john-okeefe
c156176988
- Apply DeviceAuthMiddleware.Authenticate to /opds/devices/* routes - OPDS now uses same authentication model as sync API (devices.auth_token) - Removes security vulnerability allowing unauthorized device enumeration - Update test expectations to require 401 for unauthenticated requests - Fix query parameter name from 'query' to 'q' in search endpoints - Update router comments to clarify authentication requirements
20 lines
928 B
Go
20 lines
928 B
Go
package router
|
|
|
|
// Register OPDS routes with device authentication
|
|
// Devices must use their devices.auth_token (generated during device registration/approval)
|
|
// Kobo devices store this token for both sync and OPDS catalog access
|
|
// Returns 401 Unauthorized if device token is missing, invalid, or device sync is disabled
|
|
func registerOPDSRoutes(cfg *Config) {
|
|
e := cfg.Echo
|
|
|
|
// Require device authentication for all OPDS endpoints
|
|
opds := e.Group("/opds/devices")
|
|
opds.Use(cfg.DeviceAuthMiddleware.Authenticate)
|
|
opds.GET("/:deviceId/catalog", cfg.OPDSHandler.GetDeviceCatalog)
|
|
opds.GET("/:deviceId/search", cfg.OPDSHandler.SearchDeviceCatalog)
|
|
opds.GET("/:deviceId/nav", cfg.OPDSHandler.GetDeviceNavigation)
|
|
opds.GET("/:deviceId/download/:bookId", cfg.OPDSHandler.DownloadBook)
|
|
opds.GET("/:deviceId/cover/:bookId", cfg.OPDSHandler.GetCoverImage)
|
|
opds.GET("/:deviceId/formats/:bookId", cfg.OPDSHandler.ListFormats)
|
|
}
|