invidious/src/invidious.cr

488 lines
17 KiB
Crystal
Raw Normal View History

2018-09-04 14:22:10 +00:00
# "Invidious" (which is an alternative front-end to YouTube)
2019-03-15 16:44:53 +00:00
# Copyright (C) 2019 Omar Roth
2018-01-28 17:32:40 +00:00
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as published
# by the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
2018-11-22 19:26:08 +00:00
require "digest/md5"
2019-01-23 20:15:19 +00:00
require "file_utils"
# Require kemal, kilt, then our own overrides
2017-11-23 07:48:55 +00:00
require "kemal"
require "kilt"
require "./ext/kemal_content_for.cr"
require "./ext/kemal_static_file_handler.cr"
require "athena-negotiation"
2018-07-18 19:26:02 +00:00
require "openssl/hmac"
require "option_parser"
2018-11-21 23:12:13 +00:00
require "sqlite3"
2018-01-16 20:02:35 +00:00
require "xml"
2018-03-09 18:42:23 +00:00
require "yaml"
2020-06-15 22:57:20 +00:00
require "compress/zip"
2019-10-27 17:50:42 +00:00
require "protodec/utils"
require "./invidious/database/*"
2022-02-11 04:16:40 +00:00
require "./invidious/database/migrations/*"
2018-08-04 20:30:44 +00:00
require "./invidious/helpers/*"
require "./invidious/yt_backend/*"
require "./invidious/frontend/*"
2018-07-06 12:59:56 +00:00
require "./invidious/*"
require "./invidious/channels/*"
require "./invidious/user/*"
2022-03-06 23:52:54 +00:00
require "./invidious/search/*"
require "./invidious/routes/**"
require "./invidious/jobs/**"
2017-11-29 21:33:46 +00:00
CONFIG = Config.load
HMAC_KEY = CONFIG.hmac_key || Random::Secure.hex(32)
2018-03-09 18:42:23 +00:00
PG_DB = DB.open CONFIG.database_url
ARCHIVE_URL = URI.parse("https://archive.org")
LOGIN_URL = URI.parse("https://accounts.google.com")
PUBSUB_URL = URI.parse("https://pubsubhubbub.appspot.com")
REDDIT_URL = URI.parse("https://www.reddit.com")
YT_URL = URI.parse("https://www.youtube.com")
HOST_URL = make_host_url(Kemal.config)
2019-06-07 17:39:12 +00:00
CHARS_SAFE = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"
TEST_IDS = {"AgbeGFYluEA", "BaW_jenozKc", "a9LDPn-MO4I", "ddFvjfvPnqk", "iqKdEhx-dD4"}
2019-06-08 21:04:55 +00:00
MAX_ITEMS_PER_PAGE = 1500
2018-03-05 04:25:03 +00:00
2019-11-24 18:41:47 +00:00
REQUEST_HEADERS_WHITELIST = {"accept", "accept-encoding", "cache-control", "content-length", "if-none-match", "range"}
RESPONSE_HEADERS_BLACKLIST = {"access-control-allow-origin", "alt-svc", "server"}
2019-07-04 20:30:00 +00:00
HTTP_CHUNK_SIZE = 10485760 # ~10MB
CURRENT_BRANCH = {{ "#{`git branch | sed -n '/* /s///p'`.strip}" }}
CURRENT_COMMIT = {{ "#{`git rev-list HEAD --max-count=1 --abbrev-commit`.strip}" }}
CURRENT_VERSION = {{ "#{`git log -1 --format=%ci | awk '{print $1}' | sed s/-/./g`.strip}" }}
# This is used to determine the `?v=` on the end of file URLs (for cache busting). We
# only need to expire modified assets, so we can use this to find the last commit that changes
# any assets
ASSET_COMMIT = {{ "#{`git rev-list HEAD --max-count=1 --abbrev-commit -- assets`.strip}" }}
2019-04-06 13:28:53 +00:00
SOFTWARE = {
"name" => "invidious",
"version" => "#{CURRENT_VERSION}-#{CURRENT_COMMIT}",
"branch" => "#{CURRENT_BRANCH}",
}
YT_POOL = YoutubeConnectionPool.new(YT_URL, capacity: CONFIG.pool_size, use_quic: CONFIG.use_quic)
2019-10-25 16:58:16 +00:00
# CLI
2019-04-06 13:28:53 +00:00
Kemal.config.extra_options do |parser|
parser.banner = "Usage: invidious [arguments]"
parser.on("-c THREADS", "--channel-threads=THREADS", "Number of threads for refreshing channels (default: #{CONFIG.channel_threads})") do |number|
2019-04-06 13:28:53 +00:00
begin
CONFIG.channel_threads = number.to_i
2019-04-06 13:28:53 +00:00
rescue ex
puts "THREADS must be integer"
exit
end
end
parser.on("-f THREADS", "--feed-threads=THREADS", "Number of threads for refreshing feeds (default: #{CONFIG.feed_threads})") do |number|
2019-04-06 13:28:53 +00:00
begin
CONFIG.feed_threads = number.to_i
2019-04-06 13:28:53 +00:00
rescue ex
puts "THREADS must be integer"
exit
end
end
parser.on("-o OUTPUT", "--output=OUTPUT", "Redirect output (default: #{CONFIG.output})") do |output|
CONFIG.output = output
2019-04-06 13:28:53 +00:00
end
parser.on("-l LEVEL", "--log-level=LEVEL", "Log level, one of #{LogLevel.values} (default: #{CONFIG.log_level})") do |log_level|
CONFIG.log_level = LogLevel.parse(log_level)
end
parser.on("-v", "--version", "Print version") do
2019-04-06 13:28:53 +00:00
puts SOFTWARE.to_pretty_json
exit
end
parser.on("--migrate", "Run any migrations (beta, use at your own risk!!") do
Invidious::Database::Migrator.new(PG_DB).migrate
exit
end
2019-04-06 13:28:53 +00:00
end
Kemal::CLI.new ARGV
if CONFIG.output.upcase != "STDOUT"
FileUtils.mkdir_p(File.dirname(CONFIG.output))
end
OUTPUT = CONFIG.output.upcase == "STDOUT" ? STDOUT : File.open(CONFIG.output, mode: "a")
LOGGER = Invidious::LogHandler.new(OUTPUT, CONFIG.log_level)
# Check table integrity
Invidious::Database.check_integrity(CONFIG)
2018-03-26 03:18:29 +00:00
2022-02-08 02:05:49 +00:00
{% if !flag?(:skip_videojs_download) %}
# Resolve player dependencies. This is done at compile time.
#
# Running the script by itself would show some colorful feedback while this doesn't.
# Perhaps we should just move the script to runtime in order to get that feedback?
{% puts "\nChecking player dependencies, this may take more than 20 minutes... If it is stuck, check your internet connection.\n" %}
{% if flag?(:minified_player_dependencies) %}
{% puts run("../scripts/fetch-player-dependencies.cr", "--minified").stringify %}
{% else %}
{% puts run("../scripts/fetch-player-dependencies.cr").stringify %}
{% end %}
{% puts "\nDone checking player dependencies, now compiling Invidious...\n" %}
2021-09-12 05:47:12 +00:00
{% end %}
2019-04-10 21:23:37 +00:00
# Start jobs
2019-05-15 17:26:29 +00:00
if CONFIG.channel_threads > 0
Invidious::Jobs.register Invidious::Jobs::RefreshChannelsJob.new(PG_DB)
end
if CONFIG.feed_threads > 0
Invidious::Jobs.register Invidious::Jobs::RefreshFeedsJob.new(PG_DB)
end
DECRYPT_FUNCTION = DecryptFunction.new(CONFIG.decrypt_polling)
if CONFIG.decrypt_polling
Invidious::Jobs.register Invidious::Jobs::UpdateDecryptFunctionJob.new
end
if CONFIG.statistics_enabled
Invidious::Jobs.register Invidious::Jobs::StatisticsRefreshJob.new(PG_DB, SOFTWARE)
end
2019-08-27 13:08:26 +00:00
if (CONFIG.use_pubsub_feeds.is_a?(Bool) && CONFIG.use_pubsub_feeds.as(Bool)) || (CONFIG.use_pubsub_feeds.is_a?(Int32) && CONFIG.use_pubsub_feeds.as(Int32) > 0)
Invidious::Jobs.register Invidious::Jobs::SubscribeToFeedsJob.new(PG_DB, HMAC_KEY)
end
if CONFIG.popular_enabled
Invidious::Jobs.register Invidious::Jobs::PullPopularVideosJob.new(PG_DB)
end
2022-02-23 05:20:09 +00:00
CONNECTION_CHANNEL = Channel({Bool, Channel(PQ::Notification)}).new(32)
Invidious::Jobs.register Invidious::Jobs::NotificationJob.new(CONNECTION_CHANNEL, CONFIG.database_url)
Invidious::Jobs.start_all
def popular_videos
Invidious::Jobs::PullPopularVideosJob::POPULAR_VIDEOS.get
2018-11-09 02:08:03 +00:00
end
2018-03-25 03:56:41 +00:00
before_all do |env|
preferences = Preferences.from_json("{}")
begin
if prefs_cookie = env.request.cookies["PREFS"]?
preferences = Preferences.from_json(URI.decode_www_form(prefs_cookie.value))
else
if language_header = env.request.headers["Accept-Language"]?
if language = ANG.language_negotiator.best(language_header, LOCALES.keys)
preferences.locale = language.header
end
end
end
rescue
preferences = Preferences.from_json("{}")
end
env.set "preferences", preferences
2019-05-10 21:48:38 +00:00
env.response.headers["X-XSS-Protection"] = "1; mode=block"
env.response.headers["X-Content-Type-Options"] = "nosniff"
2021-06-19 07:40:33 +00:00
# Allow media resources to be loaded from google servers
# TODO: check if *.youtube.com can be removed
if CONFIG.disabled?("local") || !preferences.local
extra_media_csp = " https://*.googlevideo.com:443 https://*.youtube.com:443"
else
extra_media_csp = ""
end
# Only allow the pages at /embed/* to be embedded
if env.request.resource.starts_with?("/embed")
frame_ancestors = "'self' http: https:"
else
frame_ancestors = "'none'"
end
# TODO: Remove style-src's 'unsafe-inline', requires to remove all
# inline styles (<style> [..] </style>, style=" [..] ")
env.response.headers["Content-Security-Policy"] = {
"default-src 'none'",
"script-src 'self'",
"style-src 'self' 'unsafe-inline'",
"img-src 'self' data:",
"font-src 'self' data:",
"connect-src 'self'",
"manifest-src 'self'",
"media-src 'self' blob:" + extra_media_csp,
"child-src 'self' blob:",
"frame-src 'self'",
"frame-ancestors " + frame_ancestors,
}.join("; ")
2019-04-07 19:01:08 +00:00
env.response.headers["Referrer-Policy"] = "same-origin"
# Ask the chrom*-based browsers to disable FLoC
# See: https://blog.runcloud.io/google-floc/
env.response.headers["Permissions-Policy"] = "interest-cohort=()"
if (Kemal.config.ssl || CONFIG.https_only) && CONFIG.hsts
2019-05-01 01:53:56 +00:00
env.response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains; preload"
2019-04-07 19:01:08 +00:00
end
2019-03-28 18:43:40 +00:00
2019-11-20 17:03:52 +00:00
next if {
"/sb/",
"/vi/",
"/s_p/",
"/yts/",
"/ggpht/",
"/api/manifest/",
"/videoplayback",
"/latest_version",
"/download",
2019-11-20 17:03:52 +00:00
}.any? { |r| env.request.resource.starts_with? r }
2018-07-16 16:24:24 +00:00
if env.request.cookies.has_key? "SID"
2018-04-01 00:09:27 +00:00
sid = env.request.cookies["SID"].value
2018-07-05 23:43:26 +00:00
2019-04-18 21:23:50 +00:00
if sid.starts_with? "v1:"
raise "Cannot use token as SID"
end
2018-07-18 19:26:02 +00:00
# Invidious users only have SID
if !env.request.cookies.has_key? "SSID"
if email = Invidious::Database::SessionIDs.select_email(sid)
user = Invidious::Database::Users.select!(email: email)
2019-08-05 23:49:13 +00:00
csrf_token = generate_response(sid, {
":authorize_token",
":playlist_ajax",
":signout",
":subscription_ajax",
":token_ajax",
":watch_ajax",
2021-12-06 21:28:16 +00:00
}, HMAC_KEY, 1.week)
2018-11-08 23:42:25 +00:00
preferences = user.preferences
env.set "preferences", preferences
2018-08-15 17:40:42 +00:00
env.set "sid", sid
2019-04-18 21:23:50 +00:00
env.set "csrf_token", csrf_token
env.set "user", user
2018-07-18 19:26:02 +00:00
end
else
headers = HTTP::Headers.new
headers["Cookie"] = env.request.headers["Cookie"]
2018-07-18 19:26:02 +00:00
begin
2021-12-06 21:28:16 +00:00
user, sid = get_user(sid, headers, false)
2019-08-05 23:49:13 +00:00
csrf_token = generate_response(sid, {
":authorize_token",
":playlist_ajax",
":signout",
":subscription_ajax",
":token_ajax",
":watch_ajax",
2021-12-06 21:28:16 +00:00
}, HMAC_KEY, 1.week)
2018-11-16 02:23:17 +00:00
preferences = user.preferences
env.set "preferences", preferences
2018-08-15 17:40:42 +00:00
env.set "sid", sid
2019-04-18 21:23:50 +00:00
env.set "csrf_token", csrf_token
env.set "user", user
2018-07-18 19:26:02 +00:00
rescue ex
end
2018-07-16 17:50:41 +00:00
end
2018-04-14 02:32:14 +00:00
end
2018-08-17 15:19:20 +00:00
dark_mode = convert_theme(env.params.query["dark_mode"]?) || preferences.dark_mode.to_s
thin_mode = env.params.query["thin_mode"]? || preferences.thin_mode.to_s
thin_mode = thin_mode == "true"
locale = env.params.query["hl"]? || preferences.locale
preferences.dark_mode = dark_mode
preferences.thin_mode = thin_mode
preferences.locale = locale
env.set "preferences", preferences
2018-12-20 21:32:09 +00:00
2018-08-17 15:19:20 +00:00
current_page = env.request.path
if env.request.query
query = HTTP::Params.parse(env.request.query.not_nil!)
if query["referer"]?
query["referer"] = get_referer(env, "/")
end
current_page += "?#{query}"
end
env.set "current_page", URI.encode_www_form(current_page)
2018-03-22 17:44:36 +00:00
end
{% unless flag?(:api_only) %}
Invidious::Routing.get "/", Invidious::Routes::Misc, :home
Invidious::Routing.get "/privacy", Invidious::Routes::Misc, :privacy
Invidious::Routing.get "/licenses", Invidious::Routes::Misc, :licenses
Invidious::Routing.register_channel_routes
Invidious::Routing.get "/watch", Invidious::Routes::Watch, :handle
2021-11-27 07:16:09 +00:00
Invidious::Routing.post "/watch_ajax", Invidious::Routes::Watch, :mark_watched
Invidious::Routing.get "/watch/:id", Invidious::Routes::Watch, :redirect
Invidious::Routing.get "/shorts/:id", Invidious::Routes::Watch, :redirect
2022-02-01 20:40:06 +00:00
Invidious::Routing.get "/clip/:clip", Invidious::Routes::Watch, :clip
Invidious::Routing.get "/w/:id", Invidious::Routes::Watch, :redirect
Invidious::Routing.get "/v/:id", Invidious::Routes::Watch, :redirect
Invidious::Routing.get "/e/:id", Invidious::Routes::Watch, :redirect
Invidious::Routing.get "/redirect", Invidious::Routes::Misc, :cross_instance_redirect
Invidious::Routing.post "/download", Invidious::Routes::Watch, :download
Invidious::Routing.get "/embed/", Invidious::Routes::Embed, :redirect
Invidious::Routing.get "/embed/:id", Invidious::Routes::Embed, :show
Invidious::Routing.get "/create_playlist", Invidious::Routes::Playlists, :new
Invidious::Routing.post "/create_playlist", Invidious::Routes::Playlists, :create
Invidious::Routing.get "/subscribe_playlist", Invidious::Routes::Playlists, :subscribe
Invidious::Routing.get "/delete_playlist", Invidious::Routes::Playlists, :delete_page
Invidious::Routing.post "/delete_playlist", Invidious::Routes::Playlists, :delete
Invidious::Routing.get "/edit_playlist", Invidious::Routes::Playlists, :edit
Invidious::Routing.post "/edit_playlist", Invidious::Routes::Playlists, :update
Invidious::Routing.get "/add_playlist_items", Invidious::Routes::Playlists, :add_playlist_items_page
Invidious::Routing.post "/playlist_ajax", Invidious::Routes::Playlists, :playlist_ajax
Invidious::Routing.get "/playlist", Invidious::Routes::Playlists, :show
Invidious::Routing.get "/mix", Invidious::Routes::Playlists, :mix
2022-02-23 05:20:09 +00:00
Invidious::Routing.get "/watch_videos", Invidious::Routes::Playlists, :watch_videos
Invidious::Routing.get "/opensearch.xml", Invidious::Routes::Search, :opensearch
Invidious::Routing.get "/results", Invidious::Routes::Search, :results
Invidious::Routing.get "/search", Invidious::Routes::Search, :search
2022-05-26 16:31:02 +00:00
Invidious::Routing.get "/hashtag/:hashtag", Invidious::Routes::Search, :hashtag
# User routes
Invidious::Routing.register_user_routes
# Feeds
Invidious::Routing.get "/view_all_playlists", Invidious::Routes::Feeds, :view_all_playlists_redirect
Invidious::Routing.get "/feed/playlists", Invidious::Routes::Feeds, :playlists
Invidious::Routing.get "/feed/popular", Invidious::Routes::Feeds, :popular
Invidious::Routing.get "/feed/trending", Invidious::Routes::Feeds, :trending
Invidious::Routing.get "/feed/subscriptions", Invidious::Routes::Feeds, :subscriptions
Invidious::Routing.get "/feed/history", Invidious::Routes::Feeds, :history
# RSS Feeds
Invidious::Routing.get "/feed/channel/:ucid", Invidious::Routes::Feeds, :rss_channel
Invidious::Routing.get "/feed/private", Invidious::Routes::Feeds, :rss_private
Invidious::Routing.get "/feed/playlist/:plid", Invidious::Routes::Feeds, :rss_playlist
Invidious::Routing.get "/feeds/videos.xml", Invidious::Routes::Feeds, :rss_videos
# Support push notifications via PubSubHubbub
Invidious::Routing.get "/feed/webhook/:token", Invidious::Routes::Feeds, :push_notifications_get
Invidious::Routing.post "/feed/webhook/:token", Invidious::Routes::Feeds, :push_notifications_post
Invidious::Routing.get "/modify_notifications", Invidious::Routes::Notifications, :modify
{% end %}
2021-10-11 20:22:11 +00:00
Invidious::Routing.get "/ggpht/*", Invidious::Routes::Images, :ggpht
Invidious::Routing.options "/sb/:authority/:id/:storyboard/:index", Invidious::Routes::Images, :options_storyboard
Invidious::Routing.get "/sb/:authority/:id/:storyboard/:index", Invidious::Routes::Images, :get_storyboard
Invidious::Routing.get "/s_p/:id/:name", Invidious::Routes::Images, :s_p_image
Invidious::Routing.get "/yts/img/:name", Invidious::Routes::Images, :yts_image
Invidious::Routing.get "/vi/:id/:name", Invidious::Routes::Images, :thumbnails
# API routes (macro)
Invidious::Routing.register_api_v1_routes
# Video playback (macros)
Invidious::Routing.register_api_manifest_routes
Invidious::Routing.register_video_playback_routes
2018-02-10 15:15:23 +00:00
error 404 do |env|
2019-03-27 10:28:53 +00:00
if md = env.request.path.match(/^\/(?<id>([a-zA-Z0-9_-]{11})|(\w+))$/)
2019-04-17 19:46:00 +00:00
item = md["id"]
2019-04-17 19:46:00 +00:00
# Check if item is branding URL e.g. https://youtube.com/gaming
2019-10-25 16:58:16 +00:00
response = YT_POOL.client &.get("/#{item}")
2019-03-27 10:28:53 +00:00
if response.status_code == 301
response = YT_POOL.client &.get(URI.parse(response.headers["Location"]).request_target)
2019-03-27 10:28:53 +00:00
end
if response.body.empty?
env.response.headers["Location"] = "/"
halt env, status_code: 302
end
2019-03-27 10:28:53 +00:00
html = XML.parse_html(response.body)
2020-01-14 13:21:17 +00:00
ucid = html.xpath_node(%q(//link[@rel="canonical"])).try &.["href"].split("/")[-1]
2019-03-27 10:28:53 +00:00
if ucid
2020-01-14 13:21:17 +00:00
env.response.headers["Location"] = "/channel/#{ucid}"
2019-03-27 10:28:53 +00:00
halt env, status_code: 302
end
params = [] of String
env.params.query.each do |k, v|
params << "#{k}=#{v}"
end
params = params.join("&")
2019-04-17 19:46:00 +00:00
url = "/watch?v=#{item}"
if !params.empty?
url += "&#{params}"
end
2019-04-17 19:46:00 +00:00
# Check if item is video ID
2019-10-25 16:58:16 +00:00
if item.match(/^[a-zA-Z0-9_-]{11}$/) && YT_POOL.client &.head("/watch?v=#{item}").status_code != 404
2019-02-21 21:07:22 +00:00
env.response.headers["Location"] = url
halt env, status_code: 302
end
end
env.response.headers["Location"] = "/"
halt env, status_code: 302
2017-12-30 21:21:43 +00:00
end
error 500 do |env, ex|
locale = env.get("preferences").as(Preferences).locale
error_template(500, ex)
2017-12-30 21:21:43 +00:00
end
2021-09-25 02:15:23 +00:00
static_headers do |response|
2019-05-08 13:58:10 +00:00
response.headers.add("Cache-Control", "max-age=2629800")
2018-03-09 17:28:57 +00:00
end
2017-11-23 07:48:55 +00:00
public_folder "assets"
2018-04-16 03:56:58 +00:00
2018-07-30 23:42:45 +00:00
Kemal.config.powered_by_header = false
2018-04-16 03:56:58 +00:00
add_handler FilteredCompressHandler.new
2019-02-03 04:48:47 +00:00
add_handler APIHandler.new
2019-04-18 21:23:50 +00:00
add_handler AuthHandler.new
2019-03-23 15:24:30 +00:00
add_handler DenyFrame.new
2019-04-18 21:23:50 +00:00
add_context_storage_type(Array(String))
add_context_storage_type(Preferences)
add_context_storage_type(Invidious::User)
2017-11-23 07:48:55 +00:00
Kemal.config.logger = LOGGER
Kemal.config.host_binding = Kemal.config.host_binding != "0.0.0.0" ? Kemal.config.host_binding : CONFIG.host_binding
Kemal.config.port = Kemal.config.port != 3000 ? Kemal.config.port : CONFIG.port
Kemal.config.app_name = "Invidious"
2021-10-11 12:42:22 +00:00
# Use in kemal's production mode.
# Users can also set the KEMAL_ENV environmental variable for this to be set automatically.
{% if flag?(:release) || flag?(:production) %}
Kemal.config.env = "production" if !ENV.has_key?("KEMAL_ENV")
{% end %}
2017-11-23 07:48:55 +00:00
Kemal.run