Apply provided patch to apps/nextjs-app/lib/api-auth.ts#515
Merged
Conversation
Contributor
Reviewer's GuideAdds support in Jellyfin token validation for authenticating server API keys by falling back from /Users/Me to /System/Info and surfacing them as a system pseudo-user, while preserving existing behavior for user access tokens. Sequence diagram for updated Jellyfin token validation fallbacksequenceDiagram
participant Caller
participant validateJellyfinToken
participant JellyfinUsersMe
participant validateAsApiKey
participant JellyfinSystemInfo
Caller->>validateJellyfinToken: validateJellyfinToken(serverUrl, token)
validateJellyfinToken->>JellyfinUsersMe: fetch(serverUrl + /Users/Me)
alt [response.ok]
JellyfinUsersMe-->>validateJellyfinToken: user JSON
validateJellyfinToken-->>Caller: { userId, userName, isAdmin }
else [response.status === 401]
validateJellyfinToken->>validateAsApiKey: validateAsApiKey(serverUrl, token)
validateAsApiKey->>JellyfinSystemInfo: fetch(serverUrl + /System/Info)
alt [sysRes.ok]
JellyfinSystemInfo-->>validateAsApiKey: system info
validateAsApiKey-->>validateJellyfinToken: { userId: system-api-key, userName: System API Key, isAdmin: true }
validateJellyfinToken-->>Caller: pseudo-user
else [!sysRes.ok]
validateAsApiKey-->>validateJellyfinToken: null
validateJellyfinToken-->>Caller: null
end
else [other non-2xx]
validateJellyfinToken-->>Caller: null
end
opt [network error or AbortError on /Users/Me]
validateJellyfinToken->>validateAsApiKey: validateAsApiKey(serverUrl, token)
validateAsApiKey->>JellyfinSystemInfo: fetch(serverUrl + /System/Info)
alt [sysRes.ok]
JellyfinSystemInfo-->>validateAsApiKey: system info
validateAsApiKey-->>validateJellyfinToken: pseudo-user
validateJellyfinToken-->>Caller: pseudo-user
else [!sysRes.ok]
validateAsApiKey-->>validateJellyfinToken: null
validateJellyfinToken-->>Caller: null
end
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Contributor
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- For non-401 non-OK responses from
/Users/Me(e.g. 403, 500),validateJellyfinTokennow returnsnullwithout attempting the/System/Infofallback; consider whether those status codes should also triggervalidateAsApiKeyfor consistency with the intended API key support. - The
"system-api-key"pseudo-user ID and name are now defined here as literals; if the same convention is used ingetUserFromEmbyTokenit may be worth centralizing these constants to avoid divergence between implementations.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- For non-401 non-OK responses from `/Users/Me` (e.g. 403, 500), `validateJellyfinToken` now returns `null` without attempting the `/System/Info` fallback; consider whether those status codes should also trigger `validateAsApiKey` for consistency with the intended API key support.
- The `"system-api-key"` pseudo-user ID and name are now defined here as literals; if the same convention is used in `getUserFromEmbyToken` it may be worth centralizing these constants to avoid divergence between implementations.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Refactor token validation logic to streamline API key handling and improve error handling. Use constants for system API key user ID and name.
Owner
|
Reviewed locally — this is sound and does what it describes. Merging it now to unblock the Maintainerr integration. 🙏 Two small things I'd love a follow-up PR for (neither blocks this one):
Any chance you'd be up for a quick follow-up PR with those? No pressure if not — happy to pick it up otherwise. |
This was referenced May 25, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
authenticateMediaBrowser(lib/api-auth.ts) is the auth path for/api/recommendations,/api/watchlists,/api/watchlists/promotedand/api/search. It validates the supplied MediaBrowser token by calling/Users/Me, which requires a user access token. A Jellyfin server API key has no user context, so/Users/Mereturns 401 even when the key is valid — locking out server-to-server callers that only hold an API key.What
When
/Users/Mereturns 401, fall back to/System/Info(which API keys can hit) and surface the caller as the admin pseudo-user{ id: "system-api-key", name: "System API Key", isAdmin: true }— the same shape and conventiongetUserFromEmbyToken(lib/jellyfin-auth.ts) already uses for this case. User access tokens keep their existing behaviour; only the 401-from-/Users/Mepath changes.Motivation
Unblocks server-to-server clients. Maintainerr has added a Streamystats integration but can only authenticate with a Jellyfin API key, so it currently can't reach these endpoints.
Summary by Sourcery
Allow Jellyfin API key authentication for media browser endpoints by falling back to /System/Info when /Users/Me cannot validate a token.
New Features:
Enhancements: