mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
jevb
7978ec40e8
Server: - Fix YAML injection in LiveKit config generation (quote values) - Revert token TTL to 4h (no server-side JWT revocation) - Derive LiveKit publish permissions from user role (prevent SFU bypass) - Add CAS guard for webhook/voice_leave race condition - Add voice_leave broadcast to rollbackVoiceJoin (prevent ghost state) - Limit webhook body to 64KB (prevent memory abuse) - Add rate limit to voice_token_refresh handler (1/60s) - Add LiveKit health check endpoint (GET /api/v1/livekit/health, 503 on degraded) - Add voice_token_refresh WS handler for client-initiated token refresh - Consolidate voice quality constants (single source of truth) - Fix video limit TOCTOU race (count from DB instead of LiveKit API) - Raise default voice_max_video from 10 to 25 (Discord parity) - Add CountActiveCameras DB query - Non-blocking broadcast send, circuit breaker, exponential backoff - Close send channel before context cancel in serve.go - Guard voice mute/deafen for active channel - Delete orphaned message on attachment link failure - Redact query string from proxy logs (prevent token leak) - Use instance-level HTTP client for health checks (no redirect following) - Set cmd.WaitDelay to prevent goroutine leak on Windows - Log buildJSON marshal errors Client: - Refactor livekitSession.ts from singleton module to LiveKitSession class - Share single AudioContext for all analysers (was 1 per participant) - Extract createRoom() helper (DRY) - Add token refresh timer (3.5h interval, re-arms on failure) - Skip setSpeakers if unchanged (sort in-place, no allocations) - Distinguish user-initiated leave from connection error in retry - Add YouTube videoId validation (prevent iframe src injection) - Add try/finally to disableCamera - Wrap store subscription callbacks in try/catch - Track and cancel initial scroll RAF on cleanup - Add 5s timeout + encodeURIComponent to YouTube oEmbed fetch - Clean raw mic stream on RNNoise suppressor failure - Full voice cleanup on logout via cleanupAll() Tests: - Add 7 new server tests (webhook parsing, voice guards, quality fallback) - Fix 2 pre-existing test failures (mute/deafen invalid payload)
47 lines
1.3 KiB
Go
47 lines
1.3 KiB
Go
package ws
|
|
|
|
import (
|
|
"log/slog"
|
|
"time"
|
|
)
|
|
|
|
// Voice rate limit settings.
|
|
const (
|
|
voiceCameraRateLimit = 2
|
|
voiceCameraWindow = time.Second
|
|
voiceScreenshareRateLimit = 2
|
|
voiceScreenshareWindow = time.Second
|
|
)
|
|
|
|
// voiceQualities maps accepted voice quality presets to their target bitrate
|
|
// in bits/s. This is the single source of truth — voice_join.go validates
|
|
// against these keys, qualityBitrate looks up the value.
|
|
var voiceQualities = map[string]int{
|
|
"low": 32000,
|
|
"medium": 64000,
|
|
"high": 128000,
|
|
}
|
|
|
|
// qualityBitrate returns the target audio bitrate in bits/s based on a quality preset.
|
|
func qualityBitrate(quality string) int {
|
|
if bitrate, ok := voiceQualities[quality]; ok {
|
|
return bitrate
|
|
}
|
|
return voiceQualities["medium"]
|
|
}
|
|
|
|
// broadcastVoiceStateUpdate fetches the current voice state for the client
|
|
// and broadcasts it to all members of the voice channel they are in.
|
|
func (h *Hub) broadcastVoiceStateUpdate(c *Client) {
|
|
state, err := h.db.GetVoiceState(c.userID)
|
|
if err != nil {
|
|
slog.Error("ws broadcastVoiceStateUpdate GetVoiceState", "err", err, "user_id", c.userID)
|
|
c.sendMsg(buildErrorMsg(ErrCodeInternal, "failed to broadcast voice state update"))
|
|
return
|
|
}
|
|
if state == nil {
|
|
return // user not in a voice channel — nothing to broadcast
|
|
}
|
|
h.BroadcastToAll(buildVoiceState(*state))
|
|
}
|