RSS feed for sources (#110)

* Add media streaming (#108)

* [WIP] set up streaming route

* Added UUID to sources and media items

* Added media preview to MI show page

* Added plug to strip file extensions

* [VERY WIP] basic podcast RSS setup

* [WIP] got basic podcast RSS working

* [WIP] more expanding on RSS

* Comment

* [WIP] Working on refactoring feed

* Added UUID backfill to a migration

* [WIP] Moar refactoring

* [WIP] Adding UI for getting RSS feed

* Many tests

* Added conditional routing for feed URLs

* Removed the need for url_base to be set

* Updated preset name

* Rendered certain fields HTML-safe; Added logging to confirm range request support

* Fixed incorrect scheme issue

* Updated env var

* Updated other UI to use dropdown

* removed commented code

* Generate rss feeds (#123)

* Added plug to strip file extensions

* [VERY WIP] basic podcast RSS setup

* [WIP] got basic podcast RSS working

* [WIP] more expanding on RSS

* [WIP] Working on refactoring feed

* Added UUID backfill to a migration

* [WIP] Moar refactoring

* [WIP] Adding UI for getting RSS feed

* Many tests

* Added conditional routing for feed URLs

* Removed the need for url_base to be set

* Updated preset name

* Rendered certain fields HTML-safe; Added logging to confirm range request support

* Fixed incorrect scheme issue

* Updated env var

* Updated other UI to use dropdown

* removed commented code

* docs

* Added unique index to UUID fields

lib/pinchflat/media/media_item.ex

@@ -5,6 +5,7 @@ defmodule Pinchflat.Media.MediaItem do
 
   use Ecto.Schema
   import Ecto.Changeset
+  import Pinchflat.Utils.ChangesetUtils
 
   alias Pinchflat.Tasks.Task
   alias Pinchflat.Sources.Source
@@ -32,6 +33,7 @@ defmodule Pinchflat.Media.MediaItem do
   ]
   # Pretty much all the fields captured at index are required.
   @required_fields ~w(
+    uuid
     title
     original_url
     livestream
@@ -42,6 +44,11 @@ defmodule Pinchflat.Media.MediaItem do
     )a
 
   schema "media_items" do
+    # This is _not_ used as the primary key or internally in the database
+    # relations. This is only used to prevent an enumeration attack on the streaming
+    # and RSS feed endpoints since those _must_ be public (ie: no basic auth)
+    field :uuid, Ecto.UUID
+
     field :title, :string
     field :media_id, :string
     field :description, :string
@@ -78,6 +85,7 @@ defmodule Pinchflat.Media.MediaItem do
     media_item
     |> cast(attrs, @allowed_fields)
     |> cast_assoc(:metadata, with: &MediaMetadata.changeset/2, required: false)
+    |> dynamic_default(:uuid, fn _ -> Ecto.UUID.generate() end)
     |> validate_required(@required_fields)
     |> unique_constraint([:media_id, :source_id])
   end