dragonflight/services/mam-api/src/routes
Zac ca71e47035 fix(playout): repair failover, authenticate scheduler self-calls, fix playlist walk + CasparCG consumer syntax
Post-review fixes for the 8-commit playout-mcr drop:

- Scheduler self-calls (callSelf -> /recorders, /playout) carried no auth, so
  under AUTH_ENABLED=true requireUiHeader 403'd every mutating POST. This broke
  playout failover AND scheduled recordings. Add a per-boot in-process service
  token (x-internal-token) the scheduler attaches; requireAuth/requireUiHeader
  treat it as the seeded admin. No env/compose config needed.

- Failover deadlocked: restartChannel set status='starting' then the scheduler
  called the guarded /start route, which 409s on 'starting'. Extract the spawn
  body into spawnChannelSidecar() shared by /start and restartChannel; failover
  now spawns directly with no self-call.

- Phase A playlist stalled after 2 clips: _scheduleAdvance cued the next clip
  via LOADBG AUTO but never advanced the pointer. Pass asset_duration_ms in the
  /play payload and arm a duration-based timer that advances currentIndex and
  cues subsequent clips, keeping as-run in sync for arbitrary-length playlists.

- CasparCG consumer syntax was invalid: "ADD <ch> FFMPEG" is the producer name,
  not a consumer keyword, and old -vcodec/-acodec short args are rejected. Use
  STREAM/FILE with -codec:v / -codec:a / -preset:v / -tune:v and a format=yuv420p
  filter ahead of libx264 (channel output is RGBA).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-30 14:51:35 +00:00
..
ampp.js feat: AMPP folder sync integration — pre-create folder hierarchy on upload, expose lookup endpoint for Script Task: ampp.js 2026-04-18 13:42:08 -04:00
assets.js fix(mam-api): close cross-project authz gaps in assets/bins/jobs/upload 2026-05-30 12:52:29 +00:00
auth.js fix(mam-api): harden TOTP login flow + tighten Google domain check 2026-05-30 12:52:53 +00:00
bins.js fix(mam-api): close cross-project authz gaps in assets/bins/jobs/upload 2026-05-30 12:52:29 +00:00
capture.js feat(mam-api): finish per-project authz on the deferred routers 2026-05-30 03:48:02 +00:00
cluster.js fix: use external MAM_API_URL for remote capture sidecars; add cluster metrics endpoint and dashboard resource graphs 2026-05-29 01:04:24 +00:00
comments.js feat(mam-api): finish per-project authz on the deferred routers 2026-05-30 03:48:02 +00:00
groups.js rip out entire auth/login flow 2026-05-27 03:39:58 +00:00
imports.js feat(mam-api): finish per-project authz on the deferred routers 2026-05-30 03:48:02 +00:00
jobs.js fix(mam-api): close cross-project authz gaps in assets/bins/jobs/upload 2026-05-30 12:52:29 +00:00
metrics.js rip out entire auth/login flow 2026-05-27 03:39:58 +00:00
playout.js fix(playout): repair failover, authenticate scheduler self-calls, fix playlist walk + CasparCG consumer syntax 2026-05-30 14:51:35 +00:00
projects.js feat(mam-api,web-ui): per-project RBAC (v2 auth layer) 2026-05-30 02:37:36 +00:00
recorders.js feat(mam-api): finish per-project authz on the deferred routers 2026-05-30 03:48:02 +00:00
schedules.js rip out entire auth/login flow 2026-05-27 03:39:58 +00:00
sdk.js rip out entire auth/login flow 2026-05-27 03:39:58 +00:00
sequences.js feat(mam-api): finish per-project authz on the deferred routers 2026-05-30 03:48:02 +00:00
settings.js rip out entire auth/login flow 2026-05-27 03:39:58 +00:00
storage.js rip out entire auth/login flow 2026-05-27 03:39:58 +00:00
system.js rip out entire auth/login flow 2026-05-27 03:39:58 +00:00
tokens.js feat(auth): bound-hostname tokens for node-agent + return role from /me 2026-05-27 19:27:59 -04:00
upload.js fix(mam-api): close cross-project authz gaps in assets/bins/jobs/upload 2026-05-30 12:52:29 +00:00
users.js fix(auth): final-review integration fixes — Users page alias + PATCH, CSRF on uploads + heartbeat, drop .bak 2026-05-27 15:42:42 -04:00