feat(sidecar): scoped PhotoPrism-compatible API proxy for third-party apps
PhotoPrism CE doesn't enforce auth_users.base_path on API reads (any user can q=path:"other/*"). New /api/v1/* proxy forwards to PhotoPrism with per-session enforcement: search queries get their path filter validated/injected, single-photo reads and like are ownership-checked, hash-addressed media and session/config pass through, everything else is 403 for scoped users. Admins (empty BasePath) pass through fully. prism.hubris.network will route here instead of straight to PhotoPrism. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
270
sidecar/handlers_ppproxy.go
Normal file
270
sidecar/handlers_ppproxy.go
Normal file
@@ -0,0 +1,270 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"net/http/httputil"
|
||||
"net/url"
|
||||
"regexp"
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
// Scoped PhotoPrism-compatible API proxy.
|
||||
//
|
||||
// PhotoPrism CE does not enforce auth_users.base_path on API reads — any
|
||||
// authenticated user can search the whole library (`q=path:"other/*"`),
|
||||
// verified empirically against this deployment. The web client compensates
|
||||
// by post-filtering inside /api/sidecar/*, but third-party PhotoPrism apps
|
||||
// (Gallery for PhotoPrism, Photo Uploader, …) speak to /api/v1 directly.
|
||||
//
|
||||
// This proxy is the public face for those apps. It forwards /api/v1/* to
|
||||
// PhotoPrism with these rules for sessions that carry a BasePath:
|
||||
//
|
||||
// - search endpoints (photos, geo) get their `path` filter rewritten so
|
||||
// results stay inside the caller's BasePath subtree;
|
||||
// - single-photo reads and like/unlike are ownership-checked per UID;
|
||||
// - hash-addressed media (t/, dl/, videos/) and session/config pass
|
||||
// through — media URLs embed per-instance preview/download tokens and
|
||||
// unguessable content hashes, the same protection PhotoPrism's own
|
||||
// share links rely on;
|
||||
// - album/label/subject reads pass through (names are visible across
|
||||
// users; the photos inside stay path-scoped);
|
||||
// - everything else (settings, users, index, import, batch, uploads,
|
||||
// any mutation) answers 403.
|
||||
//
|
||||
// Sessions with an empty BasePath (unscoped admins) pass through fully.
|
||||
|
||||
// ppQPathTerm matches a `path:` filter inside PhotoPrism's q-DSL — either
|
||||
// quoted (path:"a b/*") or bare (path:a/*).
|
||||
var ppQPathTerm = regexp.MustCompile(`(?i)\bpath:("[^"]*"|\S+)`)
|
||||
|
||||
// pathValueAllowed reports whether one path-filter value stays inside base.
|
||||
// PhotoPrism ORs `|`-separated alternatives inside a single value, so every
|
||||
// alternative must pass. A bare `base*` (no slash) is rejected because the
|
||||
// wildcard would also match sibling folders like `base2/…`.
|
||||
func pathValueAllowed(val, base string) bool {
|
||||
val = strings.Trim(val, `"`)
|
||||
for _, alt := range strings.Split(val, "|") {
|
||||
v := strings.Trim(strings.TrimSpace(alt), "/")
|
||||
if v == base {
|
||||
continue
|
||||
}
|
||||
if strings.HasPrefix(v, base+"/") {
|
||||
continue
|
||||
}
|
||||
return false
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
// scopeQ rewrites a q-DSL string so its path filter cannot leave base.
|
||||
// User-supplied path terms that already stay inside base are kept (the web
|
||||
// client and gallery apps use them for folder drills); any term that
|
||||
// escapes — or the absence of one — collapses to `path:"base/*"`.
|
||||
func scopeQ(q, base string) string {
|
||||
terms := ppQPathTerm.FindAllStringSubmatch(q, -1)
|
||||
if len(terms) > 0 {
|
||||
ok := true
|
||||
for _, m := range terms {
|
||||
if !pathValueAllowed(m[1], base) {
|
||||
ok = false
|
||||
break
|
||||
}
|
||||
}
|
||||
if ok {
|
||||
return q
|
||||
}
|
||||
q = strings.TrimSpace(ppQPathTerm.ReplaceAllString(q, ""))
|
||||
}
|
||||
scope := ` path:"` + strings.ReplaceAll(base, `"`, "") + `/*"`
|
||||
return strings.TrimSpace(q + scope)
|
||||
}
|
||||
|
||||
// scopeSearchValues enforces the BasePath on a search request's query
|
||||
// string. The q-DSL `path:` term overrides the `path` form parameter in
|
||||
// PhotoPrism's parser (verified empirically), so the guarantee lives in q;
|
||||
// the standalone param is validated too so it can't disagree.
|
||||
func scopeSearchValues(v url.Values, base string) url.Values {
|
||||
v.Set("q", scopeQ(v.Get("q"), base))
|
||||
if p := v.Get("path"); p != "" && !pathValueAllowed(p, base) {
|
||||
v.Del("path")
|
||||
}
|
||||
return v
|
||||
}
|
||||
|
||||
// ppProxyPhoto is the projection needed for per-UID ownership checks.
|
||||
type ppProxyPhoto struct {
|
||||
Path string `json:"Path"`
|
||||
Files []ppFile `json:"Files"`
|
||||
}
|
||||
|
||||
// photoWithinBase fetches one photo with the caller's own token and checks
|
||||
// that it lives inside base. Fails closed on any error.
|
||||
func photoWithinBase(ctx context.Context, pp *ppClient, token, uid, base string) bool {
|
||||
resp, err := pp.call(ctx, http.MethodGet, "/api/v1/photos/"+url.PathEscape(uid), token, nil)
|
||||
if err != nil || !resp.OK {
|
||||
return false
|
||||
}
|
||||
var p ppProxyPhoto
|
||||
if err := json.Unmarshal(resp.Body, &p); err != nil {
|
||||
return false
|
||||
}
|
||||
if p.Path != "" {
|
||||
return p.Path == base || strings.HasPrefix(p.Path, base+"/")
|
||||
}
|
||||
for _, f := range p.Files {
|
||||
if f.Root == "/" && strings.HasPrefix(f.Name, base+"/") {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// cachedSession is a short-lived token→user cache so a burst of gallery
|
||||
// requests doesn't double every call with a /session probe. 60s matches
|
||||
// the BasePath reconciler cadence; a revoked token lives at most that long.
|
||||
type cachedSession struct {
|
||||
user *ppSessionUser
|
||||
expiry time.Time
|
||||
}
|
||||
|
||||
type sessionCache struct {
|
||||
mu sync.Mutex
|
||||
m map[string]cachedSession
|
||||
}
|
||||
|
||||
func (sc *sessionCache) resolve(ctx context.Context, pp *ppClient, token string) *ppSessionUser {
|
||||
if token == "" {
|
||||
return nil
|
||||
}
|
||||
now := time.Now()
|
||||
sc.mu.Lock()
|
||||
if e, ok := sc.m[token]; ok && now.Before(e.expiry) {
|
||||
sc.mu.Unlock()
|
||||
return e.user
|
||||
}
|
||||
sc.mu.Unlock()
|
||||
user := pp.resolveSession(ctx, token)
|
||||
if user == nil {
|
||||
return nil
|
||||
}
|
||||
sc.mu.Lock()
|
||||
if len(sc.m) > 1024 { // hard cap; sessions are few, tokens churn rarely
|
||||
sc.m = map[string]cachedSession{}
|
||||
}
|
||||
sc.m[token] = cachedSession{user: user, expiry: now.Add(60 * time.Second)}
|
||||
sc.mu.Unlock()
|
||||
return user
|
||||
}
|
||||
|
||||
// proxyToken pulls the session token from any header form PhotoPrism
|
||||
// clients use: X-Auth-Token (canonical), Authorization: Bearer, or the
|
||||
// legacy X-Session-ID.
|
||||
func proxyToken(r *http.Request) string {
|
||||
if t := r.Header.Get("X-Auth-Token"); t != "" {
|
||||
return t
|
||||
}
|
||||
if a := r.Header.Get("Authorization"); strings.HasPrefix(a, "Bearer ") {
|
||||
return strings.TrimPrefix(a, "Bearer ")
|
||||
}
|
||||
return r.Header.Get("X-Session-ID")
|
||||
}
|
||||
|
||||
// handlePPProxy returns the gin handler mounted at /api/v1/*rest.
|
||||
func handlePPProxy(cfg *Config) gin.HandlerFunc {
|
||||
target, err := url.Parse(cfg.PhotoprismBaseURL)
|
||||
if err != nil {
|
||||
slog.Error("pp-proxy: bad PHOTOPRISM_BASE_URL", "err", err)
|
||||
return func(c *gin.Context) { c.AbortWithStatus(http.StatusBadGateway) }
|
||||
}
|
||||
proxy := httputil.NewSingleHostReverseProxy(target)
|
||||
proxy.ErrorHandler = func(w http.ResponseWriter, r *http.Request, err error) {
|
||||
slog.Warn("pp-proxy: upstream error", "path", r.URL.Path, "err", err)
|
||||
w.WriteHeader(http.StatusBadGateway)
|
||||
}
|
||||
// Ownership checks reuse the normal client; a dedicated instance would
|
||||
// gain nothing.
|
||||
pp := newPPClient(cfg.PhotoprismBaseURL)
|
||||
cache := &sessionCache{m: map[string]cachedSession{}}
|
||||
|
||||
forbid := func(c *gin.Context) {
|
||||
c.AbortWithStatusJSON(http.StatusForbidden,
|
||||
gin.H{"error": "not available through this proxy"})
|
||||
}
|
||||
|
||||
return func(c *gin.Context) {
|
||||
rest := strings.TrimPrefix(strings.TrimPrefix(c.Param("rest"), "/"), "")
|
||||
method := c.Request.Method
|
||||
|
||||
// Unauthenticated / token-in-URL surface: login+logout, client
|
||||
// config, hash-addressed media, websocket.
|
||||
passUnscoped := rest == "session" || strings.HasPrefix(rest, "session/") ||
|
||||
strings.HasPrefix(rest, "oauth/") ||
|
||||
rest == "config" || rest == "ws" ||
|
||||
strings.HasPrefix(rest, "t/") ||
|
||||
strings.HasPrefix(rest, "dl/") ||
|
||||
strings.HasPrefix(rest, "videos/") ||
|
||||
strings.HasPrefix(rest, "svg/")
|
||||
if passUnscoped {
|
||||
proxy.ServeHTTP(c.Writer, c.Request)
|
||||
return
|
||||
}
|
||||
|
||||
user := cache.resolve(c.Request.Context(), pp, proxyToken(c.Request))
|
||||
if user == nil {
|
||||
c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "invalid session"})
|
||||
return
|
||||
}
|
||||
base := strings.Trim(user.BasePath, "/")
|
||||
if base == "" {
|
||||
// Unscoped admin — full pass-through.
|
||||
proxy.ServeHTTP(c.Writer, c.Request)
|
||||
return
|
||||
}
|
||||
|
||||
isGet := method == http.MethodGet || method == http.MethodHead
|
||||
switch {
|
||||
// Search endpoints: enforce the path scope inside the query.
|
||||
case isGet && (rest == "photos" || rest == "photos/view" || rest == "geo"):
|
||||
q := c.Request.URL.Query()
|
||||
c.Request.URL.RawQuery = scopeSearchValues(q, base).Encode()
|
||||
proxy.ServeHTTP(c.Writer, c.Request)
|
||||
|
||||
// Single-photo reads + like/unlike: ownership-checked per UID.
|
||||
case strings.HasPrefix(rest, "photos/"):
|
||||
parts := strings.Split(rest, "/")
|
||||
uid := parts[1]
|
||||
allowed := (isGet && len(parts) == 2) || // GET photos/:uid
|
||||
(isGet && len(parts) == 3 && parts[2] == "dl") ||
|
||||
(len(parts) == 3 && parts[2] == "like" &&
|
||||
(method == http.MethodPost || method == http.MethodDelete))
|
||||
if !allowed {
|
||||
forbid(c)
|
||||
return
|
||||
}
|
||||
if !photoWithinBase(c.Request.Context(), pp, proxyToken(c.Request), uid, base) {
|
||||
c.AbortWithStatusJSON(http.StatusNotFound, gin.H{"error": "photo not found"})
|
||||
return
|
||||
}
|
||||
proxy.ServeHTTP(c.Writer, c.Request)
|
||||
|
||||
// Collection reads: names are shared across users by design (CE has
|
||||
// no per-user albums); their photo contents stay path-scoped above.
|
||||
case isGet && (rest == "albums" || strings.HasPrefix(rest, "albums/") ||
|
||||
rest == "labels" || strings.HasPrefix(rest, "labels/") ||
|
||||
rest == "subjects" || strings.HasPrefix(rest, "subjects/") ||
|
||||
rest == "faces" || strings.HasPrefix(rest, "faces/")):
|
||||
proxy.ServeHTTP(c.Writer, c.Request)
|
||||
|
||||
default:
|
||||
slog.Info("pp-proxy: blocked", "user", user.UserName, "method", method, "path", rest)
|
||||
forbid(c)
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user