OrbitTv/docs/emby-playback-test.md

Emby playback test — 0.4.0

Approved scope and prior evidence

Paul confirmed 0.3.0 returned 20 records on his Xiaomi box, then approved a small-sample playback check. This revision keeps one 20-record page and makes those items selectable. No full scan, scheduled real channel, stored credentials, profiles or automatic first-launch setup is included.

Session ownership

The sample screen holds its token only in memory until the user leaves or backgrounds the app. A sign-in that completes after the screen exits is rejected by a generation ticket and closed. Leaving attempts temporary-session logout on a cleanup executor. Android process termination can prevent cleanup, so immediate server-side revocation cannot be guaranteed after a process kill. Neither token nor password is written to files, saved state or logs. The connection screen and fullscreen playback dialog are protected with FLAG_SECURE. The password field is cleared on submit.

Playback

• Only IDs from the current sample can be selected.
• POST /Items/{Id}/PlaybackInfo negotiates a direct source with EnableTranscoding=false and AutoOpenLiveStream=false. The first eligible source must not require opening/closing live resources.
• Test containers: mp4, mkv, mov, m4v, webm, ts/mpegts. Actual video/audio decoder support is determined on hardware; this test does not promise every codec/profile in these containers works.
• Static /Videos/{Id}/stream.{container} uses source and playback session IDs. The Emby token is an origin-scoped HTTP header rather than a URL query parameter.
• A custom Media3 data source follows at most five HTTPS redirects. It re-evaluates credentials at every hop, dropping provider credentials for another host or port. Default certificate checks remain enabled; cleartext delivery, URL user-info and token-bearing external URLs are rejected.
• DNS results are checked for local/private/shared address ranges before each request. This is not a guarantee against DNS rebinding: HttpsURLConnection resolves the hostname again internally.
• Range requests support seeking. A server that ignores a non-zero byte range is rejected rather than downloading the skipped portion. A partial response must begin at the requested offset.
• Embedded subtitles and provider-delivered external SRT/WebVTT tracks are exposed to Media3. Other external subtitle formats, burn-in, HLS/transcoding and live-source opening are not added.
• One selected title plays at a time. The PlayerView exposes pause/resume, ten-second seeks, audio settings and subtitles where available. Back closes fullscreen and returns to the same sample list. Backgrounding stops the player directly, before relying on Compose disposal, and ends the temporary session.
• Normal Emby playback start/progress/stop reports are sent. They can update the provider's playback history, as normal viewing does. Reports are best effort; no raw responses are logged.
• No playback-progress/session report is sent by development tests to the real provider.
• The previous demo guide/player bar is preserved independently of this on-demand test player.

On-TV acceptance check

After approval to install: open Menu → Connect Emby, enter credentials on the TV, Check 20 items. Select a title with OK. Confirm picture and sound; pause/resume; seek forward and backward; select subtitles/audio if tracks exist. Back should return to the same sample without signing in. Try a second title. Leaving the connection screen ends the temporary login. Report only whether these checks worked and any fixed error code; do not share credentials, media URLs or screenshots.

Primary references

https://dev.emby.media/doc/restapi/Playback-Guidelines.html https://dev.emby.media/doc/restapi/Video-Streaming.html https://dev.emby.media/reference/RestAPI/MediaInfoService/postItemsByIdPlaybackinfo.html https://developer.android.com/media/media3/ui/playerview