chrisandClaude Opus 5.5
6791b62d87
- Fastify API with cookie (web) and bearer (mobile) sessions, follows, pinned friends, featured songs, account deletion, Redis-backed rate limits - Providers: Spotify (OAuth), Last.fm, ListenBrainz, Plex (PIN flow and server discovery), Jellyfin (token auth, revoked on disconnect) - Worker polls on an adaptive schedule in a Redis sorted set, so polling scales horizontally and API usage tracks whether anyone is watching - Track resolver links songs across services via ISRC (Deezer, Spotify), iTunes search and song.link - Realtime updates over WebSocket fan out through Redis pub/sub - User-supplied server URLs are restricted to public addresses, checked both up front and at connect time to defeat DNS rebinding Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8
49 lines
1.9 KiB
TypeScript
49 lines
1.9 KiB
TypeScript
/**
|
|
* Inbound webhooks from Plex (Plex Pass) and the Jellyfin Webhook plugin.
|
|
*
|
|
* We don't trust or parse the payload: a webhook only means "something
|
|
* changed", so we poll that connection right away. That keeps one code path
|
|
* for state, works with any Jellyfin template, and means a forged request can
|
|
* at most cause an extra poll. The secret in the URL identifies the connection.
|
|
*/
|
|
import { and, eq } from 'drizzle-orm';
|
|
import type { FastifyInstance } from 'fastify';
|
|
import type { NowPlayingProvider } from '@musicshare/shared';
|
|
import { db, schema } from '../db';
|
|
import { pollSoon } from '../services/scheduler';
|
|
|
|
export async function webhookRoutes(app: FastifyInstance) {
|
|
// Plex posts multipart/form-data (sometimes with a thumbnail attached). We
|
|
// ignore bodies entirely, so accept any content type without parsing.
|
|
app.addContentTypeParser('*', { bodyLimit: 10 * 1024 * 1024 }, (_req, payload, done) => {
|
|
payload.resume();
|
|
payload.on('end', () => done(null, undefined));
|
|
payload.on('error', done);
|
|
});
|
|
app.removeContentTypeParser('application/json');
|
|
app.addContentTypeParser('application/json', (_req, payload, done) => {
|
|
payload.resume();
|
|
payload.on('end', () => done(null, undefined));
|
|
});
|
|
|
|
app.post<{ Params: { provider: string; secret: string } }>(
|
|
'/webhooks/:provider/:secret',
|
|
{ config: { rateLimit: { max: 120, timeWindow: '1 minute' } } },
|
|
async (req, reply) => {
|
|
const [conn] = await db
|
|
.select({ id: schema.connections.id })
|
|
.from(schema.connections)
|
|
.where(
|
|
and(
|
|
eq(schema.connections.webhookSecret, req.params.secret),
|
|
eq(schema.connections.provider, req.params.provider as NowPlayingProvider),
|
|
eq(schema.connections.status, 'active'),
|
|
),
|
|
);
|
|
if (conn) await pollSoon([conn.id]);
|
|
// Same response either way, so secrets can't be probed.
|
|
return reply.status(204).send();
|
|
},
|
|
);
|
|
}
|