Files
OpenList/internal/transcode/manager.go
T
25e4eb663f feat(func): media library (#2210)
* feat(func): media library

* feat(func): media library

* feat(func): media library

* feat(func): media library build test

* feat(func): media library build test

* feat(func): media library fix remote fetch error

* feat(func): media library fix remote fetch error

* feat(func): media library fix remote fetch error

* feat(func): media library support select

* feat(func): media library support select

* feat(func): media library support select

* feat(func): media library support select

* feat(func): media library support change api url

* feat(func): media library support change api url

* feat(func): media library support change api url

* feat(media): 并发刮削(默认 5)+ 单条落库
增强 TMDB 搜索:模糊匹配 + 多候选关键词
管理页面新增导入/导出媒体库(全部 / 按扫描路径)
缩略图路径默认值改为 imgs

* feat(media): 清空刮削、删除已失效

* fix(media): fix api proxy path

* fix(media): fix lrc file display & music id3

* fix(media): fix media scan sub path error

* feat(media): support cloud codec via ffmpeg

* feat(media): support cloud codec via ffmpeg

* feat(media): support cloud codec via ffmpeg

* feat(media): support cloud codec via ffmpeg

* feat(media): 提升刮削精准度,支持模糊刮削

* fix(media): clean up imports and improve FetchFileReader logic

* feat(media): 提升刮削精准度,支持模糊刮削

* feat(media): 刮削支持自定义刮削数量,避免太占性能

* feat(media): 刮削支持自定义刮削数量,避免太占性能

* feat(media): 刮削修复写入作品名问题

* fix(media): return 404 on missing item_id and fix unscraped item query

- Validate GetMediaItemByID result before spawning goroutine in
  StartMediaScrape; return 404 when item_id > 0 but item is not found
- Replace `description` check with `plot` check in GetUnscrappedItems
  since scrapers populate Plot, not Description, to avoid re-selecting
  already-scraped items on every run

* Apply remaining changes

* feat(media): add master switch, app keys, STRM, Emby and OpenSubsonic APIs

* feat(media): allow any logged-in user to manage their own media app keys

* feat(media): allow signing arbitrary media path for local player

* fix(media): always return an array for media status types

* fix(media): persist per-type scraper config and apply it to thumbnails

* feat(media): add local thumbnail endpoint and cover proxy with fallback gateway

* fix(media): allow guest media access, per-file local thumbnails and optional cover proxy

* feat(media): thumbnail storage modes and STRM same-directory output

* feat(media): Google Books/OpenLibrary sources and remote cover download

* chore(media): rename transcode cache dir to ctmp and log thumbnail storage dir

* feat(media): progress and favorites API shared with Emby/Subsonic

* chore: ignore runtime thumbnail directory

* feat(media): add preferred scrape language and namespace protocol endpoints under @

* fix(media): harden anonymous emby images, pagination and cover proxy SSRF

* fix(emby): allow anonymous user discovery and login before auth

* chore: drop redundant media build workflow and protocol doc

* fix(media): ID3v2.4 syncsafe frame size and preserve Hidden flag on rescan

* fix(media): address security review (path traversal, guest bypass, cover XSS, auth rate limit, SSRF, quotas, migration)

* fix(media): 清理失效条目时只删除确认不存在的记录

此前 fs.Get 返回任何错误都视为失效并硬删除,驱动故障/超时/鉴权失败时会误删有效媒体记录。现在仅 errs.IsObjectNotFound 才删除,其余错误跳过并在响应中返回 skipped 计数。

* fix(transcode): 播放凭据与 Worker 回写凭据分离,并收紧 profile 与鉴权校验

- 新增 Job.PlayToken(json 标签为 -),master/playlist/切片只认播放凭据,播放器不再拿到可上传、可结束任务的 callback_token

- Worker 上传切片时校验 profile 必须属于任务声明的档位

- TCMaster 与 WorkerJobFinish 改用恒定时间比较,避免时序侧信道

* fix(transcode): 含冒号的本地文件名可转码,补基址缺失与重新激活配额

- ValidSourceInput 不再按冒号位置判协议:本地输入只要求以 / 开头或 Windows 盘符路径,concat:/subfile: 等前缀仍被拒且由 -protocol_whitelist 兜底(修复 /mnt/x/Star Wars: IV.mkv 被误判)

- trustedInternalBaseURL 返回空串时直接 503 并给出明确原因,不再拼出 /d/xxx 让 ffmpeg 报文件不存在

- 远程输入白名单收窄为 http,https,tcp,tls(去掉 file 与 crypto)

- Reactivate 复用同一套单用户配额,避免「先让任务闲置取消、再批量激活」绕过 SubmitLimited;配额不足返回 429

- OwnerID 改为配额键:普通用户 user:<id>,访客 guest:<clientIP>,避免单个匿名访客占满全部匿名配额;补充对应单测

* fix(media): 收紧缩略图解码内存、跳过超长条目可见化,并补 CI 单测

- MaxImagePixels 从 64MP 降到 32MP,宽高改 int64 相乘防 32 位溢出,解码阶段加 12 路全局信号量

- 封面解码失败退回原始字节时限制 512KB,避免十几 MB 的 base64 写进 cover 列(豆瓣/本地书籍三处)

- 扫描进度新增 Skipped 计数,入库被跳过的超长路径会在完成消息与日志中体现

- 数据库迁移失败日志补充 OPENLIST_MEDIA_MIGRATE_WIPE=1 的处置提示

- Subsonic 认证只对「确实带了凭据却校验失败」计数,裸探测不再刷新 IP 锁定

- goexif 从 indirect 调整为直接依赖(internal/media/scraper/image.go 直接 import)

- CI 新增 go test ./internal/db/... ./internal/transcode/... ./internal/media/...

* fix(transcode): 配额/队列满时仍放行已缓存切片,并同步 worker 协议白名单

- TCSegment/TCPlaylist: Reactivate 返回 ErrUserQuota/ErrQueueFull 时不再直接 429,改为标记 quotaBlocked,缓存命中的切片与 playlist 仍可读,只有缓存缺失才返回 429
- Reactivate: 补充全局排队上限 (MaxPendingJobs) 检查,避免批量激活顶爆队列,并补单测
- cmd/worker: 远程输入协议白名单与 master 同步为 http,https,tcp,tls(去掉 file/crypto)
- scraper: decodeSem 容量 12 -> 3,避免信号量大于默认刮削并发而形同失效

* feat(emby): 完善客户端兼容层并修复认证锁定,Subsonic 复用统一密钥校验

- Emby: 用户 ID 改用 GUID 并兼容数字/旧 ID;补齐 /Users/{id}/Authenticate、Sessions 与 WebSocket、首页分区、合集/播放列表、字幕流与歌词、Series/Season 结构
- Emby: 版本号返回客户端可接受的兼容版本,/Users/Public 返回可登录用户以渲染用户选择
- Subsonic: 支持 enc: 十六进制密码编码;app key 校验与 Emby 共用 LookUpAppKeyUser
- 限流: 认证被拒时不再刷新锁定过期时间,避免客户端持续轮询把 IP 永久锁死

* fix(media): 认证失败计数增加用户名维度,防止伪造 X-Forwarded-For 绕过锁定

- media_ratelimit: 新增 mediaAuthLockedFor / mediaAuthFailedFor / mediaAuthSucceededFor,IP 与用户名双维度计数;达到上限同样锁定 5 分钟且被拒时不续期
- emby: 按用户名登录与按 id 登录都检查用户名维度;失败计入两个维度,成功清除两个维度
- subsonic: subAuth 与 429 分支改用双维度判定;成功时用真实用户名清理计数(apiKey 认证时 u 参数为空)
- 仍保留主干 5 次/5 分钟的策略,代理信任范围(SetTrustedProxies)留给项目层面单独处理

* fix(media): 匿名封面按访客身份过滤,认证日志脱敏并收紧限流计数

- embyImage: 匿名封面不再走 loadEmbyLibraryAll(全库可见),改为 loadEmbyLibrary(guest):
  hidden / base_path 之外 / meta 受保护的条目都不可见,访客被禁用时直接 401
- embyUnauthorized: 只记录 Path、UA 与是否带 token,避免 query 里的 Pw/Password/api_key
  和 X-Emby-Authorization 里的设备令牌写进日志
- media_ratelimit: 失败计数 Set 时带 5min TTL,避免 IP/用户名 key 无限增长(用户名来自请求参数)
- auth.loginHash: 锁定期间不再续期,失败计数同样带 TTL,与媒体侧语义一致
- /System/Endpoint: 按 RemoteAddr 判断 IsLocal/IsInNetwork;/System/Info 不再返回真实监听端口

* feat(media): PDF 批注持久化

- 新增 MediaAnnotation 模型:按 (user_id, item_id, remote_id) 唯一,anchor 原样保存查看器批注对象,不重复建模页码/坐标
- GET/POST /fs/media/annotations:读取当前用户批注、按 remote_id 增量 upsert/delete(单条 512KB、单次 8MB、最多 500 条)
- 批注为用户私有数据:未登录返回空列表,访客写入 403,并校验条目可见性与访问权限
- 条目删除 / 清空类型 / 清空扫描路径 / 批量删除时,在同一事务内清理对应批注

* fix(media): 选集签名前校验最终文件权限;转码在 ffprobe 前预检配额

- GetMediaStreamURL / GetMediaStrm: 解析选集后对最终 rawPath 再执行 CanUserAccessPath,避免「目录可见但 meta 隐藏规则禁止其中某个文件」时仍能拿到有效签名(签名之后下载链路不会重跑隐藏规则)
- TranscodePlay: ProbeSource 之前调用 Scheduler.Capacity 预检配额,已满直接 429,不再先起最长 30s 的 ffprobe
- 新增探测并发闸门(全局 8 / 每用户 3),覆盖预检与 SubmitLimited 之间的并发窗口;用 defer 释放,探测 panic 也不会占死槽位
- 补 Capacity 单测

---------

Co-authored-by: j2rong4cn <j2rong@qq.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: pikachuren <pikachuren@example.com>
2026-10-24 17:34:29 +08:00

178 lines
5.0 KiB
Go
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
package transcode
import (
"sync"
"time"
"github.com/OpenListTeam/OpenList/v4/internal/conf"
"github.com/OpenListTeam/OpenList/v4/internal/setting"
"github.com/OpenListTeam/OpenList/v4/pkg/utils"
)
// Manager 全局转码管理器单例
type Manager struct {
Registry *WorkerRegistry
Scheduler *Scheduler
Cache *Cache
Chunks *ChunkManager // 智能 chunk 调度器(按需启动 ffmpeg,支持随机访问)
localRunner *LocalRunner
stopCh chan struct{}
once sync.Once
}
var (
defaultManager *Manager
managerOnce sync.Once
)
// Default 返回全局 Manager(懒加载)
func Default() *Manager {
managerOnce.Do(func() {
defaultManager = newManager()
})
return defaultManager
}
func newManager() *Manager {
reg := NewWorkerRegistry()
sch := NewScheduler(reg)
cachePath := setting.GetStr(conf.TranscodeCachePath, "data/ctmp")
// 兼容旧默认值:统一迁移到 data/ctmp
if cachePath == "data/transcode_cache" || cachePath == "./data/transcode_cache" {
cachePath = "data/ctmp"
}
cacheMaxGB := int64(setting.GetInt(conf.TranscodeCacheMaxGB, 20))
cache := NewCache(cachePath, cacheMaxGB)
_ = cache.Init()
m := &Manager{
Registry: reg,
Scheduler: sch,
Cache: cache,
stopCh: make(chan struct{}),
}
m.Chunks = NewChunkManager(m)
return m
}
// Start 启动后台维护协程:心跳清理 + 缓存 LRU + 完成任务清理
func (m *Manager) Start() {
m.once.Do(func() {
go m.maintenance()
// 根据 run_mode 决定是否启动本地 worker
mode := setting.GetStr(conf.TranscodeRunMode, "local")
if mode == "local" || mode == "hybrid" {
m.startLocalWorker()
}
})
}
// Stop 停止 Manager
func (m *Manager) Stop() {
close(m.stopCh)
if m.Chunks != nil {
m.Chunks.Stop()
}
if m.localRunner != nil {
m.localRunner.Stop()
}
}
func (m *Manager) maintenance() {
t1 := time.NewTicker(15 * time.Second) // 心跳清理
t2 := time.NewTicker(5 * time.Minute) // 缓存 LRU
t3 := time.NewTicker(30 * time.Minute) // 历史 job 清理
t4 := time.NewTicker(10 * time.Second) // 空闲超时检测
defer t1.Stop()
defer t2.Stop()
defer t3.Stop()
defer t4.Stop()
for {
select {
case <-m.stopCh:
return
case <-t1.C:
removed := m.Registry.Sweep()
for _, id := range removed {
utils.Log.Infof("[transcode] worker %s removed (heartbeat timeout)", id)
}
case <-t2.C:
_ = m.Cache.EnforceLRU()
case <-t3.C:
purged := m.Scheduler.PurgeBefore(time.Now().Add(-2 * time.Hour))
if len(purged) > 0 {
// 【内存泄漏修复】联动清理 Cache 中对应的 JobCache + segments map
for _, jobID := range purged {
m.Cache.Cleanup(jobID)
}
utils.Log.Infof("[transcode] purged %d finished jobs (cache cleaned)", len(purged))
}
case <-t4.C:
m.sweepIdleJobs()
}
}
}
// sweepIdleJobs 扫描所有活跃任务,超过空闲超时时间无播放端请求则自动取消并 kill FFmpeg
// 注意:这里只 cancel job + kill ffmpeg 释放 CPU,**不删除已转好的切片缓存**。
// 当用户继续播放时,TCSegment / TCPlaylist 会通过 Scheduler.Reactivate 复用同一 jobID/token
// 重新启动转码;已存在的切片可以直接命中,不需要再次转码。
func (m *Manager) sweepIdleJobs() {
idleTimeoutSec := setting.GetInt(conf.TranscodeIdleTimeoutSec, 90)
if idleTimeoutSec <= 0 {
return // 配置为 0 表示禁用空闲超时
}
timeout := time.Duration(idleTimeoutSec) * time.Second
now := time.Now()
activeJobs := m.Scheduler.ListActiveJobs()
for _, j := range activeJobs {
lastAccess := j.GetLastAccess()
idle := now.Sub(lastAccess)
if idle > timeout {
utils.Log.Infof("[transcode] job %s idle for %.0fs (threshold %ds), pausing ffmpeg (cache kept for resume)",
j.ID, idle.Seconds(), idleTimeoutSec)
// 先取消所有 chunk ffmpeg,再调度器层面取消
if m.Chunks != nil {
m.Chunks.CancelAllForJob(j.ID)
}
m.Scheduler.Cancel(j.ID)
// 【重要】不再调用 m.Cache.Cleanup —— 已转好的切片必须保留,
// 这样浏览器恢复播放时旧的 seg-N.ts 仍然能命中,避免 404 和重新转码。
// 真正的磁盘清理由更长周期的 PurgeBefore + Cache.EnforceLRU 负责。
}
}
}
func (m *Manager) startLocalWorker() {
r := NewLocalRunner(m)
if err := r.Start(); err != nil {
utils.Log.Errorf("[transcode] start local worker failed: %+v", err)
return
}
m.localRunner = r
// 注入取消回调:Scheduler.Cancel 时直接 kill 本地 FFmpeg 进程
m.Scheduler.SetOnCancel(func(jobID string) {
// 先清理 chunk session(kill 所有 chunk ffmpeg)
if m.Chunks != nil {
m.Chunks.CancelAllForJob(jobID)
}
if m.localRunner != nil {
m.localRunner.CancelJob(jobID)
}
})
}
// IsEnabled 总开关
func IsEnabled() bool { return setting.GetBool(conf.TranscodeEnabled) }
// VerifyWorkerSecret 校验远程 worker 注册凭据
func VerifyWorkerSecret(token string) bool {
expected := setting.GetStr(conf.TranscodeWorkerSecret)
if expected == "" {
return false // 未配置则禁用远程注册
}
return token == expected
}