pauljdandClaude Opus 5.5
934f82d805
First commit, imported from the working folder: Android TV app, loopback guide server, design sources and per-release verification notes. Includes the 0.16 tuning screen, built and tested but not yet confirmed on the box. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2.8 KiB
Orbit TV 0.3.0 — Connect Emby
Reviewable result
Menu → Connect Emby. On-TV username and always-hidden password fields, explicit provider address, and Check 20 items. One sign-in, one metadata page, then temporary-session logout. Sample contains titles, types, runtimes and any returned container/codec details. No full import or Emby video playback. The existing demo guide and fullscreen bar remain.
Validation
- Debug APK build, all 19 Android unit tests and Android lint passed.
- 15 Emby protocol/boundary tests and four scheduler tests; no failures or skipped tests.
- Tests use scripted fake replies and fake credentials. No live provider login was attempted.
- Intentional removal of the 20-item cap failed its regression test; source was restored, then the complete build/tests/lint passed again.
- Tested: one-page limit even if ignored by server; password preservation; scoped token/header use; incorrect credentials; denial of library access; malformed JSON/identity/token; rate limit and redirect responses; logout after errors; failed logout; response-size bound; UTF-8; bounded provider text.
- APK signature verified; certificate matches the installed 0.2.0 build.
- Fullscreen playback/programme-bar source matches the TV-tested previous revision.
- Security review: fixed HTTPS origin, default certificate checks, no redirects, bounded reads and I/O timeouts, no retries, no persistent credentials/tokens/sample, no request/response logging, secure password field, FLAG_SECURE while connection screen is displayed, lifecycle clearing.
- Lint: zero errors; ten warnings (eight version-update notices and two existing platform advisories).
- The org.json dependency is test-only; the app uses Android's JSONObject implementation.
Limits and next check
The new APK has not been installed on the box. Remote keyboard entry and real account permissions must be tested by Paul on the Xiaomi. No password, token or authenticated library data was received by development tools. Do not send credentials or screenshots of library results back into chat. Only the provider's public identification endpoint was previously checked, returning version 4.9.1.23.
After approval to install: Menu → Connect Emby → enter credentials on TV → Check 20 items. Report only success/count, or the fixed error message. Demo channels do not change. This version intentionally requires signing in again for another check; persistent connection and large-library indexing are separate increments. A later initial-setup flow and named/icon profiles, Kids restrictions and a four-digit adult PIN are recorded in the roadmap, not implemented here.
No device update, VPS, service or firewall changes were made during this build increment. See docs/emby-connection-check.md for the request contract and retention details.