fix: stabilize STRM and cloud playback

internal/handler/emby.go

@@ -757,7 +757,7 @@ func embyAttachRequestTokenToPlaybackInfo(c *gin.Context, out map[string]any) {
 		return
 	}
 	for _, source := range sources {
-		for _, key := range []string{"DirectStreamUrl", "TranscodingUrl"} {
+		for _, key := range []string{"DirectStreamUrl", "TranscodingUrl", "Path"} {
 			raw, ok := source[key].(string)
 			if !ok {
 				continue

internal/handler/emby_test.go

@@ -589,6 +589,74 @@ func TestEmbyLowercasePlaybackInfoRouteReturnsJSON(t *testing.T) {
 	}
 }
 
+func TestEmbyPlaybackInfoTokenizesCloudPath(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	if err := db.AutoMigrate(model.AllModels()...); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	repos := repository.New(db)
+	if err := repos.User.Create(t.Context(), &model.User{
+		Base:         model.Base{ID: "user-1"},
+		Username:     "tester",
+		PasswordHash: "x",
+		Role:         "admin",
+		Tier:         "plus",
+		IsActive:     true,
+	}); err != nil {
+		t.Fatalf("create user: %v", err)
+	}
+	lib := model.Library{Name: "OpenList", Path: "cloud://openlist/Movies", Type: "movie", Enabled: true}
+	if err := repos.Library.Create(t.Context(), &lib); err != nil {
+		t.Fatalf("create library: %v", err)
+	}
+	if err := db.Create(&model.Media{
+		Base:      model.Base{ID: "cloud-1"},
+		LibraryID: lib.ID,
+		Title:     "Cloud Movie",
+		Path:      "cloud://openlist/Movies/Movie.mkv",
+		STRMURL:   "/api/cloud/play/openlist?ref=%2FMovies%2FMovie.mkv",
+		Container: "mkv",
+	}).Error; err != nil {
+		t.Fatalf("create media: %v", err)
+	}
+
+	const secret = "test-secret"
+	router := gin.New()
+	registerEmbyRoutes(router, secret, &service.Container{
+		Repo: repos,
+		Emby: service.NewEmbyService(&config.Config{}, zap.NewNop(), repos),
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/users/user-1/items/cloud-1/playbackinfo", nil)
+	req.Header.Set("X-Emby-Token", signedTestToken(t, secret))
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String())
+	}
+	var body map[string]any
+	if err := json.Unmarshal(w.Body.Bytes(), &body); err != nil {
+		t.Fatalf("decode playback info: %v", err)
+	}
+	source := body["MediaSources"].([]any)[0].(map[string]any)
+	pathURL, _ := source["Path"].(string)
+	if !strings.HasPrefix(pathURL, "/Videos/cloud-1/stream") || !strings.Contains(pathURL, "api_key=") {
+		t.Fatalf("cloud Path should be tokenized stream URL, got %#v", source)
+	}
+	if strings.Contains(pathURL, "/api/cloud/play/") {
+		t.Fatalf("cloud Path should not expose naked cloud play URL: %#v", source)
+	}
+	directURL, _ := source["DirectStreamUrl"].(string)
+	if !strings.HasPrefix(directURL, "/Videos/cloud-1/stream.") || !strings.Contains(directURL, "api_key=") {
+		t.Fatalf("DirectStreamUrl should stay tokenized: %#v", source)
+	}
+}
+
 func TestEmbyLowercaseVideoStreamRouteServesMedia(t *testing.T) {
 	gin.SetMode(gin.TestMode)
 	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})

internal/handler/strm.go

@@ -12,6 +12,7 @@ import (
 
 	"github.com/gin-gonic/gin"
 
+	"github.com/ShukeBta/MediaStationGo/internal/middleware"
 	"github.com/ShukeBta/MediaStationGo/internal/model"
 	"github.com/ShukeBta/MediaStationGo/internal/service"
 )
@@ -118,12 +119,13 @@ func generateSTRMHandler(svc *service.Container) gin.HandlerFunc {
 			strmSvc = service.NewSTRMService(svc.Log, svc.Repo, svc.Cfg)
 		}
 		res, err := strmSvc.GenerateForLibrary(c.Request.Context(), service.GenerateSTRMOptions{
-			LibraryID:    req.LibraryID,
-			OutputDir:    req.OutputDir,
-			BaseURL:      req.BaseURL,
-			Enabled:      req.Enabled,
-			Overwrite:    req.Overwrite,
-			IncludeLocal: true,
+			LibraryID:     req.LibraryID,
+			OutputDir:     req.OutputDir,
+			BaseURL:       req.BaseURL,
+			Enabled:       req.Enabled,
+			Overwrite:     req.Overwrite,
+			IncludeLocal:  true,
+			PlaybackToken: strmPlaybackTokenForRequest(c, svc),
 		})
 		if err != nil {
 			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
@@ -132,3 +134,22 @@ func generateSTRMHandler(svc *service.Container) gin.HandlerFunc {
 		c.JSON(http.StatusOK, res)
 	}
 }
+
+func strmPlaybackTokenForRequest(c *gin.Context, svc *service.Container) string {
+	if svc == nil || svc.Auth == nil || svc.Repo == nil || svc.Repo.User == nil {
+		return ""
+	}
+	uid := middleware.GetUserID(c)
+	if uid == "" {
+		return ""
+	}
+	u, err := svc.Repo.User.FindByID(c.Request.Context(), uid)
+	if err != nil || u == nil {
+		return ""
+	}
+	token, err := svc.Auth.IssueEmbyToken(u)
+	if err != nil {
+		return ""
+	}
+	return token
+}