APIv2 stream signing and slug validation (#1600)

* update stream endpoints to include slug in path parameters

* include signed urls when building response

* add slug validation to stream endpoints

* fix linting

Author: carlobortolan

apiv2/helpers/parser.go

@@ -6,6 +6,7 @@ import (
 
 	protobuf "github.com/TUM-Dev/gocast/apiv2/protobuf/server"
 	"github.com/TUM-Dev/gocast/model"
+	"github.com/TUM-Dev/gocast/tools"
 	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
@@ -89,10 +90,11 @@ func ParseSemesterToProto(semester model.Semester) *protobuf.Semester {
 }
 
 // ParseStreamToProto converts a Stream model to its protobuf representation.
-// It returns an error if the conversion of timestamps fails.
-func ParseStreamToProto(stream model.Stream, downloads []model.DownloadableVod) *protobuf.Stream {
+func ParseStreamToProto(stream model.Stream, course model.Course, user *model.User) *protobuf.Stream {
 	liveNow := stream.LiveNowTimestamp.After(time.Now())
 
+	_ = tools.SetSignedPlaylists(&stream, user, course.DownloadsEnabled)
+
 	s := &protobuf.Stream{
 		Id:               uint32(stream.ID),
 		Name:             stream.Name,
@@ -126,8 +128,10 @@ func ParseStreamToProto(stream model.Stream, downloads []model.DownloadableVod)
 		s.Duration = uint32(stream.Duration.Int32)
 	}
 
-	for _, download := range downloads {
-		s.Downloads = append(s.Downloads, ParseDownloadToProto(download))
+	if course.DownloadsEnabled {
+		for _, download := range stream.GetVodFiles() {
+			s.Downloads = append(s.Downloads, ParseDownloadToProto(download))
+		}
 	}
 
 	return s

apiv2/protobuf/server/apiv2.pb.go

@@ -183,46 +183,46 @@ service API {
   // STREAM ENDPOINTS (./stream.go)
 
   rpc getStream(GetStreamRequest) returns (CourseStream) {
-    option (google.api.http) = {get: "/streams/{stream_id}"};
+    option (google.api.http) = {get: "/streams/{slug}/{stream_id}"};
     option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
       tags: "Streams"
-      summary: "Get stream and course by stream ID."
+      summary: "Get stream and course by course slug and stream ID."
       description: "Retrieves a stream and its course by its stream ID."
     };
   }
 
   rpc getVideoSections(GetVideoSectionsRequest) returns (GetVideoSectionsResponse) {
-    option (google.api.http) = {get: "/streams/{stream_id}/sections"};
+    option (google.api.http) = {get: "/streams/{slug}/{stream_id}/sections"};
     option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
       tags: "Streams"
-      summary: "Get video sections."
+      summary: "Get video sections by course slug and stream ID."
       description: "Retrieves the video sections for a stream."
     };
   }
 
   rpc getStreamPlaylist(GetStreamPlaylistRequest) returns (GetStreamPlaylistResponse) {
-    option (google.api.http) = {get: "/streams/{stream_id}/playlist"};
+    option (google.api.http) = {get: "/streams/{slug}/{stream_id}/playlist"};
     option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
       tags: "Streams"
-      summary: "Get stream playlist."
+      summary: "Get stream playlist by course slug and stream ID."
       description: "Retrieves the playlist for a stream including watch progress."
     };
   }
 
   rpc getSubtitles(GetSubtitlesRequest) returns (google.api.HttpBody) {
-    option (google.api.http) = {get: "/streams/{stream_id}/subtitles/{lang}"};
+    option (google.api.http) = {get: "/streams/{slug}/{stream_id}/subtitles/{lang}"};
     option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
       tags: "Streams"
-      summary: "Get subtitles."
+      summary: "Get subtitles by course slug, stream ID, and language."
       description: "Retrieves the subtitles for a stream in a specific language."
     };
   }
 
   rpc getThumbs(GetThumbsRequest) returns (google.api.HttpBody) {
-    option (google.api.http) = {get: "/streams/{stream_id}/thumbs"};
+    option (google.api.http) = {get: "/streams/{slug}/{stream_id}/thumbs"};
     option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_operation) = {
       tags: "Streams"
-      summary: "Get thumbs."
+      summary: "Get thumbs by course slug, stream ID, and optional thumb type."
       description: "Retrieves the thumbs for a stream."
     };
   }
@@ -644,24 +644,29 @@ enum VideoType {
 
 message GetStreamRequest {
   uint32 stream_id = 1;
+  string slug = 2;
 }
 
 message GetVideoSectionsRequest {
   uint32 stream_id = 1;
+  string slug = 2;
 }
 
 message GetSubtitlesRequest {
   uint32 stream_id = 1;
   string lang = 2;
+  string slug = 3;
 }
 
 message GetStreamPlaylistRequest {
   uint32 stream_id = 1;
+  string slug = 2;
 }
 
 message GetThumbsRequest {
   uint32 stream_id = 1;
   optional VideoType thumb_type = 2;
+  string slug = 3;
 }
 
 ///////////////////////////////

apiv2/protobuf/server/apiv2.pb.gw.go

@@ -101,7 +101,6 @@ type StreamRequest interface {
 	GetStreamId() uint32
 }
 
-// Checks if the user is allowed to access the stream and course and returns the user, stream and course
 func (a *API) authorizeUserForStreamCourse(ctx context.Context, req StreamRequest) (*model.User, model.Stream, model.Course, error) {
 	stream := model.Stream{}
 	course := model.Course{}
@@ -119,6 +118,16 @@ func (a *API) authorizeUserForStreamCourse(ctx context.Context, req StreamReques
 		return nil, stream, course, e.WithStatus(http.StatusInternalServerError, err)
 	}
 
+	// Only check slug if request requires it
+	type slugGetter interface {
+		GetSlug() string
+	}
+	if r, ok := req.(slugGetter); ok {
+		if r.GetSlug() != course.Slug {
+			return nil, stream, course, e.WithStatus(http.StatusBadRequest, errors.New("slug does not match course"))
+		}
+	}
+
 	user, _ := a.getCurrent(ctx)
 	if !user.IsEligibleToWatchCourse(course) {
 		return nil, stream, course, e.WithStatus(http.StatusForbidden, errors.New("User is not eligible to access course content"))

apiv2/server/apiv2.proto

@@ -67,7 +67,7 @@ func (a *API) GetLiveCourses(ctx context.Context, req *emptypb.Empty) (*protobuf
 
 		resp = append(resp, &protobuf.CourseStream{
 			Course:      h.ParseCourseToProto(courseForLiveStream, user),
-			Stream:      h.ParseStreamToProto(stream, nil),
+			Stream:      h.ParseStreamToProto(stream, courseForLiveStream, user),
 			LectureHall: h.ParseLectureHallToProto(lectureHall),
 			// Viewers:     viewers,
 		})
@@ -140,10 +140,10 @@ func (a *API) GetCourseBySlug(ctx context.Context, req *protobuf.GetCourseBySlug
 		return nil, e.WithStatus(http.StatusUnauthorized, errors.New("unauthorized"))
 	}
 
-	streams := make([]*protobuf.Stream, len(course.Streams))
-	for i, stream := range course.Streams {
+	streams := make([]*protobuf.Stream, 0, len(course.Streams))
+	for _, stream := range course.Streams {
 		if !stream.Private || user.IsAdminOfCourse(course) {
-			streams[i] = h.ParseStreamToProto(stream, nil)
+			streams = append(streams, h.ParseStreamToProto(stream, course, user))
 		}
 	}
 

apiv2/server/authorization.go

@@ -631,9 +631,9 @@
         ]
       }
     },
-    "/streams/{streamId}": {
+    "/streams/{slug}/{streamId}": {
       "get": {
-        "summary": "Get stream and course by stream ID.",
+        "summary": "Get stream and course by course slug and stream ID.",
         "description": "Retrieves a stream and its course by its stream ID.",
         "operationId": "API_getStream",
         "responses": {
@@ -651,6 +651,12 @@
           }
         },
         "parameters": [
+          {
+            "name": "slug",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          },
           {
             "name": "streamId",
             "in": "path",
@@ -664,9 +670,9 @@
         ]
       }
     },
-    "/streams/{streamId}/playlist": {
+    "/streams/{slug}/{streamId}/playlist": {
       "get": {
-        "summary": "Get stream playlist.",
+        "summary": "Get stream playlist by course slug and stream ID.",
         "description": "Retrieves the playlist for a stream including watch progress.",
         "operationId": "API_getStreamPlaylist",
         "responses": {
@@ -684,6 +690,12 @@
           }
         },
         "parameters": [
+          {
+            "name": "slug",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          },
           {
             "name": "streamId",
             "in": "path",
@@ -697,9 +709,9 @@
         ]
       }
     },
-    "/streams/{streamId}/sections": {
+    "/streams/{slug}/{streamId}/sections": {
       "get": {
-        "summary": "Get video sections.",
+        "summary": "Get video sections by course slug and stream ID.",
         "description": "Retrieves the video sections for a stream.",
         "operationId": "API_getVideoSections",
         "responses": {
@@ -717,6 +729,12 @@
           }
         },
         "parameters": [
+          {
+            "name": "slug",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          },
           {
             "name": "streamId",
             "in": "path",
@@ -730,9 +748,9 @@
         ]
       }
     },
-    "/streams/{streamId}/subtitles/{lang}": {
+    "/streams/{slug}/{streamId}/subtitles/{lang}": {
       "get": {
-        "summary": "Get subtitles.",
+        "summary": "Get subtitles by course slug, stream ID, and language.",
         "description": "Retrieves the subtitles for a stream in a specific language.",
         "operationId": "API_getSubtitles",
         "responses": {
@@ -750,6 +768,12 @@
           }
         },
         "parameters": [
+          {
+            "name": "slug",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          },
           {
             "name": "streamId",
             "in": "path",
@@ -769,9 +793,9 @@
         ]
       }
     },
-    "/streams/{streamId}/thumbs": {
+    "/streams/{slug}/{streamId}/thumbs": {
       "get": {
-        "summary": "Get thumbs.",
+        "summary": "Get thumbs by course slug, stream ID, and optional thumb type.",
         "description": "Retrieves the thumbs for a stream.",
         "operationId": "API_getThumbs",
         "responses": {
@@ -789,6 +813,12 @@
           }
         },
         "parameters": [
+          {
+            "name": "slug",
+            "in": "path",
+            "required": true,
+            "type": "string"
+          },
           {
             "name": "streamId",
             "in": "path",

apiv2/server/course.go

@@ -21,7 +21,7 @@ import (
 func (a *API) GetStream(ctx context.Context, req *protobuf.GetStreamRequest) (*protobuf.CourseStream, error) {
 	a.log.Info("GetStream")
 
-	_, stream, course, err := a.authorizeUserForStreamCourse(ctx, req)
+	user, stream, course, err := a.authorizeUserForStreamCourse(ctx, req)
 	if err != nil {
 		return nil, err
 	}
@@ -38,7 +38,7 @@ func (a *API) GetStream(ctx context.Context, req *protobuf.GetStreamRequest) (*p
 
 	return &protobuf.CourseStream{
 		Course:      h.ParseCourseToProto(course, nil),
-		Stream:      h.ParseStreamToProto(stream, nil),
+		Stream:      h.ParseStreamToProto(stream, course, user),
 		LectureHall: h.ParseLectureHallToProto(lectureHall),
 	}, nil
 }