feat: add Cleanflix Connector Tauri desktop app
Move the Mac Tauri UI (pro.cleanflix.connector) into this repo under desktop/. Bundled Node runtime stays gitignored; package scripts fetch it when building.
This commit is contained in:
@@ -0,0 +1,198 @@
|
||||
import crypto from 'node:crypto';
|
||||
import fs from 'node:fs';
|
||||
import http from 'node:http';
|
||||
import os from 'node:os';
|
||||
import path from 'node:path';
|
||||
import multicastDns from 'multicast-dns';
|
||||
import { createLibrary } from './library.js';
|
||||
|
||||
const port = Number(process.env.PORT || 8787);
|
||||
const mediaRoot = path.resolve(process.env.MEDIA_ROOT || './media');
|
||||
const publicBaseUrl = (process.env.PUBLIC_BASE_URL || `http://localhost:${port}`).replace(/\/$/, '');
|
||||
const approvalBaseUrl = (process.env.APPROVAL_BASE_URL || publicBaseUrl).replace(/\/$/, '');
|
||||
const cleanflixApiUrl = process.env.CLEANFLIX_API_URL?.replace(/\/$/, '');
|
||||
const pairingSecret = process.env.PAIRING_SECRET;
|
||||
const pairingPasswordHash = process.env.PAIRING_PASSWORD_HASH;
|
||||
const demoStreamUrl = process.env.DEMO_STREAM_URL;
|
||||
const catalogLimit = Math.max(0, Number(process.env.CATALOG_LIMIT || 0));
|
||||
const mdnsHostname = new URL(publicBaseUrl).hostname;
|
||||
const library = createLibrary(mediaRoot, path.resolve(process.env.LIBRARY_INDEX_PATH || './data/library-index.json'), process.env.TMDB_API_KEY);
|
||||
const tokenPath = path.resolve(process.env.TOKEN_STORE_PATH || './data/tokens.json');
|
||||
library.startReconciler(Number(process.env.LIBRARY_RECONCILE_SECONDS || 900));
|
||||
if (!pairingSecret && !pairingPasswordHash) throw new Error('PAIRING_PASSWORD_HASH or PAIRING_SECRET is required');
|
||||
|
||||
const sessions = new Map();
|
||||
const accountLinkSessions = new Map();
|
||||
const accountTokenLifetime = 365 * 24 * 60 * 60 * 1000;
|
||||
const loadTokens = () => {
|
||||
try { return new Map(Object.entries(JSON.parse(fs.readFileSync(tokenPath, 'utf8')))); } catch { return new Map(); }
|
||||
};
|
||||
const tokens = loadTokens();
|
||||
const localAddress = () => Object.values(os.networkInterfaces()).flat().find(address =>
|
||||
address && address.family === 'IPv4' && !address.internal,
|
||||
)?.address;
|
||||
const advertiseConnector = () => {
|
||||
if (!mdnsHostname.endsWith('.local')) return () => {};
|
||||
const address = localAddress();
|
||||
if (!address) return () => {};
|
||||
const mdns = multicastDns();
|
||||
const hostname = `${mdnsHostname}.`;
|
||||
const service = 'Cleanflix Connector._cleanflix-connector._tcp.local.';
|
||||
const records = [
|
||||
{ name: hostname, type: 'A', ttl: 120, data: address },
|
||||
{ name: '_cleanflix-connector._tcp.local.', type: 'PTR', ttl: 120, data: service },
|
||||
{ name: service, type: 'SRV', ttl: 120, data: { port, target: hostname } },
|
||||
{ name: service, type: 'TXT', ttl: 120, data: ['path=/'] },
|
||||
];
|
||||
const respond = () => mdns.respond(records);
|
||||
mdns.on('query', query => {
|
||||
if (query.questions.some(question => question.name === hostname || question.name === '_cleanflix-connector._tcp.local.')) respond();
|
||||
});
|
||||
respond();
|
||||
const interval = setInterval(respond, 60_000);
|
||||
console.log(`mDNS available at http://${mdnsHostname}:${port}`);
|
||||
return () => { clearInterval(interval); mdns.destroy(); };
|
||||
};
|
||||
const saveTokens = () => {
|
||||
fs.mkdirSync(path.dirname(tokenPath), { recursive: true });
|
||||
fs.writeFileSync(tokenPath, `${JSON.stringify(Object.fromEntries(tokens))}\n`, { mode: 0o600 });
|
||||
};
|
||||
const videos = async () => {
|
||||
const items = (await library.catalog()).map(item => ({ ...item, imdbId: item.imdbId || item.suggestedImdbId, description: item.description || item.file }));
|
||||
const limited = catalogLimit > 0 ? items.slice(0, catalogLimit) : items;
|
||||
return [...limited, ...(demoStreamUrl ? [{ id: 'demo-stream', title: 'Connector playback test', type: 'video', description: 'Staging test stream' }] : [])];
|
||||
};
|
||||
// Responses can contain pairing and stream tokens; never write their bodies to logs.
|
||||
const json = (res, code, value) => { const body = JSON.stringify(value); console.log(code); res.writeHead(code, { 'content-type': 'application/json' }); res.end(body); };
|
||||
const readJson = req => new Promise((resolve, reject) => { let raw = ''; req.on('data', d => raw += d); req.on('end', () => { try { resolve(JSON.parse(raw || '{}')); } catch { reject(new Error('Invalid JSON')); } }); });
|
||||
const bearer = req => req.headers.authorization?.replace(/^Bearer\s+/i, '');
|
||||
const authenticated = req => {
|
||||
const token = bearer(req);
|
||||
const expiresAt = Number(tokens.get(token));
|
||||
if (expiresAt > Date.now()) return true;
|
||||
if (token) { tokens.delete(token); saveTokens(); }
|
||||
return false;
|
||||
};
|
||||
const id = () => crypto.randomBytes(24).toString('base64url');
|
||||
const passwordMatches = value => {
|
||||
if (pairingPasswordHash) {
|
||||
const [salt, expected] = pairingPasswordHash.split(':');
|
||||
if (!salt || !expected) return false;
|
||||
const actual = crypto.scryptSync(value, salt, 32).toString('base64url');
|
||||
return crypto.timingSafeEqual(Buffer.from(actual), Buffer.from(expected));
|
||||
}
|
||||
const actual = Buffer.from(value);
|
||||
const expected = Buffer.from(pairingSecret || '');
|
||||
return Boolean(pairingSecret) && actual.length === expected.length && crypto.timingSafeEqual(actual, expected);
|
||||
};
|
||||
const admin = req => {
|
||||
const raw = req.headers.authorization?.replace(/^Basic\s+/i, '');
|
||||
return Boolean(raw) && passwordMatches(Buffer.from(raw, 'base64').toString().split(':').slice(1).join(':'));
|
||||
};
|
||||
const html = value => String(value).replaceAll('&', '&').replaceAll('<', '<').replaceAll('>', '>').replaceAll('"', '"');
|
||||
const accountLinkPage = (title, message) => `<!doctype html><title>${html(title)}</title><style>body{font:16px system-ui;max-width:38rem;margin:4rem auto;padding:0 1rem}h1{margin-bottom:.5rem}</style><h1>${html(title)}</h1><p>${html(message)}</p>`;
|
||||
const libraryPage = items => `<!doctype html><title>CleanStream Library</title><style>body{font:16px system-ui;max-width:1100px;margin:2rem auto}form{display:grid;grid-template-columns:2fr 2fr 1fr auto;gap:.5rem;margin:.5rem 0}input{padding:.5rem}small{grid-column:1/-1;color:#666}</style><h1>Library review</h1><p>Confirm titles and IMDb IDs. Original files are never renamed or moved.</p>${items.map(item => `<form method="post" action="/library/mapping"><input type="hidden" name="file" value="${encodeURIComponent(item.file)}"><input name="title" value="${html(item.title)}"><input name="imdbId" placeholder="tt1234567" value="${html(item.imdbId || item.suggestedImdbId || '')}"><input name="year" value="${item.year || ''}" placeholder="year"><button>Save</button><small>${html(item.file)}${item.candidate ? ` · TMDB: ${html(item.candidate.title)} (${html(item.candidate.year)})` : ''}</small></form>`).join('')}`;
|
||||
|
||||
const server = http.createServer(async (req, res) => {
|
||||
const url = new URL(req.url, publicBaseUrl);
|
||||
console.log(`${req.method} ${url.pathname}`);
|
||||
if (req.method === 'GET' && url.pathname === '/library') {
|
||||
if (!admin(req)) { res.writeHead(401, { 'www-authenticate': 'Basic realm="CleanStream Library"' }); return res.end('Authentication required'); }
|
||||
res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' }); return res.end(libraryPage(await library.scan()));
|
||||
}
|
||||
if (req.method === 'POST' && url.pathname === '/library/mapping') {
|
||||
if (!admin(req)) return json(res, 401, { error: 'Unauthorized' });
|
||||
let raw = ''; req.on('data', d => raw += d); req.on('end', () => { const body = new URLSearchParams(raw); const file = decodeURIComponent(body.get('file') || ''); if (!file || file.includes('..')) return json(res, 400, { error: 'Invalid file' }); library.saveMapping(file, { title: body.get('title') || undefined, imdbId: body.get('imdbId') || undefined, year: Number(body.get('year')) || undefined }); res.writeHead(303, { location: '/library' }); res.end(); }); return;
|
||||
}
|
||||
if (req.method === 'GET' && url.pathname === '/account/link') {
|
||||
if (!cleanflixApiUrl) return json(res, 503, { error: 'CLEANFLIX_API_URL is required for account linking' });
|
||||
const state = url.searchParams.get('state');
|
||||
const linkToken = url.searchParams.get('linkToken');
|
||||
if (!state && !linkToken) {
|
||||
const linkState = id();
|
||||
accountLinkSessions.set(linkState, { expires: Date.now() + 600000 });
|
||||
const handoff = new URL('/connector/link', cleanflixApiUrl);
|
||||
handoff.searchParams.set('returnUrl', `${publicBaseUrl}/account/link?state=${encodeURIComponent(linkState)}`);
|
||||
handoff.searchParams.set('connectorUrl', publicBaseUrl);
|
||||
res.writeHead(302, { location: handoff.toString() });
|
||||
return res.end();
|
||||
}
|
||||
const session = state && accountLinkSessions.get(state);
|
||||
accountLinkSessions.delete(state);
|
||||
if (!session || session.expires < Date.now() || !linkToken) {
|
||||
res.writeHead(400, { 'content-type': 'text/html; charset=utf-8' });
|
||||
return res.end(accountLinkPage('Account link failed', 'This account-link request is invalid or has expired. Start again from your connector.'));
|
||||
}
|
||||
const accessToken = id();
|
||||
const expiresAt = Date.now() + accountTokenLifetime;
|
||||
tokens.set(accessToken, expiresAt);
|
||||
saveTokens();
|
||||
try {
|
||||
const response = await fetch(`${cleanflixApiUrl}/api/sync/connector/link`, {
|
||||
method: 'POST',
|
||||
headers: { 'content-type': 'application/json' },
|
||||
body: JSON.stringify({ linkToken, connectorUrl: publicBaseUrl, accessToken, expiresAt: new Date(expiresAt).toISOString() }),
|
||||
signal: AbortSignal.timeout(10000),
|
||||
});
|
||||
if (!response.ok) throw new Error(`Cleanflix returned ${response.status}`);
|
||||
} catch (error) {
|
||||
tokens.delete(accessToken);
|
||||
saveTokens();
|
||||
console.error(`Account link completion failed: ${error.message}`);
|
||||
res.writeHead(502, { 'content-type': 'text/html; charset=utf-8' });
|
||||
return res.end(accountLinkPage('Account link failed', 'Cleanflix could not complete the account link. Please start again.'));
|
||||
}
|
||||
res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });
|
||||
return res.end(accountLinkPage('Account linked', 'This connector is now linked to your Cleanflix account. You can close this window.'));
|
||||
}
|
||||
if (req.method === 'GET' && url.pathname === '/.well-known/cleanstream-connector.json') return json(res, 200, {
|
||||
protocolVersion: 1, id: 'reference.home-library', name: 'Reference Home Library', capabilities: ['catalog', 'metadata', 'stream'],
|
||||
endpoints: { catalog: '/v1/catalog', metadata: '/v1/metadata', stream: '/v1/stream', pairStart: '/v1/pair/start', pairStatus: '/v1/pair/{sessionId}', pairToken: '/v1/pair/token', accountLink: '/account/link' }
|
||||
});
|
||||
if (req.method === 'POST' && url.pathname === '/v1/pair/start') {
|
||||
const body = await readJson(req); if ((body.codeChallengeMethod || 'S256') !== 'S256' || !body.codeChallenge) return json(res, 400, { error: 'PKCE S256 required' });
|
||||
const sessionId = id(); sessions.set(sessionId, { challenge: body.codeChallenge, expires: Date.now() + 300000 });
|
||||
return json(res, 200, { sessionId, approvalUri: `${approvalBaseUrl}/pair/approve?session=${sessionId}`, expiresAt: new Date(Date.now() + 300000).toISOString(), pollIntervalSeconds: 2 });
|
||||
}
|
||||
if (req.method === 'GET' && url.pathname === '/pair/approve') { res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' }); return res.end('<form method="post"><input name="secret" type="password" placeholder="Pairing secret"><button>Approve TV</button></form>'); }
|
||||
if (req.method === 'POST' && url.pathname === '/pair/approve') { let raw=''; req.on('data', d => raw += d); req.on('end', () => { const session=sessions.get(url.searchParams.get('session')); if (!session || !passwordMatches(new URLSearchParams(raw).get('secret') || '')) { res.statusCode=403; return res.end('Denied'); } session.code=id(); res.end('Approved. Return to your TV.'); }); return; }
|
||||
if (req.method === 'GET' && url.pathname.startsWith('/v1/pair/')) { const session=sessions.get(url.pathname.split('/').pop()); if (!session || session.expires < Date.now()) return json(res, 200, { status: 'expired' }); return json(res, 200, session.code ? { status: 'approved', authorizationCode: session.code } : { status: 'pending' }); }
|
||||
if (req.method === 'POST' && url.pathname === '/v1/pair/token') { const body=await readJson(req), session=sessions.get(body.sessionId); const challenge=crypto.createHash('sha256').update(body.codeVerifier || '').digest('base64url'); if (!session || session.code !== body.authorizationCode || session.challenge !== challenge) return json(res, 403, { error: 'Invalid pairing exchange' }); const token=id(); tokens.set(token, Date.now()+2592000000); saveTokens(); sessions.delete(body.sessionId); return json(res, 200, { accessToken: token, expiresAt: new Date(tokens.get(token)).toISOString(), scopes: ['catalog','stream'] }); }
|
||||
if (req.method === 'GET' && url.pathname === '/v1/catalog') return authenticated(req) ? json(res, 200, { items: await videos() }) : json(res, 401, { error: 'Unauthorized' });
|
||||
if (req.method === 'GET' && url.pathname === '/v1/metadata') {
|
||||
if (!authenticated(req)) return json(res, 401, { error: 'Unauthorized' });
|
||||
const item = await library.metadata(url.searchParams.get('id') || '');
|
||||
return item ? json(res, 200, { item: { ...item, imdbId: item.imdbId || item.suggestedImdbId, description: item.description || item.file } }) : json(res, 404, { error: 'Not found' });
|
||||
}
|
||||
if (req.method === 'POST' && url.pathname === '/v1/stream') { if (!authenticated(req)) return json(res,401,{error:'Unauthorized'}); const body=await readJson(req); if (body.id === 'demo-stream' && demoStreamUrl) return json(res,200,{streams:[{id:'demo-stream',url:demoStreamUrl,filename:'demo.m3u8',headers:{}}]}); const file=Buffer.from(body.id || '', 'base64url').toString(); if (!(await videos()).some(v => v.id === body.id) || file.includes('..')) return json(res,404,{error:'Not found'}); return json(res,200,{streams:[{id:body.id,url:`${publicBaseUrl}/v1/media/${body.id}?token=${bearer(req)}`,filename:path.basename(file),headers:{}}]}); }
|
||||
if (req.method === 'GET' && url.pathname.startsWith('/v1/media/')) {
|
||||
const token = url.searchParams.get('token');
|
||||
const file = Buffer.from(url.pathname.split('/').pop(), 'base64url').toString();
|
||||
const target = path.resolve(mediaRoot, file);
|
||||
if (!tokens.has(token) || !target.startsWith(`${mediaRoot}${path.sep}`) || !fs.existsSync(target)) return json(res, 404, { error: 'Not found' });
|
||||
const size = fs.statSync(target).size;
|
||||
const match = req.headers.range?.match(/^bytes=(\d*)-(\d*)$/);
|
||||
const start = Number(match?.[1] || 0);
|
||||
const end = Math.min(Number(match?.[2] || size - 1), size - 1);
|
||||
if (match && (start > end || start >= size)) {
|
||||
res.writeHead(416, { 'content-range': `bytes */${size}` });
|
||||
return res.end();
|
||||
}
|
||||
const headers = { 'content-type': 'application/octet-stream', 'accept-ranges': 'bytes', 'content-length': end - start + 1 };
|
||||
if (match) headers['content-range'] = `bytes ${start}-${end}/${size}`;
|
||||
res.writeHead(match ? 206 : 200, headers);
|
||||
const stream = fs.createReadStream(target, { start, end });
|
||||
stream.on('error', error => {
|
||||
console.error(`Media read failed: ${error.message}`);
|
||||
if (!res.headersSent) json(res, 502, { error: 'Media read failed' });
|
||||
else res.destroy(error);
|
||||
});
|
||||
return stream.pipe(res);
|
||||
}
|
||||
json(res, 404, { error: 'Not found' });
|
||||
});
|
||||
server.listen(port, process.env.HOST, () => {
|
||||
const stopAdvertising = advertiseConnector();
|
||||
server.once('close', stopAdvertising);
|
||||
console.log(`Connector listening on ${publicBaseUrl}`);
|
||||
});
|
||||
Reference in New Issue
Block a user