41c1f41ed2
Implement secure recording file access through authentication instead of exposing S3 bucket or using temporary signed links with loose permissions. Inspired by docs and @spaccoud's implementation, with comprehensive viewset checks to prevent unauthorized recording downloads. The ingress reserved to media intercept the original request, and thanks to Nginx annotations, check with the backend if the user is allowed to donwload this recording file. This might introduce a dependency to Nginx in the project by the way. Note: Tests are integration-based rather than unit tests, requiring minio in the compose stack and CI environment. Implementation includes known botocore deprecation warnings that per GitHub issues won't be resolved for months.
29 lines
841 B
Python
29 lines
841 B
Python
"""
|
|
Core application enums declaration
|
|
"""
|
|
|
|
import re
|
|
|
|
from django.conf import global_settings, settings
|
|
from django.utils.translation import gettext_lazy as _
|
|
|
|
UUID_REGEX = (
|
|
r"[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}"
|
|
)
|
|
FILE_EXT_REGEX = r"[a-zA-Z0-9]{1,10}"
|
|
|
|
# pylint: disable=line-too-long
|
|
RECORDING_STORAGE_URL_PATTERN = re.compile(
|
|
f"/media/{settings.RECORDING_OUTPUT_FOLDER}/(?P<recording_id>{UUID_REGEX:s}).(?P<extension>{FILE_EXT_REGEX:s})"
|
|
)
|
|
|
|
# Django sets `LANGUAGES` by default with all supported languages. We can use it for
|
|
# the choice of languages which should not be limited to the few languages active in
|
|
# the app.
|
|
# pylint: disable=no-member
|
|
ALL_LANGUAGES = getattr(
|
|
settings,
|
|
"ALL_LANGUAGES",
|
|
[(language, _(name)) for language, name in global_settings.LANGUAGES],
|
|
)
|