feat(api): default-deny mutating API writes

Refs #43

ErsatzTV/Controllers/Api/ChannelController.cs

@@ -8,7 +8,6 @@ using ErsatzTV.Core;
 using ErsatzTV.Core.Api.Channels;
 using ErsatzTV.Core.Scheduling;
 using ErsatzTV.Extensions;
-using ErsatzTV.Filters;
 using MediatR;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
@@ -16,11 +15,6 @@ using Microsoft.AspNetCore.Mvc;
 namespace ErsatzTV.Controllers.Api;
 
 [ApiController]
-// Apply the optional API-key control at the controller level so that EVERY mutating action
-// (including future ones) is covered by default; the filter no-ops on read methods (GET) and
-// when Api:WriteKey is unset, preserving the open LAN behavior. This is fail-safe: a developer
-// adding a new write endpoint here cannot accidentally leave it unauthenticated.
-[ServiceFilter(typeof(ApiKeyAuthorizationFilter))]
 public class ChannelController(ChannelWriter<IBackgroundServiceRequest> workerChannel, IMediator mediator)
 {
     [HttpGet("/api/channels")]

ErsatzTV/Controllers/Api/CollectionController.cs

@@ -3,7 +3,6 @@ using ErsatzTV.Application.MediaCollections;
 using ErsatzTV.Controllers.Api.Requests;
 using ErsatzTV.Core;
 using ErsatzTV.Extensions;
-using ErsatzTV.Filters;
 using MediatR;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
@@ -11,7 +10,6 @@ using Microsoft.AspNetCore.Mvc;
 namespace ErsatzTV.Controllers.Api;
 
 [ApiController]
-[ServiceFilter(typeof(ApiKeyAuthorizationFilter))]
 public class CollectionController(IMediator mediator) : ControllerBase
 {
     [HttpGet("/api/collections")]

ErsatzTV/Controllers/Api/FFmpegProfileController.cs

@@ -4,7 +4,6 @@ using ErsatzTV.Controllers.Api.Requests;
 using ErsatzTV.Core;
 using ErsatzTV.Core.Api.FFmpegProfiles;
 using ErsatzTV.Extensions;
-using ErsatzTV.Filters;
 using MediatR;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
@@ -12,7 +11,6 @@ using Microsoft.AspNetCore.Mvc;
 namespace ErsatzTV.Controllers.Api;
 
 [ApiController]
-[ServiceFilter(typeof(ApiKeyAuthorizationFilter))]
 public class FFmpegProfileController(IMediator mediator) : ControllerBase
 {
     [HttpGet("/api/ffmpeg/profiles", Name = "GetFFmpegProfiles")]

ErsatzTV/Controllers/Api/LibrariesController.cs

@@ -1,6 +1,5 @@
 using ErsatzTV.Application.Libraries;
 using ErsatzTV.Core.Interfaces.Repositories;
-using ErsatzTV.Filters;
 using MediatR;
 using Microsoft.AspNetCore.Mvc;
 
@@ -8,7 +7,6 @@ namespace ErsatzTV.Controllers.Api;
 
 [ApiController]
 [EndpointGroupName("general")]
-[ServiceFilter(typeof(ApiKeyAuthorizationFilter))]
 public class LibrariesController(ITelevisionRepository televisionRepository, IMediator mediator)
 {
     [HttpPost("/api/libraries/{id:int}/scan")]

ErsatzTV/Controllers/Api/MaintenanceController.cs

@@ -2,7 +2,6 @@ using System.Threading.Channels;
 using ErsatzTV.Application;
 using ErsatzTV.Application.Maintenance;
 using ErsatzTV.Core;
-using ErsatzTV.Filters;
 using MediatR;
 using Microsoft.AspNetCore.Mvc;
 
@@ -10,7 +9,6 @@ namespace ErsatzTV.Controllers.Api;
 
 [ApiController]
 [EndpointGroupName("general")]
-[ServiceFilter(typeof(ApiKeyAuthorizationFilter))]
 public class MaintenanceController(IMediator mediator, ChannelWriter<IBackgroundServiceRequest> workerChannel)
 {
     [HttpGet("/api/maintenance/gc")]

ErsatzTV/Controllers/Api/PlayoutController.cs

@@ -4,7 +4,6 @@ using ErsatzTV.Controllers.Api.Requests;
 using ErsatzTV.Core;
 using ErsatzTV.Core.Api.Playouts;
 using ErsatzTV.Extensions;
-using ErsatzTV.Filters;
 using MediatR;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
@@ -12,7 +11,6 @@ using Microsoft.AspNetCore.Mvc;
 namespace ErsatzTV.Controllers.Api;
 
 [ApiController]
-[ServiceFilter(typeof(ApiKeyAuthorizationFilter))]
 public class PlayoutController(IMediator mediator) : ControllerBase
 {
     [HttpGet("/api/playouts/{id:int}", Name = "GetPlayoutById")]

ErsatzTV/Controllers/Api/ScannerController.cs

@@ -2,12 +2,14 @@ using System.Threading.Channels;
 using ErsatzTV.Application;
 using ErsatzTV.Application.Search;
 using ErsatzTV.Core.Interfaces.Metadata;
+using ErsatzTV.Filters;
 using Microsoft.AspNetCore.Mvc;
 
 namespace ErsatzTV.Controllers.Api;
 
 [ApiController]
 [ApiExplorerSettings(IgnoreApi = true)]
+[SkipApiKeyAuthorization]
 [Route("api/scan/{scanId:guid}")]
 public class ScannerController(
     IScannerProxyService scannerProxyService,

ErsatzTV/Controllers/Api/ScheduleController.cs

@@ -3,7 +3,6 @@ using ErsatzTV.Application.ProgramSchedules;
 using ErsatzTV.Controllers.Api.Requests;
 using ErsatzTV.Core;
 using ErsatzTV.Extensions;
-using ErsatzTV.Filters;
 using MediatR;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
@@ -11,7 +10,6 @@ using Microsoft.AspNetCore.Mvc;
 namespace ErsatzTV.Controllers.Api;
 
 [ApiController]
-[ServiceFilter(typeof(ApiKeyAuthorizationFilter))]
 public class ScheduleController(IMediator mediator) : ControllerBase
 {
     [HttpGet("/api/schedules")]

ErsatzTV/Controllers/Api/SmartCollectionController.cs

@@ -4,7 +4,6 @@ using ErsatzTV.Controllers.Api.Requests;
 using ErsatzTV.Core;
 using ErsatzTV.Core.Api.SmartCollections;
 using ErsatzTV.Extensions;
-using ErsatzTV.Filters;
 using MediatR;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
@@ -12,7 +11,6 @@ using Microsoft.AspNetCore.Mvc;
 namespace ErsatzTV.Controllers.Api;
 
 [ApiController]
-[ServiceFilter(typeof(ApiKeyAuthorizationFilter))]
 public class SmartCollectionController(IMediator mediator) : ControllerBase
 {
     [HttpGet("/api/smart-collections")]