RSS feed for sources (#110)

* Add media streaming (#108)

* [WIP] set up streaming route

* Added UUID to sources and media items

* Added media preview to MI show page

* Added plug to strip file extensions

* [VERY WIP] basic podcast RSS setup

* [WIP] got basic podcast RSS working

* [WIP] more expanding on RSS

* Comment

* [WIP] Working on refactoring feed

* Added UUID backfill to a migration

* [WIP] Moar refactoring

* [WIP] Adding UI for getting RSS feed

* Many tests

* Added conditional routing for feed URLs

* Removed the need for url_base to be set

* Updated preset name

* Rendered certain fields HTML-safe; Added logging to confirm range request support

* Fixed incorrect scheme issue

* Updated env var

* Updated other UI to use dropdown

* removed commented code

* Generate rss feeds (#123)

* Added plug to strip file extensions

* [VERY WIP] basic podcast RSS setup

* [WIP] got basic podcast RSS working

* [WIP] more expanding on RSS

* [WIP] Working on refactoring feed

* Added UUID backfill to a migration

* [WIP] Moar refactoring

* [WIP] Adding UI for getting RSS feed

* Many tests

* Added conditional routing for feed URLs

* Removed the need for url_base to be set

* Updated preset name

* Rendered certain fields HTML-safe; Added logging to confirm range request support

* Fixed incorrect scheme issue

* Updated env var

* Updated other UI to use dropdown

* removed commented code

* docs

* Added unique index to UUID fields

lib/pinchflat/sources/source.ex

@@ -48,6 +48,7 @@ defmodule Pinchflat.Sources.Source do
 
   @pre_insert_required_fields @initially_required_fields ++
                                 ~w(
+                                  uuid
                                   custom_name
                                   collection_name
                                   collection_id
@@ -55,6 +56,11 @@ defmodule Pinchflat.Sources.Source do
                                 )a
 
   schema "sources" do
+    # This is _not_ used as the primary key or internally in the database
+    # relations. This is only used to prevent an enumeration attack on the streaming
+    # and RSS feed endpoints since those _must_ be public (ie: no basic auth)
+    field :uuid, Ecto.UUID
+
     field :custom_name, :string
     field :description, :string
     field :collection_name, :string
@@ -98,6 +104,7 @@ defmodule Pinchflat.Sources.Source do
     source
     |> cast(attrs, @allowed_fields)
     |> dynamic_default(:custom_name, fn cs -> get_field(cs, :collection_name) end)
+    |> dynamic_default(:uuid, fn _ -> Ecto.UUID.generate() end)
     |> validate_required(required_fields)
     |> cast_assoc(:metadata, with: &SourceMetadata.changeset/2, required: false)
   end