refactor: remove all cross-origin browser-direct federation code

- Delete storeFederationToken function from app.js - Delete window.addEventListener('message',...) handler from app.js - Delete buildAuthTileHTML function from app.js - Delete formatLastSeen function from app.js - Delete buildOfflineTileHTML function from app.js - Delete openLoginPopup function from app.js - Simplify api() to same-origin only (no baseUrl/credentials/X-Muxplex-Token) - Remove federation auth relay <script> block from index.html - Remove /api/auth/token endpoint from main.py - Remove CORSMiddleware from main.py - Remove X-Muxplex-Token header check from auth.py - Delete corresponding tests and add absence verification tests
2026-04-01 17:30:18 -07:00
parent c48456a14a
commit 046d123149
7 changed files with 23 additions and 542 deletions
@@ -15,27 +15,6 @@
  <title>muxplex</title>
 </head>
 <body>
-<script>
-// Federation auth: if opened as a login popup by another muxplex instance,
-// relay the session token back to the opener window via postMessage.
-(function() {
-  if (!window.opener) return;
-  fetch('/api/auth/token')
-    .then(function(r) { return r.ok ? r.json() : null; })
-    .then(function(data) {
-      if (data && data.token) {
-        window.opener.postMessage({
-          type: 'muxplex-auth-token',
-          origin: window.location.origin,
-          token: data.token
-        }, '*');
-        setTimeout(function() { window.close(); }, 500);
-      }
-    })
-    .catch(function() {});
-})();
-</script>
-
  <!-- ── Overview view ──────────────────────────────────────────────────── -->
  <div id="view-overview" class="view view--active">
    <header class="app-header">