mobrule/kurageyomi

Fork 0

Plugin builds against Jellyfin 10.11 and serves an authenticated page #2

New issue

Closed

opened 2026-08-09 20:41:29 +00:00 by aiko · 2 comments

aiko commented

2026-08-09 20:41:29 +00:00

Owner

Parent

#1 — PRD: Kurageyomi

What to build

The plugin skeleton: it builds against the real server version and serves an authenticated page.

Target net9.0 with Jellyfin.Controller 10.11.11 — the exact version dionysus runs, published
on NuGet with a matching net9.0 dependency group. Do not follow the official plugin template's
versions: it pins targetAbi 10.9.0.0 against Jellyfin.Controller 10.9.11 and is internally
inconsistent about net8.0 versus net9.0. Use it for shape only. meta.json must declare a
targetAbi matching 10.11.

Per ADR 0001 the plugin serves the phone UI itself, same-origin, behind Jellyfin's own auth. This
slice establishes exactly that and nothing else — no sessions, no subtitles, no dictionary. The
page only has to prove it loaded and that the request was authenticated.

The page ships whatever manifest and icon Chrome on Android needs to offer home-screen install,
and declares standalone display. Whether that actually works on the device is verified in #6.

Acceptance criteria

Solution builds clean against Jellyfin.Controller 10.11.11 on net9.0
meta.json declares a targetAbi matching the 10.11 server
Build produces a loadable Kurageyomi.dll plus its meta.json
An authenticated request to the plugin's route is served the page
An unauthenticated request to the same route is rejected
The page declares a web app manifest with standalone display and an icon
Tests cover the authenticated and unauthenticated cases without a running Jellyfin

Blocked by

None - can start immediately

Note on scope

Deployment to dionysus and verification on the Pixel were split out into #6, because neither can
be verified by an agent on dex-win. This issue is done when the build is green and the auth
behaviour is proven by test; #6 proves it runs on the real server.

## Parent #1 — PRD: Kurageyomi ## What to build The plugin skeleton: it builds against the real server version and serves an authenticated page. Target **net9.0** with `Jellyfin.Controller 10.11.11` — the exact version dionysus runs, published on NuGet with a matching `net9.0` dependency group. Do not follow the official plugin template's versions: it pins `targetAbi 10.9.0.0` against `Jellyfin.Controller 10.9.11` and is internally inconsistent about `net8.0` versus `net9.0`. Use it for shape only. `meta.json` must declare a `targetAbi` matching 10.11. Per ADR 0001 the plugin serves the phone UI itself, same-origin, behind Jellyfin's own auth. This slice establishes exactly that and nothing else — no sessions, no subtitles, no dictionary. The page only has to prove it loaded and that the request was authenticated. The page ships whatever manifest and icon Chrome on Android needs to offer home-screen install, and declares standalone display. Whether that actually works on the device is verified in #6. ## Acceptance criteria - [ ] Solution builds clean against `Jellyfin.Controller 10.11.11` on `net9.0` - [ ] `meta.json` declares a `targetAbi` matching the 10.11 server - [ ] Build produces a loadable `Kurageyomi.dll` plus its `meta.json` - [ ] An authenticated request to the plugin's route is served the page - [ ] An unauthenticated request to the same route is rejected - [ ] The page declares a web app manifest with standalone display and an icon - [ ] Tests cover the authenticated and unauthenticated cases without a running Jellyfin ## Blocked by None - can start immediately ## Note on scope Deployment to dionysus and verification on the Pixel were split out into #6, because neither can be verified by an agent on dex-win. This issue is done when the build is green and the auth behaviour is proven by test; #6 proves it runs on the real server.

aiko added the

ready-for-agent

label

2026-08-09 20:41:29 +00:00

aiko referenced this issue

2026-08-09 20:42:19 +00:00

Phone follows a live Playback Session and shows its Playhead #3

aiko referenced this issue

2026-08-09 20:42:20 +00:00

CueTrack normalizes subtitles; phone shows the transcript #4

aiko referenced this issue

2026-08-09 20:59:06 +00:00

Deploy the plugin to dionysus and verify on the Pixel #6

aiko changed title from ~~Plugin skeleton loads on Jellyfin 10.11 and serves an authenticated page~~ to Plugin builds against Jellyfin 10.11 and serves an authenticated page

2026-08-09 21:00:08 +00:00

aiko referenced this issue

2026-08-09 23:11:53 +00:00

Deploy the plugin to dionysus and verify on the Pixel #6

aiko commented

2026-08-09 23:11:54 +00:00

Author

Owner

This was generated by AI during triage.

Implemented and merged to main at c8440ee. Held open deliberately: the code is unit-tested but has never run on the real server, and this issue's criteria include behaviour only observable there. #6 deploys it; this closes once that confirms it.

> *This was generated by AI during triage.* Implemented and merged to `main` at `c8440ee`. Held open deliberately: the code is unit-tested but has never run on the real server, and this issue's criteria include behaviour only observable there. #6 deploys it; this closes once that confirms it.

aiko referenced this issue from a commit

2026-08-10 00:31:34 +00:00

fix: work over plain http, where secure-context APIs are absent

aiko commented

2026-08-10 08:03:47 +00:00

Author

Owner

This was generated by AI during triage.

Verified on dionysus: the plugin loads, and the shell is served anonymously and renders on the Pixel over the tailnet. Merged in main.

Home-screen install could not be verified — that needs a secure context, and the plugin is reached over http://dionysus:8096. The manifest and icon are in place and correct; installability is waiting on https, tracked in #6.

> *This was generated by AI during triage.* Verified on dionysus: the plugin loads, and the shell is served anonymously and renders on the Pixel over the tailnet. Merged in `main`. Home-screen install could not be verified — that needs a secure context, and the plugin is reached over `http://dionysus:8096`. The manifest and icon are in place and correct; installability is waiting on https, tracked in #6.

aiko closed this issue

2026-08-10 08:03:47 +00:00