Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
111 changes: 103 additions & 8 deletions apps/desktop-gpui/src/upload.rs
Original file line number Diff line number Diff line change
Expand Up @@ -296,7 +296,7 @@ pub async fn prepare_instant_upload(
} else {
"desktopSegments"
};
let config = create_or_get_video_with_mode(
let created = create_or_get_video_with_mode(
false,
None,
Some(project_name),
Expand All @@ -313,9 +313,11 @@ pub async fn prepare_instant_upload(
error => format!("Could not create the shareable link: {error}"),
})?;

let link = created.link();
let config = created.config;
Ok(VideoUploadInfo {
id: config.id.clone(),
link: format!("{}/s/{}", auth::server_url(), config.id),
link,
config,
})
}
Expand Down Expand Up @@ -1448,13 +1450,15 @@ async fn upload_exported_video_inner(
})
.await
{
Ok(config) => config,
Ok(created) => created,
Err(AuthApiError::InvalidAuthentication) => {
return Ok((UploadResult::NotAuthenticated, None));
}
Err(AuthApiError::UpgradeRequired) => return Ok((UploadResult::UpgradeRequired, None)),
Err(error) => return Err(error.to_string()),
};
let created_link = s3_config.share_url;
let s3_config = s3_config.config;
if s3_config.id != video_id {
return Err("Server did not preserve the reserved upload identity".into());
}
Expand Down Expand Up @@ -1485,6 +1489,7 @@ async fn upload_exported_video_inner(
.sharing
.as_ref()
.map(|sharing| sharing.link.clone())
.or(created_link)
.unwrap_or(link);
meta.sharing = Some(SharingMeta {
link: link.clone(),
Expand Down Expand Up @@ -1565,7 +1570,7 @@ async fn create_or_get_video(
name: Option<String>,
meta: Option<&VideoMeta>,
organization_id: Option<String>,
) -> Result<S3UploadMeta, AuthApiError> {
) -> Result<CreatedVideo, AuthApiError> {
create_or_get_video_with_mode(
is_screenshot,
video_id,
Expand All @@ -1584,7 +1589,7 @@ async fn create_or_get_video_with_mode(
meta: Option<&VideoMeta>,
organization_id: Option<String>,
recording_mode: &str,
) -> Result<S3UploadMeta, AuthApiError> {
) -> Result<CreatedVideo, AuthApiError> {
let mut path = format!(
"/api/desktop/video/create?recordingMode={}",
urlencoding(recording_mode)
Expand Down Expand Up @@ -1626,10 +1631,54 @@ async fn create_or_get_video_with_mode(
.text()
.await
.map_err(|error| AuthApiError::Other(format!("Failed to read response body: {error}")))?;
serde_json::from_str::<S3UploadMeta>(&text)
parse_created_video(&text)
.map_err(|_| AuthApiError::Other("Invalid video creation response".into()))
}

struct CreatedVideo {
config: S3UploadMeta,
share_url: Option<String>,
}

impl CreatedVideo {
fn link(&self) -> String {
self.share_url
.clone()
.unwrap_or_else(|| format!("{}/s/{}", auth::server_url(), self.config.id))
}
}

fn parse_created_video(body: &str) -> Result<CreatedVideo, serde_json::Error> {
#[derive(Deserialize)]
struct CreateVideoResponse {
id: String,
#[serde(default)]
share_url: Option<String>,
}

let response = serde_json::from_str::<CreateVideoResponse>(body)?;
let share_url = response
.share_url
.filter(|share_url| is_share_url_for(share_url, &response.id));
Ok(CreatedVideo {
config: S3UploadMeta { id: response.id },
share_url,
})
}

fn is_share_url_for(share_url: &str, video_id: &str) -> bool {
reqwest::Url::parse(share_url).is_ok_and(|url| {
url.scheme() == "https"
&& url.host_str().is_some_and(|host| !host.is_empty())
&& url.username().is_empty()
&& url.password().is_none()
&& url.port().is_none()
&& url.path() == format!("/s/{video_id}")
&& url.query().is_none()
&& url.fragment().is_none()
})
}

#[derive(Debug)]
enum ReplacementUploadAttempt<T, S = ()> {
Completed(T),
Expand Down Expand Up @@ -2578,11 +2627,13 @@ async fn upload_screenshot_bytes(
content_type: &str,
video_id: Option<String>,
) -> Result<UploadedItem, AuthApiError> {
let s3_config = create_or_get_video(true, video_id, None, None, None).await?;
let created = create_or_get_video(true, video_id, None, None, None).await?;
let link = created.link();
let s3_config = created.config;
let subpath = screenshot_upload_subpath(content_type);
presigned_put_bytes(&s3_config.id, subpath, image_bytes).await?;
Ok(UploadedItem {
link: format!("{}/s/{}", auth::server_url(), s3_config.id),
link,
id: s3_config.id,
})
}
Expand Down Expand Up @@ -2684,6 +2735,50 @@ fn urlencoding(value: &str) -> String {
mod tests {
use super::*;

#[test]
fn created_video_uses_a_custom_domain_share_link() {
let created = parse_created_video(
r#"{"id":"abc123","share_url":"https://videos.team.test/s/abc123","user_id":"u"}"#,
)
.unwrap();
assert_eq!(created.config.id, "abc123");
assert_eq!(
created.share_url.as_deref(),
Some("https://videos.team.test/s/abc123")
);
}

#[test]
fn created_video_without_a_share_link_keeps_the_default() {
let created = parse_created_video(r#"{"id":"abc123","user_id":"u"}"#).unwrap();
assert_eq!(created.config.id, "abc123");
assert_eq!(created.share_url, None);

let created = parse_created_video(r#"{"id":"abc123","share_url":null}"#).unwrap();
assert_eq!(created.share_url, None);
}

#[test]
fn created_video_ignores_share_links_for_other_pages() {
for share_url in [
"",
"not a url",
"http://videos.team.test/s/abc123",
"https://videos.team.test/s/other",
"https://videos.team.test/s/abc123/extra",
"https://videos.team.test/c/abc123",
"https://videos.team.test/s/abc123?x=1",
"https://videos.team.test/s/abc123#x",
"https://user:pass@videos.team.test/s/abc123",
"https://videos.team.test:8443/s/abc123",
"javascript:alert(1)//s/abc123",
] {
let body = serde_json::json!({ "id": "abc123", "share_url": share_url }).to_string();
let created = parse_created_video(&body).unwrap();
assert_eq!(created.share_url, None, "{share_url}");
}
}

#[tokio::test]
async fn presigned_transfer_errors_never_expose_secret_urls() {
let client = reqwest::Client::new();
Expand Down
10 changes: 6 additions & 4 deletions apps/desktop/src-tauri/src/lib.rs
Original file line number Diff line number Diff line change
Expand Up @@ -5216,13 +5216,13 @@ async fn upload_exported_video(
channel.send(UploadProgress { progress: 0.0 }).ok();

let existing_video_id = upload::reusable_video_id(meta.sharing.as_ref(), meta.upload.as_ref());
let s3_config = match async {
let (s3_config, created_link) = match async {
let video_id = match mode {
UploadMode::Initial { pre_created_video } => {
if let Some(video_id) = existing_video_id.clone() {
Some(video_id)
} else if let Some(pre_created) = pre_created_video {
return Ok(pre_created.config);
return Ok((pre_created.config, Some(pre_created.link)));
} else {
None
}
Expand All @@ -5236,15 +5236,16 @@ async fn upload_exported_video(
}
};

create_or_get_video(
let created = create_or_get_video(
&app,
false,
video_id,
Some(meta.pretty_name.clone()),
Some(metadata.clone()),
organization_id,
)
.await
.await?;
Ok((created.config, created.share_url))
}
.await
{
Expand Down Expand Up @@ -5288,6 +5289,7 @@ async fn upload_exported_video(
.sharing
.as_ref()
.map(|sharing| sharing.link.clone())
.or(created_link)
.unwrap_or(uploaded_video.link);

meta.upload = Some(UploadMeta::Complete);
Expand Down
5 changes: 3 additions & 2 deletions apps/desktop/src-tauri/src/recording.rs
Original file line number Diff line number Diff line change
Expand Up @@ -2317,7 +2317,7 @@ async fn start_recording_prepared(
"desktopSegments"
};

let s3_config = match crate::upload::create_or_get_video_with_mode(
let created = match crate::upload::create_or_get_video_with_mode(
&app,
false,
None,
Expand Down Expand Up @@ -2355,7 +2355,8 @@ async fn start_recording_prepared(
}
};

let link = app.make_app_url(format!("/s/{}", s3_config.id)).await;
let link = created.link(&app).await;
let s3_config = created.config;
info!("Pre-created shareable link: {}", link);

(
Expand Down
Loading
Loading