pepepper/fluxer
1
0
Fork 0
mirror of https://github.com/fluxerapp/fluxer synced 2026-10-07 19:22:14 +09:00
Code Issues Packages Projects Releases Wiki Activity

feat(media-proxy): sign attachment URLs and gate origins (#2830)

Browse Source
This commit is contained in:
Hampus
2026-09-18 15:57:32 +02:00
committed by GitHub
parent 025c01ab13
commit 522cf08e61
108 changed files with 10148 additions and 441 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fluxer_docs/scripts/VerifyDocsCoverage.ts
+20
View File
@@ -192,6 +192,7 @@ const MEDIA_PROXY_ROUTES = new Map([
['HEAD /_health', '.route("/_health", get(routes::ops::health))'],
['GET /_metrics', '.route("/_metrics", get(routes::ops::metrics_handler))'],
['POST /_metadata', '.route("/_metadata", post(routes::internal::metadata_handler))'],
['POST /_sniff', '.route("/_sniff", post(routes::internal::sniff_handler))'],
['POST /_thumbnail', '.route("/_thumbnail", post(routes::internal::thumbnail_handler))'],
['POST /_frames', '.route("/_frames", post(routes::internal::frames_handler))'],
[
@@ -439,6 +440,25 @@ for (const [route, {documentedIn}] of OUT_OF_BAND_CREDENTIAL) {
}
failures += section('stale anchors (the code moved, update this script)', staleAnchors);
const mediaProxyRouterSource = await readFile(path.join(MEDIA_PROXY_SERVER_DIR, 'runtime.rs'), 'utf8');
const mediaProxyRegisteredPaths = [...mediaProxyRouterSource.matchAll(/\.route\(\s*"([^"]+)"/gu)].map((match) =>
match[1].replace(/\{[^}]*\}/gu, '{}'),
);
const mediaProxyListedPaths = new Set([...MEDIA_PROXY_ROUTES.keys()].map((shape) => shape.split(' ')[1]));
const unlistedMediaProxyPaths = [...new Set(mediaProxyRegisteredPaths)]
.filter((routePath) => !mediaProxyListedPaths.has(routePath))
.map((routePath) => `${routePath}: build_router registers it and MEDIA_PROXY_ROUTES does not name it`)
.sort();
if (mediaProxyRegisteredPaths.length === 0) {
unlistedMediaProxyPaths.push(
'fluxer_media_proxy/src/server/runtime.rs registers no route, so this check has gone blind',
);
}
failures += section('registered by fluxer_media_proxy but absent from this script', unlistedMediaProxyPaths);
console.log(
` routes registered in fluxer_media_proxy/src/server/runtime.rs: ${mediaProxyRegisteredPaths.length.toString()}`,
);
const mediaProxyDocumented = documented.filter((route) => route.file.startsWith('media-proxy/'));
const adminDocumented = documented.filter(
(route) => !route.file.startsWith('media-proxy/') && stripVersionPrefix(route.path).startsWith('/admin'),