authentication error: missing authentication key param for private tracker

[clean-master]

When I download from index, there is no key for private tracker.

[josecelano]

Hi @clean-master, thank you for opening the issue. I'm checking it.

[josecelano]

Hi @clean-master It seems to be a bug. When we call the API from the browser we never add the Authentication header with the Bearer token:

https://github.com/torrust/torrust-index-api-lib/blob/main/src/modes/rest/resources/torrent.ts#L147-L157

You can compare with the upload method which includes the bearer token in the request:

https://github.com/torrust/torrust-index-api-lib/blob/main/src/modes/rest/resources/torrent.ts#L147-L157

    async uploadTorrent(params: UploadTorrentParams): Promise<NewTorrentResponseData> {
        const formData = new FormData();

        formData.append("title", params.title);
        formData.append("description", params.description);
        formData.append("category", params.category);
        formData.append("tags", JSON.stringify(params.tags));
        formData.append("torrent", params.file);

        return await fetchPost<NewTorrentResponse>(
            `${this.client.apiBaseUrl}/torrent/upload`,
            formData,
            { "Authorization": `Bearer ${this.client.authToken}` }
        )
            .then((res) => {
                return Promise.resolve(res.data);
            })
            .catch((err) => {
                return Promise.reject(err.response?.data?.error ?? err);
            });
    }

    async downloadTorrent(infoHash: string): Promise<Blob> {
        return await fetchGetBlob(
            `${this.client.apiBaseUrl}/torrent/download/${infoHash}`
        )
            .then((blob) => {
                return Promise.resolve(blob);
            })
            .catch((err) => {
                return Promise.reject(err.response?.data?.error ?? err);
            });
    }

In the downloadTorrent function we don't include the argument:

{ "Authorization": `Bearer ${this.client.authToken}` }

I guess the token is missing because that page is always public, but if we do not include the token the Index API serves the anonymous response because there is no session info in the server.

Probably we have to do the same as in the function:

    async proxiedImage(url: string): Promise<Blob> {
        const headers = this.client.authToken ? { "Authorization": `Bearer ${this.client.authToken}` } : undefined;

        return await fetchGetBlob(
            `${this.client.apiBaseUrl}/proxy/image/${encodeURIComponent(url)}`,
            headers
        )
            .then((blob) => {
                return Promise.resolve(blob);
            })
            .catch((err) => {
                return Promise.reject(err.response?.data?.error ?? err);
            });
    }

Thank you for submitting the bug. I'm working on fixing it.

[josecelano]

Hi @clean-master, the problem should be fixed. You should get a torrent file like this:

{
   "announce": "udp://localhost:6969/m9MBBNQ3HQMq7zWVMLP9b9dRlgovTpPt",
   "announce-list": [
      [
         "udp://localhost:6969/m9MBBNQ3HQMq7zWVMLP9b9dRlgovTpPt"
      ],
      [
         "udp://localhost:6969"
      ]
   ],
   "info": {
      "length": 172204,
      "name": "mandelbrot_2048x2048.png",
      "piece length": 16384,
      "pieces": "<hex>7D 91 71 0D 9D 4D BA 88 9B 54 20 54 D5 26 72 8D 5A 86 3F E1 21 DF 77 C7 F7 BB 6C 77 96 21 66 25 38 C5 D9 CD AB 8B 08 EF 8C 24 9B B2 F5 C4 CD 2A DF 0B C0 0C F0 AD DF 72 90 E5 B6 41 4C 23 6C 47 9B 8E 9F 46 AA 0C 0D 8E D1 97 FF EE 68 8B 5F 34 A3 87 D7 71 C5 A6 F9 8E 2E A6 31 7C BD F0 F9 E2 23 F9 CC 80 AF 54 00 04 F9 85 69 1C 77 89 C1 76 4E D6 AA BF 61 A6 C2 80 99 AB B6 5F 60 2F 40 A8 25 BE 32 A3 3D 9D 07 0C 79 68 98 D4 9D 63 49 AF 20 58 66 26 6F 98 6B 6D 32 34 CD 7D 08 15 5E 1A D0 00 09 57 AB 30 3B 20 60 C1 DC 12 87 D6 F3 E7 45 4F 70 67 09 36 31 55 F2 20 F6 6C A5 15 6F 2C 89 95 69 16 53 81 7D 31 F1 B6 BD 37 42 CC 11 0B B2 FC 2B 49 A5 85 B6 FC 76 74 44 93</hex>",
      "private": 1
   }
}

I will update the live demo soon.

[josecelano]

I'm double-checking the issue and it seems you could also get an announce URL without the tracker key if the tracker the user does not have a valid tracker key in the index and the Index cannot create a new one because the tracker is offline or the endpoint to generate tracker keys does not work.

    /// Gets a torrent from the Index.
    ///
    /// # Errors
    ///
    /// This function will return an error if unable to get the torrent from the
    /// database.
    pub async fn get_torrent(&self, info_hash: &InfoHash, opt_user_id: Option<UserId>) -> Result<Torrent, ServiceError> {
        let mut torrent = self.torrent_repository.get_by_info_hash(info_hash).await?;

        let tracker_url = self.get_tracker_url().await;

        // Add personal tracker url or default tracker url
        match opt_user_id {
            Some(user_id) => {
                log::debug!("User ID: {user_id}");

                let personal_announce_url = self
                    .tracker_service
                    .get_personal_announce_url(user_id)
                    .await
                    .unwrap_or(tracker_url);
                torrent.announce = Some(personal_announce_url.clone());
                if let Some(list) = &mut torrent.announce_list {
                    let vec = vec![personal_announce_url];
                    list.insert(0, vec);
                }
            }
            None => {
                torrent.announce = Some(tracker_url);
            }
        }

        Ok(torrent)

    /// Get personal tracker announce url of a user.
    ///
    /// Eg: <https://tracker:7070/USER_TRACKER_KEY>
    ///
    /// If the user doesn't have a not expired tracker key, it will generate a
    /// new one and save it in the database.
    ///
    /// # Errors
    ///
    /// Will return an error if the HTTP request to get generated a new
    /// user tracker key failed.
    pub async fn get_personal_announce_url(&self, user_id: UserId) -> Result<String, ServiceError> {
        let tracker_key = self.database.get_user_tracker_key(user_id).await;

        match tracker_key {
            Some(v) => Ok(self.announce_url_with_key(&v)),
            None => match self.retrieve_new_tracker_key(user_id).await {
                Ok(v) => Ok(self.announce_url_with_key(&v)),
                Err(_) => Err(ServiceError::TrackerOffline),
            },
        }
    }

@da2ce7 @WarmBeer,

• I think the Index always add the key if the user is logged in. Shouldn't do it only when the tracker mode is private?
• Even if the tracker is private, we download the torrent without the tracker key if it was not possible to generate the key, because the tracker API was not available or there was an error making the request to generate the user key. Shouldn't we cancel the download and show a message to the user (when the tracker is private)? I guess it does not make sense to download the torrent with an announce URL which is not going to work without the user key.