0.2.82

server/internal/api/api.go

@@ -91,6 +91,8 @@ type Server struct {
 	openSubtitles    *opensubtitles.Client
 	openSubtitlesKey string
 	mdblistMu        sync.Mutex
+	// viewerLists spares every authenticated request a read of the account's people.
+	viewerLists viewerListCache
 	// mdblistSettingsCache spares every row and keystroke a settings read.
 	mdblistSettingsCache mdblistSettingsCache
 	// ratingsWarm fills and renews the durable rating cache behind the viewer, so a row
@@ -267,6 +269,13 @@ func (s *Server) Routes() http.Handler {
 	v1.Handle("PUT /v1/auth/devices/{deviceID}", s.authed(s.handleRenameDevice))
 	v1.Handle("DELETE /v1/auth/devices/{deviceID}", s.authed(s.handleDeleteDevice))
 
+	// Viewers: the people under one account. The list is what the picker draws; every
+	// other route learns who is watching from the X-Memby-Viewer header instead.
+	v1.Handle("GET /v1/viewers", s.authed(s.handleViewers))
+	v1.Handle("POST /v1/viewers", s.authed(s.handleViewers))
+	v1.Handle("PUT /v1/viewers/{viewerID}", s.authed(s.handleViewer))
+	v1.Handle("DELETE /v1/viewers/{viewerID}", s.authed(s.handleViewer))
+
 	v1.Handle("GET /v1/home", s.authed(s.handleHome))
 	v1.Handle("GET /v1/heroes/active", s.authed(s.handleActiveHero))
 	v1.Handle("GET /v1/screensaver", s.authed(s.handleScreensaver))
@@ -435,6 +444,12 @@ func (s *Server) authed(h authedFunc) http.Handler {
 		}
 		sess = s.captureClientIdentity(r, sess)
 		identify(r.Context(), sess)
+		// Resolved once, here, and read out of the context by everything downstream. The
+		// header short-circuits when it is absent, so a household running no viewers pays
+		// a map lookup and nothing else.
+		viewer := s.activeViewer(r.Context(), sess, r)
+		identifyViewer(r.Context(), viewer)
+		r = r.WithContext(withViewer(r.Context(), viewer))
 		policy := s.updatePolicy.get()
 		decision := appupdate.Decide(effectiveUpdatePolicy(policy), clientVersion(r))
 		retireBelow := destructiveUpdateFloor(policy)
@@ -446,7 +461,7 @@ func (s *Server) authed(h authedFunc) http.Handler {
 				s.loggerFor(r.Context()).Error("required-update session delete failed", "error", err)
 			}
 			_ = s.cache.Delete(r.Context(), cache.SessionKey(hexHash(sess.TokenHash)))
-			_ = s.cache.InvalidateUser(r.Context(), sess.EmbyUserID)
+			s.invalidateAccountViews(r.Context(), sess)
 			s.loggerFor(r.Context()).Info("signed out for required update",
 				"device_id", sess.DeviceID,
 				"from", clientLogValue(clientVersion(r)),