MichaelandClaude Fable 5 b749960d26 fix: stream auth middleware blocked non-streaming requests ...

streamAuthMiddleware wrapped the whole streaming router inside the
Cascade, so any unmatched path without a session (e.g. GET / through the
reverse proxy) returned 401 before reaching the static file handler.
Now only /api/live, /api/vod and /api/recordings/stream are guarded;
other paths fall through to the router's 404 and the Cascade continues.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-06-10 10:58:11 +02:00

..

auth_middleware.dart

fix: stream auth middleware blocked non-streaming requests

2026-06-10 10:58:11 +02:00

security_middleware.dart

feat: security hardening, streaming overhaul, design polish, tests

2026-06-10 10:07:18 +02:00