From b749960d2614c7b32f3a73ab87935300f723ff10 Mon Sep 17 00:00:00 2001 From: Michael SCHAL Date: Wed, 10 Jun 2026 10:58:11 +0200 Subject: [PATCH] fix: stream auth middleware blocked non-streaming requests streamAuthMiddleware wrapped the whole streaming router inside the Cascade, so any unmatched path without a session (e.g. GET / through the reverse proxy) returned 401 before reaching the static file handler. Now only /api/live, /api/vod and /api/recordings/stream are guarded; other paths fall through to the router's 404 and the Cascade continues. Co-Authored-By: Claude Fable 5 --- bin/middleware/auth_middleware.dart | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/bin/middleware/auth_middleware.dart b/bin/middleware/auth_middleware.dart index 6283f35..08b9be6 100644 --- a/bin/middleware/auth_middleware.dart +++ b/bin/middleware/auth_middleware.dart @@ -48,6 +48,18 @@ Middleware authMiddleware(AppDatabase db) { Middleware streamAuthMiddleware(AppDatabase db) { return (Handler handler) { return (Request request) async { + // Only guard actual streaming routes. Anything else must fall through + // untouched: the wrapped router returns 404 for unmatched paths and the + // Cascade then reaches the static file handler (a 401 here would block + // the whole app, e.g. GET / through the reverse proxy). + final path = request.url.path; + final isStreamingPath = path.startsWith('api/live') || + path.startsWith('api/vod') || + path.startsWith('api/recordings/stream'); + if (!isStreamingPath) { + return handler(request); + } + final connectionInfo = request.context['shelf.io.connection_info'] as HttpConnectionInfo?; final isLoopback = connectionInfo?.remoteAddress.isLoopback ?? false;