Many improvemtns and fixes related to decoupling of svelte and rust on android.

src-tauri/src/repository/online_integration_test.rs

@@ -30,7 +30,8 @@ mod tests {
                 self.server_url, item_id, image_type
             );
 
-            let mut params = vec![("api_key", self.access_token.clone())];
+            // No api_key — image downloads use X-Emby-Authorization header
+            let mut params: Vec<(&str, String)> = Vec::new();
 
             if let Some(opts) = options {
                 if let Some(max_width) = opts.max_width {
@@ -304,14 +305,11 @@ mod tests {
         let subtitle_url = repo.get_subtitle_url("item123", "src123", 0, "vtt");
         let download_url = repo.get_video_download_url("item123", "720p");
 
-        // These URLs are constructed in BACKEND and returned to frontend
-        // Frontend never receives this token directly
-        assert!(image_url.contains("api_key=super_secret_token"));
+        // Image URLs no longer contain api_key — auth is via X-Emby-Authorization header
+        assert!(!image_url.contains("api_key="));
+        // Subtitle and download URLs still use api_key (used directly, not via download_bytes)
         assert!(subtitle_url.contains("api_key=super_secret_token"));
         assert!(download_url.contains("api_key=super_secret_token"));
-
-        // In actual implementation, frontend would only get the URL string
-        // Frontend cannot construct its own URLs or extract the token
     }
 
     #[test]
@@ -335,10 +333,10 @@ mod tests {
 
         let url = repo.get_image_url("id123", "Primary", None);
 
-        // Should be valid format
+        // Should be valid format (no api_key — auth via header)
         assert!(url.starts_with("https://server.com"));
         assert!(url.contains("/Items/id123/Images/Primary"));
-        assert!(url.contains("?api_key="));
+        assert!(!url.contains("api_key="));
     }
 
     #[test]
@@ -353,13 +351,13 @@ mod tests {
 
         let url = repo.get_image_url("id123", "Primary", Some(&options));
 
-        // Should have single ? separator
+        // Should have single ? separator with params
         let question_marks = url.matches('?').count();
         assert_eq!(question_marks, 1);
 
-        // Should have ampersands between params
-        assert!(url.contains("?"));
-        assert!(url.contains("&"));
+        // Should have params for maxWidth and maxHeight
+        assert!(url.contains("maxWidth=300"));
+        assert!(url.contains("maxHeight=200"));
     }
 
     #[test]
@@ -368,8 +366,7 @@ mod tests {
 
         let url = repo.get_image_url("item-with-special_chars", "Primary", None);
 
-        // Should handle special characters in token and id
-        assert!(url.contains("token_with_special-chars"));
+        // Should handle special characters in id (no token in URL anymore)
         assert!(url.contains("item-with-special_chars"));
     }
 
@@ -383,9 +380,9 @@ mod tests {
         // Backend generates full URL with credentials
         let url = repo.get_image_url("item123", "Primary", None);
 
-        // URL is complete and ready to use
+        // URL is complete and ready to use (auth via header, not api_key)
         assert!(url.starts_with("https://"));
-        assert!(url.contains("api_key="));
+        assert!(url.contains("/Items/item123/Images/Primary"));
 
         // Frontend never constructs URLs directly
         // Frontend only receives pre-constructed URLs from backend
@@ -408,7 +405,6 @@ mod tests {
         assert!(url.contains("maxHeight=200"));
         assert!(url.contains("quality=90"));
         assert!(url.contains("tag=abc"));
-        assert!(url.contains("api_key=token"));
     }
 
     #[test]
@@ -423,8 +419,8 @@ mod tests {
 
         let url = repo.get_image_url("item123", "Primary", Some(&options));
 
-        // Should only have api_key
-        assert!(url.contains("api_key=token"));
+        // Should have no query params (no api_key, no options)
+        assert!(!url.contains("?"));
         assert!(!url.contains("maxWidth"));
         assert!(!url.contains("maxHeight"));
         assert!(!url.contains("quality"));