New Webserver and WebApp (#942)
* Replace the WCF webserver with an ASP.NET Core webserver (VocaluxeWeb) - New project VocaluxeWeb: ASP.NET Core 2.3 (Kestrel) on .NET Framework 4.8.1, HTTP or HTTPS with a self-signed certificate, REST API (/api/v1) with Swagger, live events (Server-Sent Events) - Access to the game only through IVocaluxeRemote; requests run on the main thread once per frame - Sessions with roles (guest, player, admin) and configurable permissions, PINs hashed with PBKDF2 - Queue as a playlist with requesters and singers, fair order (one song per person and round) - Admin: settings, server status, logged-in devices, activate/deactivate and delete profiles - Profile pictures: own photo or one of the Vocaluxe avatars - Game: WebApp queue screen (song options, playlist group) to start the next song with the chosen singers, return to it after singing, warning when the webserver is off, remote keyboard - Old WCF server, WebserverInitalConfig and URL reservations removed; libraries moved to libs/managed - Unit tests for PIN hashing, settings and permissions, queue order and device names - AppVeyor: Visual Studio 2022 image and Node.js 24 (the build compiles the WebApp) - Documentation in VocaluxeWeb/README.md * New WebApp (Vue 3, TypeScript, Vite) replacing the old jQuery Mobile website - Login with profile and PIN, create profiles - Songs with search, filters, sorting and 30 second previews - Queue: add songs with game mode, audio and singers, edit, reorder, start in the game - Playlists: create, edit, add to the queue - Now playing with live updates, remote control and keyboard - Players: own profile with picture (photo or Vocaluxe avatar), roles for admins - Admin settings: permissions, server status, devices, profiles - Help page, responsive layout for phones, tablets and desktops, light and dark mode - Texts in WebApp/src/locales/en.json, translated with Transifex - Old website and PhoneGap config removed --------- Co-authored-by: Florian Ostertag <flokuep@users.noreply.github.com>
This commit is contained in:
McSchneidarandFlorian Ostertag authored and GitHub committed
1 parent
e3e9d1d6ae
commit
336d08040e
186 files changed
+14971
-6988
No files matched your search
@@ -0,0 +1,169 @@
|
||||
#region license
|
||||
// This file is part of Vocaluxe.
|
||||
//
|
||||
// Vocaluxe is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// Vocaluxe is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU General Public License
|
||||
// along with Vocaluxe. If not, see <http://www.gnu.org/licenses/>.
|
||||
#endregion
|
||||
|
||||
using System;
|
||||
using System.Collections.Concurrent;
|
||||
using System.Collections.Generic;
|
||||
using System.Linq;
|
||||
using Microsoft.AspNetCore.Http;
|
||||
using VocaluxeWeb.Remote;
|
||||
|
||||
namespace VocaluxeWeb.Services
|
||||
{
|
||||
public sealed class CSession
|
||||
{
|
||||
/// Public id of the session (the token itself is secret).
|
||||
public string Id;
|
||||
public string Token;
|
||||
public string UserAgent;
|
||||
public string RemoteAddress;
|
||||
public DateTime Created;
|
||||
public Guid ProfileId;
|
||||
public string ProfileName;
|
||||
public ERemoteRole Role;
|
||||
public DateTime LastSeen;
|
||||
}
|
||||
|
||||
/// Logged in devices. The token is kept in an HttpOnly cookie. Sessions live in memory only:
|
||||
|
||||
/// after a restart of Vocaluxe the WebApp logs in again (automatically for profiles without PIN).
|
||||
public sealed class CSessionStore
|
||||
{
|
||||
public const string CookieName = "vlx_session";
|
||||
private static readonly TimeSpan _IdleTimeout = TimeSpan.FromHours(12);
|
||||
private static readonly TimeSpan _LockTime = TimeSpan.FromSeconds(30);
|
||||
private const int _MaxFailedLogins = 5;
|
||||
|
||||
private readonly ConcurrentDictionary<string, CSession> _Sessions = new ConcurrentDictionary<string, CSession>();
|
||||
private readonly ConcurrentDictionary<Guid, (int Count, DateTime LockedUntil)> _FailedLogins = new ConcurrentDictionary<Guid, (int, DateTime)>();
|
||||
|
||||
public CSession Create(HttpContext context, Guid profileId, string profileName, ERemoteRole role)
|
||||
{
|
||||
var session = new CSession
|
||||
{
|
||||
Id = CWebSettingsStore.CreateToken(6),
|
||||
Token = CWebSettingsStore.CreateToken(32),
|
||||
UserAgent = context.Request.Headers["User-Agent"].ToString(),
|
||||
RemoteAddress = context.Connection.RemoteIpAddress?.ToString(),
|
||||
Created = DateTime.UtcNow,
|
||||
ProfileId = profileId,
|
||||
ProfileName = profileName,
|
||||
Role = role,
|
||||
LastSeen = DateTime.UtcNow
|
||||
};
|
||||
_Sessions[session.Token] = session;
|
||||
_FailedLogins.TryRemove(profileId, out _);
|
||||
|
||||
context.Response.Cookies.Append(CookieName, session.Token, new CookieOptions
|
||||
{
|
||||
HttpOnly = true,
|
||||
SameSite = SameSiteMode.Strict,
|
||||
Secure = context.Request.IsHttps,
|
||||
Path = "/",
|
||||
Expires = DateTimeOffset.UtcNow.AddDays(30)
|
||||
});
|
||||
return session;
|
||||
}
|
||||
|
||||
public CSession Get(HttpContext context)
|
||||
{
|
||||
if (!context.Request.Cookies.TryGetValue(CookieName, out var token) || !_Sessions.TryGetValue(token, out var session))
|
||||
{
|
||||
return null;
|
||||
}
|
||||
|
||||
var now = DateTime.UtcNow;
|
||||
if (now - session.LastSeen > _IdleTimeout)
|
||||
{
|
||||
_Sessions.TryRemove(token, out _);
|
||||
return null;
|
||||
}
|
||||
|
||||
session.LastSeen = now;
|
||||
return session;
|
||||
}
|
||||
|
||||
public void Remove(HttpContext context)
|
||||
{
|
||||
if (context.Request.Cookies.TryGetValue(CookieName, out var token))
|
||||
{
|
||||
_Sessions.TryRemove(token, out _);
|
||||
}
|
||||
|
||||
context.Response.Cookies.Delete(CookieName, new CookieOptions
|
||||
{
|
||||
HttpOnly = true,
|
||||
SameSite = SameSiteMode.Strict,
|
||||
Secure = context.Request.IsHttps,
|
||||
Path = "/"
|
||||
});
|
||||
}
|
||||
|
||||
/// All active sessions, most recently used first.
|
||||
public IList<CSession> List()
|
||||
{
|
||||
var limit = DateTime.UtcNow - _IdleTimeout;
|
||||
foreach (var expired in _Sessions.Values.Where(s => s.LastSeen < limit).ToList())
|
||||
{
|
||||
_Sessions.TryRemove(expired.Token, out _);
|
||||
}
|
||||
|
||||
return _Sessions.Values.OrderByDescending(s => s.LastSeen).ToList();
|
||||
}
|
||||
|
||||
/// Logs out the device with this session id.
|
||||
public bool RemoveById(string id)
|
||||
{
|
||||
var session = _Sessions.Values.FirstOrDefault(s => s.Id == id);
|
||||
return session != null && _Sessions.TryRemove(session.Token, out _);
|
||||
}
|
||||
|
||||
/// Logs out all devices of a profile, e.g. after its role changed.
|
||||
public void RemoveProfile(Guid profileId)
|
||||
{
|
||||
foreach (var session in _Sessions.Values.Where(s => s.ProfileId == profileId).ToList())
|
||||
{
|
||||
_Sessions.TryRemove(session.Token, out _);
|
||||
}
|
||||
}
|
||||
|
||||
public void UpdateProfileName(Guid profileId, string name)
|
||||
{
|
||||
foreach (var session in _Sessions.Values.Where(s => s.ProfileId == profileId))
|
||||
{
|
||||
session.ProfileName = name;
|
||||
}
|
||||
}
|
||||
|
||||
public bool IsLocked(Guid profileId)
|
||||
{
|
||||
return _FailedLogins.TryGetValue(profileId, out var entry) && entry.LockedUntil > DateTime.UtcNow;
|
||||
}
|
||||
|
||||
/// Counts a wrong PIN. After too many attempts the profile is locked for a short time.
|
||||
public void RegisterFailedLogin(Guid profileId)
|
||||
{
|
||||
_FailedLogins.AddOrUpdate(profileId,
|
||||
_ => (1, DateTime.MinValue),
|
||||
(_, entry) =>
|
||||
{
|
||||
var count = entry.Count + 1;
|
||||
return count >= _MaxFailedLogins ? (0, DateTime.UtcNow + _LockTime) : (count, entry.LockedUntil);
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user