mirror of
https://github.com/nestriness/nestri.git
synced 2026-09-19 17:25:19 +03:00
40b4270161
A single secret that turned any request into an operator was the only credential several routes accepted, and it had no caller left: the device pairing it existed for is on hold, and nothing in this tree or any client sent it. What remained was a key that bypassed authentication entirely, required to boot, and checked by nobody. Every route behind it had a better answer available: - Library and game sync move to host credentials. Both took a `userId` in the body, which meant one secret could write into anybody's library. A host now says which of its enrolled users a batch is for, and that claim is checked against the Steam sign-ins it actually holds — one box carries several people's accounts, so the pair is the unit. - Download-state reporting narrows to hosts alone, and the body that could name a different host is gone. Which host is reporting comes from its own credentials, and a body that still names one is refused rather than ignored. - Linking a Steam account is always for the caller. - Creating a game by hand is deleted; syncing already upserts the catalogue. - Reading the waitlist is deleted. Every address on it belongs to someone who has not agreed to anything, and answering it over HTTP made that list something a leaked key could drain. - The pairing-code routes are deleted with the flow they served. The domain module and its table stay, so returning to it is a route file rather than a migration. Nothing in the API now accepts a credential that stands for more than one caller: every request resolves to a specific user or a specific host, which is what lets a route say "the caller's own library" and mean it. BREAKING CHANGE: the `x-nestri-admin-token` header is no longer accepted and `ADMIN_SHARED_SECRET` is no longer read. `POST /games`, `GET /waitlist` and the `/pairing-code` routes are gone; `POST /games/sync` and `POST /library/sync` now require host credentials and take `userId` in the body; `POST /steam/link` no longer accepts `userId`; `POST /games/download-state` no longer accepts `hostId`.
63 lines
3.0 KiB
Markdown
63 lines
3.0 KiB
Markdown
# apps/api
|
|
|
|
The public HTTP API for Nestri — a [Hono](https://hono.dev) app. One handler, run either as a
|
|
Cloudflare Worker or as an ordinary HTTP server.
|
|
|
|
## What it does
|
|
|
|
Exposes the JSON API consumed by frontends and other clients. Every route is a thin wrapper that
|
|
validates input, delegates to a domain function in [`@nestri/core`](../../packages/core/README.md),
|
|
and returns `{ data: ... }`. All business logic lives in the core package.
|
|
|
|
Routes:
|
|
|
|
| Prefix | Purpose |
|
|
| --------------- | --------------------------------------------------- |
|
|
| `/` | Health check |
|
|
| `/user` | Current user profile, fingerprints, linked accounts |
|
|
| `/steam` | Link / sync / unlink a Steam account |
|
|
| `/library` | Owned games with playtime |
|
|
| `/games` | Game catalog |
|
|
| `/pairing-code` | Device pairing codes |
|
|
| `/machine` | Host machines |
|
|
| `/access-token` | Short-lived access tokens |
|
|
| `/doc` | Generated OpenAPI spec |
|
|
|
|
## Structure
|
|
|
|
```text
|
|
app/
|
|
index.ts # The handler: middleware, routes, error handler, /doc
|
|
server.ts # The same handler behind a listening socket
|
|
middleware/auth.ts # Bearer JWT, access token or host credentials → Actor
|
|
routes/*.ts # Thin route namespaces (UserApi, SteamApi, ...)
|
|
utils/ # ErrorResponses, Result(), validator wrapping
|
|
wrangler.jsonc # Worker configuration, one environment per stage
|
|
Dockerfile # The container, built from the repository root
|
|
test/ # Route tests
|
|
```
|
|
|
|
## Key details
|
|
|
|
- Auth: `Authorization: Bearer …`, carrying either a session token verified against `@nestri/auth`
|
|
or a personal access token resolved from the database; or a registered host's own
|
|
`x-nestri-machine-id` and `x-nestri-machine-secret`. There is no shared secret and no credential
|
|
that stands for more than one caller, so every route resolves to a specific user or a specific
|
|
host — which is what lets a route say "the caller's own library" and mean it.
|
|
- Errors: centralized `VisibleError` → typed JSON responses.
|
|
- Settings arrive as bindings or as environment variables, and two of them have one spelling of
|
|
each: Postgres is `HYPERDRIVE` or `DATABASE_URL`, and the route to the issuer is an `AUTH`
|
|
service binding or `AUTH_INTERNAL_URL`. Nothing here branches on which it got.
|
|
- `AUTH_ISSUER_URL` is the issuer's **public** URL and never the internal one, because it is
|
|
compared literally against the `iss` claim on every token.
|
|
|
|
## Running
|
|
|
|
```sh
|
|
bun run dev # under the Workers runtime, on :3000
|
|
bun run serve # as a plain process, on $PORT (default 3000)
|
|
```
|
|
|
|
Needs a Postgres database and a reachable issuer. Full list and deployment steps:
|
|
[`docs/deploy.md`](../../docs/deploy.md).
|