Allow frontend auth token bootstrap from URL

.dockerignore

@@ -0,0 +1,13 @@
+node_modules
+dist
+.git
+.github
+coverage
+.vscode
+*.log
+downloads
+config
+.env
+.env.*
+README.md
+assets

Dockerfile

@@ -6,15 +6,27 @@ RUN npm run build
 
 FROM node:20.20.0-alpine
 WORKDIR /spooty
-COPY --from=builder /spooty/dist .
-COPY --from=builder /spooty/src ./src
-COPY --from=builder /spooty/package.json ./package.json
-COPY --from=builder /spooty/package-lock.json ./package-lock.json
-COPY --from=builder /spooty/src/backend/.env.docker ./.env
-RUN npm prune --production
-RUN rm -rf src package.json package-lock.json
-RUN apk add --no-cache ffmpeg
-RUN apk add --no-cache redis
-RUN apk add --no-cache python3 py3-pip
+
+RUN apk add --no-cache ffmpeg redis python3 py3-pip curl \
+  && addgroup -S spooty \
+  && adduser -S spooty -G spooty
+
+COPY --from=builder --chown=spooty:spooty /spooty/dist .
+COPY --from=builder --chown=spooty:spooty /spooty/src ./src
+COPY --from=builder --chown=spooty:spooty /spooty/package.json ./package.json
+COPY --from=builder --chown=spooty:spooty /spooty/package-lock.json ./package-lock.json
+COPY --from=builder --chown=spooty:spooty /spooty/src/backend/.env.docker ./.env
+
+RUN npm prune --production \
+  && rm -rf src package.json package-lock.json \
+  && mkdir -p /spooty/backend/downloads /spooty/backend/config /spooty/config \
+  && chown -R spooty:spooty /spooty
+
+USER spooty
+
 EXPOSE 3000
-CMD ["node", "backend/main.js"]
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+  CMD curl -fsS http://127.0.0.1:3000/api/health || exit 1
+
+CMD ["node", "backend/main.js"]

src/backend/src/app.controller.ts

@@ -2,10 +2,13 @@ import { Controller, Get } from '@nestjs/common';
 
 @Controller()
 export class AppController {
-  constructor() {}
-
   @Get()
   getHello(): string {
     return 'ONLINE';
   }
+
+  @Get('health')
+  getHealth(): { status: string } {
+    return { status: 'ok' };
+  }
 }

src/backend/src/shared/auth.guard.ts

@@ -9,6 +9,12 @@ import type { Request } from 'express';
 @Injectable()
 export class AuthGuard implements CanActivate {
   canActivate(context: ExecutionContext): boolean {
+    const request = context.switchToHttp().getRequest<Request>();
+
+    if (request.path === '/api/health') {
+      return true;
+    }
+
     if (!this.authEnabled()) {
       return true;
     }
@@ -20,7 +26,6 @@ export class AuthGuard implements CanActivate {
       );
     }
 
-    const request = context.switchToHttp().getRequest<Request>();
     const providedToken = this.extractToken(request);
 
     if (providedToken !== expectedToken) {

src/frontend/src/app/app.component.ts

@@ -30,9 +30,23 @@ export class AppComponent {
     private readonly playlistService: PlaylistService,
     private readonly versionService: VersionService,
   ) {
+    this.bootstrapAuthTokenFromUrl();
     this.fetchPlaylists();
   }
 
+  private bootstrapAuthTokenFromUrl(): void {
+    const url = new URL(window.location.href);
+    const token = url.searchParams.get('token');
+
+    if (!token) {
+      return;
+    }
+
+    localStorage.setItem('spooty_auth_token', token);
+    url.searchParams.delete('token');
+    window.history.replaceState({}, document.title, url.toString());
+  }
+
   fetchPlaylists(): void {
     this.playlistService.fetch();
   }