fix(jellyfin): send Authorization MediaBrowser header for modern servers

[setiapam]

Fixes #451

Problem

Modern Jellyfin versions (including 10.10.x and 12.x) require standard Authorization: MediaBrowser ... headers and reject legacy X-Emby-Authorization / X-Emby-Token only requests with HTTP 400 Bad Request or HTTP 401 Unauthorized.

Solution

Update jellyfinDialect.applyAuth to set the Authorization: MediaBrowser ... header (including Token="..." when authenticated), while retaining X-Emby-Authorization and X-Emby-Token for backwards compatibility with older Jellyfin instances.

Verification

• Added test coverage in internal/embyapi/client_test.go ensuring Authorization: MediaBrowser ... header is sent for both unauthenticated and authenticated requests.
• All repository unit tests pass cleanly (go test ./...).
• Verified against live Jellyfin 12 server: successfully connects, authenticates, and retrieves music library/tracks.

Summary by CodeRabbit

• Bug Fixes
  • Improved Jellyfin authentication compatibility by including credentials in the standard MediaBrowser authorization scheme.
  • Preserved support for existing Emby authentication headers.
  • Added validation to ensure authentication headers are correctly sent during login and content requests.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 6301bbd9-9705-4440-8863-d5e1504f88d9

📥 Commits

Reviewing files that changed from the base of the PR and between 93a4ac6 and 5455e0a.

📒 Files selected for processing (2)

• internal/embyapi/client_test.go
• internal/embyapi/dialect.go

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The Jellyfin client now sends the token in the standard Authorization: MediaBrowser header while retaining legacy Emby headers. Tests verify the header during API token and password authentication flows.

Changes

Jellyfin authentication

Layer / File(s)	Summary
MediaBrowser authorization header internal/embyapi/dialect.go	The Jellyfin dialect now sets the Authorization header with the MediaBrowser scheme and includes the token when present. Legacy headers remain enabled.
Authorization header assertions internal/embyapi/client_test.go	Tests verify the MediaBrowser scheme and token on authentication and Views requests.

Estimated code review effort: 2 (Simple) | ~10 minutes

Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 5455e

Jellyfin requests now include authenticated tokens in the standard MediaBrowser Authorization header while retaining legacy Emby headers. Authentication and library-access flows are covered, with no remaining merge-readiness risk identified.

Suggested reviewers: bjarneo, tyrichards

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: sending the standard Jellyfin MediaBrowser Authorization header.
Linked Issues check	✅ Passed	The changes address issue #451 by adding the standard MediaBrowser Authorization header, including the token when available, while preserving legacy headers. Tests cover authenticated and unauthentica…
Out of Scope Changes check	✅ Passed	All changes are directly related to Jellyfin authentication compatibility and validation. The added assertions verify the intended header behavior.

• Fix all pre-merge checks with AI

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}