Nicolas
b6818655b1
All checks were successful
Publier l'image Docker / publish (push) Successful in 6s
Three changes requested:
1. Server proxies Emby, browser never talks to it directly. Login is
now POST /api/auth/login {username,password} on our own backend;
the backend calls Emby's AuthenticateByName server-side and mints
its own opaque session (httpOnly cookie), storing
{embyToken,userId,userName} in memory. The browser never sees or
holds a real Emby access token. Every other call - search, item
details, images, HLS streaming, party actions - goes to our own
/api/* origin, authenticated by that cookie; server/src/embyProxy.js
forwards to Emby server-side and streams the response back
(including a playlist-rewrite pass for HLS .m3u8 so hls.js never
gets handed a URL pointing at Emby directly). This also sidesteps
the CORS problem the previous direct-to-Emby design had.
2. EMBY_SERVER_URL is backend-only config (.env.example); the login
form no longer asks for a server address at all.
3. client/css/app.css now uses colors read directly off the live Emby
server's own dark theme (--theme-primary-color-* etc, fetched via a
JS probe against the running client, not guessed): accent green
#52b54b/#6ccf65, near-black background #151216.
Tested for real: ran the server locally against the actual
EMBY_SERVER_URL and submitted intentionally-wrong credentials through
the UI - confirmed the full round trip (browser -> our backend -> real
Emby -> real 401 -> our error message) with no CORS issue, since it's
all server-to-server now. Login itself hasn't been exercised with real
credentials, so catalog/streaming remain unverified - see
docs/architecture.md.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
71 lines
2.3 KiB
JavaScript
71 lines
2.3 KiB
JavaScript
// Party REST + realtime WebSocket - same origin as everything else, auth is
|
|
// the session cookie (see embyApi.js), so no headers/tokens to pass around
|
|
// here at all.
|
|
|
|
async function apiFetch(path, options = {}) {
|
|
const res = await fetch(path, {
|
|
credentials: 'same-origin',
|
|
...options,
|
|
headers: { 'Content-Type': 'application/json', ...(options.headers || {}) }
|
|
});
|
|
if (!res.ok) {
|
|
const body = await res.json().catch(() => ({}));
|
|
throw new Error(body.error || `Request failed: ${res.status}`);
|
|
}
|
|
return res.json();
|
|
}
|
|
|
|
export function createParty(itemId) {
|
|
return apiFetch('/api/parties', { method: 'POST', body: JSON.stringify({ itemId }) });
|
|
}
|
|
|
|
export function joinParty(joinCode) {
|
|
return apiFetch(`/api/parties/${encodeURIComponent(joinCode)}/join`, { method: 'POST' });
|
|
}
|
|
|
|
export function leaveParty(partyId) {
|
|
return apiFetch(`/api/parties/${partyId}/leave`, { method: 'POST' });
|
|
}
|
|
|
|
export function getParty(partyId) {
|
|
return apiFetch(`/api/parties/${partyId}`);
|
|
}
|
|
|
|
/**
|
|
* Opens the realtime connection for a party. Auth rides along on the
|
|
* WebSocket's HTTP upgrade handshake as the session cookie (browsers attach
|
|
* cookies to that handshake automatically for a same-origin URL) - so all
|
|
* this needs to send is which party to join.
|
|
*/
|
|
export function connectParty(partyId, { onMembers, onPlaystate, onError, onClose } = {}) {
|
|
const proto = location.protocol === 'https:' ? 'wss://' : 'ws://';
|
|
const ws = new WebSocket(proto + location.host + '/ws');
|
|
|
|
ws.addEventListener('open', () => {
|
|
ws.send(JSON.stringify({ type: 'join', partyId }));
|
|
});
|
|
|
|
ws.addEventListener('message', (evt) => {
|
|
let msg;
|
|
try { msg = JSON.parse(evt.data); } catch (err) { return; }
|
|
if (msg.type === 'members' && onMembers) onMembers(msg.members);
|
|
if (msg.type === 'playstate' && onPlaystate) onPlaystate(msg);
|
|
if (msg.type === 'error' && onError) onError(msg.message);
|
|
});
|
|
|
|
ws.addEventListener('close', () => { if (onClose) onClose(); });
|
|
|
|
return {
|
|
sendPlaystate(isPaused, positionTicks) {
|
|
if (ws.readyState === WebSocket.OPEN) {
|
|
ws.send(JSON.stringify({ type: 'playstate', isPaused, positionTicks }));
|
|
}
|
|
},
|
|
leave() {
|
|
if (ws.readyState === WebSocket.OPEN) {
|
|
ws.send(JSON.stringify({ type: 'leave' }));
|
|
}
|
|
ws.close();
|
|
}
|
|
};
|
|
}
|