pauljdandClaude Opus 5.5
934f82d805
First commit, imported from the working folder: Android TV app, loopback guide server, design sources and per-release verification notes. Includes the 0.16 tuning screen, built and tested but not yet confirmed on the box. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
3.3 KiB
Emby connection check — 0.3.0
Approved scope
Paul approved a Connect Emby entry in the main menu for now. A designed first-launch connection flow can follow later. Authenticate to his selected provider and read one small metadata page, with no full scan or media playback in this increment.
Request contract
Fixed HTTPS origin: https://bk2.appboxmanager.xyz, API prefix /emby.
- POST /Users/AuthenticateByName with Username and Pw in JSON and the Emby client header.
- GET /Users/{authenticated-user-id}/Items with Recursive=true, IncludeItemTypes=Movie,Episode, StartIndex=0, Limit=20, SortBy=SortName, Fields=MediaStreams, images and user-data disabled.
- POST /Sessions/Logout with the temporary token, including when the metadata request fails.
The HTTP transport follows no redirects and uses standard TLS certificate verification. The token is sent in X-Emby-Token, not a URL. Each response is capped at 2 MiB; connection timeout is 10 seconds, read timeout 15 seconds (5 seconds for logout). These are I/O timeouts, not an overall operation deadline. No automatic retries. A per-screen 15-second cooldown prevents rapid repeat submissions; provider rate limits still apply.
Trust boundaries and retention
- Username/password are entered directly in the TV app. No tool or assistant receives them.
- The provider supplies tokens, user IDs and metadata. Check token type/header characters, validate IDs before building paths, bound fields and sample count, render metadata as plain text.
- The password uses BasicSecureTextField with always-hidden text and no saveable state.
- The connection screen sets FLAG_SECURE and uses LocalActivity. Sample metadata is private too.
- On submit, remove the password from the field. On background or exit, clear password/sample state and cancel the UI operation. Blocking HTTP can finish within its I/O timeouts and still attempts logout; cancellation does not guarantee instantaneous socket shutdown.
- Password and token are not written to preferences, files, logs, URLs, saved state or the APK. JVM strings are garbage-collected; no claim of guaranteed memory zeroisation is made.
- The temporary token never appears in the returned sample DTO. Explicit sign-out revokes it when the provider accepts logout; otherwise the UI reports that sign-out was not confirmed.
- No artwork, media, credentials or real provider response bodies are collected by development tests.
Evidence and limits
Only public server identification was checked without authentication. The endpoint reported version 4.9.1.23. Live account authentication and sample access remain for Paul's TV test. Tests use fake credentials and an injected scripted transport; they make no network requests. The connection check does not connect the guide to Emby or persist an imported library.
Primary references
- https://dev.emby.media/doc/restapi/User-Authentication.html
- https://dev.emby.media/reference/RestAPI/UserService/postUsersAuthenticatebyname.html
- https://dev.emby.media/reference/RestAPI/ItemsService/getItems.html
- https://developer.android.com/develop/ui/compose/text/user-input
Later
Encrypted persistent sessions, an initial setup flow, scalable indexing and real playback need their own reviewed increment after this check succeeds. Profile icons, names, Kids restrictions and a four-digit adult PIN are recorded in profiles-roadmap.md.