diff --git a/src/backend/core/api/connection_test.py b/src/backend/core/api/connection_test.py new file mode 100644 index 00000000..4670b2a0 --- /dev/null +++ b/src/backend/core/api/connection_test.py @@ -0,0 +1,51 @@ +"""Connection test API endpoint.""" + +from datetime import timedelta +from uuid import uuid4 + +from django.conf import settings + +from rest_framework.decorators import api_view, throttle_classes +from rest_framework.response import Response + +from core.api.throttling import ( + ConnectionTestAnonRateThrottle, + ConnectionTestUserRateThrottle, +) +from core.tasks.connection_test import delete_connection_test_room +from core.utils import generate_token + +CONNECTION_TEST_USERNAME = "Connection Test" + + +@api_view(["POST"]) +@throttle_classes([ConnectionTestUserRateThrottle, ConnectionTestAnonRateThrottle]) +def create_connection_test_config(request): + """Create a short-lived LiveKit token for an ephemeral connection test room.""" + room = f"{settings.CONNECTION_TEST_ROOM_PREFIX}{uuid4()}" + expires_in = settings.CONNECTION_TEST_TOKEN_TTL_SECONDS + + # LiveKit refreshes tokens for connected clients, so JWT TTL alone does not + # eject someone who stays connected. Schedule a hard DeleteRoom when Celery + # is available. + if settings.CELERY_ENABLED: + delete_connection_test_room.apply_async( + args=[room], + countdown=settings.CONNECTION_TEST_ROOM_MAX_AGE_SECONDS, + ) + + return Response( + { + "livekit": { + "url": settings.LIVEKIT_CONFIGURATION["url"], + "room": room, + "token": generate_token( + room=room, + user=request.user, + username=CONNECTION_TEST_USERNAME, + ttl=timedelta(seconds=expires_in), + ), + "expires_in": expires_in, + }, + } + ) diff --git a/src/backend/core/api/throttling.py b/src/backend/core/api/throttling.py index b7b89b43..155d7059 100644 --- a/src/backend/core/api/throttling.py +++ b/src/backend/core/api/throttling.py @@ -73,3 +73,15 @@ class CreationCallbackAnonRateThrottle(MonitoredAnonRateThrottle): """Throttle Anonymous user requesting room generation callback""" scope = "creation_callback" + + +class ConnectionTestUserRateThrottle(MonitoredUserRateThrottle): + """Throttle authenticated users requesting connection test tokens.""" + + scope = "connection_test" + + +class ConnectionTestAnonRateThrottle(MonitoredAnonRateThrottle): + """Throttle anonymous users requesting connection test tokens.""" + + scope = "connection_test" diff --git a/src/backend/core/services/livekit_events.py b/src/backend/core/services/livekit_events.py index 8bdf1fd0..42c9c99b 100644 --- a/src/backend/core/services/livekit_events.py +++ b/src/backend/core/services/livekit_events.py @@ -137,6 +137,13 @@ class LiveKitEventsService: room_name = data.room.name or data.egress_info.room_name + if self._is_connection_test_room(room_name): + logger.info( + "Ignoring webhook event for connection test room '%s'.", + room_name, + ) + return + if self._filter_regex and not self._filter_regex.search(room_name): logger.info("Filtered webhook event for room '%s'", room_name) return @@ -228,6 +235,13 @@ class LiveKitEventsService: # Silently ignoring EGRESS_ABORTED, EGRESS_FAILED + @staticmethod + def _is_connection_test_room(room_name: str) -> bool: + """Return True for ephemeral rooms created by the connection test endpoint.""" + return isinstance(room_name, str) and room_name.startswith( + settings.CONNECTION_TEST_ROOM_PREFIX + ) + def _handle_room_started(self, data): """Handle 'room_started' event.""" diff --git a/src/backend/core/services/room_management.py b/src/backend/core/services/room_management.py index 109d7f9d..163af6e2 100644 --- a/src/backend/core/services/room_management.py +++ b/src/backend/core/services/room_management.py @@ -8,6 +8,7 @@ from typing import Dict, Optional from asgiref.sync import async_to_sync from livekit.api import ( + DeleteRoomRequest, ListRoomsRequest, TwirpError, UpdateRoomMetadataRequest, @@ -88,3 +89,30 @@ class RoomManagement: finally: await lkapi.aclose() + + @async_to_sync + async def delete_room(self, room_name: str): + """Delete a LiveKit room and disconnect all participants. + + Raises: + RoomNotFoundException: the room does not exist in LiveKit. + RoomManagementException: the deletion otherwise fails. + """ + + lkapi = utils.create_livekit_client() + + try: + await lkapi.room.delete_room(DeleteRoomRequest(room=room_name)) + logger.info("Deleted LiveKit room %s", room_name) + except TwirpError as e: + if e.code == "not_found": + logger.warning( + "Room %s not found in LiveKit, skipping deletion", + room_name, + ) + raise RoomNotFoundException("Room does not exist") from e + + logger.exception("Unexpected error deleting room %s", room_name) + raise RoomManagementException("Could not delete room") from e + finally: + await lkapi.aclose() diff --git a/src/backend/core/tasks/__init__.py b/src/backend/core/tasks/__init__.py new file mode 100644 index 00000000..b433db5f --- /dev/null +++ b/src/backend/core/tasks/__init__.py @@ -0,0 +1,9 @@ +"""Celery tasks for the core app.""" + +from core.tasks.connection_test import delete_connection_test_room +from core.tasks.file import process_file_deletion + +__all__ = ( + "delete_connection_test_room", + "process_file_deletion", +) diff --git a/src/backend/core/tasks/connection_test.py b/src/backend/core/tasks/connection_test.py new file mode 100644 index 00000000..ba8872d6 --- /dev/null +++ b/src/backend/core/tasks/connection_test.py @@ -0,0 +1,39 @@ +"""Tasks related to connection test rooms.""" + +import logging + +from django.conf import settings + +from core.services.room_management import ( + RoomManagement, + RoomManagementException, + RoomNotFoundException, +) +from core.tasks._task import task + +logger = logging.getLogger(__name__) + + +@task +def delete_connection_test_room(room_name: str): + """Force-delete an ephemeral connection-test room. + + Used as a hard cap so a participant cannot keep an auto-refreshed + LiveKit session open indefinitely after requesting a test token. + """ + prefix = settings.CONNECTION_TEST_ROOM_PREFIX + if not room_name.startswith(prefix): + logger.error( + "Refusing to delete room '%s': expected prefix '%s'.", + room_name, + prefix, + ) + return + + try: + RoomManagement().delete_room(room_name) + except RoomNotFoundException: + # Room may already be gone after empty/departure timeout. + logger.info("Connection test room '%s' already gone.", room_name) + except RoomManagementException: + logger.exception("Failed to delete connection test room '%s'.", room_name) diff --git a/src/backend/core/tests/services/test_livekit_events.py b/src/backend/core/tests/services/test_livekit_events.py index 16adb661..f68c2806 100644 --- a/src/backend/core/tests/services/test_livekit_events.py +++ b/src/backend/core/tests/services/test_livekit_events.py @@ -6,6 +6,8 @@ Test LiveKitEvents service. import uuid from unittest import mock +from django.test.utils import override_settings + import pytest from livekit.api import EgressStatus @@ -551,6 +553,34 @@ def test_handle_room_finished_raises_error_when_telephony_deletion_fails( mock_clear_cache.assert_not_called() +@override_settings(CONNECTION_TEST_ROOM_PREFIX="connection-test-") +@mock.patch.object(api.WebhookReceiver, "receive") +@mock.patch.object(LiveKitEventsService, "_handle_room_finished") +@mock.patch.object(LiveKitEventsService, "_handle_room_started") +def test_receive_ignores_connection_test_room( + mock_handle_room_started, + mock_handle_room_finished, + mock_receive, + mock_livekit_config, + settings, +): + """Should ignore all webhook events for connection test rooms in receive().""" + mock_request = mock.MagicMock() + mock_request.headers = {"Authorization": "test_token"} + mock_request.body = b"{}" + + mock_data = mock.MagicMock() + mock_data.room.name = f"{settings.CONNECTION_TEST_ROOM_PREFIX}{uuid.uuid4()}" + mock_data.event = "room_started" + mock_receive.return_value = mock_data + + service = LiveKitEventsService() + service.receive(mock_request) + + mock_handle_room_started.assert_not_called() + mock_handle_room_finished.assert_not_called() + + def test_handle_room_finished_raises_error_for_invalid_room_name(service): """Should raise ActionFailedError when room name format is invalid when room finishes.""" mock_data = mock.MagicMock() diff --git a/src/backend/core/tests/services/test_room_management.py b/src/backend/core/tests/services/test_room_management.py new file mode 100644 index 00000000..a63e5aa4 --- /dev/null +++ b/src/backend/core/tests/services/test_room_management.py @@ -0,0 +1,60 @@ +"""Tests for the RoomManagement service.""" + +from unittest import mock + +import pytest +from livekit.api import TwirpError + +from core.services.room_management import ( + RoomManagement, + RoomManagementException, + RoomNotFoundException, +) + + +@mock.patch("core.services.room_management.utils.create_livekit_client") +def test_delete_room_calls_livekit(mock_create_livekit_client): + """DeleteRoom is forwarded to the LiveKit API.""" + mock_api = mock.MagicMock() + mock_api.room.delete_room = mock.AsyncMock() + mock_api.aclose = mock.AsyncMock() + mock_create_livekit_client.return_value = mock_api + + RoomManagement().delete_room("room-abc") + + mock_api.room.delete_room.assert_awaited_once() + request = mock_api.room.delete_room.await_args.args[0] + assert request.room == "room-abc" + mock_api.aclose.assert_awaited_once() + + +@mock.patch("core.services.room_management.utils.create_livekit_client") +def test_delete_room_raises_not_found(mock_create_livekit_client): + """Missing rooms raise RoomNotFoundException.""" + mock_api = mock.MagicMock() + mock_api.room.delete_room = mock.AsyncMock( + side_effect=TwirpError("not_found", "room not found", status=404) + ) + mock_api.aclose = mock.AsyncMock() + mock_create_livekit_client.return_value = mock_api + + with pytest.raises(RoomNotFoundException): + RoomManagement().delete_room("missing-room") + + mock_api.aclose.assert_awaited_once() + + +@mock.patch("core.services.room_management.utils.create_livekit_client") +def test_delete_room_raises_management_exception(mock_create_livekit_client): + """Unexpected Twirp errors raise RoomManagementException.""" + mock_api = mock.MagicMock() + mock_api.room.delete_room = mock.AsyncMock( + side_effect=TwirpError("internal", "boom", status=500) + ) + mock_api.aclose = mock.AsyncMock() + mock_create_livekit_client.return_value = mock_api + + with pytest.raises(RoomManagementException): + RoomManagement().delete_room("room-abc") + + mock_api.aclose.assert_awaited_once() diff --git a/src/backend/core/tests/tasks/test_connection_test.py b/src/backend/core/tests/tasks/test_connection_test.py new file mode 100644 index 00000000..559700fd --- /dev/null +++ b/src/backend/core/tests/tasks/test_connection_test.py @@ -0,0 +1,51 @@ +"""Tests for connection test Celery tasks.""" + +from unittest import mock + +from django.test.utils import override_settings + +from core.services.room_management import ( + RoomManagementException, + RoomNotFoundException, +) +from core.tasks.connection_test import delete_connection_test_room + + +@override_settings(CONNECTION_TEST_ROOM_PREFIX="connection-test-") +@mock.patch("core.tasks.connection_test.RoomManagement.delete_room") +def test_delete_connection_test_room_calls_room_management(mock_delete_room): + """RoomManagement.delete_room is called for connection-test rooms.""" + delete_connection_test_room("connection-test-abc") + + mock_delete_room.assert_called_once_with("connection-test-abc") + + +@override_settings(CONNECTION_TEST_ROOM_PREFIX="connection-test-") +@mock.patch("core.tasks.connection_test.RoomManagement.delete_room") +def test_delete_connection_test_room_refuses_other_rooms(mock_delete_room): + """Refuse to delete rooms outside the connection-test namespace.""" + delete_connection_test_room("production-room") + + mock_delete_room.assert_not_called() + + +@override_settings(CONNECTION_TEST_ROOM_PREFIX="connection-test-") +@mock.patch("core.tasks.connection_test.RoomManagement.delete_room") +def test_delete_connection_test_room_ignores_missing_room(mock_delete_room): + """Missing rooms are treated as already cleaned up.""" + mock_delete_room.side_effect = RoomNotFoundException("Room does not exist") + + delete_connection_test_room("connection-test-gone") + + mock_delete_room.assert_called_once_with("connection-test-gone") + + +@override_settings(CONNECTION_TEST_ROOM_PREFIX="connection-test-") +@mock.patch("core.tasks.connection_test.RoomManagement.delete_room") +def test_delete_connection_test_room_logs_other_failures(mock_delete_room): + """Unexpected LiveKit failures are swallowed after logging.""" + mock_delete_room.side_effect = RoomManagementException("Could not delete room") + + delete_connection_test_room("connection-test-fail") + + mock_delete_room.assert_called_once_with("connection-test-fail") diff --git a/src/backend/core/tests/test_api_connection_test.py b/src/backend/core/tests/test_api_connection_test.py new file mode 100644 index 00000000..9880312f --- /dev/null +++ b/src/backend/core/tests/test_api_connection_test.py @@ -0,0 +1,94 @@ +"""Test connection test API endpoint.""" + +import uuid +from unittest import mock + +from django.test.utils import override_settings + +import jwt +import pytest +from rest_framework.test import APIClient + +from core.api.connection_test import CONNECTION_TEST_USERNAME + +pytestmark = pytest.mark.django_db + + +@override_settings( + CONNECTION_TEST_TOKEN_TTL_SECONDS=600, + CONNECTION_TEST_ROOM_PREFIX="connection-test-", +) +def test_api_connection_test_returns_ephemeral_livekit_config(): + """Each request gets a dedicated room and a short-lived token.""" + client = APIClient() + response_a = client.post("/api/v1.0/connection-test/") + response_b = client.post("/api/v1.0/connection-test/") + + assert response_a.status_code == 200 + assert response_b.status_code == 200 + + data_a = response_a.json() + data_b = response_b.json() + + room_a = data_a["livekit"]["room"] + room_b = data_b["livekit"]["room"] + + assert room_a.startswith("connection-test-") + assert room_b.startswith("connection-test-") + uuid.UUID(room_a.removeprefix("connection-test-")) + uuid.UUID(room_b.removeprefix("connection-test-")) + assert room_a != room_b + assert data_a["livekit"]["url"] + assert data_a["livekit"]["token"] + assert data_a["livekit"]["expires_in"] == 600 + assert data_a["livekit"]["token"] != data_b["livekit"]["token"] + + +@override_settings(CONNECTION_TEST_TOKEN_TTL_SECONDS=300) +def test_api_connection_test_token_is_short_lived_for_user(settings): + """Connection test tokens expire quickly for users.""" + client = APIClient() + response = client.post("/api/v1.0/connection-test/") + + assert response.status_code == 200 + + config = response.json()["livekit"] + payload = jwt.decode( + config["token"], + settings.LIVEKIT_CONFIGURATION["api_secret"], + algorithms=["HS256"], + options={"verify_exp": False}, + ) + + assert config["expires_in"] == 300 + assert payload["video"]["room"] == config["room"] + assert payload["name"] == CONNECTION_TEST_USERNAME + assert payload["video"]["roomAdmin"] is False + assert payload["exp"] - payload["nbf"] == 300 + + +@override_settings( + CELERY_ENABLED=True, + CONNECTION_TEST_ROOM_MAX_AGE_SECONDS=300, + CONNECTION_TEST_ROOM_PREFIX="connection-test-", +) +@mock.patch("core.api.connection_test.delete_connection_test_room.apply_async") +def test_api_connection_test_schedules_room_deletion(mock_apply_async): + """When Celery is enabled, schedule a hard room delete after max age.""" + client = APIClient() + response = client.post("/api/v1.0/connection-test/") + + assert response.status_code == 200 + room = response.json()["livekit"]["room"] + mock_apply_async.assert_called_once_with(args=[room], countdown=300) + + +@override_settings(CELERY_ENABLED=False) +@mock.patch("core.api.connection_test.delete_connection_test_room.apply_async") +def test_api_connection_test_skips_room_deletion_without_celery(mock_apply_async): + """Without Celery, do not schedule deletion (apply_async would run immediately).""" + client = APIClient() + response = client.post("/api/v1.0/connection-test/") + + assert response.status_code == 200 + mock_apply_async.assert_not_called() diff --git a/src/backend/core/urls.py b/src/backend/core/urls.py index 3bc4f5e8..80499a6f 100644 --- a/src/backend/core/urls.py +++ b/src/backend/core/urls.py @@ -8,6 +8,7 @@ from rest_framework.routers import DefaultRouter, SimpleRouter from core.addons import viewsets as addons_viewsets from core.api import get_frontend_configuration, viewsets +from core.api.connection_test import create_connection_test_config from core.external_api import viewsets as external_viewsets # - Main endpoints @@ -46,6 +47,11 @@ urlpatterns = [ *router.urls, *oidc_urls, path("config/", get_frontend_configuration, name="config"), + path( + "connection-test/", + create_connection_test_config, + name="connection_test", + ), ] ), ), diff --git a/src/backend/core/utils.py b/src/backend/core/utils.py index b35b5bcb..f37f0d3e 100644 --- a/src/backend/core/utils.py +++ b/src/backend/core/utils.py @@ -12,6 +12,7 @@ import mimetypes import random import secrets import string +from datetime import timedelta from functools import lru_cache from typing import List, Optional from uuid import uuid4 @@ -67,6 +68,7 @@ def generate_token( sources: Optional[List[str]] = None, role: Optional[str] = None, participant_id: Optional[str] = None, + ttl: Optional[timedelta] = None, ) -> str: """Generate a LiveKit access token for a user in a specific room. @@ -82,6 +84,7 @@ def generate_token( role (Optional[str]): Room's access role if any participant_id (Optional[str]): Stable identifier for anonymous users; used as identity when user.is_anonymous. + ttl (Optional[timedelta]): Token validity duration. Defaults to LiveKit SDK default. Returns: str: The LiveKit JWT access token. @@ -135,6 +138,8 @@ def generate_token( } ) ) + if ttl is not None: + token = token.with_ttl(ttl) return token.to_jwt() diff --git a/src/backend/meet/settings.py b/src/backend/meet/settings.py index f392917d..b2fee19d 100755 --- a/src/backend/meet/settings.py +++ b/src/backend/meet/settings.py @@ -349,6 +349,11 @@ class Base(Configuration): environ_name="CREATION_CALLBACK_THROTTLE_RATES", environ_prefix=None, ), + "connection_test": values.Value( + default="30/minute", + environ_name="CONNECTION_TEST_THROTTLE_RATES", + environ_prefix=None, + ), }, } MONITORED_THROTTLE_FAILURE_CALLBACK = ( @@ -655,6 +660,21 @@ class Base(Configuration): environ_prefix=None, default=False, ) + CONNECTION_TEST_TOKEN_TTL_SECONDS = values.PositiveIntegerValue( + 300, + environ_name="CONNECTION_TEST_TOKEN_TTL_SECONDS", + environ_prefix=None, + ) + CONNECTION_TEST_ROOM_MAX_AGE_SECONDS = values.PositiveIntegerValue( + 300, + environ_name="CONNECTION_TEST_ROOM_MAX_AGE_SECONDS", + environ_prefix=None, + ) + CONNECTION_TEST_ROOM_PREFIX = values.Value( + "connection-test-", + environ_name="CONNECTION_TEST_ROOM_PREFIX", + environ_prefix=None, + ) LIVEKIT_VERIFY_SSL = values.BooleanValue( True, environ_name="LIVEKIT_VERIFY_SSL", environ_prefix=None )