WildDragonLLC/dragonflight
1
0
Fork 0
Code Issues 32 Pull requests 1 Projects Releases Packages Wiki Activity Actions

fix(capture): authenticate sidecar->mam-api calls with bearer token

Browse source 
The live-thumbnail and manual /start,/stop sidecar->mam-api calls hit the CSRF
guard (403 missing X-Requested-With). Match the working pattern in index.js:
send Authorization: Bearer $MAM_API_TOKEN (= CAPTURE_TOKEN, injected by
recorders.js), which is CSRF-exempt. Falls back to the UI header only when no
token is set (dev). Fixes [livethumb] failed ... 403 — posters now persist.

🤖 Generated with Claude Code
This commit is contained in:
Claude 2026-06-02 16:00:13 +00:00
parent b40f640fa1
commit 22853da023
2 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
services/capture/src/capture-manager.js
View file

@ -1346,7 +1346,10 @@ exit "$BMXRC"
// 4. Tell mam-api the key (only sticks while the asset is still 'live'). // 4. Tell mam-api the key (only sticks while the asset is still 'live').
const resp = await fetch(`${mamUrl}/api/v1/assets/${assetId}/live-thumbnail`, { const resp = await fetch(`${mamUrl}/api/v1/assets/${assetId}/live-thumbnail`, {
method: 'POST', method: 'POST',
headers: { 'Content-Type': 'application/json' }, headers: {
'Content-Type': 'application/json',
...(process.env.MAM_API_TOKEN ? { Authorization: `Bearer ${process.env.MAM_API_TOKEN}` } : {}),
},
body: JSON.stringify({ thumbnailKey: thumbKey }), body: JSON.stringify({ thumbnailKey: thumbKey }),
}); });
if (!resp.ok) throw new Error(`mam-api ${resp.status}: ${(await resp.text()).slice(0, 200)}`); if (!resp.ok) throw new Error(`mam-api ${resp.status}: ${(await resp.text()).slice(0, 200)}`);

3
services/capture/src/routes/capture.js
View file

@ -77,6 +77,7 @@ function classifyProbeError(raw, sourceType) {
const router = express.Router(); const router = express.Router();
const MAM_API_URL = process.env.MAM_API_URL || 'http://mam-api:3000'; const MAM_API_URL = process.env.MAM_API_URL || 'http://mam-api:3000';
const MAM_API_TOKEN = process.env.MAM_API_TOKEN || '';
/** /**
* GET /devices * GET /devices
@ -340,7 +341,7 @@ router.post('/start', async (req, res) => {
try { try {
const mamResponse = await fetch(`${MAM_API_URL}/api/v1/assets`, { const mamResponse = await fetch(`${MAM_API_URL}/api/v1/assets`, {
method: 'POST', method: 'POST',
headers: { 'Content-Type': 'application/json' }, headers: { 'Content-Type': 'application/json', ...(MAM_API_TOKEN ? { Authorization: `Bearer ${MAM_API_TOKEN}` } : { 'X-Requested-With': 'dragonflight-ui' }) },
body: JSON.stringify({ body: JSON.stringify({
projectId: project_id, projectId: project_id,
binId: bin_id, binId: bin_id,