add ability to verify the requests

fixes #9

config/default.toml

@@ -3,6 +3,7 @@ port = 8282
 host = "127.0.0.1"
 secret_key = "CHANGE_ME"
 base_url = "http://localhost:8282"
+verify_requests = false
 
 [cache]
 enabled = true

src/lib/helpers/verifyRequest.ts

@@ -0,0 +1,42 @@
+import { Store } from "@willsoto/node-konfig-core";
+import { decodeBase64 } from "jsr:@std/encoding/base64";
+import { Aes } from "https://deno.land/x/[email protected]/aes.ts";
+import {
+    Ecb,
+    Padding,
+} from "https://deno.land/x/[email protected]/block-modes.ts";
+
+export const verifyRequest = (
+    stringToCheck: string,
+    videoId: string,
+    konfigStore: Store,
+): boolean => {
+    try {
+        const decipher = new Ecb(
+            Aes,
+            new TextEncoder().encode(
+                Deno.env.get("SERVER_SECRET_KEY") ||
+                    konfigStore.get("server.secret_key") as string,
+            ),
+            Padding.PKCS7,
+        );
+
+        const encryptedData = new TextDecoder().decode(
+            decipher.decrypt(decodeBase64(stringToCheck)),
+        );
+        const [parsedTimestamp, parsedVideoId] = encryptedData.split("|");
+        const parsedTimestampInt = parseInt(parsedTimestamp);
+        const timestampNow = Math.round(+new Date() / 1000);
+        if (parsedVideoId !== videoId) {
+            return false;
+        }
+        // only allow ID to live for 6 hours
+        if ((timestampNow + 6 * 60 * 60) - parsedTimestampInt < 0) {
+            console.log("sup lol")
+            return false;
+        }
+    } catch (_) {
+        return false;
+    }
+    return true;
+};

src/routes/invidious_routes/dashManifest.ts

@@ -6,12 +6,16 @@ import {
     youtubePlayerParsing,
     youtubeVideoInfo,
 } from "../../lib/helpers/youtubePlayerHandling.ts";
+import {
+    verifyRequest
+} from "../../lib/helpers/verifyRequest.ts";
+import { HTTPException } from "hono/http-exception";
 
 const dashManifest = new Hono<{ Variables: HonoVariables }>();
 
 dashManifest.get("/:videoId", async (c) => {
     const { videoId } = c.req.param();
-    const { local } = c.req.query();
+    const { check, local } = c.req.query();
     c.header("access-control-allow-origin", "*");
 
     const innertubeClient = await c.get("innertubeClient") as Innertube;
@@ -20,6 +24,18 @@ dashManifest.get("/:videoId", async (c) => {
         Record<string, unknown>
     >;
 
+    if (konfigStore.get("server.verify_requests") && check == undefined) {
+        throw new HTTPException(400, {
+            res: new Response("No check ID."),
+        });
+    } else if (konfigStore.get("server.verify_requests") && check) {
+        if (verifyRequest(check, videoId, konfigStore) === false) {
+            throw new HTTPException(400, {
+                res: new Response("ID incorrect."),
+            });
+        }
+    }
+
     const youtubePlayerResponseJson = await youtubePlayerParsing(
         innertubeClient,
         videoId,

src/routes/invidious_routes/latestVersion.ts

@@ -7,11 +7,14 @@ import {
     youtubePlayerParsing,
     youtubeVideoInfo,
 } from "../../lib/helpers/youtubePlayerHandling.ts";
+import {
+    verifyRequest
+} from "../../lib/helpers/verifyRequest.ts";
 
 const latestVersion = new Hono<{ Variables: HonoVariables }>();
 
 latestVersion.get("/", async (c) => {
-    const { itag, id, local } = c.req.query();
+    const { check, itag, id, local } = c.req.query();
     c.header("access-control-allow-origin", "*");
 
     if (!id || !itag) {
@@ -26,6 +29,18 @@ latestVersion.get("/", async (c) => {
         Record<string, unknown>
     >;
 
+    if (konfigStore.get("server.verify_requests") && check == undefined) {
+        throw new HTTPException(400, {
+            res: new Response("No check ID."),
+        });
+    } else if (konfigStore.get("server.verify_requests") && check) {
+        if (verifyRequest(check, id, konfigStore) === false) {
+            throw new HTTPException(400, {
+                res: new Response("ID incorrect."),
+            });
+        }
+    }
+
     const youtubePlayerResponseJson = await youtubePlayerParsing(
         innertubeClient,
         id,