CoffeeKnyte
0217cce2df
Add the enforcement layer on top of server-observed monitoring: a revocation kill switch that stops any stream within ~120s and keeps it dead, plus an async over-cap enforcer that drives kills off the live monitoring picture — entirely off the per-segment hot path and with no client-protocol change. - internal/streamrevoke: the central kill list. IsRevoked is a pure in-memory lookup safe on the request hot path; a Redis pub/sub + poll mirror keeps edge caches current, and a Postgres durable mirror lets kills survive a server restart AND a Redis flush so a restart-resilient stream cannot be reconstructed and re-served after being killed. A user revocation is a cutoff (kills tokens minted before it, spares post-reauth tokens), not a 24h ban. - internal/streamenforcer: async over-cap brain — reads the monitoring snapshot and per-user limits, selects victims, and collapses every reason (exceeded limit, admin terminate, abuse) to the same action: write a revocation. - Edge + native + jellycompat enforcement: proxy refuses revoked sessions on every request and cuts long direct-play/remux pours mid-stream; the transcode node guards both serve and the reconstruct path so a killed session is never re-spawned after a node restart; jellycompat serve surfaces close their kill-switch coverage holes. - streamtoken.IssuedTime exposes the token iat the user-kill cutoff compares against; token IssuedTime + revocation guards wire through router, downloads, and admin terminate-by-id (with admin-list dedupe). - Restore sendfile zero-copy on direct-play/remux byte counting so the monitor's served-byte accounting does not cost the sendfile fast path. - migrations/sql: stream_revocations durable table. Part of the stream monitoring & kill-switch epic.
110 lines
2.9 KiB
Go
110 lines
2.9 KiB
Go
package middleware
|
|
|
|
import (
|
|
"bufio"
|
|
"fmt"
|
|
"net"
|
|
"net/http"
|
|
"regexp"
|
|
"strconv"
|
|
"time"
|
|
|
|
"github.com/prometheus/client_golang/prometheus"
|
|
"github.com/prometheus/client_golang/prometheus/promauto"
|
|
)
|
|
|
|
var (
|
|
httpRequestsTotal = promauto.NewCounterVec(
|
|
prometheus.CounterOpts{
|
|
Name: "streamapp_http_requests_total",
|
|
Help: "Total number of HTTP requests.",
|
|
},
|
|
[]string{"method", "path", "status"},
|
|
)
|
|
|
|
httpRequestDuration = promauto.NewHistogramVec(
|
|
prometheus.HistogramOpts{
|
|
Name: "streamapp_http_request_duration_seconds",
|
|
Help: "Duration of HTTP requests in seconds.",
|
|
Buckets: prometheus.DefBuckets,
|
|
},
|
|
[]string{"method", "path"},
|
|
)
|
|
)
|
|
|
|
// Metrics is an HTTP middleware that records request count and duration.
|
|
func Metrics(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
start := time.Now()
|
|
|
|
// Wrap response writer to capture status code.
|
|
wrapped := &statusWriter{ResponseWriter: w, status: 200}
|
|
|
|
next.ServeHTTP(wrapped, r)
|
|
|
|
duration := time.Since(start).Seconds()
|
|
path := sanitizePath(r.URL.Path)
|
|
|
|
httpRequestsTotal.WithLabelValues(r.Method, path, strconv.Itoa(wrapped.status)).Inc()
|
|
httpRequestDuration.WithLabelValues(r.Method, path).Observe(duration)
|
|
})
|
|
}
|
|
|
|
type statusWriter struct {
|
|
http.ResponseWriter
|
|
status int
|
|
written bool
|
|
}
|
|
|
|
func (w *statusWriter) WriteHeader(status int) {
|
|
if !w.written {
|
|
w.status = status
|
|
w.written = true
|
|
}
|
|
w.ResponseWriter.WriteHeader(status)
|
|
}
|
|
|
|
// Hijack implements http.Hijacker, required for WebSocket upgrades.
|
|
func (w *statusWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
|
|
if hj, ok := w.ResponseWriter.(http.Hijacker); ok {
|
|
return hj.Hijack()
|
|
}
|
|
return nil, nil, fmt.Errorf("underlying ResponseWriter does not implement http.Hijacker")
|
|
}
|
|
|
|
// Flush implements http.Flusher so progressive responses keep flushing
|
|
// through the metrics wrapper instead of silently buffering.
|
|
func (w *statusWriter) Flush() {
|
|
if !w.written {
|
|
w.WriteHeader(http.StatusOK)
|
|
}
|
|
if f, ok := w.ResponseWriter.(http.Flusher); ok {
|
|
f.Flush()
|
|
}
|
|
}
|
|
|
|
// Unwrap exposes the wrapped ResponseWriter so http.ResponseController (used by
|
|
// the stream kill switch's in-flight cut via SetWriteDeadline) can reach the
|
|
// underlying socket instead of stopping at this wrapper and no-oping.
|
|
func (w *statusWriter) Unwrap() http.ResponseWriter {
|
|
return w.ResponseWriter
|
|
}
|
|
|
|
var (
|
|
uuidRegex = regexp.MustCompile(`[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`)
|
|
numericRegex = regexp.MustCompile(`/\d+(/|$)`)
|
|
)
|
|
|
|
// sanitizePath normalizes URL paths to avoid high-cardinality labels.
|
|
// Replaces dynamic segments (UUIDs, numeric IDs) with placeholders.
|
|
func sanitizePath(path string) string {
|
|
path = uuidRegex.ReplaceAllString(path, "{id}")
|
|
path = numericRegex.ReplaceAllStringFunc(path, func(m string) string {
|
|
if m[len(m)-1] == '/' {
|
|
return "/{id}/"
|
|
}
|
|
return "/{id}"
|
|
})
|
|
return path
|
|
}
|