refactor: split emby playback route tests

internal/handler/emby_playback_cloud_routes_test.go

@@ -0,0 +1,223 @@
+package handler
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/glebarez/sqlite"
+	"go.uber.org/zap"
+	"gorm.io/gorm"
+
+	"github.com/ShukeBta/MediaStationGo/internal/config"
+	"github.com/ShukeBta/MediaStationGo/internal/middleware"
+	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MediaStationGo/internal/repository"
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+func TestEmbyVideoStreamUsesSTRMWhenRedirectProxyDisabled(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	if err := db.AutoMigrate(model.AllModels()...); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	repos := repository.New(db)
+	if err := repos.Setting.Set(t.Context(), service.CloudPlaybackModeSettingKey, service.CloudPlaybackModeSTRM); err != nil {
+		t.Fatalf("set cloud playback mode: %v", err)
+	}
+	if err := repos.Setting.Set(t.Context(), service.CloudPlaybackSTRMEnabledSettingKey, "true"); err != nil {
+		t.Fatalf("enable strm playback: %v", err)
+	}
+	if err := repos.Setting.Set(t.Context(), service.CloudPlaybackRedirectEnabledSettingKey, "false"); err != nil {
+		t.Fatalf("disable redirect playback: %v", err)
+	}
+	if err := repos.User.Create(t.Context(), &model.User{
+		Base:         model.Base{ID: "user-1"},
+		Username:     "tester",
+		PasswordHash: "x",
+		Role:         "admin",
+		Tier:         "plus",
+		IsActive:     true,
+	}); err != nil {
+		t.Fatalf("create user: %v", err)
+	}
+	lib := model.Library{Name: "OpenList", Path: "cloud://openlist/Movies", Type: "movie", Enabled: true}
+	if err := repos.Library.Create(t.Context(), &lib); err != nil {
+		t.Fatalf("create library: %v", err)
+	}
+	if err := db.Create(&model.Media{
+		Base:      model.Base{ID: "cloud-1"},
+		LibraryID: lib.ID,
+		Title:     "Cloud Movie",
+		Path:      "cloud://openlist/Movies/Movie.mkv",
+		STRMURL:   "/api/cloud/play/openlist?ref=%2FMovies%2FMovie.mkv",
+		Container: "mkv",
+	}).Error; err != nil {
+		t.Fatalf("create media: %v", err)
+	}
+
+	const secret = "test-secret"
+	router := gin.New()
+	cfg := &config.Config{Secrets: config.SecretsConfig{JWTSecret: secret}}
+	registerEmbyRoutes(router, secret, &service.Container{
+		Repo:   repos,
+		Emby:   service.NewEmbyService(cfg, zap.NewNop(), repos),
+		Stream: service.NewStreamService(cfg, zap.NewNop(), repos, nil),
+	})
+
+	token := signedTestToken(t, secret)
+	req := httptest.NewRequest(http.MethodGet, "/videos/cloud-1/stream?api_key="+token, nil)
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+
+	if w.Code != http.StatusFound {
+		t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String())
+	}
+	loc := w.Header().Get("Location")
+	if !strings.Contains(loc, "/api/stream/cloud-1") || !strings.Contains(loc, "api_key=") {
+		t.Fatalf("STRM mode should redirect /Videos fallback to tokenized /api/stream, got %q", loc)
+	}
+	if got := w.Header().Get("Cache-Control"); !strings.Contains(got, "no-store") {
+		t.Fatalf("STRM fallback redirect Cache-Control = %q, want no-store", got)
+	}
+	if strings.Contains(loc, "/api/cloud/play/") {
+		t.Fatalf("STRM mode should not expose cloud play directly from /Videos fallback: %q", loc)
+	}
+}
+
+func TestEmbyVideoStreamIssuesTokenForSessionFallbackSTRMRedirect(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	if err := db.AutoMigrate(model.AllModels()...); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	repos := repository.New(db)
+	if err := repos.Setting.Set(t.Context(), service.CloudPlaybackModeSettingKey, service.CloudPlaybackModeSTRM); err != nil {
+		t.Fatalf("set cloud playback mode: %v", err)
+	}
+	if err := repos.Setting.Set(t.Context(), service.CloudPlaybackSTRMEnabledSettingKey, "true"); err != nil {
+		t.Fatalf("enable strm playback: %v", err)
+	}
+	if err := repos.Setting.Set(t.Context(), service.CloudPlaybackRedirectEnabledSettingKey, "false"); err != nil {
+		t.Fatalf("disable redirect playback: %v", err)
+	}
+	user := model.User{
+		Base:         model.Base{ID: "user-1"},
+		Username:     "tester",
+		PasswordHash: "x",
+		Role:         "admin",
+		Tier:         "plus",
+		IsActive:     true,
+	}
+	if err := repos.User.Create(t.Context(), &user); err != nil {
+		t.Fatalf("create user: %v", err)
+	}
+	lib := model.Library{Name: "OpenList", Path: "cloud://openlist/Movies", Type: "movie", Enabled: true}
+	if err := repos.Library.Create(t.Context(), &lib); err != nil {
+		t.Fatalf("create library: %v", err)
+	}
+	if err := db.Create(&model.Media{
+		Base:      model.Base{ID: "cloud-1"},
+		LibraryID: lib.ID,
+		Title:     "Cloud Movie",
+		Path:      "cloud://openlist/Movies/Movie.mkv",
+		STRMURL:   "/api/cloud/play/openlist?ref=%2FMovies%2FMovie.mkv",
+		Container: "mkv",
+	}).Error; err != nil {
+		t.Fatalf("create media: %v", err)
+	}
+
+	const secret = "test-secret"
+	cfg := &config.Config{Secrets: config.SecretsConfig{JWTSecret: secret}}
+	svc := &service.Container{
+		Repo:   repos,
+		Auth:   service.NewAuthService(cfg, zap.NewNop(), repos, nil, nil),
+		Emby:   service.NewEmbyService(cfg, zap.NewNop(), repos),
+		Stream: service.NewStreamService(cfg, zap.NewNop(), repos, nil),
+	}
+	router := gin.New()
+	router.GET("/videos/:id/stream", func(c *gin.Context) {
+		c.Set(middleware.CtxUserID, user.ID)
+		c.Set(middleware.CtxUserRole, user.Role)
+		embyVideoStreamHandler(svc, service.CloudPlaybackModeRedirectProxy)(c)
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/videos/cloud-1/stream", nil)
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+
+	if w.Code != http.StatusFound {
+		t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String())
+	}
+	loc := w.Header().Get("Location")
+	if !strings.Contains(loc, "/api/stream/cloud-1") || !strings.Contains(loc, "api_key=") {
+		t.Fatalf("session fallback redirect should include api_key for /api/stream, got %q", loc)
+	}
+}
+
+func TestEmbyVideoStreamRedirectKeepsMediaBrowserAuthorizationToken(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	if err := db.AutoMigrate(model.AllModels()...); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	repos := repository.New(db)
+	if err := repos.User.Create(t.Context(), &model.User{
+		Base:         model.Base{ID: "user-1"},
+		Username:     "tester",
+		PasswordHash: "x",
+		Role:         "admin",
+		Tier:         "plus",
+		IsActive:     true,
+	}); err != nil {
+		t.Fatalf("create user: %v", err)
+	}
+	lib := model.Library{Name: "OpenList", Path: "cloud://openlist/Movies", Type: "movie", Enabled: true}
+	if err := repos.Library.Create(t.Context(), &lib); err != nil {
+		t.Fatalf("create library: %v", err)
+	}
+	if err := db.Create(&model.Media{
+		Base:      model.Base{ID: "cloud-1"},
+		LibraryID: lib.ID,
+		Title:     "Cloud Movie",
+		Path:      "cloud://openlist/Movies/Movie.mkv",
+		STRMURL:   "/api/cloud/play/openlist?ref=%2FMovies%2FMovie.mkv",
+		Container: "mkv",
+	}).Error; err != nil {
+		t.Fatalf("create media: %v", err)
+	}
+
+	const secret = "test-secret"
+	router := gin.New()
+	registerEmbyRoutes(router, secret, &service.Container{
+		Repo:   repos,
+		Emby:   service.NewEmbyService(&config.Config{}, zap.NewNop(), repos),
+		Stream: service.NewStreamService(&config.Config{}, zap.NewNop(), repos, nil),
+	})
+
+	token := signedTestToken(t, secret)
+	req := httptest.NewRequest(http.MethodGet, "/videos/cloud-1/stream", nil)
+	req.Header.Set("X-MediaBrowser-Authorization", `MediaBrowser Client="Infuse", Device="PC", Token="`+token+`"`)
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+
+	if w.Code != http.StatusFound {
+		t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String())
+	}
+	loc := w.Header().Get("Location")
+	if !strings.Contains(loc, "/api/cloud/play/openlist?") || !strings.Contains(loc, "token=") {
+		t.Fatalf("redirect Location should target tokenized cloud play endpoint, got %q", loc)
+	}
+}

internal/handler/emby_playback_info_routes_test.go

@@ -0,0 +1,245 @@
+package handler
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/glebarez/sqlite"
+	"go.uber.org/zap"
+	"gorm.io/gorm"
+
+	"github.com/ShukeBta/MediaStationGo/internal/config"
+	"github.com/ShukeBta/MediaStationGo/internal/model"
+	"github.com/ShukeBta/MediaStationGo/internal/repository"
+	"github.com/ShukeBta/MediaStationGo/internal/service"
+)
+
+func TestEmbyLowercasePlaybackInfoRouteReturnsJSON(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	if err := db.AutoMigrate(model.AllModels()...); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	repos := repository.New(db)
+	if err := repos.User.Create(t.Context(), &model.User{
+		Base:         model.Base{ID: "user-1"},
+		Username:     "tester",
+		PasswordHash: "x",
+		Role:         "admin",
+		Tier:         "plus",
+		IsActive:     true,
+	}); err != nil {
+		t.Fatalf("create user: %v", err)
+	}
+	lib := model.Library{Name: "电影", Path: t.TempDir(), Type: "movie", Enabled: true}
+	if err := repos.Library.Create(t.Context(), &lib); err != nil {
+		t.Fatalf("create library: %v", err)
+	}
+	if err := db.Create(&model.Media{
+		Base:      model.Base{ID: "media-1"},
+		LibraryID: lib.ID,
+		Title:     "Lowercase Playback",
+		Path:      filepath.Join(lib.Path, "lowercase-playback.mp4"),
+		Container: "mp4",
+	}).Error; err != nil {
+		t.Fatalf("create media: %v", err)
+	}
+
+	const secret = "test-secret"
+	router := gin.New()
+	registerEmbyRoutes(router, secret, &service.Container{
+		Repo: repos,
+		Emby: service.NewEmbyService(&config.Config{}, zap.NewNop(), repos),
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/users/user-1/items/media-1/playbackinfo", nil)
+	req.Header.Set("X-Emby-Token", signedTestToken(t, secret))
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String())
+	}
+	var body map[string]any
+	if err := json.Unmarshal(w.Body.Bytes(), &body); err != nil {
+		t.Fatalf("decode playback info: %v", err)
+	}
+	if _, ok := body["MediaSources"]; !ok {
+		t.Fatalf("missing MediaSources: %#v", body)
+	}
+	sources, ok := body["MediaSources"].([]any)
+	if !ok || len(sources) == 0 {
+		t.Fatalf("unexpected MediaSources: %#v", body["MediaSources"])
+	}
+	source, ok := sources[0].(map[string]any)
+	if !ok {
+		t.Fatalf("unexpected MediaSource: %#v", sources[0])
+	}
+	directURL, _ := source["DirectStreamUrl"].(string)
+	if !strings.Contains(directURL, "api_key=") {
+		t.Fatalf("DirectStreamUrl should carry api_key for clients that do not repeat auth headers: %#v", source)
+	}
+	transcodeURL, _ := source["TranscodingUrl"].(string)
+	if transcodeURL != "" && !strings.Contains(transcodeURL, "api_key=") {
+		t.Fatalf("TranscodingUrl should carry api_key: %#v", source)
+	}
+}
+
+func TestEmbyPlaybackInfoDoesNotExposeTokenInCloudPath(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	if err := db.AutoMigrate(model.AllModels()...); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	repos := repository.New(db)
+	if err := repos.Setting.Set(t.Context(), service.CloudPlaybackModeSettingKey, service.CloudPlaybackModeSTRM); err != nil {
+		t.Fatalf("set cloud playback mode: %v", err)
+	}
+	if err := repos.User.Create(t.Context(), &model.User{
+		Base:         model.Base{ID: "user-1"},
+		Username:     "tester",
+		PasswordHash: "x",
+		Role:         "admin",
+		Tier:         "plus",
+		IsActive:     true,
+	}); err != nil {
+		t.Fatalf("create user: %v", err)
+	}
+	lib := model.Library{Name: "OpenList", Path: "cloud://openlist/Movies", Type: "movie", Enabled: true}
+	if err := repos.Library.Create(t.Context(), &lib); err != nil {
+		t.Fatalf("create library: %v", err)
+	}
+	if err := db.Create(&model.Media{
+		Base:      model.Base{ID: "cloud-1"},
+		LibraryID: lib.ID,
+		Title:     "Cloud Movie",
+		Path:      "cloud://openlist/Movies/Movie.mkv",
+		STRMURL:   "/api/cloud/play/openlist?ref=%2FMovies%2FMovie.mkv",
+		Container: "mkv",
+	}).Error; err != nil {
+		t.Fatalf("create media: %v", err)
+	}
+
+	const secret = "test-secret"
+	router := gin.New()
+	registerEmbyRoutes(router, secret, &service.Container{
+		Repo: repos,
+		Emby: service.NewEmbyService(&config.Config{}, zap.NewNop(), repos),
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/users/user-1/items/cloud-1/playbackinfo", nil)
+	req.Header.Set("X-Emby-Token", signedTestToken(t, secret))
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String())
+	}
+	var body map[string]any
+	if err := json.Unmarshal(w.Body.Bytes(), &body); err != nil {
+		t.Fatalf("decode playback info: %v", err)
+	}
+	source := body["MediaSources"].([]any)[0].(map[string]any)
+	pathURL, _ := source["Path"].(string)
+	if pathURL != "/api/stream/cloud-1" {
+		t.Fatalf("cloud Path should stay as non-tokenized display stream URL, got %#v", source)
+	}
+	if strings.Contains(pathURL, "api_key=") || strings.Contains(pathURL, "token=") {
+		t.Fatalf("cloud Path must not expose auth key/token: %#v", source)
+	}
+	if strings.Contains(pathURL, "/api/cloud/play/") {
+		t.Fatalf("cloud Path should not expose naked cloud play URL: %#v", source)
+	}
+	directURL, _ := source["DirectStreamUrl"].(string)
+	if !strings.HasPrefix(directURL, "/api/stream/cloud-1") || !strings.Contains(directURL, "api_key=") {
+		t.Fatalf("DirectStreamUrl should stay tokenized: %#v", source)
+	}
+	if source["SupportsDirectPlay"] != true {
+		t.Fatalf("cloud media should advertise DirectPlay when tokenized Path is playable: %#v", source)
+	}
+	if source["SupportsTranscoding"] != false {
+		t.Fatalf("cloud media should not advertise host transcoding: %#v", source)
+	}
+}
+
+func TestEmbyItemsDoNotExposeTokenInEmbeddedCloudPath(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	if err := db.AutoMigrate(model.AllModels()...); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	repos := repository.New(db)
+	if err := repos.Setting.Set(t.Context(), service.CloudPlaybackModeSettingKey, service.CloudPlaybackModeSTRM); err != nil {
+		t.Fatalf("set cloud playback mode: %v", err)
+	}
+	if err := repos.User.Create(t.Context(), &model.User{
+		Base:         model.Base{ID: "user-1"},
+		Username:     "tester",
+		PasswordHash: "x",
+		Role:         "admin",
+		Tier:         "plus",
+		IsActive:     true,
+	}); err != nil {
+		t.Fatalf("create user: %v", err)
+	}
+	lib := model.Library{Name: "OpenList", Path: "cloud://openlist/Movies", Type: "movie", Enabled: true}
+	if err := repos.Library.Create(t.Context(), &lib); err != nil {
+		t.Fatalf("create library: %v", err)
+	}
+	if err := db.Create(&model.Media{
+		Base:      model.Base{ID: "cloud-1"},
+		LibraryID: lib.ID,
+		Title:     "Cloud Movie",
+		Path:      "cloud://openlist/Movies/Movie.mkv",
+		STRMURL:   "/api/cloud/play/openlist?ref=%2FMovies%2FMovie.mkv",
+		Container: "mkv",
+	}).Error; err != nil {
+		t.Fatalf("create media: %v", err)
+	}
+
+	const secret = "test-secret"
+	token := signedTestToken(t, secret)
+	router := gin.New()
+	registerEmbyRoutes(router, secret, &service.Container{
+		Repo: repos,
+		Emby: service.NewEmbyService(&config.Config{}, zap.NewNop(), repos),
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/emby/Users/user-1/Items?IncludeItemTypes=Movie&Recursive=true&Limit=5&X-Emby-Token="+token, nil)
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String())
+	}
+	var body map[string]any
+	if err := json.Unmarshal(w.Body.Bytes(), &body); err != nil {
+		t.Fatalf("decode items: %v", err)
+	}
+	items := body["Items"].([]any)
+	if len(items) != 1 {
+		t.Fatalf("unexpected items: %#v", body["Items"])
+	}
+	source := items[0].(map[string]any)["MediaSources"].([]any)[0].(map[string]any)
+	pathURL, _ := source["Path"].(string)
+	if pathURL != "/api/stream/cloud-1" {
+		t.Fatalf("embedded cloud Path should stay as non-tokenized display stream URL, got %#v", source)
+	}
+	if strings.Contains(pathURL, "api_key=") || strings.Contains(pathURL, "token=") {
+		t.Fatalf("embedded cloud Path must not expose auth key/token: %#v", source)
+	}
+}

internal/handler/emby_playback_routes_test.go

@@ -1,12 +1,10 @@
 package handler
 
 import (
-	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"path/filepath"
-	"strings"
 	"testing"
 
 	"github.com/gin-gonic/gin"
@@ -15,383 +13,11 @@ import (
 	"gorm.io/gorm"
 
 	"github.com/ShukeBta/MediaStationGo/internal/config"
-	"github.com/ShukeBta/MediaStationGo/internal/middleware"
 	"github.com/ShukeBta/MediaStationGo/internal/model"
 	"github.com/ShukeBta/MediaStationGo/internal/repository"
 	"github.com/ShukeBta/MediaStationGo/internal/service"
 )
 
-func TestEmbyLowercasePlaybackInfoRouteReturnsJSON(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	if err := db.AutoMigrate(model.AllModels()...); err != nil {
-		t.Fatalf("migrate: %v", err)
-	}
-	repos := repository.New(db)
-	if err := repos.User.Create(t.Context(), &model.User{
-		Base:         model.Base{ID: "user-1"},
-		Username:     "tester",
-		PasswordHash: "x",
-		Role:         "admin",
-		Tier:         "plus",
-		IsActive:     true,
-	}); err != nil {
-		t.Fatalf("create user: %v", err)
-	}
-	lib := model.Library{Name: "电影", Path: t.TempDir(), Type: "movie", Enabled: true}
-	if err := repos.Library.Create(t.Context(), &lib); err != nil {
-		t.Fatalf("create library: %v", err)
-	}
-	if err := db.Create(&model.Media{
-		Base:      model.Base{ID: "media-1"},
-		LibraryID: lib.ID,
-		Title:     "Lowercase Playback",
-		Path:      filepath.Join(lib.Path, "lowercase-playback.mp4"),
-		Container: "mp4",
-	}).Error; err != nil {
-		t.Fatalf("create media: %v", err)
-	}
-
-	const secret = "test-secret"
-	router := gin.New()
-	registerEmbyRoutes(router, secret, &service.Container{
-		Repo: repos,
-		Emby: service.NewEmbyService(&config.Config{}, zap.NewNop(), repos),
-	})
-
-	req := httptest.NewRequest(http.MethodGet, "/users/user-1/items/media-1/playbackinfo", nil)
-	req.Header.Set("X-Emby-Token", signedTestToken(t, secret))
-	w := httptest.NewRecorder()
-	router.ServeHTTP(w, req)
-
-	if w.Code != http.StatusOK {
-		t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String())
-	}
-	var body map[string]any
-	if err := json.Unmarshal(w.Body.Bytes(), &body); err != nil {
-		t.Fatalf("decode playback info: %v", err)
-	}
-	if _, ok := body["MediaSources"]; !ok {
-		t.Fatalf("missing MediaSources: %#v", body)
-	}
-	sources, ok := body["MediaSources"].([]any)
-	if !ok || len(sources) == 0 {
-		t.Fatalf("unexpected MediaSources: %#v", body["MediaSources"])
-	}
-	source, ok := sources[0].(map[string]any)
-	if !ok {
-		t.Fatalf("unexpected MediaSource: %#v", sources[0])
-	}
-	directURL, _ := source["DirectStreamUrl"].(string)
-	if !strings.Contains(directURL, "api_key=") {
-		t.Fatalf("DirectStreamUrl should carry api_key for clients that do not repeat auth headers: %#v", source)
-	}
-	transcodeURL, _ := source["TranscodingUrl"].(string)
-	if transcodeURL != "" && !strings.Contains(transcodeURL, "api_key=") {
-		t.Fatalf("TranscodingUrl should carry api_key: %#v", source)
-	}
-}
-
-func TestEmbyPlaybackInfoDoesNotExposeTokenInCloudPath(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	if err := db.AutoMigrate(model.AllModels()...); err != nil {
-		t.Fatalf("migrate: %v", err)
-	}
-	repos := repository.New(db)
-	if err := repos.Setting.Set(t.Context(), service.CloudPlaybackModeSettingKey, service.CloudPlaybackModeSTRM); err != nil {
-		t.Fatalf("set cloud playback mode: %v", err)
-	}
-	if err := repos.User.Create(t.Context(), &model.User{
-		Base:         model.Base{ID: "user-1"},
-		Username:     "tester",
-		PasswordHash: "x",
-		Role:         "admin",
-		Tier:         "plus",
-		IsActive:     true,
-	}); err != nil {
-		t.Fatalf("create user: %v", err)
-	}
-	lib := model.Library{Name: "OpenList", Path: "cloud://openlist/Movies", Type: "movie", Enabled: true}
-	if err := repos.Library.Create(t.Context(), &lib); err != nil {
-		t.Fatalf("create library: %v", err)
-	}
-	if err := db.Create(&model.Media{
-		Base:      model.Base{ID: "cloud-1"},
-		LibraryID: lib.ID,
-		Title:     "Cloud Movie",
-		Path:      "cloud://openlist/Movies/Movie.mkv",
-		STRMURL:   "/api/cloud/play/openlist?ref=%2FMovies%2FMovie.mkv",
-		Container: "mkv",
-	}).Error; err != nil {
-		t.Fatalf("create media: %v", err)
-	}
-
-	const secret = "test-secret"
-	router := gin.New()
-	registerEmbyRoutes(router, secret, &service.Container{
-		Repo: repos,
-		Emby: service.NewEmbyService(&config.Config{}, zap.NewNop(), repos),
-	})
-
-	req := httptest.NewRequest(http.MethodGet, "/users/user-1/items/cloud-1/playbackinfo", nil)
-	req.Header.Set("X-Emby-Token", signedTestToken(t, secret))
-	w := httptest.NewRecorder()
-	router.ServeHTTP(w, req)
-
-	if w.Code != http.StatusOK {
-		t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String())
-	}
-	var body map[string]any
-	if err := json.Unmarshal(w.Body.Bytes(), &body); err != nil {
-		t.Fatalf("decode playback info: %v", err)
-	}
-	source := body["MediaSources"].([]any)[0].(map[string]any)
-	pathURL, _ := source["Path"].(string)
-	if pathURL != "/api/stream/cloud-1" {
-		t.Fatalf("cloud Path should stay as non-tokenized display stream URL, got %#v", source)
-	}
-	if strings.Contains(pathURL, "api_key=") || strings.Contains(pathURL, "token=") {
-		t.Fatalf("cloud Path must not expose auth key/token: %#v", source)
-	}
-	if strings.Contains(pathURL, "/api/cloud/play/") {
-		t.Fatalf("cloud Path should not expose naked cloud play URL: %#v", source)
-	}
-	directURL, _ := source["DirectStreamUrl"].(string)
-	if !strings.HasPrefix(directURL, "/api/stream/cloud-1") || !strings.Contains(directURL, "api_key=") {
-		t.Fatalf("DirectStreamUrl should stay tokenized: %#v", source)
-	}
-	if source["SupportsDirectPlay"] != true {
-		t.Fatalf("cloud media should advertise DirectPlay when tokenized Path is playable: %#v", source)
-	}
-	if source["SupportsTranscoding"] != false {
-		t.Fatalf("cloud media should not advertise host transcoding: %#v", source)
-	}
-}
-
-func TestEmbyItemsDoNotExposeTokenInEmbeddedCloudPath(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	if err := db.AutoMigrate(model.AllModels()...); err != nil {
-		t.Fatalf("migrate: %v", err)
-	}
-	repos := repository.New(db)
-	if err := repos.Setting.Set(t.Context(), service.CloudPlaybackModeSettingKey, service.CloudPlaybackModeSTRM); err != nil {
-		t.Fatalf("set cloud playback mode: %v", err)
-	}
-	if err := repos.User.Create(t.Context(), &model.User{
-		Base:         model.Base{ID: "user-1"},
-		Username:     "tester",
-		PasswordHash: "x",
-		Role:         "admin",
-		Tier:         "plus",
-		IsActive:     true,
-	}); err != nil {
-		t.Fatalf("create user: %v", err)
-	}
-	lib := model.Library{Name: "OpenList", Path: "cloud://openlist/Movies", Type: "movie", Enabled: true}
-	if err := repos.Library.Create(t.Context(), &lib); err != nil {
-		t.Fatalf("create library: %v", err)
-	}
-	if err := db.Create(&model.Media{
-		Base:      model.Base{ID: "cloud-1"},
-		LibraryID: lib.ID,
-		Title:     "Cloud Movie",
-		Path:      "cloud://openlist/Movies/Movie.mkv",
-		STRMURL:   "/api/cloud/play/openlist?ref=%2FMovies%2FMovie.mkv",
-		Container: "mkv",
-	}).Error; err != nil {
-		t.Fatalf("create media: %v", err)
-	}
-
-	const secret = "test-secret"
-	token := signedTestToken(t, secret)
-	router := gin.New()
-	registerEmbyRoutes(router, secret, &service.Container{
-		Repo: repos,
-		Emby: service.NewEmbyService(&config.Config{}, zap.NewNop(), repos),
-	})
-
-	req := httptest.NewRequest(http.MethodGet, "/emby/Users/user-1/Items?IncludeItemTypes=Movie&Recursive=true&Limit=5&X-Emby-Token="+token, nil)
-	w := httptest.NewRecorder()
-	router.ServeHTTP(w, req)
-
-	if w.Code != http.StatusOK {
-		t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String())
-	}
-	var body map[string]any
-	if err := json.Unmarshal(w.Body.Bytes(), &body); err != nil {
-		t.Fatalf("decode items: %v", err)
-	}
-	items := body["Items"].([]any)
-	if len(items) != 1 {
-		t.Fatalf("unexpected items: %#v", body["Items"])
-	}
-	source := items[0].(map[string]any)["MediaSources"].([]any)[0].(map[string]any)
-	pathURL, _ := source["Path"].(string)
-	if pathURL != "/api/stream/cloud-1" {
-		t.Fatalf("embedded cloud Path should stay as non-tokenized display stream URL, got %#v", source)
-	}
-	if strings.Contains(pathURL, "api_key=") || strings.Contains(pathURL, "token=") {
-		t.Fatalf("embedded cloud Path must not expose auth key/token: %#v", source)
-	}
-}
-
-func TestEmbyVideoStreamUsesSTRMWhenRedirectProxyDisabled(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	if err := db.AutoMigrate(model.AllModels()...); err != nil {
-		t.Fatalf("migrate: %v", err)
-	}
-	repos := repository.New(db)
-	if err := repos.Setting.Set(t.Context(), service.CloudPlaybackModeSettingKey, service.CloudPlaybackModeSTRM); err != nil {
-		t.Fatalf("set cloud playback mode: %v", err)
-	}
-	if err := repos.Setting.Set(t.Context(), service.CloudPlaybackSTRMEnabledSettingKey, "true"); err != nil {
-		t.Fatalf("enable strm playback: %v", err)
-	}
-	if err := repos.Setting.Set(t.Context(), service.CloudPlaybackRedirectEnabledSettingKey, "false"); err != nil {
-		t.Fatalf("disable redirect playback: %v", err)
-	}
-	if err := repos.User.Create(t.Context(), &model.User{
-		Base:         model.Base{ID: "user-1"},
-		Username:     "tester",
-		PasswordHash: "x",
-		Role:         "admin",
-		Tier:         "plus",
-		IsActive:     true,
-	}); err != nil {
-		t.Fatalf("create user: %v", err)
-	}
-	lib := model.Library{Name: "OpenList", Path: "cloud://openlist/Movies", Type: "movie", Enabled: true}
-	if err := repos.Library.Create(t.Context(), &lib); err != nil {
-		t.Fatalf("create library: %v", err)
-	}
-	if err := db.Create(&model.Media{
-		Base:      model.Base{ID: "cloud-1"},
-		LibraryID: lib.ID,
-		Title:     "Cloud Movie",
-		Path:      "cloud://openlist/Movies/Movie.mkv",
-		STRMURL:   "/api/cloud/play/openlist?ref=%2FMovies%2FMovie.mkv",
-		Container: "mkv",
-	}).Error; err != nil {
-		t.Fatalf("create media: %v", err)
-	}
-
-	const secret = "test-secret"
-	router := gin.New()
-	cfg := &config.Config{Secrets: config.SecretsConfig{JWTSecret: secret}}
-	registerEmbyRoutes(router, secret, &service.Container{
-		Repo:   repos,
-		Emby:   service.NewEmbyService(cfg, zap.NewNop(), repos),
-		Stream: service.NewStreamService(cfg, zap.NewNop(), repos, nil),
-	})
-
-	token := signedTestToken(t, secret)
-	req := httptest.NewRequest(http.MethodGet, "/videos/cloud-1/stream?api_key="+token, nil)
-	w := httptest.NewRecorder()
-	router.ServeHTTP(w, req)
-
-	if w.Code != http.StatusFound {
-		t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String())
-	}
-	loc := w.Header().Get("Location")
-	if !strings.Contains(loc, "/api/stream/cloud-1") || !strings.Contains(loc, "api_key=") {
-		t.Fatalf("STRM mode should redirect /Videos fallback to tokenized /api/stream, got %q", loc)
-	}
-	if got := w.Header().Get("Cache-Control"); !strings.Contains(got, "no-store") {
-		t.Fatalf("STRM fallback redirect Cache-Control = %q, want no-store", got)
-	}
-	if strings.Contains(loc, "/api/cloud/play/") {
-		t.Fatalf("STRM mode should not expose cloud play directly from /Videos fallback: %q", loc)
-	}
-}
-
-func TestEmbyVideoStreamIssuesTokenForSessionFallbackSTRMRedirect(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	if err := db.AutoMigrate(model.AllModels()...); err != nil {
-		t.Fatalf("migrate: %v", err)
-	}
-	repos := repository.New(db)
-	if err := repos.Setting.Set(t.Context(), service.CloudPlaybackModeSettingKey, service.CloudPlaybackModeSTRM); err != nil {
-		t.Fatalf("set cloud playback mode: %v", err)
-	}
-	if err := repos.Setting.Set(t.Context(), service.CloudPlaybackSTRMEnabledSettingKey, "true"); err != nil {
-		t.Fatalf("enable strm playback: %v", err)
-	}
-	if err := repos.Setting.Set(t.Context(), service.CloudPlaybackRedirectEnabledSettingKey, "false"); err != nil {
-		t.Fatalf("disable redirect playback: %v", err)
-	}
-	user := model.User{
-		Base:         model.Base{ID: "user-1"},
-		Username:     "tester",
-		PasswordHash: "x",
-		Role:         "admin",
-		Tier:         "plus",
-		IsActive:     true,
-	}
-	if err := repos.User.Create(t.Context(), &user); err != nil {
-		t.Fatalf("create user: %v", err)
-	}
-	lib := model.Library{Name: "OpenList", Path: "cloud://openlist/Movies", Type: "movie", Enabled: true}
-	if err := repos.Library.Create(t.Context(), &lib); err != nil {
-		t.Fatalf("create library: %v", err)
-	}
-	if err := db.Create(&model.Media{
-		Base:      model.Base{ID: "cloud-1"},
-		LibraryID: lib.ID,
-		Title:     "Cloud Movie",
-		Path:      "cloud://openlist/Movies/Movie.mkv",
-		STRMURL:   "/api/cloud/play/openlist?ref=%2FMovies%2FMovie.mkv",
-		Container: "mkv",
-	}).Error; err != nil {
-		t.Fatalf("create media: %v", err)
-	}
-
-	const secret = "test-secret"
-	cfg := &config.Config{Secrets: config.SecretsConfig{JWTSecret: secret}}
-	svc := &service.Container{
-		Repo:   repos,
-		Auth:   service.NewAuthService(cfg, zap.NewNop(), repos, nil, nil),
-		Emby:   service.NewEmbyService(cfg, zap.NewNop(), repos),
-		Stream: service.NewStreamService(cfg, zap.NewNop(), repos, nil),
-	}
-	router := gin.New()
-	router.GET("/videos/:id/stream", func(c *gin.Context) {
-		c.Set(middleware.CtxUserID, user.ID)
-		c.Set(middleware.CtxUserRole, user.Role)
-		embyVideoStreamHandler(svc, service.CloudPlaybackModeRedirectProxy)(c)
-	})
-
-	req := httptest.NewRequest(http.MethodGet, "/videos/cloud-1/stream", nil)
-	w := httptest.NewRecorder()
-	router.ServeHTTP(w, req)
-
-	if w.Code != http.StatusFound {
-		t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String())
-	}
-	loc := w.Header().Get("Location")
-	if !strings.Contains(loc, "/api/stream/cloud-1") || !strings.Contains(loc, "api_key=") {
-		t.Fatalf("session fallback redirect should include api_key for /api/stream, got %q", loc)
-	}
-}
-
 func TestEmbyLowercaseVideoStreamRouteServesMedia(t *testing.T) {
 	gin.SetMode(gin.TestMode)
 	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
@@ -510,64 +136,6 @@ func TestEmbyPrefixedAPIStreamRouteServesMedia(t *testing.T) {
 	}
 }
 
-func TestEmbyVideoStreamRedirectKeepsMediaBrowserAuthorizationToken(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
-	if err != nil {
-		t.Fatalf("open db: %v", err)
-	}
-	if err := db.AutoMigrate(model.AllModels()...); err != nil {
-		t.Fatalf("migrate: %v", err)
-	}
-	repos := repository.New(db)
-	if err := repos.User.Create(t.Context(), &model.User{
-		Base:         model.Base{ID: "user-1"},
-		Username:     "tester",
-		PasswordHash: "x",
-		Role:         "admin",
-		Tier:         "plus",
-		IsActive:     true,
-	}); err != nil {
-		t.Fatalf("create user: %v", err)
-	}
-	lib := model.Library{Name: "OpenList", Path: "cloud://openlist/Movies", Type: "movie", Enabled: true}
-	if err := repos.Library.Create(t.Context(), &lib); err != nil {
-		t.Fatalf("create library: %v", err)
-	}
-	if err := db.Create(&model.Media{
-		Base:      model.Base{ID: "cloud-1"},
-		LibraryID: lib.ID,
-		Title:     "Cloud Movie",
-		Path:      "cloud://openlist/Movies/Movie.mkv",
-		STRMURL:   "/api/cloud/play/openlist?ref=%2FMovies%2FMovie.mkv",
-		Container: "mkv",
-	}).Error; err != nil {
-		t.Fatalf("create media: %v", err)
-	}
-
-	const secret = "test-secret"
-	router := gin.New()
-	registerEmbyRoutes(router, secret, &service.Container{
-		Repo:   repos,
-		Emby:   service.NewEmbyService(&config.Config{}, zap.NewNop(), repos),
-		Stream: service.NewStreamService(&config.Config{}, zap.NewNop(), repos, nil),
-	})
-
-	token := signedTestToken(t, secret)
-	req := httptest.NewRequest(http.MethodGet, "/videos/cloud-1/stream", nil)
-	req.Header.Set("X-MediaBrowser-Authorization", `MediaBrowser Client="Infuse", Device="PC", Token="`+token+`"`)
-	w := httptest.NewRecorder()
-	router.ServeHTTP(w, req)
-
-	if w.Code != http.StatusFound {
-		t.Fatalf("unexpected status: %d body=%s", w.Code, w.Body.String())
-	}
-	loc := w.Header().Get("Location")
-	if !strings.Contains(loc, "/api/cloud/play/openlist?") || !strings.Contains(loc, "token=") {
-		t.Fatalf("redirect Location should target tokenized cloud play endpoint, got %q", loc)
-	}
-}
-
 func TestEmbyLowercaseOriginalHeadRouteServesHeaders(t *testing.T) {
 	gin.SetMode(gin.TestMode)
 	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})