various/stale

endpoints/radio.py

@@ -4,6 +4,7 @@ import time
 import random
 import json
 import asyncio
+import socket
 from typing import Dict, Set
 from .constructors import (
     ValidRadioNextRequest,
@@ -33,6 +34,21 @@ from fastapi.responses import RedirectResponse, JSONResponse, FileResponse
 from auth.deps import get_current_user
 from collections import defaultdict
 
+
+def _get_local_ips() -> set[str]:
+    """Get all local IP addresses for this host."""
+    ips = {"127.0.0.1", "::1"}
+    try:
+        for info in socket.getaddrinfo(socket.gethostname(), None):
+            ips.add(str(info[4][0]))
+    except Exception:
+        pass
+    return ips
+
+
+_LOCAL_IPS = _get_local_ips()
+
+
 class Radio(FastAPI):
     """Radio Endpoints"""
 
@@ -380,7 +396,6 @@ class Radio(FastAPI):
         data: ValidRadioNextRequest,
         request: Request,
         background_tasks: BackgroundTasks,
-        user=Depends(get_current_user),
     ) -> JSONResponse:
         """
         Get the next track in the queue. The track will be removed from the queue in the process.
@@ -395,8 +410,11 @@ class Radio(FastAPI):
         - **JSONResponse**: Contains the next track information.
         """
 
-        if "dj" not in user.get("roles", []):
-            raise HTTPException(status_code=403, detail="Insufficient permissions")
+        try:
+            if request.client and request.client.host not in _LOCAL_IPS:
+                raise HTTPException(status_code=403, detail="Access denied")
+        except ValueError:
+            raise HTTPException(status_code=403, detail="Access denied")
 
         logging.info("Radio get next")
         if data.station not in self.radio_util.active_playlist.keys():