fix emby clients and cloud playback controls

internal/service/cloud/cloud_test.go

@@ -3,6 +3,7 @@ package cloud
 import (
 	"context"
 	"encoding/base64"
+	"encoding/json"
 	"fmt"
 	"net/http"
 	"net/http/httptest"
@@ -105,10 +106,18 @@ func quarkPagePayload(page int) string {
 	return strings.Join(items, ",")
 }
 
-func TestQuarkForce302(t *testing.T) {
-	p := newQuark(map[string]any{"cookie": "c", "force_302": "true"}, http.DefaultClient)
-	if p.proxy {
-		t.Fatalf("force_302 should disable proxy mode")
+func TestDeprecatedProviderPlaybackOverrideKeysAreIgnored(t *testing.T) {
+	quark := newQuark(map[string]any{"cookie": "c", "force_302": "true"}, http.DefaultClient)
+	if !quark.proxy {
+		t.Fatalf("quark should keep safe proxy mode; force_302 is deprecated")
+	}
+	pan115 := new115(map[string]any{"cookie": "UID=1; CID=2", "force_proxy": "true"}, http.DefaultClient)
+	if pan115.proxy {
+		t.Fatalf("115 should keep safe direct mode; force_proxy is deprecated")
+	}
+	cd2 := newCloudDrive2(map[string]any{"url": "http://example.test/dav", "force_302": "true"}, http.DefaultClient)
+	if !cd2.proxy {
+		t.Fatalf("clouddrive2 should keep safe proxy mode; force_302 is deprecated")
 	}
 }
 
@@ -375,6 +384,10 @@ func TestCloudDrive2WebDAVListAndResolve(t *testing.T) {
 func TestOpenListWebDAVListAndResolve(t *testing.T) {
 	var gotPath, gotDepth string
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/api/auth/login" {
+			http.NotFound(w, r)
+			return
+		}
 		if r.URL.Path == "/api/fs/get" {
 			http.NotFound(w, r)
 			return
@@ -467,6 +480,50 @@ func TestOpenListResolveUsesAPIRawURLFor302Playback(t *testing.T) {
 	}
 }
 
+func TestOpenListResolveLogsInWithUsernamePasswordForAPIRawURL(t *testing.T) {
+	var loginSeen bool
+	var gotAuth string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		switch r.URL.Path {
+		case "/api/auth/login":
+			loginSeen = true
+			var body map[string]string
+			if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+				t.Fatalf("decode login body: %v", err)
+			}
+			if body["username"] != "alice" || body["password"] != "secret" {
+				t.Fatalf("login body = %#v", body)
+			}
+			_, _ = w.Write([]byte(`{"code":200,"data":{"token":"api-token"}}`))
+		case "/api/fs/get":
+			gotAuth = r.Header.Get("Authorization")
+			_, _ = w.Write([]byte(`{"code":200,"data":{"raw_url":"https://cdn.example.test/movie.mkv?sign=1"}}`))
+		default:
+			t.Fatalf("unexpected path %s", r.URL.Path)
+		}
+	}))
+	defer srv.Close()
+
+	p, err := New(TypeOpenList, map[string]any{"server": srv.URL, "username": "alice", "password": "secret"}, srv.Client())
+	if err != nil {
+		t.Fatal(err)
+	}
+	link, err := p.Resolve(context.Background(), "/Cloud/Movie.mkv")
+	if err != nil {
+		t.Fatalf("resolve: %v", err)
+	}
+	if !loginSeen {
+		t.Fatalf("expected api login before fs/get")
+	}
+	if gotAuth != "api-token" {
+		t.Fatalf("Authorization = %q, want api-token", gotAuth)
+	}
+	if link.URL != "https://cdn.example.test/movie.mkv?sign=1" || link.Proxy {
+		t.Fatalf("link = %#v, want raw_url 302 playback", link)
+	}
+}
+
 func TestOpenListResolveFallsBackToProxyWhenAPIRawURLNeedsHeaders(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path != "/api/fs/get" {

internal/service/cloud/clouddrive2.go

@@ -54,9 +54,6 @@ func newCloudDAVProvider(typ, name string, cfg map[string]any, client *http.Clie
 		ua = defaultUA
 	}
 	proxy := true
-	if _, ok := cfg["force_302"]; ok && boolish(cfg["force_302"]) {
-		proxy = false
-	}
 	return &cloudDrive2Provider{
 		typ:      typ,
 		name:     name,
@@ -82,7 +79,7 @@ func (p *cloudDrive2Provider) List(ctx context.Context, dir string) ([]FileEntry
 	if err := p.validate(); err != nil {
 		return nil, err
 	}
-	if p.typ == TypeOpenList && p.apiBase != nil && strings.TrimSpace(p.token) != "" {
+	if p.typ == TypeOpenList && p.apiBase != nil && p.hasOpenListAPICredentials() {
 		if entries, err := p.listOpenListAPI(ctx, dir); err == nil {
 			return entries, nil
 		}
@@ -135,6 +132,10 @@ func (p *cloudDrive2Provider) List(ctx context.Context, dir string) ([]FileEntry
 }
 
 func (p *cloudDrive2Provider) listOpenListAPI(ctx context.Context, dir string) ([]FileEntry, error) {
+	token, err := p.openListAPIToken(ctx)
+	if err != nil {
+		return nil, err
+	}
 	const pageSize = 500
 	target := normalizeCloudDAVPath(dir)
 	out := make([]FileEntry, 0, pageSize)
@@ -154,8 +155,8 @@ func (p *cloudDrive2Provider) listOpenListAPI(ctx context.Context, dir string) (
 		req.Header.Set("Content-Type", "application/json")
 		req.Header.Set("Accept", "application/json")
 		req.Header.Set("User-Agent", p.ua)
-		if p.token != "" {
-			req.Header.Set("Authorization", p.token)
+		if token != "" {
+			req.Header.Set("Authorization", token)
 		}
 		resp, err := p.client.Do(req)
 		if err != nil {
@@ -228,6 +229,10 @@ func (p *cloudDrive2Provider) Resolve(ctx context.Context, fileRef string) (*Dir
 }
 
 func (p *cloudDrive2Provider) resolveOpenListAPIDirect(ctx context.Context, fileRef string) (*DirectLink, error) {
+	token, err := p.openListAPIToken(ctx)
+	if err != nil {
+		return nil, err
+	}
 	payload, _ := json.Marshal(map[string]string{"path": normalizeCloudDAVPath(fileRef), "password": ""})
 	req, err := http.NewRequestWithContext(ctx, http.MethodPost, p.openListAPIURL("/api/fs/get"), bytes.NewReader(payload))
 	if err != nil {
@@ -236,8 +241,8 @@ func (p *cloudDrive2Provider) resolveOpenListAPIDirect(ctx context.Context, file
 	req.Header.Set("Content-Type", "application/json")
 	req.Header.Set("Accept", "application/json")
 	req.Header.Set("User-Agent", p.ua)
-	if p.token != "" {
-		req.Header.Set("Authorization", p.token)
+	if token != "" {
+		req.Header.Set("Authorization", token)
 	}
 	resp, err := p.client.Do(req)
 	if err != nil {
@@ -274,6 +279,55 @@ func (p *cloudDrive2Provider) resolveOpenListAPIDirect(ctx context.Context, file
 	return &DirectLink{URL: resolved, Headers: headers, Proxy: proxy}, nil
 }
 
+func (p *cloudDrive2Provider) hasOpenListAPICredentials() bool {
+	return strings.TrimSpace(p.token) != "" || (strings.TrimSpace(p.username) != "" && p.password != "")
+}
+
+func (p *cloudDrive2Provider) openListAPIToken(ctx context.Context) (string, error) {
+	if token := strings.TrimSpace(p.token); token != "" {
+		return token, nil
+	}
+	if strings.TrimSpace(p.username) == "" || p.password == "" {
+		return "", nil
+	}
+	payload, _ := json.Marshal(map[string]string{
+		"username": p.username,
+		"password": p.password,
+	})
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, p.openListAPIURL("/api/auth/login"), bytes.NewReader(payload))
+	if err != nil {
+		return "", err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("User-Agent", p.ua)
+	resp, err := p.client.Do(req)
+	if err != nil {
+		return "", decorateDAVTransportError(p.name, p.openListAPIURL("/api/auth/login"), err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return "", fmt.Errorf("%s: api login returned http %d", p.name, resp.StatusCode)
+	}
+	var decoded openListLoginResponse
+	if err := json.NewDecoder(io.LimitReader(resp.Body, 4<<20)).Decode(&decoded); err != nil {
+		return "", fmt.Errorf("%s: decode api login: %w", p.name, err)
+	}
+	if decoded.Code != 0 && decoded.Code != 200 {
+		msg := strings.TrimSpace(decoded.Message)
+		if msg == "" {
+			msg = fmt.Sprintf("code %d", decoded.Code)
+		}
+		return "", fmt.Errorf("%s: api login failed: %s", p.name, msg)
+	}
+	token := strings.TrimSpace(decoded.Data.Token)
+	if token == "" {
+		return "", fmt.Errorf("%s: api login returned empty token", p.name)
+	}
+	p.token = token
+	return token, nil
+}
+
 func (p *cloudDrive2Provider) resolveOpenListPlaybackURL(raw string) (string, error) {
 	raw = strings.TrimSpace(raw)
 	if raw == "" {
@@ -603,6 +657,14 @@ type openListGetResponse struct {
 	} `json:"data"`
 }
 
+type openListLoginResponse struct {
+	Code    int    `json:"code"`
+	Message string `json:"message"`
+	Data    struct {
+		Token string `json:"token"`
+	} `json:"data"`
+}
+
 func normalizeCloudDAVPath(p string) string {
 	p = strings.ReplaceAll(strings.TrimSpace(p), "\\", "/")
 	if p == "" || p == "." {

internal/service/cloud/pan115.go

@@ -45,11 +45,9 @@ func new115(cfg map[string]any, client *http.Client) *pan115Provider {
 		ua = defaultUA
 	}
 	// 115 CDN download URLs work with a plain 302 (Alist's recommended mode),
-	// so offload by default; admin can force proxy mode if their network needs it.
+	// so offload by default. The global cloud playback setting decides whether
+	// clients receive a STRMURL entry or a /Videos stream entry.
 	proxy := false
-	if _, ok := cfg["force_proxy"]; ok && boolish(cfg["force_proxy"]) {
-		proxy = true
-	}
 	pro := str(cfg["pro_base"])
 	if pro == "" {
 		pro = pan115ProBase

internal/service/cloud/quark.go

@@ -36,11 +36,10 @@ func newQuark(cfg map[string]any, client *http.Client) *quarkProvider {
 		ua = defaultUA
 	}
 	// Quark download links require the session cookie + UA, so the host must
-	// reverse-proxy unless the admin explicitly opts into raw 302.
+	// reverse-proxy. The global cloud playback setting decides whether clients
+	// receive a STRMURL entry or a /Videos stream entry; this provider only
+	// reports whether the resolved upstream URL itself is safe for raw 302.
 	proxy := true
-	if _, ok := cfg["force_302"]; ok && boolish(cfg["force_302"]) {
-		proxy = false
-	}
 	return &quarkProvider{
 		cookie: str(cfg["cookie"]),
 		ua:     ua,