hub/abapi.js

// Audiobooks: the library, covers, chapters, the audio itself and each person's listening position. Two ways to reach them:
//  - OPENAUDIBLE_URL set: the hub talks to OpenAudible directly, signing in with the username and password saved in Settings (OpenAudible's own login;
//    OPENAUDIBLE_USER / OPENAUDIBLE_PASSWORD are used when none are saved). The hub keeps each person's listening position itself.
//  - otherwise: through the audiobook player (https://git.necloud.us/nate/audiobook-player) at AUDIOBOOKS_URL, signing in to it as the person
//    (the account in Settings), or with the shared secret link (AUDIOBOOKS_LOGIN_LINK). The player keeps the positions.
// No password or link ever reaches the browser.
const { Readable } = require('stream');
const fs = require('fs'), path = require('path');
const settings = require('./settings');
const users = require('./users');

const OA = (process.env.OPENAUDIBLE_URL || '').replace(/\/$/, ''); // direct mode
const BASE = (process.env.AUDIOBOOKS_URL || 'https://audiobooks.necloud.us').replace(/\/$/, '');
const LINK = process.env.AUDIOBOOKS_LOGIN_LINK || '';
const COOKIE = 'oa_session';
const sessions = new Map(); // person id -> the player's session cookie
const json = (res, code, o) => { res.writeHead(code, { 'content-type': 'application/json', 'cache-control': 'no-store' }); res.end(JSON.stringify(o)); };
const cookieOf = r => { const c = (r.headers.getSetCookie ? r.headers.getSetCookie() : []).map(x => x.split(';')[0]).find(x => x.startsWith(COOKIE + '=')); return c || ''; };

// Hub path -> player path (the player itself only serves read-only calls for these)
const ROUTES = [
  [/^\/books$/, () => '/api/books'],
  [/^\/books\/([^/]+)\/(chapters\/flat|cover)$/, m => `/api/books/${m[1]}/${m[2]}`],
  [/^\/books\/([^/]+)\/filelist$/, m => `/admin/api/books/${m[1]}/files`],
  [/^\/books\/([^/]+)\/files\/([^/]+)$/, m => `/api/books/${m[1]}/files/${m[2]}`],
];

async function signIn(me) {
  const c = settings.get('ab_creds') || {};
  let r;
  if (c.u && c.p) r = await fetch(BASE + '/login', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ username: c.u, password: c.p }), redirect: 'manual', signal: AbortSignal.timeout(15000) });
  else if (LINK) r = await fetch(LINK, { redirect: 'manual', signal: AbortSignal.timeout(15000) });
  else throw Object.assign(new Error('Add your audiobook sign-in in Settings first'), { code: 503 });
  const ck = cookieOf(r);
  if (!ck) throw Object.assign(new Error(c.u ? 'The audiobook site did not accept your saved sign-in' : 'The audiobook site did not accept the shared sign-in'), { code: 502 });
  sessions.set(me.id, ck); return ck;
}

// Direct to OpenAudible: Basic auth with the saved login (or the server's), and a clear message when it is refused.
async function direct(path, init = {}) {
  const c = settings.get('ab_creds') || {}, u = c.u || process.env.OPENAUDIBLE_USER || '', p = c.u ? c.p : process.env.OPENAUDIBLE_PASSWORD || '';
  const headers = { ...init.headers }; if (u) headers.authorization = 'Basic ' + Buffer.from(u + ':' + p).toString('base64');
  else throw Object.assign(new Error('Add your OpenAudible username and password in Settings first'), { code: 503 });
  const r = await fetch(OA + path, { ...init, headers, redirect: 'manual' });
  if (r.status === 401) { await r.body?.cancel().catch(() => {}); throw Object.assign(new Error('OpenAudible did not accept the username and password saved in Settings'), { code: 502 }); }
  return r;
}

// Listening positions kept by the hub (direct mode): one file per person, the newest time wins for each book.
const progFile = () => path.join(users.dir(), 'audiobook-progress.json');
const progLoad = () => { try { return JSON.parse(fs.readFileSync(progFile(), 'utf8')); } catch { return {}; } };
function progMerge(body) {
  const mine = progLoad();
  for (const [k, v] of Object.entries(body || {})) if (v && typeof v === 'object' && (v.t || 0) >= ((mine[k] || {}).t || 0)) mine[k] = { pos: +v.pos || 0, dur: +v.dur || 0, t: +v.t || 0 };
  const f = progFile(), tmp = f + '.tmp'; fs.writeFileSync(tmp, JSON.stringify(mine), { mode: 0o600 }); fs.renameSync(tmp, f); return mine;
}

async function upstream(me, path, init = {}, retry = true) {
  if (OA) return direct(path, init);
  const ck = sessions.get(me.id) || await signIn(me);
  const r = await fetch(BASE + path, { ...init, headers: { ...init.headers, cookie: ck }, redirect: 'manual' });
  if ((r.status === 401 || r.status === 302) && retry) { sessions.delete(me.id); await r.body?.cancel().catch(() => {}); return upstream(me, path, init, false); }
  return r;
}

async function handle(req, res) {
  const me = users.current();
  const u = new URL(req.url, 'http://x'), p = u.pathname.slice('/api/ab'.length) || '/';
  const ctl = new AbortController(); res.on('close', () => ctl.abort());
  try {
    if (p === '/progress') {
      if (OA) { // positions live in the hub
        if (req.method === 'GET') return json(res, 200, progLoad());
        if (req.method !== 'POST') return json(res, 405, { error: 'Method not allowed' });
        const chunks = []; let n = 0; for await (const c of req) { n += c.length; if (n > 1e6) return json(res, 413, { error: 'Too large' }); chunks.push(c); }
        let body; try { body = JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}'); } catch { return json(res, 400, { error: 'Bad request' }); }
        return json(res, 200, progMerge(body));
      }
      if (req.method === 'POST') {
        const chunks = []; let n = 0; for await (const c of req) { n += c.length; if (n > 1e6) return json(res, 413, { error: 'Too large' }); chunks.push(c); }
        const r = await upstream(me, '/sync/progress', { method: 'POST', body: Buffer.concat(chunks), headers: { 'content-type': 'application/json' }, signal: ctl.signal });
        res.writeHead(r.status, { 'content-type': 'application/json', 'cache-control': 'no-store' }); return res.end(Buffer.from(await r.arrayBuffer()));
      }
      if (req.method !== 'GET') return json(res, 405, { error: 'Method not allowed' });
      const r = await upstream(me, '/sync/progress', { signal: ctl.signal });
      res.writeHead(r.status, { 'content-type': 'application/json', 'cache-control': 'no-store' }); return res.end(Buffer.from(await r.arrayBuffer()));
    }
    if (req.method !== 'GET') return json(res, 405, { error: 'Method not allowed' });
    let to = null; for (const [re, f] of ROUTES) { const m = re.exec(p); if (m) { to = f(m); break; } }
    if (!to) return json(res, 404, { error: 'Not found' });
    const headers = req.headers.range ? { range: req.headers.range } : {};
    const r = await upstream(me, to, { headers, signal: ctl.signal });
    const out = { 'cache-control': p.endsWith('/cover') ? 'private, max-age=86400' : 'no-store' };
    for (const k of ['content-type', 'content-length', 'content-range', 'accept-ranges']) if (r.headers.get(k)) out[k] = r.headers.get(k);
    const want = /^bytes=(\d*)-(\d*)$/.exec(req.headers.range || ''), total = +r.headers.get('content-length') || 0;
    if (OA && want && r.status === 200 && total && (want[1] || want[2])) { // OpenAudible sent the whole file: phones need byte ranges, so cut the piece out here
      const a = want[1] === '' ? Math.max(0, total - +want[2]) : +want[1], b = want[1] === '' || want[2] === '' ? total - 1 : Math.min(+want[2], total - 1);
      if (a > b || a >= total) { await r.body.cancel().catch(() => {}); res.writeHead(416, { 'content-range': 'bytes */' + total }); return res.end(); }
      res.writeHead(206, { ...out, 'content-range': `bytes ${a}-${b}/${total}`, 'content-length': String(b - a + 1), 'accept-ranges': 'bytes' });
      let at = 0; const rd = r.body.getReader();
      try { for (;;) { const { done, value } = await rd.read(); if (done) break; const end = at + value.length; if (end > a && at <= b) { if (!res.write(value.subarray(Math.max(0, a - at), Math.min(value.length, b + 1 - at)))) await new Promise(ok => res.once('drain', ok)); } at = end; if (at > b) break; } }
      finally { rd.cancel().catch(() => {}); res.end(); }
      return;
    }
    res.writeHead(r.status, out);
    if (!r.body) return res.end();
    Readable.fromWeb(r.body).on('error', () => res.destroy()).pipe(res);
  } catch (e) {
    if (res.headersSent) return res.destroy();
    json(res, e.code || 502, { error: e.code ? e.message : 'The audiobook site did not answer' });
  }
}

module.exports = { handle };