nixamp 0.28.1 → 0.28.2

package/dist/owner.js

@@ -136,6 +136,8 @@ export function needsMember(path, method = "GET") {
         return true;
     if (method === "POST" && /^\/api\/channels\/[^/]+\/keep$/.test(path))
         return true;
+    if (method === "POST" && /^\/api\/channels\/[^/]+\/(?:start|stop|restart)$/.test(path))
+        return true;
     // A link -- a YouTube page, an IPTV feed, a file somewhere -- is the one
     // thing a member can go live with that needs nothing on the server first,
     // and it was the one thing they could not. Going live with one is the same

package/dist/server.js

@@ -3480,14 +3480,18 @@ export function createHandler(engine, options) {
                 return;
             }
             if (!check.allowed) {
-                if (member !== "" && needsMember(path, request.method ?? "GET")) {
+                const ownedChannel = channelId === "" ? "" : options.channels?.info(channelId)?.startedBy ?? "";
+                const memberOwnsChannel = member !== "" && ownedChannel === member;
+                if (member !== "" && (needsMember(path, request.method ?? "GET") || memberOwnsChannel)) {
                     // Metered per member, before anything is done: going live is a
                     // decoder on this machine, and a script could ask for one a
                     // second. Three a minute is a person; more is not.
-                    const refused = await memberThrottle.handle(requestFor(request));
-                    if (refused) {
-                        await answerWith(response, refused);
-                        return;
+                    if (needsMember(path, request.method ?? "GET")) {
+                        const refused = await memberThrottle.handle(requestFor(request));
+                        if (refused) {
+                            await answerWith(response, refused);
+                            return;
+                        }
                     }
                     liveBy = member;
                 }
@@ -4406,7 +4410,7 @@ export function createHandler(engine, options) {
                 json(response, 200, { ok: true, channel: id, name });
                 return;
             }
-            if (action === undefined && request.method === "DELETE") {
+            if ((action === undefined && request.method === "DELETE") || (action === "stop" && request.method === "POST")) {
                 // A member takes off what they put on, and nothing else.
                 if (liveBy && channels.info(id)?.startedBy !== liveBy) {
                     json(response, 403, { error: "that stream is not yours to take off" });
@@ -4444,7 +4448,7 @@ export function createHandler(engine, options) {
              * take it off, put it back -- without having to know the source, which
              * a browser is never told.
              */
-            if (action === "restart") {
+            if (action === "start" || action === "restart") {
                 if (!channels.has(id)) {
                     json(response, 404, { error: "nothing is playing on that channel" });
                     return;
@@ -4453,6 +4457,10 @@ export function createHandler(engine, options) {
                     json(response, 409, { error: "that channel is published into this server; restart it at the publisher" });
                     return;
                 }
+                if (liveBy && channels.info(id)?.startedBy !== liveBy) {
+                    json(response, 403, { error: "that stream is not yours to restart" });
+                    return;
+                }
                 const restarted = channels.restart(id);
                 json(response, restarted ? 200 : 409, { ok: restarted });
                 return;
@@ -4472,6 +4480,10 @@ export function createHandler(engine, options) {
                 // a member, counted and marked like anything else they put on.
                 if (liveBy) {
                     const info = channels.info(id);
+                    if (info && info.startedBy && info.startedBy !== liveBy) {
+                        json(response, 403, { error: "that stream is not yours to keep" });
+                        return;
+                    }
                     if (info && !info.startedBy && !channels.isEphemeral(id)) {
                         json(response, 403, { error: "that stream is the owner's" });
                         return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nixamp",
-  "version": "0.28.1",
+  "version": "0.28.2",
   "description": "It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.",
   "license": "MIT",
   "type": "module",

package/src/owner.ts

@@ -148,6 +148,7 @@ export function needsMember(path: string, method = "GET"): boolean {
   if (method === "POST" && /^\/api\/tracks\/\d+\/live$/.test(path)) return true;
   if (method === "POST" && /^\/api\/catalogs\/[^/]+\/entries\/[^/]+\/live$/.test(path)) return true;
   if (method === "POST" && /^\/api\/channels\/[^/]+\/keep$/.test(path)) return true;
+  if (method === "POST" && /^\/api\/channels\/[^/]+\/(?:start|stop|restart)$/.test(path)) return true;
   // A link -- a YouTube page, an IPTV feed, a file somewhere -- is the one
   // thing a member can go live with that needs nothing on the server first,
   // and it was the one thing they could not. Going live with one is the same

package/src/server.ts

@@ -3926,14 +3926,18 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
         return;
       }
       if (!check.allowed) {
-        if (member !== "" && needsMember(path, request.method ?? "GET")) {
+        const ownedChannel = channelId === "" ? "" : options.channels?.info(channelId)?.startedBy ?? "";
+        const memberOwnsChannel = member !== "" && ownedChannel === member;
+        if (member !== "" && (needsMember(path, request.method ?? "GET") || memberOwnsChannel)) {
           // Metered per member, before anything is done: going live is a
           // decoder on this machine, and a script could ask for one a
           // second. Three a minute is a person; more is not.
-          const refused = await memberThrottle.handle(requestFor(request));
-          if (refused) {
-            await answerWith(response, refused);
-            return;
+          if (needsMember(path, request.method ?? "GET")) {
+            const refused = await memberThrottle.handle(requestFor(request));
+            if (refused) {
+              await answerWith(response, refused);
+              return;
+            }
           }
           liveBy = member;
         } else {
@@ -4858,7 +4862,7 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
         return;
       }
 
-      if (action === undefined && request.method === "DELETE") {
+      if ((action === undefined && request.method === "DELETE") || (action === "stop" && request.method === "POST")) {
         // A member takes off what they put on, and nothing else.
         if (liveBy && channels.info(id)?.startedBy !== liveBy) {
           json(response, 403, { error: "that stream is not yours to take off" });
@@ -4898,7 +4902,7 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
        * take it off, put it back -- without having to know the source, which
        * a browser is never told.
        */
-      if (action === "restart") {
+      if (action === "start" || action === "restart") {
         if (!channels.has(id)) {
           json(response, 404, { error: "nothing is playing on that channel" });
           return;
@@ -4907,6 +4911,10 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
           json(response, 409, { error: "that channel is published into this server; restart it at the publisher" });
           return;
         }
+        if (liveBy && channels.info(id)?.startedBy !== liveBy) {
+          json(response, 403, { error: "that stream is not yours to restart" });
+          return;
+        }
         const restarted = channels.restart(id);
         json(response, restarted ? 200 : 409, { ok: restarted });
         return;
@@ -4927,6 +4935,10 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
         // a member, counted and marked like anything else they put on.
         if (liveBy) {
           const info = channels.info(id);
+          if (info && info.startedBy && info.startedBy !== liveBy) {
+            json(response, 403, { error: "that stream is not yours to keep" });
+            return;
+          }
           if (info && !info.startedBy && !channels.isEphemeral(id)) {
             json(response, 403, { error: "that stream is the owner's" });
             return;

package/web/dist/assets/{hls-3VKVEQE3-DQXeuMAN.js → hls-3VKVEQE3-Cw5UD-5P.js}

@@ -1 +1 @@
-import{t as e}from"./index-HDrZHpqb.js";var t=3;async function n(n){let{media:r,src:i,isTv:a}=n,{default:o}=await e(async()=>{let{default:e}=await import(`./hls-n74Cnh8A.js`);return{default:e}},[]);if(!o.isSupported())return n.onError(`This browser cannot play HLS streams.`),{destroy:()=>void 0,levels:()=>[]};let s=new o({...a?{maxBufferLength:60,maxMaxBufferLength:120,backBufferLength:30,liveSyncDurationCount:4}:{backBufferLength:90},enableWorker:!0}),c=0,l=!1;s.on(o.Events.ERROR,(e,r)=>{if(!l&&r.fatal){if(c>=t){n.onError(`This stream kept failing and has been stopped.`),s.destroy();return}switch(c+=1,r.type){case o.ErrorTypes.NETWORK_ERROR:n.onNotice(`Reconnecting…`),s.startLoad();break;case o.ErrorTypes.MEDIA_ERROR:n.onNotice(`Recovering…`),s.recoverMediaError();break;default:n.onError(`This stream could not be played.`),s.destroy()}}}),s.on(o.Events.MANIFEST_PARSED,()=>{l||(n.onNotice(null),n.onReady?.({live:s.levels.length>0&&!Number.isFinite(r.duration),levels:u()}))}),s.on(o.Events.LEVEL_LOADED,(e,t)=>{l||n.onReady?.({live:t.details.live,levels:u()})}),s.on(o.Events.FRAG_BUFFERED,()=>{l||n.onNotice(null)});function u(){return s.levels.map((e,t)=>({index:t,height:e.height||null,bitrate:e.bitrate||null,label:e.height?`${String(e.height)}p`:`${String(Math.round((e.bitrate||0)/1e3))}k`}))}return s.loadSource(i),s.attachMedia(r),{destroy(){l=!0,s.destroy()},levels:u,setLevel(e){s.currentLevel=e},currentLevel:()=>s.autoLevelEnabled?-1:s.currentLevel}}export{n as createHlsEngine};
+import{t as e}from"./index-BqcDIh2Q.js";var t=3;async function n(n){let{media:r,src:i,isTv:a}=n,{default:o}=await e(async()=>{let{default:e}=await import(`./hls-n74Cnh8A.js`);return{default:e}},[]);if(!o.isSupported())return n.onError(`This browser cannot play HLS streams.`),{destroy:()=>void 0,levels:()=>[]};let s=new o({...a?{maxBufferLength:60,maxMaxBufferLength:120,backBufferLength:30,liveSyncDurationCount:4}:{backBufferLength:90},enableWorker:!0}),c=0,l=!1;s.on(o.Events.ERROR,(e,r)=>{if(!l&&r.fatal){if(c>=t){n.onError(`This stream kept failing and has been stopped.`),s.destroy();return}switch(c+=1,r.type){case o.ErrorTypes.NETWORK_ERROR:n.onNotice(`Reconnecting…`),s.startLoad();break;case o.ErrorTypes.MEDIA_ERROR:n.onNotice(`Recovering…`),s.recoverMediaError();break;default:n.onError(`This stream could not be played.`),s.destroy()}}}),s.on(o.Events.MANIFEST_PARSED,()=>{l||(n.onNotice(null),n.onReady?.({live:s.levels.length>0&&!Number.isFinite(r.duration),levels:u()}))}),s.on(o.Events.LEVEL_LOADED,(e,t)=>{l||n.onReady?.({live:t.details.live,levels:u()})}),s.on(o.Events.FRAG_BUFFERED,()=>{l||n.onNotice(null)});function u(){return s.levels.map((e,t)=>({index:t,height:e.height||null,bitrate:e.bitrate||null,label:e.height?`${String(e.height)}p`:`${String(Math.round((e.bitrate||0)/1e3))}k`}))}return s.loadSource(i),s.attachMedia(r),{destroy(){l=!0,s.destroy()},levels:u,setLevel(e){s.currentLevel=e},currentLevel:()=>s.autoLevelEnabled?-1:s.currentLevel}}export{n as createHlsEngine};