Nicolas
b6818655b1
All checks were successful
Publier l'image Docker / publish (push) Successful in 6s
Three changes requested:
1. Server proxies Emby, browser never talks to it directly. Login is
now POST /api/auth/login {username,password} on our own backend;
the backend calls Emby's AuthenticateByName server-side and mints
its own opaque session (httpOnly cookie), storing
{embyToken,userId,userName} in memory. The browser never sees or
holds a real Emby access token. Every other call - search, item
details, images, HLS streaming, party actions - goes to our own
/api/* origin, authenticated by that cookie; server/src/embyProxy.js
forwards to Emby server-side and streams the response back
(including a playlist-rewrite pass for HLS .m3u8 so hls.js never
gets handed a URL pointing at Emby directly). This also sidesteps
the CORS problem the previous direct-to-Emby design had.
2. EMBY_SERVER_URL is backend-only config (.env.example); the login
form no longer asks for a server address at all.
3. client/css/app.css now uses colors read directly off the live Emby
server's own dark theme (--theme-primary-color-* etc, fetched via a
JS probe against the running client, not guessed): accent green
#52b54b/#6ccf65, near-black background #151216.
Tested for real: ran the server locally against the actual
EMBY_SERVER_URL and submitted intentionally-wrong credentials through
the UI - confirmed the full round trip (browser -> our backend -> real
Emby -> real 401 -> our error message) with no CORS issue, since it's
all server-to-server now. Login itself hasn't been exercised with real
credentials, so catalog/streaming remain unverified - see
docs/architecture.md.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
63 lines
1.8 KiB
JavaScript
63 lines
1.8 KiB
JavaScript
// Talks ONLY to our own backend now - never directly to Emby. The backend
|
|
// holds the real Emby session (server/src/embyAuth.js); this module just
|
|
// wraps fetch calls to our own /api/* routes. See docs/architecture.md for
|
|
// why this changed from the first version (CORS, plus not wanting the
|
|
// browser to hold an Emby token at all).
|
|
|
|
async function apiFetch(path, options = {}) {
|
|
const res = await fetch(path, {
|
|
credentials: 'same-origin',
|
|
...options,
|
|
headers: { 'Content-Type': 'application/json', ...(options.headers || {}) }
|
|
});
|
|
if (!res.ok) {
|
|
const body = await res.json().catch(() => ({}));
|
|
throw new Error(body.error || `Request failed: ${res.status}`);
|
|
}
|
|
return res.json();
|
|
}
|
|
|
|
export const auth = {
|
|
userName: null,
|
|
get isLoggedIn() { return !!this.userName; }
|
|
};
|
|
|
|
/** Call once on app start to find out if our session cookie is still valid. */
|
|
export async function restoreSession() {
|
|
try {
|
|
const data = await apiFetch('/api/auth/me');
|
|
auth.userName = data.userName;
|
|
return true;
|
|
} catch (err) {
|
|
auth.userName = null;
|
|
return false;
|
|
}
|
|
}
|
|
|
|
export async function login(username, password) {
|
|
const data = await apiFetch('/api/auth/login', {
|
|
method: 'POST',
|
|
body: JSON.stringify({ username, password })
|
|
});
|
|
auth.userName = data.userName;
|
|
return data;
|
|
}
|
|
|
|
export async function logout() {
|
|
await apiFetch('/api/auth/logout', { method: 'POST' }).catch(() => {});
|
|
auth.userName = null;
|
|
}
|
|
|
|
export async function searchItems(query) {
|
|
if (!query || query.trim().length < 2) return [];
|
|
const data = await apiFetch(`/api/catalog/search?q=${encodeURIComponent(query)}`);
|
|
return data.items || [];
|
|
}
|
|
|
|
export async function getItem(itemId) {
|
|
return apiFetch(`/api/catalog/item/${itemId}`);
|
|
}
|
|
|
|
export function streamUrl(itemId) {
|
|
return `/api/catalog/stream/${itemId}/master.m3u8`;
|
|
}
|