MichaelandClaude Opus 5 ad3e970c8d fix(api): send session token on EPG, recordings and season-pass calls ...

The security hardening in 60d3f42 moved /api/epg, /api/recordings and
/api/season-passes behind authMiddleware, but the Flutter client still
called them through bare package:http. Those requests carry no
Authorization header, and on web BrowserClient sets withCredentials to
false so the session cookie is not sent either — every call came back
401. Symptoms: empty TV guide, empty recordings list, empty season
passes.

Adds AuthedHttp, a thin wrapper that injects the same token ApiClient
and XtreamService already use (localStorage['auth_token']), and routes
the 13 affected calls through it.

subtitle_service is left on plain http: it fetches third-party subtitle
URLs, not our API, and must not leak the session token.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-10 21:54:01 +02:00

..

admin/screens

feat(design): Warm Cinema theme + event-driven adaptive players

2026-08-10 21:42:56 +02:00

auth

feat(design): Warm Cinema theme + event-driven adaptive players

2026-08-10 21:42:56 +02:00

iptv

fix(api): send session token on EPG, recordings and season-pass calls

2026-08-10 21:54:01 +02:00