Fix local adult metadata and watch history removal

internal/middleware/emby_auth.go

@@ -1,10 +1,11 @@
 // Package middleware — Emby API 兼容层认证中间件。
-// 支持 X-Emby-Token / Bearer / URL token / Username+Password 四种认证方式。
+// 支持 X-Emby-Token / X-MediaBrowser-Token / Bearer / MediaBrowser / URL token。
 package middleware
 
 import (
 	"errors"
 	"net/http"
+	"strings"
 
 	"github.com/gin-gonic/gin"
 	"github.com/golang-jwt/jwt/v5"
@@ -15,41 +16,13 @@ const EmbyCtxUserID = "emby_user_id"
 
 // EmbyAuthRequired Emby 认证中间件。
 // 按优先级尝试以下认证方式：
-// 1. X-Emby-Token 请求头
-// 2. Authorization: Bearer <token> 请求头
-// 3. ?token=<token> URL 参数
-// 4. （仅 AuthenticateByName 端点）POST body 中的 Username+Password
+// 1. X-Emby-Token / X-MediaBrowser-Token 请求头
+// 2. Authorization: Bearer <token> / MediaBrowser Token="<token>" 请求头
+// 3. X-Emby-Authorization: MediaBrowser Token="<token>"
+// 4. ?token= / ?api_key= / ?apiKey= URL 参数
 func EmbyAuthRequired(secret string) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		token := ""
-
-		// 1. X-Emby-Token 头
-		if t := c.GetHeader("X-Emby-Token"); t != "" {
-			token = t
-		}
-
-		// 2. Authorization: Bearer <token> 或 Emby <token>
-		if token == "" {
-			if authHeader := c.GetHeader("Authorization"); authHeader != "" {
-				// Strip "Bearer " or "Emby " prefix
-				for _, prefix := range []string{"Bearer ", "Emby "} {
-					if len(authHeader) > len(prefix) && authHeader[:len(prefix)] == prefix {
-						token = authHeader[len(prefix):]
-						break
-					}
-				}
-				if token == "" {
-					token = authHeader
-				}
-			}
-		}
-
-		// 3. URL 参数 token
-		if token == "" {
-			if t := c.Query("token"); t != "" {
-				token = t
-			}
-		}
+		token := extractEmbyToken(c)
 
 		if token == "" {
 			c.JSON(http.StatusUnauthorized, gin.H{
@@ -86,6 +59,53 @@ func EmbyAuthRequired(secret string) gin.HandlerFunc {
 	}
 }
 
+func extractEmbyToken(c *gin.Context) string {
+	for _, header := range []string{"X-Emby-Token", "X-MediaBrowser-Token"} {
+		if value := strings.TrimSpace(c.GetHeader(header)); value != "" {
+			return value
+		}
+	}
+
+	for _, header := range []string{"Authorization", "X-Emby-Authorization"} {
+		if value := strings.TrimSpace(c.GetHeader(header)); value != "" {
+			if token := tokenFromAuthHeader(value); token != "" {
+				return token
+			}
+		}
+	}
+
+	for _, key := range []string{"token", "api_key", "apiKey", "ApiKey"} {
+		if value := strings.TrimSpace(c.Query(key)); value != "" {
+			return value
+		}
+	}
+	return ""
+}
+
+func tokenFromAuthHeader(value string) string {
+	for _, prefix := range []string{"Bearer ", "Emby "} {
+		if strings.HasPrefix(value, prefix) {
+			return strings.TrimSpace(strings.TrimPrefix(value, prefix))
+		}
+	}
+	if strings.HasPrefix(value, "MediaBrowser ") || strings.Contains(value, "Token=") {
+		return tokenFromMediaBrowserAuth(value)
+	}
+	return value
+}
+
+func tokenFromMediaBrowserAuth(value string) string {
+	for _, part := range strings.Split(value, ",") {
+		part = strings.TrimSpace(strings.TrimPrefix(strings.TrimSpace(part), "MediaBrowser "))
+		if !strings.HasPrefix(part, "Token=") {
+			continue
+		}
+		token := strings.TrimSpace(strings.TrimPrefix(part, "Token="))
+		return strings.Trim(token, `"`)
+	}
+	return ""
+}
+
 // GetEmbyUserID 从上下文中获取 Emby 用户 ID。
 func GetEmbyUserID(c *gin.Context) string {
 	if uid, exists := c.Get(EmbyCtxUserID); exists {

internal/middleware/emby_auth_test.go

@@ -0,0 +1,67 @@
+package middleware
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+)
+
+func TestEmbyAuthRequiredAcceptsEmbyClientTokenFormats(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	const secret = "test-secret"
+	token := signedTestToken(t, secret)
+
+	tests := []struct {
+		name      string
+		headerKey string
+		headerVal string
+		query     string
+	}{
+		{name: "x emby token", headerKey: "X-Emby-Token", headerVal: token},
+		{name: "x mediabrowser token", headerKey: "X-MediaBrowser-Token", headerVal: token},
+		{name: "authorization mediabrowser token", headerKey: "Authorization", headerVal: `MediaBrowser Client="Infuse", Token="` + token + `"`},
+		{name: "x emby authorization", headerKey: "X-Emby-Authorization", headerVal: `MediaBrowser Client="VidHub", Token="` + token + `"`},
+		{name: "query api key", query: "?api_key=" + token},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			router := gin.New()
+			router.GET("/Users/Me", EmbyAuthRequired(secret), func(c *gin.Context) {
+				c.String(http.StatusOK, GetUserID(c))
+			})
+			req := httptest.NewRequest(http.MethodGet, "/Users/Me"+tt.query, nil)
+			if tt.headerKey != "" {
+				req.Header.Set(tt.headerKey, tt.headerVal)
+			}
+			w := httptest.NewRecorder()
+			router.ServeHTTP(w, req)
+			if w.Code != http.StatusOK {
+				t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
+			}
+			if got := w.Body.String(); got != "user-1" {
+				t.Fatalf("expected user id, got %q", got)
+			}
+		})
+	}
+}
+
+func signedTestToken(t *testing.T, secret string) string {
+	t.Helper()
+	raw := jwt.NewWithClaims(jwt.SigningMethodHS256, &Claims{
+		UserID: "user-1",
+		Role:   "admin",
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),
+		},
+	})
+	token, err := raw.SignedString([]byte(secret))
+	if err != nil {
+		t.Fatalf("failed to sign token: %v", err)
+	}
+	return token
+}

internal/middleware/middleware.go

@@ -53,7 +53,7 @@ func CORS(origins []string) gin.HandlerFunc {
 			c.Header("Vary", "Origin")
 		}
 		c.Header("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS")
-		c.Header("Access-Control-Allow-Headers", "Authorization, Content-Type, X-Requested-With")
+		c.Header("Access-Control-Allow-Headers", "Authorization, Content-Type, X-Requested-With, X-Emby-Token, X-MediaBrowser-Token, X-Emby-Authorization")
 		if c.Request.Method == http.MethodOptions {
 			c.AbortWithStatus(http.StatusNoContent)
 			return