expiry and guest-account teardown work.
/// Scheduled task that expires share links past their <c>ExpiresAtUtc</c> and tears down
/// the associated guest users and tags.
/// </summary>
public sealed class CleanupShareLinksScheduledTask : IScheduledTask, IConfigurableScheduledTask
{
@@ -27,7 +28,7 @@ public sealed class CleanupShareLinksScheduledTask : IScheduledTask, IConfigurab
public string Key => "ShareLinksCleanup";
/// <inheritdoc />
public string Description => "Removes expired share links and performs future guest-account cleanup.";
public string Description => "Expires share links past their expiry time and removes their guest users and tags.";
/// <inheritdoc />
public string Category => "ShareLinks";
@@ -53,8 +54,8 @@ public sealed class CleanupShareLinksScheduledTask : IScheduledTask, IConfigurab
{
yield return new TaskTriggerInfo
{
Type = TaskTriggerInfoType.DailyTrigger,
TimeOfDayTicks = TimeSpan.FromHours(4).Ticks,
Type = TaskTriggerInfoType.IntervalTrigger,
IntervalTicks = TimeSpan.FromMinutes(30).Ticks,
};
}
}