Melde dich mit deinem Konto an, um ein Zugriffstoken für die Desktop-App zu erhalten. Damit nutzt du TMDB, ohne einen eigenen API-Key zu brauchen.
`) } func (s *server) handleLogin(w http.ResponseWriter, r *http.Request) { state := randString(24) verifier := oauth2.GenerateVerifier() s.setCookie(w, "umt_state", state, 600) s.setCookie(w, "umt_verifier", verifier, 600) // An optional app_redirect lets the desktop app capture the token via a // loopback URL instead of copy/paste. Only accept localhost targets. if appcb := r.URL.Query().Get("app_redirect"); isLoopbackRedirect(appcb) { s.setCookie(w, "umt_appcb", appcb, 600) } else { s.setCookie(w, "umt_appcb", "", -1) } authURL := s.oauth.AuthCodeURL(state, oauth2.AccessTypeOffline, oauth2.S256ChallengeOption(verifier)) http.Redirect(w, r, authURL, http.StatusFound) } // isLoopbackRedirect reports whether raw is a plain-HTTP URL pointing at the // local machine, so it is safe to hand a freshly minted token to. func isLoopbackRedirect(raw string) bool { if raw == "" { return false } u, err := url.Parse(raw) if err != nil || u.Scheme != "http" { return false } switch u.Hostname() { case "127.0.0.1", "localhost", "::1": return true } return false } func (s *server) handleCallback(w http.ResponseWriter, r *http.Request) { ctx := r.Context() stateCookie, err := r.Cookie("umt_state") if err != nil || stateCookie.Value == "" || stateCookie.Value != r.URL.Query().Get("state") { http.Error(w, "ungültiger oder abgelaufener Login-Versuch", http.StatusBadRequest) return } verifierCookie, err := r.Cookie("umt_verifier") if err != nil { http.Error(w, "fehlender PKCE-Verifier", http.StatusBadRequest) return } oauthToken, err := s.oauth.Exchange(ctx, r.URL.Query().Get("code"), oauth2.VerifierOption(verifierCookie.Value)) if err != nil { http.Error(w, "Token-Austausch fehlgeschlagen: "+err.Error(), http.StatusBadGateway) return } rawIDToken, ok := oauthToken.Extra("id_token").(string) if !ok { http.Error(w, "kein id_token in der Antwort", http.StatusBadGateway) return } idToken, err := s.verifier.Verify(ctx, rawIDToken) if err != nil { http.Error(w, "id_token-Prüfung fehlgeschlagen: "+err.Error(), http.StatusUnauthorized) return } var claims struct { Subject string `json:"sub"` Email string `json:"email"` Name string `json:"preferred_username"` Groups []string `json:"groups"` } if err := idToken.Claims(&claims); err != nil { http.Error(w, "Claims konnten nicht gelesen werden", http.StatusInternalServerError) return } if !s.groupAllowed(claims.Groups) { http.Error(w, "Dein Konto ist für diesen Dienst nicht freigeschaltet.", http.StatusForbidden) return } // Clear the transient cookies. s.setCookie(w, "umt_state", "", -1) s.setCookie(w, "umt_verifier", "", -1) appToken, err := mintToken(s.cfg.SessionKey, claims.Subject, claims.Email, s.cfg.TokenTTL) if err != nil { http.Error(w, "Token konnte nicht erstellt werden", http.StatusInternalServerError) return } // If the login was started by the desktop app, hand the token back via its // loopback URL so it is captured automatically. if appcbCookie, err := r.Cookie("umt_appcb"); err == nil && isLoopbackRedirect(appcbCookie.Value) { s.setCookie(w, "umt_appcb", "", -1) cb, _ := url.Parse(appcbCookie.Value) q := cb.Query() q.Set("token", appToken) cb.RawQuery = q.Encode() http.Redirect(w, r, cb.String(), http.StatusFound) return } who := claims.Name if who == "" { who = claims.Email } s.renderToken(w, who, appToken) } func (s *server) groupAllowed(userGroups []string) bool { if len(s.cfg.AllowGroups) == 0 { return true } for _, allowed := range s.cfg.AllowGroups { for _, g := range userGroups { if g == allowed { return true } } } return false } func (s *server) renderToken(w http.ResponseWriter, who, token string) { w.Header().Set("Content-Type", "text/html; charset=utf-8") io.WriteString(w, `Kopiere dieses Token und trage es in der Desktop-App unter Einstellungen → Filme/Serien über → Proxy-Server ein:
` + htmlEscape(s.cfg.PublicURL) + `Das Token ist persönlich und läuft nach einiger Zeit ab – dann hier erneut anmelden.
`) } func htmlEscape(s string) string { r := strings.NewReplacer("&", "&", "<", "<", ">", ">", `"`, """) return r.Replace(s) } // handleProxy forwards an authenticated /3/* request to TMDB with the shared key. func (s *server) handleProxy(w http.ResponseWriter, r *http.Request) { if r.Method != http.MethodGet { http.Error(w, "only GET is supported", http.StatusMethodNotAllowed) return } bearer := strings.TrimSpace(strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer")) if _, err := verifyToken(s.cfg.SessionKey, bearer); err != nil { http.Error(w, "unauthorized", http.StatusUnauthorized) return } // Build upstream URL: /3/