Memby v0.1.53: Android TV client plus gateway

Android TV client for Emby (Kotlin, Compose for TV) and the Memby gateway
(Go, Postgres, Redis) that fronts it.

Client:
- Setup, profiles, home rows, Media3 playback, system screensaver (Dream)
- Backend chosen at build time: gateway when memby.gatewayUrl is set,
  otherwise direct to Emby. Both paths stay working.
- Server-composed home rows, rendered verbatim so new row types ship
  without an app release
- Full-screen animated maintenance state, row engagement telemetry

Gateway:
- One request per TV screen; auth, caching, search and row shaping
- Library import from Emby into Postgres (manual, then hourly incremental)
- Recommendations from viewing history (recency-weighted genre affinity)
- Admin page for imports, an offline switch, and per-row analytics
- Video always direct-plays from Emby; only metadata passes through

Identity is com.ponzischeme89.memby throughout, replacing
com.mattcohen.embyclientsname. A changed applicationId installs as a new
app: TVs need a fresh sign-in and the old package uninstalled.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/internal/api/api_test.go

@@ -0,0 +1,143 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/ponzischeme89/memby/server/internal/emby"
+)
+
+func TestBearerTokenSources(t *testing.T) {
+	t.Run("authorization header", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodGet, "/v1/home", nil)
+		r.Header.Set("Authorization", "Bearer abc123")
+		if got := bearerToken(r); got != "abc123" {
+			t.Fatalf("got %q, want abc123", got)
+		}
+	})
+
+	t.Run("query parameter for image urls", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodGet, "/v1/images/1/backdrop?t=abc123", nil)
+		if got := bearerToken(r); got != "abc123" {
+			t.Fatalf("got %q, want abc123", got)
+		}
+	})
+
+	t.Run("absent", func(t *testing.T) {
+		r := httptest.NewRequest(http.MethodGet, "/v1/home", nil)
+		if got := bearerToken(r); got != "" {
+			t.Fatalf("got %q, want empty", got)
+		}
+	})
+}
+
+func TestHashTokenIsStable(t *testing.T) {
+	a, b := hashToken("token"), hashToken("token")
+	if string(a) != string(b) {
+		t.Fatal("hashing the same token produced different digests")
+	}
+	if string(a) == string(hashToken("other")) {
+		t.Fatal("different tokens hashed to the same digest")
+	}
+}
+
+func TestNewTokenIsUnique(t *testing.T) {
+	seen := map[string]bool{}
+	for range 100 {
+		token, err := newToken()
+		if err != nil {
+			t.Fatalf("newToken: %v", err)
+		}
+		if seen[token] {
+			t.Fatal("newToken repeated a value")
+		}
+		seen[token] = true
+	}
+}
+
+// Empty rows must serialise as [] so kotlinx.serialization can decode them into the
+// client's non-null List fields.
+func TestHomeResponseEncodesEmptyRowsAsArrays(t *testing.T) {
+	var resp homeResponse
+	ensureSlices(&resp)
+
+	body, err := json.Marshal(resp)
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	var decoded map[string]any
+	if err := json.Unmarshal(body, &decoded); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	for _, row := range []string{"continueWatching", "nextUp", "favorites", "latestMovies"} {
+		if _, ok := decoded[row].([]any); !ok {
+			t.Fatalf("row %q encoded as %T, want array", row, decoded[row])
+		}
+	}
+}
+
+// The four fixed rows must keep their order, ids and kinds: the client maps kinds onto
+// card shapes and uses ids as Compose keys.
+func TestBaseRowsShape(t *testing.T) {
+	rows := baseRows(homeResponse{
+		ContinueWatching: []json.RawMessage{json.RawMessage(`{"Id":"1"}`)},
+		Favorites:        []json.RawMessage{json.RawMessage(`{"Id":"2"}`)},
+	})
+
+	if len(rows) != 4 {
+		t.Fatalf("expected 4 base rows, got %d", len(rows))
+	}
+	wantIDs := []string{"continue", "next-up", "favorites", "latest-movies"}
+	wantKinds := []string{"continue", "nextup", "favorites", "latest"}
+	for i, row := range rows {
+		if row.ID != wantIDs[i] {
+			t.Fatalf("row %d id = %q, want %q", i, row.ID, wantIDs[i])
+		}
+		if row.Kind != wantKinds[i] {
+			t.Fatalf("row %d kind = %q, want %q", i, row.Kind, wantKinds[i])
+		}
+		if row.Title == "" {
+			t.Fatalf("row %d has no title", i)
+		}
+	}
+
+	// The favourites row carries the items the client used to assemble itself.
+	if len(rows[2].Items) != 1 {
+		t.Fatalf("favourites row lost its items: %+v", rows[2])
+	}
+}
+
+func TestRecommendationBuildsAreDeduplicatedPerUser(t *testing.T) {
+	var builds recommendationBuilds
+
+	if !builds.begin("user-1") {
+		t.Fatal("first build should be allowed to start")
+	}
+	if builds.begin("user-1") {
+		t.Fatal("a second concurrent build for the same user must be skipped")
+	}
+	if !builds.begin("user-2") {
+		t.Fatal("a different user must not be blocked")
+	}
+
+	builds.done("user-1")
+	if !builds.begin("user-1") {
+		t.Fatal("a build should be allowed again once the previous one finished")
+	}
+}
+
+func TestSummariseReadsResumePosition(t *testing.T) {
+	raw := json.RawMessage(`{"Id":"42","Name":"Arrival","Type":"Movie","UserData":{"PlaybackPositionTicks":36000000000}}`)
+	summary, err := emby.Summarise(raw)
+	if err != nil {
+		t.Fatalf("summarise: %v", err)
+	}
+	if summary.ID != "42" || summary.Name != "Arrival" {
+		t.Fatalf("unexpected summary: %+v", summary)
+	}
+	if got := summary.UserData.PlaybackPositionTicks / ticksPerMillisecond; got != 3_600_000 {
+		t.Fatalf("resume position = %d ms, want 3600000", got)
+	}
+}