rays/ipx
1
0
Fork 0
Code Issues 11 Pull Requests Actions Packages Projects Releases 20 Wiki Activity

iOS: the player goes to ipxapi.sdf1.net with one API token; unread badge (#419, #421)

Browse Source 
The Access service token plus API token pair was three values to enter
and Access in front of both. The player, the badge and CarPlay now send
the ipx API token alone to https://ipxapi.sdf1.net: a route of the
rays-unraid tunnel to the same ipx-web, with no Access application, held
to the paths the app uses by a custom firewall rule on the sdf1.net zone
(403 for anything without a bearer header or off the list: the page, the
login form, /api/login, ?token= sign-in, the admin API). docs/sso.md
says so, since it also says not to bypass Access for /api/*; this is
that warning's narrow version, and the rule is on Cloudflare, not here.

The unread badge (#421) shows All Subscriptions' count, as the page's
badge does: set when the app comes forward, after an item is read, and
by a background refresh iOS runs now and then. The test target had no
Info.plist and could never have run; it does now.

Build 4. Not yet run on a phone with the token set.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
Ray Slakinski
2026-11-08 14:11:03 -05:00
parent 7d4456bb2f
commit 3626a30b52
14 changed files with 234 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
ios/README.md
View File

@@ -29,15 +29,19 @@ Shake the phone to change it. Plain `http://` only on your own network
that follows, through Cloudflare Access or ipx's own form; the cookies that leaves are what the
player uses (`CookieBridge`). `-ipx.server <url>` as a launch argument overrides it for a run.
## Player tokens
## Player token
The player normally rides on the web view's cookie, which ends with Cloudflare Access's session.
To make it outlast that, shake the phone, choose Player Tokens and enter three things, all kept
in the keychain (`Credentials.swift`): an ipx API token (the page's Settings, API tokens), and the
Client ID and Client Secret of an Access service token (Zero Trust, Access, Service credentials),
which the `ipodderx` application needs a *Service Auth* policy for. Without all three the player
sends only the cookie, as before. Playback's own requests use them (the audio, positions, the
artwork); the page still signs in as it did.
To make it outlast that, shake the phone, choose Player Token and enter an ipx API token (the
page's Settings, API tokens) and the address to send it to, `https://ipxapi.sdf1.net`. The token is
kept in the keychain (`Credentials.swift`). The player's audio, positions, read flags, artwork and
the unread badge go to that address with `Authorization: Bearer`; the page still signs in as it
did, at the server address. Without a token the player sends only the cookie, as before.
`ipxapi.sdf1.net` is the tunnel's route to the same ipx-web as `ipodderx.sdf1.net`, with no Access
application in front, which would turn a bearer header away. Cloudflare's firewall (a custom rule
on the `sdf1.net` zone) blocks every request to it except a bearer-token one for `/api/feeds`,
`/api/me`, `/api/art`, `/api/entries/*` and `/media/*`; ipx still checks the token.
## How it hangs together
@@ -83,7 +87,7 @@ its own clock, so both happen while the page is frozen. Video stays in the page.
* Episodes kept on the device (#412) are the page's service worker's, which a `WKWebView` does
not run without App-Bound Domains; the app plays them from the server.
* Without the player tokens the cookie is the only credential: when Cloudflare Access's expires
* Without the player token the cookie is the only credential: when Cloudflare Access's expires
mid-drive, playback stops with "Sign in again", and opening the app signs in.
* CarPlay's dashboard app needs Apple's entitlement first; then it is a second scene over the same
`Playback`.