Authentication with webhooks and example authentication-backend

[neilschark]

Hello,

This is currently just a draft and not finished, but I am at a point where I think we should discuss the idea and implementation!

Background

as discussed in #140 there is the need for only allowing some people to stream to the server. A good solution was also proposed by https://github.com/mpisat: webhooks.

They also wrote some code in their own fork, but never opened a PR.

So I took the liberty of using their code as a base but also add an example/reference implementation of a authentication-backend, so that the project can deliver it for users to use.

Plan

The plan is, that each user has a username and also a streamkey. If they want to stream, the have to provide their token as a bearer token e.g.:

If their token matches a user (their user hopefully 😉 ) the stream gets accepted. For viewers to watch they can now go to server/$username to watch the stream for this user. Authentication for viewers is currently NOT intended, but could be implemented in a similar way very easily in the future, as far as I understand the code.

Current Implementation in this PR

What I have done: I used pocketbase (https://pocketbase.io/) as it offers an easy way of building a REST-API in go. For starters we just need users, streamkeys and some permissions on the endpoints and that's it. Pocketbase offers an easy way of doing this and you can also add tons of SSO options for log in, so each administrator of a broadcast-box could easily add the providers of its choice.

Currently I only created the database schema and an custom internal endpoint for the webhook. The permissions are also still missing.

I currently have to problem that I can not fully test the changes, as the local dev environment is not working for me (doesn't work on the main branch either), as the frontend refuses to display any video and shows the following error: ERROR The fetching process for the media resource was aborted by the user agent at the user's request.

Could anyone help me, how to get it to work? I followed this documentation for local testing: https://github.com/Glimesh/broadcast-box/blob/main/CONTRIBUTING.md

Any feedback for the current plan and help is appreciated!

[Sean-Der]

Oh hell yea! This is amazing, you rock @neilschark

I will give input tonight. Just getting off a flight and excited to see this :)

[gedw99]

This looks like much needed feature …

I will try it out ..

thanks @neilschark for working on this . Doing it with pocketbase is a good idea since it has so many integrated auth providers.

@Sean-Der I guess you got side tracked ? If you have any review comments it would be good to hear it :)

[neilschark]

@gedw99
Thanks for your input. I also think its a good feature. There is still some work to do, like proper auth, but I want to wait for some feedback if it matches the ideas @Sean-Der has for this project before finishing it.