From e3ecae12d7a309eb5a6c8e62910257096cb99375 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 21 Sep 2026 07:05:24 +0000 Subject: Split download from hosting; carry the token into enclosure URLs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The machine that hosts a feed and the machine that downloads the audio do not have to be the same, and usually shouldn't be: a datacentre IP is treated very differently from a home connection by the larger video sites. Downloading where the person actually is sidesteps that entirely, and means the server needs no credentials for or route to the source. - push/ingest: `podkit push` uploads a local library to a remote `serve --ingest`, asking for a manifest first so only the difference is sent. Uploads land via a temp file and rename, so an interrupted transfer cannot be picked up as a short episode. Ingest is off by default and refuses to start without a token. - get: downloads a direct audio URL or every enclosure in an RSS feed, with no extractor involved. Numbers RSS items in reverse so a mirrored series plays in order rather than backwards. Two bugs found by running it rather than by testing it: - A tokened server produced enclosure URLs with no token. The feed loaded, listed every episode, and all of them 404'd in a real client — the whole point of the tool, broken in the default configuration. Feeds now carry the token; regression test asserts enclosures from a tokened feed actually resolve against a tokened server. - Ingest ran filepath.Base before validating, so "../evil.mp3" was stored as "evil.mp3" — contained, but under a name the client never asked for, leaving push and the server disagreeing about the library. Names are now validated raw and rejected. Also: identify with a real user-agent (libsyn 403s Go's default), write feed.xml via rename so a polling client never reads a truncated feed, and match ingested file permissions to downloaded ones. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_018AwnALZL6bD4VBtATDVv3B --- internal/serve/roundtrip_test.go | 102 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 102 insertions(+) create mode 100644 internal/serve/roundtrip_test.go (limited to 'internal/serve/roundtrip_test.go') diff --git a/internal/serve/roundtrip_test.go b/internal/serve/roundtrip_test.go new file mode 100644 index 0000000..c18de79 --- /dev/null +++ b/internal/serve/roundtrip_test.go @@ -0,0 +1,102 @@ +package serve + +import ( + "net/http" + "net/http/httptest" + "os" + "path/filepath" + "testing" + "time" + + "podkit/internal/feed" +) + +// A podcast client fetches the feed, then fetches each enclosure as a bare GET +// carrying nothing from the first request. If the server wants a token and the +// enclosure URLs do not have one, the feed loads, lists every episode, and not +// one of them will ever download — a failure that looks like success right up +// until playback. +// +// Found live: a tokened server produced enclosure URLs without the token, and +// every episode 404'd. +func TestTokenedFeedEnclosuresAreFetchable(t *testing.T) { + const token = "s3cret" + + dir := t.TempDir() + for _, name := range []string{"01 - April.mp3", "10 - Probability & Uncertainty.mp3"} { + if err := os.WriteFile(filepath.Join(dir, name), []byte("audio"), 0o644); err != nil { + t.Fatal(err) + } + } + + srv := httptest.NewServer(Handler(Options{Dir: dir, Token: token})) + defer srv.Close() + + // Build the feed exactly as the server would, pointed at itself. + rss, err := feed.Build(feed.Options{ + Dir: dir, + BaseURL: srv.URL + "/audio/", + Title: "Test", + Token: token, + Epoch: time.Date(2000, time.January, 1, 12, 0, 0, 0, time.UTC), + }, nil) + if err != nil { + t.Fatal(err) + } + if len(rss.Channel.Items) != 2 { + t.Fatalf("got %d items", len(rss.Channel.Items)) + } + + for _, item := range rss.Channel.Items { + resp, err := http.Get(item.Enclosure.URL) + if err != nil { + t.Fatalf("GET %s: %v", item.Enclosure.URL, err) + } + resp.Body.Close() + if resp.StatusCode != http.StatusOK { + t.Errorf("enclosure %s returned %d — a podcast client could not download this episode", + item.Enclosure.URL, resp.StatusCode) + } + } +} + +// The converse: without a token configured anywhere, enclosures must still +// resolve, and must not carry a stray empty k= parameter. +func TestUntokenedFeedEnclosuresAreFetchable(t *testing.T) { + dir := t.TempDir() + if err := os.WriteFile(filepath.Join(dir, "01 - April.mp3"), []byte("audio"), 0o644); err != nil { + t.Fatal(err) + } + + srv := httptest.NewServer(Handler(Options{Dir: dir})) + defer srv.Close() + + rss, err := feed.Build(feed.Options{ + Dir: dir, BaseURL: srv.URL + "/audio/", Title: "Test", + }, nil) + if err != nil { + t.Fatal(err) + } + + url := rss.Channel.Items[0].Enclosure.URL + if got := rss.Channel.Items[0].Enclosure.URL; len(got) > 0 && containsQ(got, "k=") { + t.Errorf("enclosure %s carries a token parameter when none was set", got) + } + resp, err := http.Get(url) + if err != nil { + t.Fatal(err) + } + defer resp.Body.Close() + if resp.StatusCode != http.StatusOK { + t.Errorf("enclosure %s returned %d", url, resp.StatusCode) + } +} + +func containsQ(h, n string) bool { + for i := 0; i+len(n) <= len(h); i++ { + if h[i:i+len(n)] == n { + return true + } + } + return false +} -- cgit v1.2.3