Backend of #197 Bundle A (auth posture). Owner decisions: single API key; Api:RequireKeyForReads defaults true (whole /api surface gated; /iptv streaming + guide unaffected — outside the filter's /api scope). - #280 S1: writes are fail-closed. New IApiKeyProvider resolves the key once (Api:WriteKey config, else persisted /config/api.key, else a generated 256-bit key written 0600). The empty-key open branch is gone; there is no open mode. - #282 S3/S5: reads under /api require the key when Api:RequireKeyForReads (default true) or the endpoint carries the new [RequiresApiKey]. Applied [RequiresApiKey] to Troubleshoot/Logs/Settings/Maintenance so the sensitive tier stays gated even if reads are opened. OPTIONS preflight is exempt. - #281 S2: delete SortController (dead Blazor SortableJS residue; SPA uses PUT /api/collections/{id}/custom-order) and AccountController (dead OIDC logout) — both non-/api persistent surfaces that bypassed the key. - #284 S6: replace CORS AllowAll with an opt-in exact-origin allowlist (Api:CorsAllowedOrigins; permits X-Api-Key/If-Match, exposes ETag). Default is no cross-origin (SPA is same-origin). - #285 S7/S10: gc GET->POST (spec regenerated); ForwardedHeaders trust configurable via ForwardedHeaders:KnownProxies/KnownNetworks (warns when unrestricted); ScannerController gains [LocalhostOnly] (scanner always calls back over localhost). Filter unit tests rewritten for fail-closed + read-gating + tier + OPTIONS; ApiControllerSecurityTests assert the sensitive tier + scanner-loopback reflectively. search/all-items paging deferred (SPA add-all coupling) — exposure closed by read-gating. Refs #197 #280 #281 #282 #284 #285 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
308 lines
14 KiB
C#
308 lines
14 KiB
C#
using System.ComponentModel.DataAnnotations;
|
|
using ErsatzTV.Application.Configuration;
|
|
using ErsatzTV.Application.FFmpegProfiles;
|
|
using ErsatzTV.Application.HDHR;
|
|
using ErsatzTV.Controllers.Api.Requests;
|
|
using ErsatzTV.Core;
|
|
using ErsatzTV.Core.Api.Settings;
|
|
using ErsatzTV.Extensions;
|
|
using ErsatzTV.Filters;
|
|
using MediatR;
|
|
using Microsoft.AspNetCore.Http;
|
|
using Microsoft.AspNetCore.Mvc;
|
|
using ApiXmltvBlockBehavior = ErsatzTV.Core.Api.Settings.XmltvBlockBehavior;
|
|
using ApiXmltvTimeZone = ErsatzTV.Core.Api.Settings.XmltvTimeZone;
|
|
using VmXmltvBlockBehavior = ErsatzTV.Application.Configuration.XmltvBlockBehavior;
|
|
using VmXmltvTimeZone = ErsatzTV.Application.Configuration.XmltvTimeZone;
|
|
|
|
namespace ErsatzTV.Controllers.Api;
|
|
|
|
[ApiController]
|
|
[EndpointGroupName("general")]
|
|
[RequiresApiKey]
|
|
public class SettingsController(IMediator mediator) : ControllerBase
|
|
{
|
|
// FFmpeg settings
|
|
|
|
[HttpGet("/api/settings/ffmpeg", Name = "GetFfmpegSettings")]
|
|
[Tags("Settings")]
|
|
[EndpointSummary("Get global FFmpeg settings")]
|
|
[ProducesResponseType(typeof(FFmpegSettingsResponseModel), StatusCodes.Status200OK)]
|
|
public async Task<FFmpegSettingsResponseModel> GetFfmpeg(CancellationToken cancellationToken)
|
|
{
|
|
FFmpegSettingsViewModel settings = await mediator.Send(new GetFFmpegSettings(), cancellationToken);
|
|
return ProjectToResponseModel(settings);
|
|
}
|
|
|
|
[HttpPut("/api/settings/ffmpeg", Name = "UpdateFfmpegSettings")]
|
|
[Tags("Settings")]
|
|
[EndpointSummary("Update global FFmpeg settings")]
|
|
[ProducesResponseType(typeof(FFmpegSettingsResponseModel), StatusCodes.Status200OK)]
|
|
[ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status401Unauthorized)]
|
|
[ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status422UnprocessableEntity)]
|
|
public async Task<IActionResult> UpdateFfmpeg(
|
|
[Required] [FromBody]
|
|
UpdateFFmpegSettingsRequest request,
|
|
CancellationToken cancellationToken)
|
|
{
|
|
Either<BaseError, Unit> result = await mediator.Send(request.ToCommand(), cancellationToken);
|
|
return await result.Match(
|
|
Left: error => Task.FromResult(error.ToErrorResult()),
|
|
Right: async _ =>
|
|
{
|
|
FFmpegSettingsViewModel settings = await mediator.Send(new GetFFmpegSettings(), cancellationToken);
|
|
return (IActionResult)new OkObjectResult(ProjectToResponseModel(settings));
|
|
});
|
|
}
|
|
|
|
// Playout settings
|
|
|
|
[HttpGet("/api/settings/playout", Name = "GetPlayoutSettings")]
|
|
[Tags("Settings")]
|
|
[EndpointSummary("Get global playout settings")]
|
|
[ProducesResponseType(typeof(PlayoutSettingsResponseModel), StatusCodes.Status200OK)]
|
|
public async Task<PlayoutSettingsResponseModel> GetPlayout(CancellationToken cancellationToken)
|
|
{
|
|
PlayoutSettingsViewModel settings = await mediator.Send(new GetPlayoutSettings(), cancellationToken);
|
|
return ProjectToResponseModel(settings);
|
|
}
|
|
|
|
[HttpPut("/api/settings/playout", Name = "UpdatePlayoutSettings")]
|
|
[Tags("Settings")]
|
|
[EndpointSummary("Update global playout settings")]
|
|
[ProducesResponseType(typeof(PlayoutSettingsResponseModel), StatusCodes.Status200OK)]
|
|
[ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status401Unauthorized)]
|
|
[ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status422UnprocessableEntity)]
|
|
public async Task<IActionResult> UpdatePlayout(
|
|
[Required] [FromBody]
|
|
UpdatePlayoutSettingsRequest request,
|
|
CancellationToken cancellationToken)
|
|
{
|
|
Either<BaseError, Unit> result = await mediator.Send(request.ToCommand(), cancellationToken);
|
|
return await result.Match(
|
|
Left: error => Task.FromResult(error.ToErrorResult()),
|
|
Right: async _ =>
|
|
{
|
|
PlayoutSettingsViewModel settings = await mediator.Send(new GetPlayoutSettings(), cancellationToken);
|
|
return (IActionResult)new OkObjectResult(ProjectToResponseModel(settings));
|
|
});
|
|
}
|
|
|
|
// XMLTV settings
|
|
|
|
[HttpGet("/api/settings/xmltv", Name = "GetXmltvSettings")]
|
|
[Tags("Settings")]
|
|
[EndpointSummary("Get global XMLTV settings")]
|
|
[ProducesResponseType(typeof(XmltvSettingsResponseModel), StatusCodes.Status200OK)]
|
|
public async Task<XmltvSettingsResponseModel> GetXmltv(CancellationToken cancellationToken)
|
|
{
|
|
XmltvSettingsViewModel settings = await mediator.Send(new GetXmltvSettings(), cancellationToken);
|
|
return ProjectToResponseModel(settings);
|
|
}
|
|
|
|
[HttpPut("/api/settings/xmltv", Name = "UpdateXmltvSettings")]
|
|
[Tags("Settings")]
|
|
[EndpointSummary("Update global XMLTV settings")]
|
|
[ProducesResponseType(typeof(XmltvSettingsResponseModel), StatusCodes.Status200OK)]
|
|
[ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status401Unauthorized)]
|
|
[ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status422UnprocessableEntity)]
|
|
public async Task<IActionResult> UpdateXmltv(
|
|
[Required] [FromBody]
|
|
UpdateXmltvSettingsRequest request,
|
|
CancellationToken cancellationToken)
|
|
{
|
|
Either<BaseError, Unit> result = await mediator.Send(request.ToCommand(), cancellationToken);
|
|
return await result.Match(
|
|
Left: error => Task.FromResult(error.ToErrorResult()),
|
|
Right: async _ =>
|
|
{
|
|
XmltvSettingsViewModel settings = await mediator.Send(new GetXmltvSettings(), cancellationToken);
|
|
return (IActionResult)new OkObjectResult(ProjectToResponseModel(settings));
|
|
});
|
|
}
|
|
|
|
// Scanner settings
|
|
|
|
[HttpGet("/api/settings/scanner", Name = "GetScannerSettings")]
|
|
[Tags("Settings")]
|
|
[EndpointSummary("Get library scan cadence")]
|
|
[ProducesResponseType(typeof(ScannerSettingsResponseModel), StatusCodes.Status200OK)]
|
|
public async Task<ScannerSettingsResponseModel> GetScanner(CancellationToken cancellationToken)
|
|
{
|
|
int libraryRefreshInterval = await mediator.Send(new GetLibraryRefreshInterval(), cancellationToken);
|
|
return new ScannerSettingsResponseModel(libraryRefreshInterval);
|
|
}
|
|
|
|
[HttpPut("/api/settings/scanner", Name = "UpdateScannerSettings")]
|
|
[Tags("Settings")]
|
|
[EndpointSummary("Update library scan cadence")]
|
|
[ProducesResponseType(typeof(ScannerSettingsResponseModel), StatusCodes.Status200OK)]
|
|
[ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status401Unauthorized)]
|
|
[ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status422UnprocessableEntity)]
|
|
public async Task<IActionResult> UpdateScanner(
|
|
[Required] [FromBody]
|
|
UpdateScannerSettingsRequest request,
|
|
CancellationToken cancellationToken)
|
|
{
|
|
Either<BaseError, Unit> result = await mediator.Send(request.ToCommand(), cancellationToken);
|
|
return await result.Match(
|
|
Left: error => Task.FromResult(error.ToErrorResult()),
|
|
Right: async _ =>
|
|
{
|
|
int libraryRefreshInterval = await mediator.Send(new GetLibraryRefreshInterval(), cancellationToken);
|
|
return (IActionResult)new OkObjectResult(new ScannerSettingsResponseModel(libraryRefreshInterval));
|
|
});
|
|
}
|
|
|
|
// Logging settings
|
|
|
|
[HttpGet("/api/settings/logging", Name = "GetLoggingSettings")]
|
|
[Tags("Settings")]
|
|
[EndpointSummary("Get per-area minimum log levels")]
|
|
[ProducesResponseType(typeof(LoggingSettingsResponseModel), StatusCodes.Status200OK)]
|
|
public async Task<LoggingSettingsResponseModel> GetLogging(CancellationToken cancellationToken)
|
|
{
|
|
LoggingSettingsViewModel settings = await mediator.Send(new GetLoggingSettings(), cancellationToken);
|
|
return ProjectToResponseModel(settings);
|
|
}
|
|
|
|
[HttpPut("/api/settings/logging", Name = "UpdateLoggingSettings")]
|
|
[Tags("Settings")]
|
|
[EndpointSummary("Update per-area minimum log levels")]
|
|
[ProducesResponseType(typeof(LoggingSettingsResponseModel), StatusCodes.Status200OK)]
|
|
[ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status401Unauthorized)]
|
|
[ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status422UnprocessableEntity)]
|
|
public async Task<IActionResult> UpdateLogging(
|
|
[Required] [FromBody]
|
|
UpdateLoggingSettingsRequest request,
|
|
CancellationToken cancellationToken)
|
|
{
|
|
Either<BaseError, Unit> result = await mediator.Send(request.ToCommand(), cancellationToken);
|
|
return await result.Match(
|
|
Left: error => Task.FromResult(error.ToErrorResult()),
|
|
Right: async _ =>
|
|
{
|
|
LoggingSettingsViewModel settings = await mediator.Send(new GetLoggingSettings(), cancellationToken);
|
|
return (IActionResult)new OkObjectResult(ProjectToResponseModel(settings));
|
|
});
|
|
}
|
|
|
|
// UI settings
|
|
|
|
[HttpGet("/api/settings/ui", Name = "GetUiSettings")]
|
|
[Tags("Settings")]
|
|
[EndpointSummary("Get UI preferences")]
|
|
[ProducesResponseType(typeof(UiSettingsResponseModel), StatusCodes.Status200OK)]
|
|
public async Task<UiSettingsResponseModel> GetUi(CancellationToken cancellationToken)
|
|
{
|
|
UiSettingsViewModel settings = await mediator.Send(new GetUiSettings(), cancellationToken);
|
|
return ProjectToResponseModel(settings);
|
|
}
|
|
|
|
[HttpPut("/api/settings/ui", Name = "UpdateUiSettings")]
|
|
[Tags("Settings")]
|
|
[EndpointSummary("Update UI preferences")]
|
|
[ProducesResponseType(typeof(UiSettingsResponseModel), StatusCodes.Status200OK)]
|
|
[ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status401Unauthorized)]
|
|
[ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status422UnprocessableEntity)]
|
|
public async Task<IActionResult> UpdateUi(
|
|
[Required] [FromBody]
|
|
UpdateUiSettingsRequest request,
|
|
CancellationToken cancellationToken)
|
|
{
|
|
Either<BaseError, Unit> result = await mediator.Send(request.ToCommand(), cancellationToken);
|
|
return await result.Match(
|
|
Left: error => Task.FromResult(error.ToErrorResult()),
|
|
Right: async _ =>
|
|
{
|
|
UiSettingsViewModel settings = await mediator.Send(new GetUiSettings(), cancellationToken);
|
|
return (IActionResult)new OkObjectResult(ProjectToResponseModel(settings));
|
|
});
|
|
}
|
|
|
|
// HDHR settings
|
|
|
|
[HttpGet("/api/settings/hdhr", Name = "GetHdhrSettings")]
|
|
[Tags("Settings")]
|
|
[EndpointSummary("Get HDHomeRun emulation settings")]
|
|
[ProducesResponseType(typeof(HdhrSettingsResponseModel), StatusCodes.Status200OK)]
|
|
public async Task<HdhrSettingsResponseModel> GetHdhr(CancellationToken cancellationToken) =>
|
|
await LoadHdhrSettings(cancellationToken);
|
|
|
|
[HttpPut("/api/settings/hdhr", Name = "UpdateHdhrSettings")]
|
|
[Tags("Settings")]
|
|
[EndpointSummary("Update HDHomeRun emulation settings")]
|
|
[ProducesResponseType(typeof(HdhrSettingsResponseModel), StatusCodes.Status200OK)]
|
|
[ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status401Unauthorized)]
|
|
[ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status422UnprocessableEntity)]
|
|
public async Task<IActionResult> UpdateHdhr(
|
|
[Required] [FromBody]
|
|
UpdateHdhrSettingsRequest request,
|
|
CancellationToken cancellationToken)
|
|
{
|
|
Either<BaseError, Unit> result = await mediator.Send(request.ToCommand(), cancellationToken);
|
|
return await result.Match(
|
|
Left: error => Task.FromResult(error.ToErrorResult()),
|
|
Right: async _ => (IActionResult)new OkObjectResult(await LoadHdhrSettings(cancellationToken)));
|
|
}
|
|
|
|
private async Task<HdhrSettingsResponseModel> LoadHdhrSettings(CancellationToken cancellationToken)
|
|
{
|
|
int tunerCount = await mediator.Send(new GetHDHRTunerCount(), cancellationToken);
|
|
Guid uuid = await mediator.Send(new GetHDHRUUID(), cancellationToken);
|
|
return new HdhrSettingsResponseModel(tunerCount, uuid);
|
|
}
|
|
|
|
private static FFmpegSettingsResponseModel ProjectToResponseModel(FFmpegSettingsViewModel vm) =>
|
|
new(
|
|
vm.FFmpegPath,
|
|
vm.FFprobePath,
|
|
vm.DefaultFFmpegProfileId,
|
|
vm.PreferredAudioLanguageCode,
|
|
vm.UseEmbeddedSubtitles,
|
|
vm.ExtractEmbeddedSubtitles,
|
|
vm.ProbeForInterlacedFrames,
|
|
vm.SaveReports,
|
|
vm.GlobalWatermarkId,
|
|
vm.GlobalFallbackFillerId,
|
|
vm.HlsSegmenterIdleTimeout,
|
|
vm.WorkAheadSegmenterLimit,
|
|
vm.InitialSegmentCount,
|
|
vm.HlsDirectOutputFormat,
|
|
vm.DefaultMpegTsScript);
|
|
|
|
private static PlayoutSettingsResponseModel ProjectToResponseModel(PlayoutSettingsViewModel vm) =>
|
|
new(vm.DaysToBuild, vm.SkipMissingItems, vm.ScriptedScheduleTimeoutSeconds);
|
|
|
|
private static XmltvSettingsResponseModel ProjectToResponseModel(XmltvSettingsViewModel vm) =>
|
|
new(vm.DaysToBuild, ToApiTimeZone(vm.TimeZone), ToApiBlockBehavior(vm.BlockBehavior));
|
|
|
|
private static ApiXmltvTimeZone ToApiTimeZone(VmXmltvTimeZone timeZone) =>
|
|
timeZone switch
|
|
{
|
|
VmXmltvTimeZone.Local => ApiXmltvTimeZone.Local,
|
|
VmXmltvTimeZone.Utc => ApiXmltvTimeZone.Utc,
|
|
_ => throw new ArgumentOutOfRangeException(nameof(timeZone), timeZone, null)
|
|
};
|
|
|
|
private static ApiXmltvBlockBehavior ToApiBlockBehavior(VmXmltvBlockBehavior blockBehavior) =>
|
|
blockBehavior switch
|
|
{
|
|
VmXmltvBlockBehavior.SplitTimeEvenly => ApiXmltvBlockBehavior.SplitTimeEvenly,
|
|
VmXmltvBlockBehavior.UseActualTimes => ApiXmltvBlockBehavior.UseActualTimes,
|
|
_ => throw new ArgumentOutOfRangeException(nameof(blockBehavior), blockBehavior, null)
|
|
};
|
|
|
|
private static LoggingSettingsResponseModel ProjectToResponseModel(LoggingSettingsViewModel vm) =>
|
|
new(
|
|
vm.DefaultMinimumLogLevel,
|
|
vm.ScanningMinimumLogLevel,
|
|
vm.SchedulingMinimumLogLevel,
|
|
vm.SearchingMinimumLogLevel,
|
|
vm.StreamingMinimumLogLevel,
|
|
vm.HttpMinimumLogLevel);
|
|
|
|
private static UiSettingsResponseModel ProjectToResponseModel(UiSettingsViewModel vm) =>
|
|
new(vm.IsDarkMode, vm.Language);
|
|
}
|