This commit is contained in:
legop3
2025-11-13 23:49:33 -05:00
parent fafc3e0312
commit 7195e257b8
+9 -5
View File
@@ -20,16 +20,21 @@ function canView(socket) {
return true; return true;
} }
app.get('/mediamtx/auth', (req, res) => { app.post('/mediamtx/auth', (req, res) => {
const { session: sessionId, roverId } = req.query; const body = req.body || {};
const path = (body.path || '').replace(/^\//, '');
const params = new URLSearchParams(body.query || '');
const sessionId = params.get('session');
const roverId = path;
if (!sessionId || !roverId) { if (!sessionId || !roverId) {
logger.warn('auth missing session or rover'); logger.warn('auth missing session or rover (session=%s path=%s)', sessionId, path);
return res.status(401).end(); return res.status(401).end();
} }
const info = videoSessions.getSession(sessionId); const info = videoSessions.getSession(sessionId);
if (!info || info.roverId !== roverId) { if (!info || info.roverId !== roverId) {
logger.warn('invalid session %s', sessionId); logger.warn('invalid session %s for rover %s', sessionId, roverId);
return res.status(401).end(); return res.status(401).end();
} }
const socket = io.sockets.sockets.get(info.socketId); const socket = io.sockets.sockets.get(info.socketId);
@@ -40,7 +45,6 @@ app.get('/mediamtx/auth', (req, res) => {
if (!canView(socket)) { if (!canView(socket)) {
return res.status(401).end(); return res.status(401).end();
} }
// optionally ensure non-admin drivers only view their rover
const role = getRole(socket); const role = getRole(socket);
if (role !== 'spectator' && !isAdmin(socket)) { if (role !== 'spectator' && !isAdmin(socket)) {
if (!roverManager.isDriver(roverId, socket)) { if (!roverManager.isDriver(roverId, socket)) {