Maven/cmd/mavweb/voiceproxy.go

package main

import (
	"encoding/binary"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"log"
	"net"
	"net/http"
	"net/url"
	"time"

	"github.com/kami/maven/internal/audio"
	"github.com/kami/maven/internal/voice"
	"github.com/kami/maven/internal/webauthn"
)

// POST /api/ptt proxies one turn onto mavend's voice port. It carries the same
// step-up gate as typed chat, because speaking an act is not a smaller act than
// typing one (Vikunja #317). The length-prefixed voice framing is at the bottom.

// maxFrame caps a single voice frame in either direction.
const maxFrame = 64 << 20

// maxPTTAudioBytes is ten minutes of canonical 16 kHz mono int16 PCM. A PTT
// turn should be seconds, but the generous cap preserves long dictation while
// keeping both the HTTP allocation and the base64-expanded voice frame bounded.
// Meeting capture has its own streaming/blob path and does not use this route.
const maxPTTAudioBytes int64 = 10 * 60 * 16000 * 2

// pushToTalk builds the request the HTTP proxy sends. SurfacePCClient records
// that the browser is standing in for the PC client.
func pushToTalk(pcm []byte) voice.Request {
	return voice.Request{
		ID:     uint64(time.Now().UnixNano()),
		Method: voice.MethodPushToTalk,
		Params: mustMarshal(voice.PushToTalkReq{
			Audio:   audio.Audio{Format: audio.PCM16kMono, Bytes: pcm},
			Lang:    "mixed",
			Surface: voice.SurfacePCClient,
		}),
	}
}

func handlePTT(w http.ResponseWriter, r *http.Request, voiceAddr string, session *webauthn.PasskeySession, requireStepUp bool) {
	if r.Method != http.MethodPost {
		http.Error(w, "POST only", http.StatusMethodNotAllowed)
		return
	}
	if !stepUpGate(w, session, requireStepUp) {
		return
	}
	body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, maxPTTAudioBytes))
	if err != nil {
		var tooLarge *http.MaxBytesError
		if errors.As(err, &tooLarge) {
			http.Error(w, "audio exceeds the ten-minute PTT limit", http.StatusRequestEntityTooLarge)
			return
		}
		http.Error(w, "read audio", http.StatusBadRequest)
		return
	}
	if len(body) < 4 {
		http.Error(w, "too short", 400)
		return
	}

	log.Printf("ptt got %d bytes from client", len(body))

	var d net.Dialer
	tc, err := d.DialContext(r.Context(), "tcp", voiceAddr)
	if err != nil {
		log.Printf("ptt dial voice: %v", err)
		http.Error(w, "voice unavailable", http.StatusServiceUnavailable)
		return
	}
	defer tc.Close()

	req := pushToTalk(body)
	if err := writeFrame(tc, &req); err != nil {
		log.Printf("ptt write: %v", err)
		http.Error(w, err.Error(), 500)
		return
	}

	for {
		resp, push, err := readOneFrame(tc)
		if err != nil {
			log.Printf("ptt read: %v", err)
			http.Error(w, err.Error(), 500)
			return
		}
		if push != nil {
			continue
		}
		if resp.Error != nil {
			http.Error(w, resp.Error.Message, 500)
			return
		}
		var pttResp voice.PushToTalkResp
		if err := json.Unmarshal(resp.Result, &pttResp); err != nil {
			http.Error(w, err.Error(), 500)
			return
		}
		w.Header().Set("Content-Type", "audio/l16;rate=16000;channels=1")
		// PathEscape, not QueryEscape (Vikunja #533). QueryEscape writes a space
		// as "+", which is form encoding, and the client decodes this header
		// with decodeURIComponent, which only knows "%20" — so every space in a
		// spoken reply reached the on-page log as a plus sign. PathEscape is the
		// flavour decodeURIComponent actually reverses, which keeps the encoding
		// a property of the header rather than something the client has to know.
		w.Header().Set("X-Reply-Text", url.PathEscape(pttResp.ReplyText))
		w.Write(pttResp.ReplyAudio.Bytes)
		return
	}
}

func writeFrame(w io.Writer, v any) error {
	body, err := json.Marshal(v)
	if err != nil {
		return fmt.Errorf("marshal: %w", err)
	}
	if len(body) > maxFrame {
		return fmt.Errorf("frame too large: %d", len(body))
	}
	var hdr [4]byte
	binary.BigEndian.PutUint32(hdr[:], uint32(len(body)))
	if _, err := w.Write(hdr[:]); err != nil {
		return err
	}
	_, err = w.Write(body)
	return err
}

func readFrame(r io.Reader, v any) error {
	var hdr [4]byte
	if _, err := io.ReadFull(r, hdr[:]); err != nil {
		return err
	}
	n := binary.BigEndian.Uint32(hdr[:])
	if n > maxFrame {
		return fmt.Errorf("frame too large: %d", n)
	}
	buf := make([]byte, n)
	if _, err := io.ReadFull(r, buf); err != nil {
		return err
	}
	return json.Unmarshal(buf, v)
}

func readOneFrame(r io.Reader) (*voice.Response, *voice.Push, error) {
	var raw struct {
		ID     uint64          `json:"id"`
		Result json.RawMessage `json:"r,omitempty"`
		Error  *voice.RpcError `json:"e,omitempty"`
		Kind   voice.PushKind  `json:"kind,omitempty"`
		Params json.RawMessage `json:"p,omitempty"`
	}
	if err := readFrame(r, &raw); err != nil {
		return nil, nil, err
	}
	if raw.Kind != "" && raw.ID == 0 {
		return nil, &voice.Push{Kind: raw.Kind, Params: raw.Params}, nil
	}
	return &voice.Response{ID: raw.ID, Result: raw.Result, Error: raw.Error}, nil, nil
}

func mustMarshal(v any) json.RawMessage {
	b, err := json.Marshal(v)
	if err != nil {
		panic(err)
	}
	return b
}