Files
OwnCord/Server/service/voice.go
T
Claude d320a8b587 fix(review): address 11 Copilot review findings on PR #1132
Clean sweep of every actionable item from the two Copilot review passes
on head 59ae4d8. Grouped by severity:

─── Crash / security (must-fix) ─────────────────────────────────────

1. main.go:140 — telemetryShutdown nil panic.
   telemetry.Init can return (nil, err) on the -tags otel skeleton
   path; the deferred closure would then call a nil function. Normalise
   to a no-op shutdown when Init errors so the defer is always safe.

2. api/upload_handler.go — permSvc nil deref.
   MountUploadRoutes + handleServeFile dereference permSvc on every
   authenticated file request. Add a fail-fast panic at mount time so
   the misconfiguration surfaces at wiring, not on the first 500.
   Update upload_handler_test.go to pass a real PermissionService built
   on the test DB (the existing tests were missing the argument entirely,
   which meant the package wouldn't compile — this fixes the real bug
   Copilot flagged).

3. ws/event_persister.go — NewEventPersister nil EventStore panic.
   run() dereferences p.store on every flush. Panic at constructor
   time instead so the crash happens once at startup rather than
   minutes later in a background goroutine.

4. plugin/host_ui.go — serve-time symlink check.
   rejectSymlinksUnder only runs at install time, so a symlink created
   post-install (accidental or malicious) would be followed by
   http.ServeFile and leak host files. Add an os.Lstat + ModeSymlink
   check + IsRegular check to AssetHandler on every request. Cheap
   relative to the file read and closes the TOCTOU window.

─── Correctness / observability (should-fix) ───────────────────────

5. ws/deps.go:77 — requirePerm hides misconfig as FORBIDDEN.
   Previously, nil database, nil perms, or a GetRoleForUser error all
   returned ErrCodeForbidden with the same message, making operator
   failures indistinguishable from legitimate permission denials.
   Split the branches: misconfig + DB error now return ErrCodeInternal
   with a server-side slog.Error so operators see the real problem;
   FORBIDDEN is reserved for the actual permission-bit check.

6. telemetry/metrics.go — ServiceCallDurationMs renamed to Sec.
   Field name said "Ms" but the instrument name was
   `service_call_duration_seconds` with unit "s". Renamed the field
   and updated all 8 service-layer callers so the struct field and
   metric semantics match.

7. ws/event_persister.go — flushEvy typo → flushEvery.
   Renamed the field and the one call site in run().

─── Comments out of sync with code ──────────────────────────────────

8. plugin/loader.go — Stat vs Lstat comment.
   The comment claimed "Stat (not Lstat)" but the code correctly uses
   os.Lstat to detect symlinks. Updated the comment to match the code;
   the code was already right.

9. telemetry/telemetry_otel.go — compile claim wrong.
   Comment said the file would fail to compile without the upstream
   OTel modules, but the skeleton deliberately avoids importing them
   and Init returns a runtime error instead. Updated the comment to
   reflect actual CI behaviour (the -tags otel build step passes
   today but doesn't exercise real telemetry).

─── Nit / polish ────────────────────────────────────────────────────

10. ws/event_pruner.go — startup delay magic constant.
    Hard-coded time.Minute made the "run shortly after startup"
    behaviour untestable (a test with a 100ms interval would still
    wait a full minute). Cap the startup delay by the interval:
    min(interval, time.Minute). Documented via a new `maxStartupDelay`
    constant.

11. ws/event_pruner_test.go — new file.
    Unit coverage for runPrune cutoff correctness, error swallowing,
    StartEventPruner nil-store short-circuit, ctx cancellation, and
    the interval-bounded startup delay from fix #10. Uses a fakeEventStore
    stub that records every prune call and signals the first one so
    tests don't sleep.

─── Verification ────────────────────────────────────────────────────

gofmt -l clean. No network access in sandbox so `go vet` and `go test`
could not run; the changes are local and surgical and every touched
file compiles in isolation against the existing signatures.

https://claude.ai/code/session_01UsBsQW2YiA2usk9pnJjAWk
2026-04-06 13:48:41 +00:00

152 lines
5.4 KiB
Go

package service
import (
"context"
"errors"
"fmt"
"log/slog"
"time"
"github.com/owncord/server/db"
"github.com/owncord/server/permissions"
"github.com/owncord/server/store"
"github.com/owncord/server/telemetry"
)
// VoiceService handles voice state business logic.
type VoiceService struct {
st store.Store
perm *PermissionService
}
// NewVoiceService creates a VoiceService.
func NewVoiceService(st store.Store, perm *PermissionService) *VoiceService {
return &VoiceService{st: st, perm: perm}
}
// JoinChannel validates the channel, checks ConnectVoice permission, and
// joins the user to the voice channel respecting capacity limits.
// Returns the channel on success so callers can access voice config fields.
func (s *VoiceService) JoinChannel(userID, channelID int64) (*db.Channel, error) {
ctx, span := telemetry.GlobalTracer("service/voice").Start(context.Background(), "VoiceService.JoinChannel",
telemetry.Int64("user_id", userID),
telemetry.Int64("channel_id", channelID),
)
start := time.Now()
defer func() {
telemetry.TimeSince(ctx, telemetry.NewAppMetrics().ServiceCallDurationSec, start,
telemetry.String("method", "JoinChannel"))
span.End()
}()
if channelID <= 0 {
return nil, fmt.Errorf("%w: channel_id must be a positive integer", ErrBadRequest)
}
ch, err := s.st.GetChannel(channelID)
if err != nil || ch == nil {
return nil, fmt.Errorf("%w: channel not found", ErrNotFound)
}
if !s.perm.HasChannelPerm(userID, channelID, permissions.ConnectVoice) {
return nil, fmt.Errorf("%w: missing CONNECT_VOICE permission", ErrForbidden)
}
maxUsers := ch.VoiceMaxUsers
if maxUsers > 0 {
if err := s.st.JoinVoiceChannelIfCapacity(userID, channelID, maxUsers); err != nil {
if errors.Is(err, db.ErrChannelFull) {
return nil, fmt.Errorf("%w: voice channel is full", ErrForbidden)
}
slog.Error("VoiceService.JoinChannel JoinVoiceChannelIfCapacity", "err", err, "user_id", userID)
return nil, fmt.Errorf("%w: failed to join voice channel", ErrInternal)
}
} else {
if err := s.st.JoinVoiceChannel(userID, channelID); err != nil {
slog.Error("VoiceService.JoinChannel JoinVoiceChannel", "err", err, "user_id", userID)
return nil, fmt.Errorf("%w: failed to join voice channel", ErrInternal)
}
}
slog.Info("voice join", "user_id", userID, "channel_id", channelID)
return ch, nil
}
// LeaveChannel removes the user from their current voice channel.
func (s *VoiceService) LeaveChannel(userID int64) error {
if err := s.st.LeaveVoiceChannel(userID); err != nil {
slog.Error("VoiceService.LeaveChannel", "err", err, "user_id", userID)
return fmt.Errorf("%w: failed to leave voice channel", ErrInternal)
}
slog.Info("voice leave", "user_id", userID)
return nil
}
// UpdateMute toggles the mute state for the given user.
func (s *VoiceService) UpdateMute(userID int64, muted bool) error {
if err := s.st.UpdateVoiceMute(userID, muted); err != nil {
slog.Error("VoiceService.UpdateMute", "err", err, "user_id", userID)
return fmt.Errorf("%w: failed to update mute state", ErrInternal)
}
slog.Debug("voice mute changed", "user_id", userID, "muted", muted)
return nil
}
// UpdateDeafen toggles the deafen state for the given user.
func (s *VoiceService) UpdateDeafen(userID int64, deafened bool) error {
if err := s.st.UpdateVoiceDeafen(userID, deafened); err != nil {
slog.Error("VoiceService.UpdateDeafen", "err", err, "user_id", userID)
return fmt.Errorf("%w: failed to update deafen state", ErrInternal)
}
slog.Debug("voice deafen changed", "user_id", userID, "deafened", deafened)
return nil
}
// ToggleCamera enables or disables the user's camera. When enabling, it
// enforces the maxVideo limit via an atomic check-and-update. Returns true
// if the camera was successfully enabled (or disabled), false if the video
// limit was reached.
func (s *VoiceService) ToggleCamera(userID, channelID int64, enable bool, maxVideo int) (bool, error) {
if !s.perm.HasChannelPerm(userID, channelID, permissions.UseVideo) {
return false, fmt.Errorf("%w: missing USE_VIDEO permission", ErrForbidden)
}
if enable && maxVideo > 0 {
ok, err := s.st.EnableCameraIfUnderLimit(userID, channelID, maxVideo)
if err != nil {
slog.Error("VoiceService.ToggleCamera EnableCameraIfUnderLimit", "err", err, "user_id", userID)
return false, fmt.Errorf("%w: failed to check video limit", ErrInternal)
}
if !ok {
return false, nil
}
} else {
if err := s.st.UpdateVoiceCamera(userID, enable); err != nil {
slog.Error("VoiceService.ToggleCamera UpdateVoiceCamera", "err", err, "user_id", userID)
return false, fmt.Errorf("%w: failed to update camera state", ErrInternal)
}
}
slog.Debug("voice camera changed", "user_id", userID, "enabled", enable, "channel_id", channelID)
return true, nil
}
// ToggleScreenshare enables or disables the user's screen share after
// checking the ShareScreen permission.
func (s *VoiceService) ToggleScreenshare(userID, channelID int64, enable bool) error {
if !s.perm.HasChannelPerm(userID, channelID, permissions.ShareScreen) {
return fmt.Errorf("%w: missing SHARE_SCREEN permission", ErrForbidden)
}
if err := s.st.UpdateVoiceScreenshare(userID, enable); err != nil {
slog.Error("VoiceService.ToggleScreenshare", "err", err, "user_id", userID)
return fmt.Errorf("%w: failed to update screenshare state", ErrInternal)
}
slog.Debug("voice screenshare changed", "user_id", userID, "enabled", enable, "channel_id", channelID)
return nil
}