muse drives a download client and writes to the media library, so exposing it publicly needs more than a login form. It fails closed. Auth is on unless MUSE_AUTH=off is set explicitly, and when it is on with incomplete config the app refuses to start rather than serving open. The mode worth engineering against is not a broken login page, it is a misconfigured deploy quietly publishing an unauthenticated download client. Sessions are server-side: the cookie carries a 256-bit random token and nothing else, and only its SHA-256 is stored. There is no signed payload to get subtly wrong, a stolen database yields no usable cookies, and logout revokes for real. The allowlist is re-checked on every request so removing a user takes effect immediately rather than at session expiry. OAuth state is compared with secrets.compare_digest, so a callback the user did not initiate is rejected. MUSE_BASE_URL comes from config rather than X-Forwarded-* because those headers are attacker-controllable and this one is a redirect target. CSP is default-src 'self' with no unsafe-inline, which is why the stylesheet and script moved out of index.html into static files -- an injected <script> now cannot execute. Also frame-ancestors 'none', base-uri 'none', nosniff, DENY, no-referrer and HSTS. FastAPI's /docs, /redoc and /openapi.json are disabled so the login page does not hand out a map of every endpoint. /healthz is the only unauthenticated route and returns a bare ok, so the container healthcheck works without leaking anything. Verified: misconfigured auth refuses to boot; unauthenticated / redirects and /api/* returns 401; a forged state is rejected 400; a junk cookie is 401; a valid session for a non-allowlisted user is 401; all headers present; and the UI renders with no CSP violations in the console. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
122 lines
4.3 KiB
JavaScript
122 lines
4.3 KiB
JavaScript
// Who is signed in, plus a logout link. Hidden entirely when MUSE_AUTH=off.
|
|
fetch('/api/me').then(r => r.json()).then(d => {
|
|
if (d.user) document.getElementById('who').innerHTML =
|
|
'signed in as ' + d.user.replace(/[&<>"]/g, '') + ' <a href="/auth/logout">log out</a>';
|
|
}).catch(() => {});
|
|
|
|
const $ = s => document.querySelector(s);
|
|
const esc = s => (s??'').replace(/[&<>"]/g, c => ({'&':'&','<':'<','>':'>','"':'"'}[c]));
|
|
|
|
$('#f').onsubmit = async e => {
|
|
e.preventDefault();
|
|
const q = $('#q').value.trim();
|
|
if (!q) return;
|
|
$('#go').disabled = true;
|
|
$('#results').innerHTML = '<div class="empty">searching MusicBrainz…</div>';
|
|
try {
|
|
const r = await fetch('/api/search?q=' + encodeURIComponent(q));
|
|
const { results } = await r.json();
|
|
render(results);
|
|
} catch (err) {
|
|
$('#results').innerHTML = '<div class="empty">search failed: ' + esc(err.message) + '</div>';
|
|
}
|
|
$('#go').disabled = false;
|
|
};
|
|
|
|
function render(list) {
|
|
if (!list || !list.length) {
|
|
$('#results').innerHTML = '<div class="empty">no matches</div>';
|
|
return;
|
|
}
|
|
$('#results').innerHTML = list.map((x, i) => `
|
|
<div class="row">
|
|
${x.cover ? `<img src="${esc(x.cover)}" loading="lazy" onerror="this.style.visibility='hidden'">`
|
|
: '<img>'}
|
|
<div class="meta">
|
|
<div class="t">${esc(x.title)}</div>
|
|
<div class="s">${esc(x.artist)}${x.album ? ' · ' + esc(x.album) : ''}${x.year ? ' · ' + esc(x.year) : ''}</div>
|
|
</div>
|
|
<button class="get" data-i="${i}">Get</button>
|
|
</div>`).join('');
|
|
|
|
$('#results').querySelectorAll('.get').forEach(b => {
|
|
b.onclick = async () => {
|
|
const x = list[+b.dataset.i];
|
|
b.disabled = true; b.textContent = '…';
|
|
await fetch('/api/request', {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify(x)
|
|
});
|
|
b.textContent = 'Queued'; b.classList.add('done');
|
|
poll();
|
|
};
|
|
});
|
|
}
|
|
|
|
$('#imprun').onclick = async () => {
|
|
const text = $('#bulk').value.trim();
|
|
if (!text) return;
|
|
const b = $('#imprun');
|
|
b.disabled = true; b.textContent = 'Queueing…';
|
|
$('#impout').innerHTML = '';
|
|
try {
|
|
const r = await fetch('/api/import', {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({ text })
|
|
});
|
|
const d = await r.json();
|
|
$('#impout').innerHTML =
|
|
`<div class="hint">Queued ${d.queued.length}.</div>` +
|
|
(d.skipped.length
|
|
? `<div class="skipped">Skipped ${d.skipped.length}: ` +
|
|
d.skipped.map(s => esc(s.line) + ' (' + esc(s.why) + ')').join('; ') + '</div>'
|
|
: '');
|
|
if (d.queued.length) $('#bulk').value = '';
|
|
poll();
|
|
} catch (e) {
|
|
$('#impout').innerHTML = '<div class="skipped">import failed: ' + esc(e.message) + '</div>';
|
|
}
|
|
b.disabled = false; b.textContent = 'Queue all';
|
|
};
|
|
|
|
async function poll() {
|
|
try {
|
|
const { jobs, counts, pending } = await (await fetch('/api/jobs')).json();
|
|
|
|
const active = (counts.queued || 0) + (counts.searching || 0) + (counts.downloading || 0);
|
|
const done = counts.imported || 0;
|
|
$('#qcount').textContent = active
|
|
? `${active} in flight${pending ? ` · ${pending} waiting` : ''}`
|
|
: (done ? `${done} imported` : '');
|
|
|
|
// Progress only means something during a batch.
|
|
const bar = $('#bar'), total = active + done;
|
|
bar.classList.toggle('hidden', !(active && total));
|
|
if (active && total)
|
|
bar.firstElementChild.style.width = (done / total * 100).toFixed(1) + '%';
|
|
|
|
$('#jobs').innerHTML = jobs.length ? jobs.map(j => `
|
|
<div class="row">
|
|
<div class="meta">
|
|
<div class="t">${esc(j.title)}</div>
|
|
<div class="s">${esc(j.artist)}${j.detail ? ' · ' + esc(j.detail) : ''}</div>
|
|
</div>
|
|
${j.state === 'failed'
|
|
? `<button class="retry" data-id="${esc(j.id)}">Retry</button>` : ''}
|
|
<span class="pill ${esc(j.state)}">${esc(j.state)}</span>
|
|
</div>`).join('') : '<div class="empty">nothing requested yet</div>';
|
|
|
|
$('#jobs').querySelectorAll('.retry').forEach(b => {
|
|
b.onclick = async () => {
|
|
b.disabled = true;
|
|
await fetch('/api/retry/' + b.dataset.id, { method: 'POST' });
|
|
poll();
|
|
};
|
|
});
|
|
} catch {}
|
|
}
|
|
poll();
|
|
setInterval(poll, 4000);
|