fix: another player see your skin!

app/api/meta.py

@@ -4,15 +4,29 @@ router = APIRouter(tags=["Meta"])
 
 @router.get("/")
 def api_root():
-    return {
-        "meta": {
-            "serverName": "Your Auth Server",
-            "implementationName": "FastAPI",
-            "implementationVersion": "1.0.0",
-            "links": {
-                "homepage": "https://your-server.com"
+    # Читаем публичный ключ из файла
+    public_key_path = "app/keys/public_key.pem"
+    
+    try:
+        with open(public_key_path, "r") as f:
+            public_key = f.read().strip()
+            
+        return {
+            "meta": {
+                "serverName": "Popa Auth Server",
+                "implementationName": "FastAPI",
+                "implementationVersion": "1.0.0",
+                "links": {
+                    "homepage": "https://popa-popa.ru"
+                }
             },
-        },
-        "skinDomains": ["147.78.65.214"],
-        "capeDomains": ["147.78.65.214"]
-    }
+            "skinDomains": ["147.78.65.214"],
+            "capeDomains": ["147.78.65.214"],
+            # Важно - возвращаем ключ как есть, без дополнительной обработки
+            "signaturePublickey": public_key
+        }
+    except Exception as e:
+        return {
+            "error": str(e),
+            "traceback": str(e)
+        }

app/keys/private_key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC1olpnwfijhTT9
+vRR/AzZc5t4DYM3AOMRf0rdBGn5YWzvzk6LQaWLV7PAycUehzvZmSD5Ko5leg4mm
+pCVod/bm+U99fofaW+MpQ/T+UEg2q3FAkVTmyTts6lQaDXgkOckLj4SQcKemn/9l
+HDL5czDfpUnxBA5ONuTiBiQpxYAQHLk9r2cxIzyDk6veBzAvg6W9eBg1AAs8WJXo
+zo9EwM0JustDgsLgK+x+g43U9pHSF9DoWBCoICYeShDl2DMQQFO4DW6v/E4qGgI9
+BGii3ef4glXJ9OwJv0JlE5Cg3FaHgyFm0I+NroDurIED7JiL4k7UXw+Bb22KrL9Z
+tgGggzspAgMBAAECggEAOTj/8GZc1e92hWYXWfiCHPyi/z91MtTvkRzKnRkiquV7
+Wr6tcalx+OGfvtSPc7vHRuwFq/AktnEMYdKe8m2w/I2Y7Hl7hWCjjXGacrCKP6b9
+lBD1RYwqS6L7ggWyTv9hhmHdqr/DIayQgqNCr/IJeLwTMnpLo3qJ22eB5yMQuII6
+inhTbL/uCvoU2R2gfMQRjtC2GIXApjWJwz20Ydv6B9X+jdw431n5ZNresyR6Chfx
+tVCku+LZ7gpbX/t7B6glYZ/B+CGO8RglQwW67YEYfgxaEHqoYy7yKEaOYRv2BXKA
+T6Aj7+0z0P2kV067eVCu8tf4WK/ji44K1uNEVmbxnQKBgQD8nFhFz+AXULNnjJuf
+RwE2WuxmXKkL3fCYp/PlN9+WznoNfRLyMxYI5tJe7yqoBj1S7caBTS9JkPTpEIhQ
+qsJaDdvEzNm62TxeArUs9KO/IPI5P8P616W4z2YWYFGHrKpJz3KXfOP/DMYcyCG3
+cmzPjKaQhGyi3TXPh1sbgmCbSwKBgQC4Eji3mqCpDLxJlctQs67uQ6gdNEePDDL/
+Kl6BoqQ8RaSSh5PAHdFzRefeKxRSEF63ZRVJBaqZadS/Wx9qu6ZbpMx7NO+6B4/7
+mcf2OBPr3/ioVuaAOAwOPNsCtMPnQDbETAnGBddRj8Bo2+YF75xaIGR0N8qI+Gic
+dvx9rGvm2wKBgQD0JHb8IgjG/+wkrDTMH+gADKhl1jBbk8kxAUIry3CBZFV6K+Pf
+yZgGSnAP6L8lXcJvH/e2iE6nnz3U83GL5T2po7M/5WyZtdMuWReZt2d7FfCFfCeB
+jGJS18Am6DhkFHEQnTp3RvFkU4g10QclMaYQgjOJgTMtxPZ4+K0JTVzpOQKBgCor
+Un8Nl5zi5Affn1J/t6WyLkNyhKpK2ywF4tzEC+ga9Fb1ZG3w5tkHvNTy/ZbHVUui
+hrvR5oF681hbYdkr4DLCkG3xdLIjpWK4mkzYEAhLqUW3ktrw/CIO4wW9r9u8pE9Y
+NCz/jZKL4kKjjhDyEdm77geJ+IZkkmK2B6Yq6BVdAoGAPlSRQFCo3ZKk78wJm19j
+IjSacufzhQyG9G6US0Ql0HEqsjo+T2ZOPhge2zkfxs+sr6EQrbEBOoTV3IOtet78
+x6u/IxD1QfJQtIAS8n4s6+HEFV7Gu+zvkz9dIIN6nMKZb1tfZlMmEtdm0Ms9kFma
+1eyyqBR6aOhWwYopsHhdCOc=
+-----END PRIVATE KEY-----

app/keys/public_key.pem

@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtaJaZ8H4o4U0/b0UfwM2
+XObeA2DNwDjEX9K3QRp+WFs785Oi0Gli1ezwMnFHoc72Zkg+SqOZXoOJpqQlaHf2
+5vlPfX6H2lvjKUP0/lBINqtxQJFU5sk7bOpUGg14JDnJC4+EkHCnpp//ZRwy+XMw
+36VJ8QQOTjbk4gYkKcWAEBy5Pa9nMSM8g5Or3gcwL4OlvXgYNQALPFiV6M6PRMDN
+CbrLQ4LC4CvsfoON1PaR0hfQ6FgQqCAmHkoQ5dgzEEBTuA1ur/xOKhoCPQRoot3n
++IJVyfTsCb9CZROQoNxWh4MhZtCPja6A7qyBA+yYi+JO1F8PgW9tiqy/WbYBoIM7
+KQIDAQAB
+-----END PUBLIC KEY-----

app/services/auth.py

@@ -108,7 +108,7 @@ class AuthService:
 
         textures = {
             "timestamp": int(datetime.now().timestamp() * 1000),
-            "profileId": user["uuid"],  # UUID с дефисами
+            "profileId": user["uuid"].replace("-", ""),
             "profileName": user["username"],
             "textures": {}
         }
@@ -124,29 +124,67 @@ class AuthService:
 
         textures_json = json.dumps(textures).encode()
         base64_textures = base64.b64encode(textures_json).decode()
-
-        # Подписываем текстуры
-        with open("private_key.pem", "rb") as key_file:
-            private_key = serialization.load_pem_private_key(
-                key_file.read(),
-                password=None
-            )
         
-        signature = private_key.sign(
-            textures_json,
-            padding.PKCS1v15(),
-            hashes.SHA1()
-        )
+        try:
+            # Подписываем текстуры
+            private_key_path = "app/keys/private_key.pem"
+            with open(private_key_path, "rb") as key_file:
+                private_key = serialization.load_pem_private_key(
+                    key_file.read(),
+                    password=None
+                )
+            
+            signature = private_key.sign(
+                base64.b64encode(textures_json),
+                padding.PKCS1v15(),
+                hashes.SHA1()
+            )
+            
+            signature_base64 = base64.b64encode(signature).decode()
+            
+            return {
+                "id": user["uuid"].replace("-", ""),
+                "name": user["username"],
+                "properties": [{
+                    "name": "textures",
+                    "value": base64_textures,
+                    "signature": signature_base64
+                }]
+            }
+        except Exception as e:
+            print(f"Error signing textures: {e}")
+            # В случае ошибки возвращаем текстуры без подписи
+            return {
+                "id": user["uuid"].replace("-", ""),
+                "name": user["username"],
+                "properties": [{
+                    "name": "textures",
+                    "value": base64_textures
+                }]
+            }
 
-        return JSONResponse({
-            "id": user["uuid"].replace("-", ""),  # Уберите дефисы
-            "name": user["username"],
-            "properties": [{
-                "name": "textures",
-                "value": base64_textures,
-                "signature": base64.b64encode(signature).decode()
-            }]
-        })
+        # # Подписываем текстуры
+        # with open("private_key.pem", "rb") as key_file:
+        #     private_key = serialization.load_pem_private_key(
+        #         key_file.read(),
+        #         password=None
+        #     )
+        
+        # signature = private_key.sign(
+        #     textures_json,
+        #     padding.PKCS1v15(),
+        #     hashes.SHA1()
+        # )
+
+        # return JSONResponse({
+        #     "id": user["uuid"].replace("-", ""),  # Уберите дефисы
+        #     "name": user["username"],
+        #     "properties": [{
+        #         "name": "textures",
+        #         "value": base64_textures,
+        #         # "signature": base64.b64encode(signature).decode()
+        #     }]
+        # })
         
     async def join_server(self, request_data: dict):
         access_token = request_data.get("accessToken")
@@ -186,24 +224,59 @@ class AuthService:
         if not session:
             raise HTTPException(status_code=403, detail="Not joined this server")
 
-        textures = {}
-        if user.get("skin_url"):
-            textures["SKIN"] = {"url": user["skin_url"]}
-        if user.get("cloak_url"):
-            textures["CAPE"] = {"url": user["cloak_url"]}
-
-        textures_value = base64.b64encode(json.dumps({
-            "timestamp": int(datetime.now().timestamp()),
-            "profileId": user["uuid"].replace("-", ""),  # UUID без дефисов
-            "profileName": username,
-            "textures": textures
-        }).encode()).decode()
-
-        return {
-            "id": user["uuid"].replace("-", ""),  # UUID без дефисов
-            "name": username,
-            "properties": [{
-                "name": "textures",
-                "value": textures_value
-            }] if textures else []
+        textures = {
+            "timestamp": int(datetime.now().timestamp() * 1000),
+            "profileId": user["uuid"].replace("-", ""),
+            "profileName": user["username"],
+            "textures": {}
         }
+
+        if user.get("skin_url"):
+            textures["textures"]["SKIN"] = {
+                "url": user["skin_url"],
+                "metadata": {"model": user.get("skin_model", "classic")}
+            }
+
+        if user.get("cloak_url"):
+            textures["textures"]["CAPE"] = {"url": user["cloak_url"]}
+
+        textures_json = json.dumps(textures).encode()
+        base64_textures = base64.b64encode(textures_json).decode()
+        
+        try:
+            # Подписываем текстуры
+            private_key_path = "app/keys/private_key.pem"
+            with open(private_key_path, "rb") as key_file:
+                private_key = serialization.load_pem_private_key(
+                    key_file.read(),
+                    password=None
+                )
+            
+            signature = private_key.sign(
+                base64.b64encode(textures_json),
+                padding.PKCS1v15(),
+                hashes.SHA1()
+            )
+            
+            signature_base64 = base64.b64encode(signature).decode()
+            
+            return {
+                "id": user["uuid"].replace("-", ""),
+                "name": user["username"],
+                "properties": [{
+                    "name": "textures",
+                    "value": base64_textures,
+                    "signature": signature_base64
+                }]
+            }
+        except Exception as e:
+            print(f"Error signing textures: {e}")
+            # В случае ошибки возвращаем текстуры без подписи
+            return {
+                "id": user["uuid"].replace("-", ""),
+                "name": user["username"],
+                "properties": [{
+                    "name": "textures",
+                    "value": base64_textures
+                }]
+            }