Hermes (Server)
77a20422be
CRIT: - Cloud-Token jetzt in flutter_secure_storage (Keystore/Keychain) statt SharedPreferences, mit Migration alter Eintraege - usesCleartextTraffic entfernt (kein HTTP-Klartext mehr) HIGH: - Path-Traversal gefixt: p.basename bei YouTube-Download, Navidrome-Download und Cloud-Auto-Sync MED: - allowBackup=false (kein Backup von Token-Daten) - Navidrome-Salt kryptographisch sicher (Random.secure statt Timestamp)
255 lines
8.2 KiB
Dart
255 lines
8.2 KiB
Dart
import 'dart:convert';
|
|
import 'dart:io';
|
|
import 'package:http/http.dart' as http;
|
|
import 'package:flutter_secure_storage/flutter_secure_storage.dart';
|
|
import 'package:shared_preferences/shared_preferences.dart';
|
|
import '../config/app_config.dart';
|
|
import '../services/melo_logger.dart';
|
|
|
|
/// Cloud-Sync Service für Melo Registry.
|
|
/// Auth: Bearer-JWT vom Baka-Auth-Server (Login mit Nutzername + Passwort).
|
|
/// Der alte X-API-Key/X-User-Mechanismus wurde entfernt (IDOR-Lücke).
|
|
class CloudService {
|
|
static final CloudService _instanz = CloudService._();
|
|
factory CloudService() => _instanz;
|
|
CloudService._();
|
|
|
|
static String get _base => AppConfig.cloudUrl;
|
|
static String get _authBase => AppConfig.authUrl;
|
|
|
|
String _user = '';
|
|
String _token = '';
|
|
|
|
/// Token liegt verschlüsselt im Keychain/Keystore (flutter_secure_storage) —
|
|
/// nicht mehr im Klartext in SharedPreferences (Security-Audit CRIT-1).
|
|
static const _secure = FlutterSecureStorage();
|
|
|
|
String get user => _user;
|
|
String get token => _token;
|
|
bool get istAngemeldet => _token.isNotEmpty;
|
|
|
|
/// Echter Login gegen den Baka-Auth-Server.
|
|
/// Der Token wird gespeichert und bei allen Cloud-Calls als
|
|
/// Authorization: Bearer `token` mitgeschickt.
|
|
Future<bool> login(String user, String pass) async {
|
|
try {
|
|
final r = await http
|
|
.post(Uri.parse('$_authBase/login'),
|
|
headers: {'Content-Type': 'application/json'},
|
|
body: jsonEncode({'username': user, 'password': pass}))
|
|
.timeout(const Duration(seconds: 10));
|
|
if (r.statusCode == 200) {
|
|
final d = jsonDecode(r.body);
|
|
if (d['status'] == 'ok' && d['token'] != null) {
|
|
_user = d['username'] as String? ?? user;
|
|
_token = d['token'] as String;
|
|
await _speichereToken();
|
|
MeloLogger.cloudToken = _token;
|
|
return true;
|
|
}
|
|
}
|
|
} catch (_) {}
|
|
return false;
|
|
}
|
|
|
|
/// Stellt gespeicherten Token wieder her (Auto-Login nach App-Start).
|
|
/// Migriert einmalig alte SharedPreferences-Einträge in SecureStorage.
|
|
Future<bool> restoreLogin() async {
|
|
final prefs = await SharedPreferences.getInstance();
|
|
var t = await _secure.read(key: 'melo_cloud_token') ?? '';
|
|
var u = await _secure.read(key: 'melo_cloud_user') ?? '';
|
|
// Migration alter Versionen (Token lag früher in SharedPreferences)
|
|
if (t.isEmpty) {
|
|
final altT = prefs.getString('melo_cloud_token') ?? '';
|
|
final altU = prefs.getString('melo_cloud_user') ?? '';
|
|
if (altT.isNotEmpty) {
|
|
t = altT;
|
|
u = altU;
|
|
await _secure.write(key: 'melo_cloud_token', value: t);
|
|
if (u.isNotEmpty) {
|
|
await _secure.write(key: 'melo_cloud_user', value: u);
|
|
}
|
|
await prefs.remove('melo_cloud_token');
|
|
await prefs.remove('melo_cloud_user');
|
|
}
|
|
}
|
|
if (t.isEmpty) return false;
|
|
_token = t;
|
|
_user = u;
|
|
MeloLogger.cloudToken = t;
|
|
return true;
|
|
}
|
|
|
|
Future<void> logout() async {
|
|
_token = '';
|
|
_user = '';
|
|
MeloLogger.cloudToken = null;
|
|
await _secure.delete(key: 'melo_cloud_token');
|
|
await _secure.delete(key: 'melo_cloud_user');
|
|
}
|
|
|
|
Future<void> _speichereToken() async {
|
|
await _secure.write(key: 'melo_cloud_token', value: _token);
|
|
await _secure.write(key: 'melo_cloud_user', value: _user);
|
|
}
|
|
|
|
Map<String, String> get _authHeader => {
|
|
if (_token.isNotEmpty) 'Authorization': 'Bearer $_token',
|
|
};
|
|
|
|
Future<Map?> status() => _get('/api/cloud/status');
|
|
|
|
Future<List<Map>> listSongs() async {
|
|
final r = await _get('/api/cloud/list');
|
|
return List<Map>.from(r?['songs'] ?? []);
|
|
}
|
|
|
|
Future<String?> upload(String filepath, String filename) async {
|
|
try {
|
|
final req = http.MultipartRequest('POST', Uri.parse('$_base/api/cloud/upload'));
|
|
req.headers.addAll(_authHeader);
|
|
req.files.add(await http.MultipartFile.fromPath('file', filepath,
|
|
filename: filename));
|
|
final resp = await req.send().timeout(const Duration(seconds: 120));
|
|
final body = jsonDecode(await resp.stream.bytesToString());
|
|
return body['song_id'] as String?;
|
|
} catch (e) {
|
|
MeloLogger().fehler('cloud_upload', e);
|
|
return null;
|
|
}
|
|
}
|
|
|
|
Future<bool> download(String songId, String destPath) async {
|
|
try {
|
|
final r = await http
|
|
.get(Uri.parse('$_base/api/cloud/download/$songId'),
|
|
headers: _authHeader)
|
|
.timeout(const Duration(seconds: 120));
|
|
if (r.statusCode == 200) {
|
|
final file = File(destPath);
|
|
if (!await file.parent.exists()) {
|
|
await file.parent.create(recursive: true);
|
|
}
|
|
await file.writeAsBytes(r.bodyBytes);
|
|
return true;
|
|
}
|
|
return false;
|
|
} catch (e) {
|
|
MeloLogger().fehler('cloud_download', e);
|
|
return false;
|
|
}
|
|
}
|
|
|
|
Future<bool> delete(String songId) async {
|
|
try {
|
|
final r = await http
|
|
.post(Uri.parse('$_base/api/cloud/delete'),
|
|
headers: {..._authHeader, 'Content-Type': 'application/json'},
|
|
body: jsonEncode({'song_id': songId}))
|
|
.timeout(const Duration(seconds: 10));
|
|
return r.statusCode == 200;
|
|
} catch (_) {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
Future<Map?> _get(String path) async {
|
|
try {
|
|
final r = await http
|
|
.get(Uri.parse('$_base$path'), headers: _authHeader)
|
|
.timeout(const Duration(seconds: 10));
|
|
if (r.statusCode == 200) return jsonDecode(r.body);
|
|
} catch (_) {}
|
|
return null;
|
|
}
|
|
|
|
Future<String?> share(List<String> songIds) async {
|
|
try {
|
|
final r = await http
|
|
.post(Uri.parse('$_base/api/cloud/share'),
|
|
headers: {..._authHeader, 'Content-Type': 'application/json'},
|
|
body: jsonEncode({'song_ids': songIds}))
|
|
.timeout(const Duration(seconds: 10));
|
|
if (r.statusCode == 200) {
|
|
final d = jsonDecode(r.body);
|
|
return d['code'] as String?;
|
|
}
|
|
} catch (_) {}
|
|
return null;
|
|
}
|
|
|
|
Future<Map?> importCode(String code) async {
|
|
try {
|
|
final r = await http
|
|
.post(Uri.parse('$_base/api/cloud/import'),
|
|
headers: {..._authHeader, 'Content-Type': 'application/json'},
|
|
body: jsonEncode({'code': code}))
|
|
.timeout(const Duration(seconds: 10));
|
|
if (r.statusCode == 200) return jsonDecode(r.body);
|
|
} catch (_) {}
|
|
return null;
|
|
}
|
|
|
|
Future<List<Map>> syncChanges(String since) async {
|
|
try {
|
|
final r = await http
|
|
.post(Uri.parse('$_base/api/cloud/sync'),
|
|
headers: {..._authHeader, 'Content-Type': 'application/json'},
|
|
body: jsonEncode({'since': since}))
|
|
.timeout(const Duration(seconds: 10));
|
|
if (r.statusCode == 200) {
|
|
final d = jsonDecode(r.body);
|
|
return List<Map>.from(d['changes'] ?? []);
|
|
}
|
|
} catch (_) {}
|
|
return [];
|
|
}
|
|
|
|
Future<List<Map>> globalList() async {
|
|
try {
|
|
final r = await http
|
|
.get(Uri.parse('$_base/api/cloud/global'), headers: _authHeader)
|
|
.timeout(const Duration(seconds: 10));
|
|
if (r.statusCode == 200) {
|
|
return List<Map>.from(jsonDecode(r.body)['songs'] ?? []);
|
|
}
|
|
} catch (_) {}
|
|
return [];
|
|
}
|
|
|
|
Future<bool> toggleGlobal(String songId) async {
|
|
try {
|
|
final r = await http
|
|
.post(Uri.parse('$_base/api/cloud/toggle-global'),
|
|
headers: {..._authHeader, 'Content-Type': 'application/json'},
|
|
body: jsonEncode({'song_id': songId}))
|
|
.timeout(const Duration(seconds: 10));
|
|
return r.statusCode == 200;
|
|
} catch (_) {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
/// Löscht alle Cloud-Songs des angemeldeten Users (inkl. Server-Dateien).
|
|
Future<bool> loescheMusik() async {
|
|
return _postOhneBody('/api/cloud/delete-music');
|
|
}
|
|
|
|
/// Löscht ALLE Cloud-Daten des Users (Musik + Shares + Ordner).
|
|
Future<bool> loescheAlles() async {
|
|
return _postOhneBody('/api/cloud/delete-all');
|
|
}
|
|
|
|
Future<bool> _postOhneBody(String path) async {
|
|
try {
|
|
final r = await http
|
|
.post(Uri.parse('$_base$path'),
|
|
headers: {..._authHeader, 'Content-Type': 'application/json'})
|
|
.timeout(const Duration(seconds: 30));
|
|
return r.statusCode == 200;
|
|
} catch (_) {
|
|
return false;
|
|
}
|
|
}
|
|
}
|