0.2.65 - End Credits wiring / Gateway: 0.1.45 - Credits

CLAUDE.md

@@ -660,6 +660,25 @@ console is still the whole point, and serving a page is still a write of a `[]by
 Guarded by `MEMBY_ADMIN_TOKEN`; unset means every `/admin` route 404s. It polls
 `/admin/api/status` every 30s and stops entirely on a hidden tab.
 
+**Who may open it is Emby's answer, not the gateway's.** The sign-in behind the console is
+the same discreet Emby password check the public installer uses, so on its own it admitted
+anybody in the household — and opening `/admin/` then handed them the admin token cookie.
+`embyAdministrator` requires `Policy.IsAdministrator`, which Emby returns *in the
+authentication response*, so the check costs no request; a response carrying no policy at
+all is asked again directly and an Emby that will not answer refuses the sign-in, because
+silence is not permission and reading it as "no" would lock an operator out of their own
+console. Three things to preserve: the refusal is worded exactly as a wrong password —
+somebody who may not administer the server has no business learning that their password
+was right — and the reason goes to the log instead; the *installer* is deliberately not
+gated this way, since a viewer setting up a new television is who it is for; and the two
+sign-ins issue **one cookie**, so they are separated by being signed with their own
+purpose (`installerSessionPurpose` / `adminSessionPurpose`) rather than by a claim inside
+the payload. An admin session satisfies the installer's gate; an installer session can
+never satisfy the console's. `adminSessionTTL` is 90 days of idle time, matching
+`MEMBY_SESSION_IDLE_EXPIRY` so a browser and a television are forgotten on the same
+schedule, and only a request an operator actually made slides it forward — see
+`operatorPresent`.
+
 It was one HTML file holding every screen at once, all but one of them hidden, which is why
 opening `/admin/logs` also sent the accounts settings editor and the feature grid, and why
 each page read as a pile of unrelated controls. Things to preserve: