Merge pull request #1 from tces1/codex/fix-emby-auth-token

Fix missing Emby auth token in transcode URLs

Author: tces1

internal/proxy/server.go

@@ -10,6 +10,7 @@ import (
 	"net/http/httputil"
 	"net/url"
 	"path"
+	"regexp"
 	"strconv"
 	"strings"
 	"time"
@@ -31,6 +32,8 @@ type Server struct {
 	transcodeManager *transcode.Manager
 }
 
+var embyTokenPattern = regexp.MustCompile(`(?i)\btoken\s*=\s*"?([^",\s]+)"?`)
+
 func New(cfg config.Config) (*Server, error) {
 	return NewWithTransport(cfg, http.DefaultTransport)
 }
@@ -193,7 +196,7 @@ func (s *Server) handlePlaybackInfo(w http.ResponseWriter, r *http.Request) {
 	itemID := itemIDFromPlaybackPath(r.URL.Path)
 	publicURL := s.publicURL(r)
 	if strings.Contains(resp.Header.Get("Content-Type"), "application/json") && itemID != "" {
-		rewritten, changed, report, err := emby.RewritePlaybackInfoWithReport(respBody, itemID, publicURL, r.URL.RawQuery)
+		rewritten, changed, report, err := emby.RewritePlaybackInfoWithReport(respBody, itemID, publicURL, authAwareRawQuery(r))
 		if err != nil {
 			logging.Errorf("playbackinfo rewrite error item=%s err=%v", itemID, err)
 		}
@@ -275,6 +278,7 @@ func (s *Server) prewarmPlaybackInfoTranscode(r *http.Request, report emby.Rewri
 	inputURL := prewarmTranscodeInputURL(s.upstream, itemID, source.ID, audioStreamIndex, r)
 	request := transcode.Request{
 		InputURL:                inputURL,
+		Headers:                 r.Header.Clone(),
 		ItemID:                  itemID,
 		MediaSourceID:           source.ID,
 		PlaySessionID:           source.SessionID,
@@ -317,7 +321,7 @@ func preferredAudioStreamIndex(streams []emby.AudioStreamReport) int {
 func prewarmTranscodeInputURL(upstream *url.URL, id string, mediaSourceID string, audioStreamIndex int, r *http.Request) string {
 	u := *upstream
 	u.Path = singleJoiningSlash(upstream.Path, path.Join("/emby/Videos", id, "stream"))
-	query := r.URL.Query()
+	query := authAwareQuery(r)
 	query.Del("reqformat")
 	query.Set("AutoOpenLiveStream", "true")
 	query.Set("IsPlayback", "true")
@@ -334,12 +338,50 @@ func prewarmTranscodeInputURL(upstream *url.URL, id string, mediaSourceID string
 func transcodeInputURL(upstream *url.URL, id string, r *http.Request) string {
 	u := *upstream
 	u.Path = singleJoiningSlash(upstream.Path, path.Join("/emby/Videos", id, "stream"))
-	query := r.URL.Query()
+	query := authAwareQuery(r)
 	query.Del("reqformat")
 	u.RawQuery = query.Encode()
 	return u.String()
 }
 
+func authAwareRawQuery(r *http.Request) string {
+	return authAwareQuery(r).Encode()
+}
+
+func authAwareQuery(r *http.Request) url.Values {
+	query := r.URL.Query()
+	if query.Get("X-Emby-Token") == "" {
+		if token := embyTokenFromHeaders(r.Header); token != "" {
+			query.Set("X-Emby-Token", token)
+		}
+	}
+	return query
+}
+
+func embyTokenFromHeaders(headers http.Header) string {
+	for _, key := range []string{"X-Emby-Token", "X-MediaBrowser-Token"} {
+		if value := strings.TrimSpace(headers.Get(key)); value != "" {
+			return value
+		}
+	}
+	for _, key := range []string{"X-Emby-Authorization", "Authorization"} {
+		if value := strings.TrimSpace(headers.Get(key)); value != "" {
+			if token := extractEmbyToken(value); token != "" {
+				return token
+			}
+		}
+	}
+	return ""
+}
+
+func extractEmbyToken(value string) string {
+	match := embyTokenPattern.FindStringSubmatch(value)
+	if len(match) == 2 {
+		return match[1]
+	}
+	return ""
+}
+
 func (s *Server) publicURL(r *http.Request) string {
 	if s.cfg.Server.PublicURL != "" {
 		return s.cfg.Server.PublicURL

internal/proxy/server_test.go

@@ -110,6 +110,35 @@ func TestNormalRequestsAreProxied(t *testing.T) {
 	}
 }
 
+func TestPlaybackInfoCarriesHeaderTokenIntoRewrittenTranscodeURL(t *testing.T) {
+	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
+		return jsonResponse(`{"MediaSources":[{"Id":"source1","SupportsDirectPlay":true,"MediaStreams":[{"Type":"Video","Codec":"hevc","Width":3840,"Height":2160},{"Type":"Audio","Codec":"dts","Channels":6}]}]}`), nil
+	})
+
+	cfg := config.Default()
+	cfg.Upstream.URL = "http://upstream.local"
+	cfg.Server.PublicURL = "http://proxy.local"
+	cfg.Clients = []config.ClientProfile{{Name: "yamby", Match: []string{"Yamby"}, Transcode: true}}
+
+	srv, err := proxy.NewWithTransport(cfg, transport)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	req := httptest.NewRequest("GET", "/emby/Items/item123/PlaybackInfo?AutoOpenLiveStream=false&IsPlayback=false", nil)
+	req.Header.Set("User-Agent", "Yamby TV")
+	req.Header.Set("X-Emby-Authorization", `MediaBrowser Client="Emby for Android TV", Token="abc"`)
+	rec := httptest.NewRecorder()
+	srv.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d body = %s", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "X-Emby-Token=abc") {
+		t.Fatalf("rewritten body should carry header token: %s", rec.Body.String())
+	}
+}
+
 type roundTripFunc func(*http.Request) (*http.Response, error)
 
 func (f roundTripFunc) RoundTrip(r *http.Request) (*http.Response, error) {

internal/proxy/transcode_input_test.go

@@ -60,3 +60,18 @@ func TestTranscodeInputURLStripsReqFormatFromStreamRequest(t *testing.T) {
 		t.Fatalf("input url should keep stream parameters: %s", got)
 	}
 }
+
+func TestTranscodeInputURLUsesHeaderTokenWhenQueryIsMissing(t *testing.T) {
+	upstream, err := url.Parse("http://upstream.local")
+	if err != nil {
+		t.Fatal(err)
+	}
+	req := httptest.NewRequest("GET", "/streambridge/transcode/item123/master.m3u8?MediaSourceId=source1", nil)
+	req.Header.Set("X-Emby-Authorization", `MediaBrowser Client="Emby for Android TV", Token="abc"`)
+
+	got := transcodeInputURL(upstream, "item123", req)
+
+	if !strings.Contains(got, "X-Emby-Token=abc") {
+		t.Fatalf("input url should carry token from auth header: %s", got)
+	}
+}