c0adce2b09
Some checks failed
Build TV app / build (push) Failing after 2s
Control server security and robustness: - Socket read timeout, handshake deadline and a client cap so an idle or hostile connection can no longer pin threads forever (#1) - Per-address rate limiting that counts every failed hello, Origin checking on the upgrade, and a separate revocable session token for code-authenticated clients so the guessable path no longer yields the QR credential (#2) - Credentials excluded from cloud backup and device transfer, constant time comparisons, and a pairing reset in the settings (#3) - Playlist fetches restricted to http(s), capped at 24 MB and bounded by an overall transfer deadline (#4) - Port conflicts and MediaSession id collisions no longer crash the app; the remote degrades to unavailable with a plain-language note (#11) Player: - Seeking no longer collapses to position 0 when the duration is unknown (#5) - Pause acts on playWhenReady, so pausing during a stall works and playback cannot resume in the background after leaving the app (#6) - Playback failures stay on screen with a retry action instead of silently dropping back to the list (#7) - Reconnects are spaced 1s/3s/8s and re-entering the channel just closed waits out a short grace period, which is what the provider needs to release the previous session (#12) Channel list and remote: - Leaving playback returns to the channel the viewer came from (#13) - The remote only rebuilds its list when the data changed, never overwrites a focused input and carries indices instead of scanning (#8) - Pairing retry reconnects properly, resets its backoff and validates the code before spending an attempt (#9) - M3U parsing keeps commas in names, strips a BOM and rejects payloads that are not playlists, covered by unit tests under tests/ (#10) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
8 lines
343 B
XML
8 lines
343 B
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<!-- Credentials must not travel to Google Drive: the pairing token grants
|
|
full control of the TV and the OIDC tokens are account credentials. -->
|
|
<full-backup-content>
|
|
<exclude domain="sharedpref" path="pairing.xml" />
|
|
<exclude domain="sharedpref" path="auth.xml" />
|
|
</full-backup-content>
|