kiper292
2 months ago
6 changed files with 1056 additions and 725 deletions
@ -0,0 +1,151 @@ |
|||
// SPDX-FileCopyrightText: 2023 The Pion community <https://pion.ly>
|
|||
// SPDX-License-Identifier: MIT
|
|||
|
|||
package main |
|||
|
|||
import ( |
|||
"context" |
|||
"log" |
|||
"sync" |
|||
"sync/atomic" |
|||
"time" |
|||
) |
|||
|
|||
// getCredsFunc is the signature for credential retrieval functions
|
|||
type getCredsFunc func(context.Context, string, int) (string, string, string, error) |
|||
|
|||
// TurnCredentials stores cached TURN credentials
|
|||
type TurnCredentials struct { |
|||
Username string |
|||
Password string |
|||
ServerAddr string |
|||
ExpiresAt time.Time |
|||
Link string |
|||
} |
|||
|
|||
// StreamCredentialsCache holds credentials cache for a single stream
|
|||
type StreamCredentialsCache struct { |
|||
creds TurnCredentials |
|||
mutex sync.RWMutex |
|||
errorCount atomic.Int32 |
|||
lastErrorTime atomic.Int64 |
|||
} |
|||
|
|||
const ( |
|||
credentialLifetime = 10 * time.Minute |
|||
cacheSafetyMargin = 60 * time.Second |
|||
maxCacheErrors = 3 |
|||
errorWindow = 10 * time.Second |
|||
streamsPerCache = 4 // Number of streams sharing one credentials cache
|
|||
) |
|||
|
|||
// getCacheID returns the shared cache ID for a given stream ID
|
|||
func getCacheID(streamID int) int { |
|||
return streamID / streamsPerCache |
|||
} |
|||
|
|||
// credentialsStore manages per-stream credentials caches
|
|||
var credentialsStore = struct { |
|||
mu sync.RWMutex |
|||
caches map[int]*StreamCredentialsCache |
|||
}{ |
|||
caches: make(map[int]*StreamCredentialsCache), |
|||
} |
|||
|
|||
// getStreamCache returns or creates a shared cache for the given stream ID
|
|||
func getStreamCache(streamID int) *StreamCredentialsCache { |
|||
cacheID := getCacheID(streamID) |
|||
|
|||
// Try read lock first for fast path
|
|||
credentialsStore.mu.RLock() |
|||
cache, exists := credentialsStore.caches[cacheID] |
|||
credentialsStore.mu.RUnlock() |
|||
|
|||
if exists { |
|||
return cache |
|||
} |
|||
|
|||
// Need to create new cache
|
|||
credentialsStore.mu.Lock() |
|||
defer credentialsStore.mu.Unlock() |
|||
|
|||
// Double-check after acquiring write lock
|
|||
if cache, exists = credentialsStore.caches[cacheID]; exists { |
|||
return cache |
|||
} |
|||
|
|||
cache = &StreamCredentialsCache{} |
|||
credentialsStore.caches[cacheID] = cache |
|||
return cache |
|||
} |
|||
|
|||
// invalidate invalidates the credentials cache for this stream
|
|||
func (c *StreamCredentialsCache) invalidate(streamID int) { |
|||
c.mutex.Lock() |
|||
c.creds = TurnCredentials{} |
|||
c.mutex.Unlock() |
|||
|
|||
// Reset auth error counter
|
|||
c.errorCount.Store(0) |
|||
c.lastErrorTime.Store(0) |
|||
|
|||
log.Printf("[Auth] Credentials cache invalidated for stream %d", streamID) |
|||
} |
|||
|
|||
// fetchMu serializes credential fetching to avoid API rate limiting
|
|||
var fetchMu sync.Mutex |
|||
|
|||
// fetchFunc is the signature for credential retrieval functions (without cache logic)
|
|||
type fetchFunc func(ctx context.Context, link string) (string, string, string, error) |
|||
|
|||
// serializeFetch wraps a fetch call with the global fetchMu to avoid API rate limiting
|
|||
func serializeFetch(ctx context.Context, link string, storeFn fetchFunc) (string, string, string, error) { |
|||
fetchMu.Lock() |
|||
defer fetchMu.Unlock() |
|||
return storeFn(ctx, link) |
|||
} |
|||
|
|||
// getCredsCached checks cache before fetching credentials.
|
|||
// This is the general entry point for credential retrieval with caching.
|
|||
func getCredsCached(ctx context.Context, link string, streamID int, storeFn fetchFunc) (string, string, string, error) { |
|||
cache := getStreamCache(streamID) |
|||
cacheID := getCacheID(streamID) |
|||
|
|||
cache.mutex.Lock() |
|||
defer cache.mutex.Unlock() |
|||
|
|||
// Check cache - another stream may have populated it while waiting
|
|||
if cache.creds.Link == link && time.Now().Before(cache.creds.ExpiresAt) { |
|||
expires := time.Until(cache.creds.ExpiresAt) |
|||
log.Printf("[Auth] Using cached credentials (cache=%d, expires in %v)", cacheID, expires) |
|||
return cache.creds.Username, cache.creds.Password, cache.creds.ServerAddr, nil |
|||
} |
|||
|
|||
log.Printf("[Auth] Cache miss (cache=%d), starting credential fetch...", cacheID) |
|||
|
|||
// Check context before long fetch
|
|||
select { |
|||
case <-ctx.Done(): |
|||
return "", "", "", ctx.Err() |
|||
default: |
|||
} |
|||
|
|||
// Fetch credentials with global mutex to avoid API rate limiting
|
|||
user, pass, addr, err := serializeFetch(ctx, link, storeFn) |
|||
|
|||
if err != nil { |
|||
return "", "", "", err |
|||
} |
|||
|
|||
// Store in cache
|
|||
cache.creds = TurnCredentials{ |
|||
Username: user, |
|||
Password: pass, |
|||
ServerAddr: addr, |
|||
ExpiresAt: time.Now().Add(credentialLifetime - cacheSafetyMargin), |
|||
Link: link, |
|||
} |
|||
|
|||
log.Printf("[Auth] Success! Credentials cached until %v (cache=%d)", cache.creds.ExpiresAt, cacheID) |
|||
return user, pass, addr, nil |
|||
} |
|||
@ -0,0 +1,258 @@ |
|||
// SPDX-FileCopyrightText: 2023 The Pion community <https://pion.ly>
|
|||
// SPDX-License-Identifier: MIT
|
|||
|
|||
package main |
|||
|
|||
import ( |
|||
"bytes" |
|||
"context" |
|||
"encoding/json" |
|||
"fmt" |
|||
"io" |
|||
"log" |
|||
"math/rand" |
|||
"net/http" |
|||
"net/url" |
|||
"strings" |
|||
"time" |
|||
|
|||
"github.com/google/uuid" |
|||
) |
|||
|
|||
const vkClientID = "6287487" |
|||
const vkClientSecret = "QbYic1K3lEV5kTGiqlq2" |
|||
const vkAPIVersion = "5.275" |
|||
|
|||
func min(a, b int) int { |
|||
if a < b { |
|||
return a |
|||
} |
|||
return b |
|||
} |
|||
|
|||
// vkDelay sleeps for a random duration between minMs and maxMs to avoid bot detection
|
|||
func vkDelay(minMs, maxMs int) { |
|||
ms := minMs + rand.Intn(maxMs-minMs+1) |
|||
time.Sleep(time.Duration(ms) * time.Millisecond) |
|||
} |
|||
|
|||
func vkHTTPPost(ctx context.Context, data string, url string) (map[string]interface{}, error) { |
|||
client := &http.Client{ |
|||
Timeout: 20 * time.Second, |
|||
Transport: &http.Transport{ |
|||
MaxIdleConns: 100, |
|||
MaxIdleConnsPerHost: 100, |
|||
IdleConnTimeout: 90 * time.Second, |
|||
}, |
|||
} |
|||
defer client.CloseIdleConnections() |
|||
req, err := http.NewRequestWithContext(ctx, "POST", url, bytes.NewBuffer([]byte(data))) |
|||
if err != nil { |
|||
return nil, err |
|||
} |
|||
// Headers matching HAR capture exactly
|
|||
req.Header.Set("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36") |
|||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded") |
|||
req.Header.Set("Accept", "*/*") |
|||
req.Header.Set("Accept-Language", "en-US,en;q=0.9") |
|||
req.Header.Set("Origin", "https://vk.ru") |
|||
req.Header.Set("Referer", "https://vk.ru/") |
|||
req.Header.Set("sec-ch-ua-platform", `"Windows"`) |
|||
req.Header.Set("sec-ch-ua", `"Chromium";v="146", "Not-A.Brand";v="24", "Google Chrome";v="146"`) |
|||
req.Header.Set("sec-ch-ua-mobile", "?0") |
|||
req.Header.Set("Sec-Fetch-Site", "same-site") |
|||
req.Header.Set("Sec-Fetch-Mode", "cors") |
|||
req.Header.Set("Sec-Fetch-Dest", "empty") |
|||
req.Header.Set("DNT", "1") |
|||
req.Header.Set("Priority", "u=1, i") |
|||
|
|||
httpResp, err := client.Do(req) |
|||
if err != nil { |
|||
return nil, err |
|||
} |
|||
defer httpResp.Body.Close() |
|||
|
|||
// Handle HTTP errors (redirects, rate limits, etc.)
|
|||
if httpResp.StatusCode >= 400 { |
|||
body, _ := io.ReadAll(httpResp.Body) |
|||
return nil, fmt.Errorf("HTTP %d from %s: %s", httpResp.StatusCode, req.URL, string(body[:min(len(body), 500)])) |
|||
} |
|||
|
|||
body, err := io.ReadAll(httpResp.Body) |
|||
if err != nil { |
|||
return nil, err |
|||
} |
|||
|
|||
// Check content type - VK may return HTML instead of JSON (captcha page, redirect, etc.)
|
|||
contentType := httpResp.Header.Get("Content-Type") |
|||
if contentType != "" && !strings.Contains(contentType, "application/json") && !strings.Contains(contentType, "text/javascript") { |
|||
// Log first 500 chars of non-JSON response for debugging
|
|||
logPreview := string(body) |
|||
if len(logPreview) > 500 { |
|||
logPreview = logPreview[:500] + "...(truncated)" |
|||
} |
|||
return nil, fmt.Errorf("unexpected content-type %s, status %d, body: %s", contentType, httpResp.StatusCode, logPreview) |
|||
} |
|||
|
|||
var resp map[string]interface{} |
|||
if err = json.Unmarshal(body, &resp); err != nil { |
|||
// Log the raw body for debugging
|
|||
logPreview := string(body) |
|||
if len(logPreview) > 500 { |
|||
logPreview = logPreview[:500] + "...(truncated)" |
|||
} |
|||
return nil, fmt.Errorf("JSON parse error: %w, body: %s", err, logPreview) |
|||
} |
|||
return resp, nil |
|||
} |
|||
|
|||
func getVkCreds(ctx context.Context, link string) (string, string, string, error) { |
|||
// Token 1 (messages)
|
|||
log.Println("[VK Auth] Getting Token 1...") |
|||
data := fmt.Sprintf("client_id=%s&token_type=messages&client_secret=%s&version=1&app_id=%s", |
|||
vkClientID, vkClientSecret, vkClientID) |
|||
resp, err := vkHTTPPost(ctx, data, "https://login.vk.ru/?act=get_anonym_token") |
|||
if err != nil { |
|||
return "", "", "", fmt.Errorf("Token 1 request error: %w", err) |
|||
} |
|||
if errMsg, ok := resp["error"].(map[string]interface{}); ok { |
|||
return "", "", "", fmt.Errorf("Token 1 VK error: %v", errMsg) |
|||
} |
|||
dataObj, ok := resp["data"].(map[string]interface{}) |
|||
if !ok { |
|||
return "", "", "", fmt.Errorf("invalid Token 1 response: %v", resp) |
|||
} |
|||
token1, ok := dataObj["access_token"].(string) |
|||
if !ok { |
|||
return "", "", "", fmt.Errorf("access_token not found in Token 1 response") |
|||
} |
|||
log.Println("[VK Auth] Token 1 received") |
|||
vkDelay(100, 200) // Token 1 → getCallPreview
|
|||
|
|||
// getCallPreview (optional, like browser)
|
|||
log.Println("[VK Auth] Getting call preview...") |
|||
cpData := fmt.Sprintf("vk_join_link=https://vk.ru/call/join/%s&fields=photo_200&access_token=%s", |
|||
url.QueryEscape(link), token1) |
|||
cpURL := fmt.Sprintf("https://api.vk.ru/method/calls.getCallPreview?v=%s&client_id=%s", vkAPIVersion, vkClientID) |
|||
_, _ = vkHTTPPost(ctx, cpData, cpURL) // non-critical
|
|||
vkDelay(500, 1000) // getCallPreview → Token 2
|
|||
|
|||
// Token 2 (may require captcha)
|
|||
log.Println("[VK Auth] Getting Token 2...") |
|||
t2Data := fmt.Sprintf("vk_join_link=https://vk.ru/call/join/%s&name=123&access_token=%s", |
|||
url.QueryEscape(link), token1) |
|||
t2URL := fmt.Sprintf("https://api.vk.ru/method/calls.getAnonymousToken?v=%s&client_id=%s", vkAPIVersion, vkClientID) |
|||
resp, err = vkHTTPPost(ctx, t2Data, t2URL) |
|||
if err != nil { |
|||
return "", "", "", fmt.Errorf("Token 2 request error: %w", err) |
|||
} |
|||
|
|||
// Check for captcha error
|
|||
if errMsg, ok := resp["error"].(map[string]interface{}); ok { |
|||
captchaData, isCaptcha := ExtractCaptchaData(errMsg) |
|||
if !isCaptcha { |
|||
return "", "", "", fmt.Errorf("Token 2 VK error: %v", errMsg) |
|||
} |
|||
|
|||
log.Printf("[VK Auth] Captcha detected, solving...") |
|||
successToken, solveErr := SolveVkCaptcha(ctx, captchaData) |
|||
if solveErr != nil { |
|||
return "", "", "", fmt.Errorf("captcha solving failed: %w", solveErr) |
|||
} |
|||
|
|||
// Delay before retry (endSession → Token 2 retry)
|
|||
vkDelay(100, 200) |
|||
|
|||
// Retry Token 2 with captcha solution
|
|||
log.Println("[VK Auth] Retrying Token 2 with captcha solution...") |
|||
t2Data = fmt.Sprintf( |
|||
"vk_join_link=https://vk.ru/call/join/%s&name=123"+ |
|||
"&captcha_key=&captcha_sid=%s&is_sound_captcha=0"+ |
|||
"&success_token=%s&captcha_ts=%s&captcha_attempt=%s"+ |
|||
"&access_token=%s", |
|||
url.QueryEscape(link), |
|||
captchaData.CaptchaSid, |
|||
successToken, |
|||
captchaData.CaptchaTs, |
|||
captchaData.CaptchaAttempt, |
|||
token1, |
|||
) |
|||
resp, err = vkHTTPPost(ctx, t2Data, t2URL) |
|||
if err != nil { |
|||
return "", "", "", fmt.Errorf("Token 2 retry request error: %w", err) |
|||
} |
|||
if errMsg2, ok := resp["error"].(map[string]interface{}); ok { |
|||
return "", "", "", fmt.Errorf("Token 2 retry VK error: %v", errMsg2) |
|||
} |
|||
// Token 2 retry → Token 3
|
|||
vkDelay(100, 200) |
|||
} |
|||
|
|||
token2Obj, ok := resp["response"].(map[string]interface{}) |
|||
if !ok { |
|||
return "", "", "", fmt.Errorf("invalid Token 2 response: %v", resp) |
|||
} |
|||
token2, ok := token2Obj["token"].(string) |
|||
if !ok { |
|||
return "", "", "", fmt.Errorf("token not found in Token 2 response") |
|||
} |
|||
log.Println("[VK Auth] Token 2 received") |
|||
// Token 2 → Token 3
|
|||
vkDelay(100, 200) |
|||
|
|||
// Token 3 (OK auth.anonymLogin)
|
|||
log.Println("[VK Auth] Getting Token 3...") |
|||
sessionData := fmt.Sprintf(`{"version":2,"device_id":"%s","client_version":1.1,"client_type":"SDK_JS"}`, uuid.New()) |
|||
t3Data := fmt.Sprintf("session_data=%s&method=auth.anonymLogin&format=JSON&application_key=CGMMEJLGDIHBABABA", |
|||
url.QueryEscape(sessionData)) |
|||
resp, err = vkHTTPPost(ctx, t3Data, "https://calls.okcdn.ru/fb.do") |
|||
if err != nil { |
|||
return "", "", "", fmt.Errorf("Token 3 request error: %w", err) |
|||
} |
|||
if errMsg, ok := resp["error"].(string); ok && errMsg != "" { |
|||
return "", "", "", fmt.Errorf("Token 3 API error: %s", errMsg) |
|||
} |
|||
token3, ok := resp["session_key"].(string) |
|||
if !ok { |
|||
return "", "", "", fmt.Errorf("session_key not found in Token 3 response") |
|||
} |
|||
log.Println("[VK Auth] Token 3 received") |
|||
// Token 3 → Final (TURN)
|
|||
vkDelay(100, 200) |
|||
|
|||
// Final: vchat.joinConversationByLink (Token 4)
|
|||
log.Println("[VK Auth] Getting TURN credentials (Token 4)...") |
|||
finalData := fmt.Sprintf( |
|||
"joinLink=%s&isVideo=false&protocolVersion=5&capabilities=2F7F&anonymToken=%s&method=vchat.joinConversationByLink&format=JSON&application_key=CGMMEJLGDIHBABABA&session_key=%s", |
|||
url.QueryEscape(link), token2, token3) |
|||
resp, err = vkHTTPPost(ctx, finalData, "https://calls.okcdn.ru/fb.do") |
|||
if err != nil { |
|||
return "", "", "", fmt.Errorf("Final request error: %w", err) |
|||
} |
|||
if errMsg, ok := resp["error"].(string); ok && errMsg != "" { |
|||
return "", "", "", fmt.Errorf("Final API error: %s", errMsg) |
|||
} |
|||
|
|||
ts, ok := resp["turn_server"].(map[string]interface{}) |
|||
if !ok { |
|||
return "", "", "", fmt.Errorf("turn_server not found in response: %v", resp) |
|||
} |
|||
urls, _ := ts["urls"].([]interface{}) |
|||
if len(urls) == 0 { |
|||
return "", "", "", fmt.Errorf("urls not found in turn_server") |
|||
} |
|||
urlStr, _ := urls[0].(string) |
|||
clean := strings.Split(urlStr, "?")[0] |
|||
address := strings.TrimPrefix(strings.TrimPrefix(clean, "turn:"), "turns:") |
|||
|
|||
username, _ := ts["username"].(string) |
|||
credential, _ := ts["credential"].(string) |
|||
|
|||
if username == "" || credential == "" { |
|||
return "", "", "", fmt.Errorf("username or credential not found in turn_server") |
|||
} |
|||
|
|||
log.Println("[VK Auth] TURN credentials received") |
|||
vkDelay(1500, 2500) // Final delay before exit
|
|||
return username, credential, address, nil |
|||
} |
|||
@ -0,0 +1,358 @@ |
|||
// SPDX-FileCopyrightText: 2023 The Pion community <https://pion.ly>
|
|||
// SPDX-License-Identifier: MIT
|
|||
|
|||
package main |
|||
|
|||
import ( |
|||
"bytes" |
|||
"compress/gzip" |
|||
"context" |
|||
"crypto/tls" |
|||
"encoding/json" |
|||
"fmt" |
|||
"io" |
|||
"log" |
|||
"net/http" |
|||
"net/url" |
|||
"strings" |
|||
"time" |
|||
|
|||
"github.com/gorilla/websocket" |
|||
) |
|||
|
|||
const ( |
|||
wbBase = "https://stream.wb.ru" |
|||
wbUA = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36" |
|||
) |
|||
|
|||
// WbTurnCred stores a single TURN credential
|
|||
type WbTurnCred struct { |
|||
URL string |
|||
Username string |
|||
Password string |
|||
} |
|||
|
|||
// wbFetch adapts fetchWbCreds to the fetchFunc signature
|
|||
func wbFetch(ctx context.Context, link string) (string, string, string, error) { |
|||
_ = link // WB doesn't use link parameter
|
|||
creds, err := fetchWbCreds(ctx) |
|||
if err != nil { |
|||
return "", "", "", err |
|||
} |
|||
if len(creds) > 0 { |
|||
// Clean URL: "turn:host:port?transport=udp" -> "host:port"
|
|||
clean := strings.Split(creds[0].URL, "?")[0] |
|||
address := strings.TrimPrefix(strings.TrimPrefix(clean, "turn:"), "turns:") |
|||
return creds[0].Username, creds[0].Password, address, nil |
|||
} |
|||
return "", "", "", fmt.Errorf("no TURN credentials received from WB") |
|||
} |
|||
|
|||
// wbHTTPClient creates a WB HTTP client
|
|||
func wbHTTPClient() *http.Client { |
|||
return &http.Client{ |
|||
Timeout: 15 * time.Second, |
|||
Transport: &http.Transport{ |
|||
MaxIdleConns: 100, |
|||
MaxIdleConnsPerHost: 100, |
|||
IdleConnTimeout: 90 * time.Second, |
|||
TLSClientConfig: &tls.Config{}, |
|||
}, |
|||
} |
|||
} |
|||
|
|||
// wbReq makes an HTTP request to WB API
|
|||
func wbReq(ctx context.Context, client *http.Client, method, ep string, body []byte, tok string) ([]byte, error) { |
|||
var rd io.Reader |
|||
if body != nil { |
|||
rd = bytes.NewReader(body) |
|||
} |
|||
|
|||
rq, err := http.NewRequestWithContext(ctx, method, wbBase+ep, rd) |
|||
if err != nil { |
|||
return nil, err |
|||
} |
|||
|
|||
rq.Header.Set("User-Agent", wbUA) |
|||
rq.Header.Set("Accept", "application/json") |
|||
rq.Header.Set("Accept-Language", "en-US,en;q=0.9") |
|||
rq.Header.Set("Origin", wbBase) |
|||
rq.Header.Set("Referer", wbBase+"/") |
|||
if body != nil { |
|||
rq.Header.Set("Content-Type", "application/json") |
|||
} |
|||
if tok != "" { |
|||
rq.Header.Set("Authorization", "Bearer "+tok) |
|||
} |
|||
|
|||
rs, err := client.Do(rq) |
|||
if err != nil { |
|||
return nil, err |
|||
} |
|||
defer rs.Body.Close() |
|||
|
|||
var r io.Reader = rs.Body |
|||
if rs.Header.Get("Content-Encoding") == "gzip" { |
|||
if g, e := gzip.NewReader(rs.Body); e == nil { |
|||
defer g.Close() |
|||
r = g |
|||
} |
|||
} |
|||
|
|||
b, err := io.ReadAll(r) |
|||
if err != nil { |
|||
return nil, err |
|||
} |
|||
|
|||
if rs.StatusCode >= 300 { |
|||
return nil, fmt.Errorf("HTTP %d: %s", rs.StatusCode, string(b)) |
|||
} |
|||
|
|||
return b, nil |
|||
} |
|||
|
|||
// fetchWbCreds performs the full WB credential acquisition flow
|
|||
func fetchWbCreds(ctx context.Context) ([]WbTurnCred, error) { |
|||
client := wbHTTPClient() |
|||
defer client.CloseIdleConnections() |
|||
|
|||
nm := fmt.Sprintf("lh_%d", time.Now().UnixMilli()%100000) |
|||
|
|||
log.Println("[WB Auth] Step 1: Guest registration...") |
|||
rr, err := wbReq(ctx, client, "POST", "/auth/api/v1/auth/user/guest-register", |
|||
[]byte(`{"displayName":"`+nm+`"}`), "") |
|||
if err != nil { |
|||
return nil, fmt.Errorf("guest register: %w", err) |
|||
} |
|||
|
|||
var reg struct { |
|||
AccessToken string `json:"accessToken"` |
|||
} |
|||
if err = json.Unmarshal(rr, ®); err != nil { |
|||
return nil, fmt.Errorf("parse register response: %w", err) |
|||
} |
|||
if reg.AccessToken == "" { |
|||
return nil, fmt.Errorf("no access token in response") |
|||
} |
|||
log.Println("[WB Auth] Guest registered") |
|||
|
|||
log.Println("[WB Auth] Step 2: Create room...") |
|||
rr, err = wbReq(ctx, client, "POST", "/api-room/api/v2/room", |
|||
[]byte(`{"roomType":"ROOM_TYPE_ALL_ON_SCREEN","roomPrivacy":"ROOM_PRIVACY_FREE"}`), |
|||
reg.AccessToken) |
|||
if err != nil { |
|||
return nil, fmt.Errorf("create room: %w", err) |
|||
} |
|||
|
|||
var room struct { |
|||
RoomID string `json:"roomId"` |
|||
} |
|||
if err = json.Unmarshal(rr, &room); err != nil { |
|||
return nil, fmt.Errorf("parse room response: %w", err) |
|||
} |
|||
if room.RoomID == "" { |
|||
return nil, fmt.Errorf("no room ID in response") |
|||
} |
|||
roomPreview := room.RoomID |
|||
if len(roomPreview) > 8 { |
|||
roomPreview = roomPreview[:8] |
|||
} |
|||
log.Printf("[WB Auth] Room created: %s", roomPreview) |
|||
|
|||
log.Println("[WB Auth] Step 3: Join room...") |
|||
_, err = wbReq(ctx, client, "POST", fmt.Sprintf("/api-room/api/v1/room/%s/join", room.RoomID), |
|||
[]byte("{}"), reg.AccessToken) |
|||
if err != nil { |
|||
return nil, fmt.Errorf("join room: %w", err) |
|||
} |
|||
|
|||
log.Println("[WB Auth] Step 4: Get room token...") |
|||
rr, err = wbReq(ctx, client, "GET", fmt.Sprintf( |
|||
"/api-room-manager/api/v1/room/%s/token?deviceType=PARTICIPANT_DEVICE_TYPE_WEB_DESKTOP&displayName=%s", |
|||
room.RoomID, url.QueryEscape(nm)), nil, reg.AccessToken) |
|||
if err != nil { |
|||
return nil, fmt.Errorf("get token: %w", err) |
|||
} |
|||
|
|||
var tok struct { |
|||
RoomToken string `json:"roomToken"` |
|||
} |
|||
if err = json.Unmarshal(rr, &tok); err != nil { |
|||
return nil, fmt.Errorf("parse token response: %w", err) |
|||
} |
|||
if tok.RoomToken == "" { |
|||
return nil, fmt.Errorf("no room token in response") |
|||
} |
|||
|
|||
log.Println("[WB Auth] Step 5: Negotiating ICE (LiveKit)...") |
|||
creds, err := wbLkICE(ctx, tok.RoomToken) |
|||
if err != nil { |
|||
return nil, fmt.Errorf("livekit ICE: %w", err) |
|||
} |
|||
|
|||
for _, c := range creds { |
|||
log.Printf("[WB Auth] → %s", c.URL) |
|||
} |
|||
|
|||
return creds, nil |
|||
} |
|||
|
|||
// wbLkICE connects to LiveKit WebSocket and extracts TURN credentials
|
|||
func wbLkICE(ctx context.Context, token string) ([]WbTurnCred, error) { |
|||
u := "wss://wbstream01-el.wb.ru:7880/rtc?access_token=" + url.QueryEscape(token) + |
|||
"&auto_subscribe=1&sdk=js&version=2.15.3&protocol=16&adaptive_stream=1" |
|||
|
|||
conn, _, err := (&websocket.Dialer{ |
|||
TLSClientConfig: &tls.Config{}, |
|||
HandshakeTimeout: 10 * time.Second, |
|||
}).DialContext(ctx, u, http.Header{ |
|||
"User-Agent": {wbUA}, |
|||
"Origin": {wbBase}, |
|||
}) |
|||
if err != nil { |
|||
return nil, err |
|||
} |
|||
defer conn.Close() |
|||
|
|||
for i := 0; i < 15; i++ { |
|||
conn.SetReadDeadline(time.Now().Add(5 * time.Second)) |
|||
_, msg, err := conn.ReadMessage() |
|||
if err != nil { |
|||
break |
|||
} |
|||
if creds := wbPbICE(msg); len(creds) > 0 { |
|||
return wbDedup(creds), nil |
|||
} |
|||
} |
|||
|
|||
return nil, fmt.Errorf("TURN credentials not found in LiveKit response") |
|||
} |
|||
|
|||
// PbVar reads protobuf varint
|
|||
func wbPbVar(d []byte, o int) (uint64, int) { |
|||
var v uint64 |
|||
for s := 0; o < len(d) && s < 64; s += 7 { |
|||
b := d[o] |
|||
o++ |
|||
v |= uint64(b&0x7f) << s |
|||
if b < 0x80 { |
|||
return v, o |
|||
} |
|||
} |
|||
return 0, o |
|||
} |
|||
|
|||
// PbAll finds all fields with given tag number in protobuf data
|
|||
func wbPbAll(d []byte, f uint64) (r [][]byte) { |
|||
for o := 0; o < len(d); { |
|||
t, n := wbPbVar(d, o) |
|||
if n == o { |
|||
break |
|||
} |
|||
o = n |
|||
switch t & 7 { |
|||
case 0: |
|||
_, o = wbPbVar(d, o) |
|||
case 2: |
|||
l, n := wbPbVar(d, o) |
|||
o = n |
|||
e := o + int(l) |
|||
if e > len(d) || e < o { |
|||
return |
|||
} |
|||
if t>>3 == f { |
|||
r = append(r, d[o:e]) |
|||
} |
|||
o = e |
|||
case 1: |
|||
o += 8 |
|||
case 5: |
|||
o += 4 |
|||
default: |
|||
return |
|||
} |
|||
} |
|||
return |
|||
} |
|||
|
|||
// PbStr extracts string field with given tag number
|
|||
func wbPbStr(d []byte, f uint64) string { |
|||
if a := wbPbAll(d, f); len(a) > 0 { |
|||
return string(a[0]) |
|||
} |
|||
return "" |
|||
} |
|||
|
|||
// PbICE extracts TURN/STUN credentials from protobuf message
|
|||
func wbPbICE(d []byte) (res []WbTurnCred) { |
|||
for o := 0; o < len(d); { |
|||
t, n := wbPbVar(d, o) |
|||
if n == o { |
|||
break |
|||
} |
|||
o = n |
|||
switch t & 7 { |
|||
case 0: |
|||
_, o = wbPbVar(d, o) |
|||
case 2: |
|||
l, n := wbPbVar(d, o) |
|||
o = n |
|||
e := o + int(l) |
|||
if e > len(d) || e < o { |
|||
return |
|||
} |
|||
inner := d[o:e] |
|||
for _, f := range []uint64{5, 9} { |
|||
for _, blk := range wbPbAll(inner, f) { |
|||
urls := wbPbAll(blk, 1) |
|||
hit := false |
|||
for _, u := range urls { |
|||
s := string(u) |
|||
if strings.HasPrefix(s, "turn") || strings.HasPrefix(s, "stun") { |
|||
hit = true |
|||
break |
|||
} |
|||
} |
|||
if !hit { |
|||
continue |
|||
} |
|||
un, pw := wbPbStr(blk, 2), wbPbStr(blk, 3) |
|||
for _, u := range urls { |
|||
res = append(res, WbTurnCred{string(u), un, pw}) |
|||
} |
|||
for _, blk2 := range wbPbAll(inner, f) { |
|||
if len(blk2) > 0 && len(blk) > 0 && &blk2[0] == &blk[0] { |
|||
continue |
|||
} |
|||
u2, p2 := wbPbStr(blk2, 2), wbPbStr(blk2, 3) |
|||
for _, u := range wbPbAll(blk2, 1) { |
|||
res = append(res, WbTurnCred{string(u), u2, p2}) |
|||
} |
|||
} |
|||
return |
|||
} |
|||
} |
|||
o = e |
|||
case 1: |
|||
o += 8 |
|||
case 5: |
|||
o += 4 |
|||
default: |
|||
return |
|||
} |
|||
} |
|||
return |
|||
} |
|||
|
|||
// wbDedup removes duplicate credentials
|
|||
func wbDedup(cc []WbTurnCred) (r []WbTurnCred) { |
|||
seen := map[string]bool{} |
|||
for _, c := range cc { |
|||
k := c.URL + "|" + c.Username |
|||
if !seen[k] { |
|||
seen[k] = true |
|||
r = append(r, c) |
|||
} |
|||
} |
|||
return |
|||
} |
|||
Loading…
Reference in new issue