From d9bbe4df1be405709a7b64de35583d387d84490b Mon Sep 17 00:00:00 2001
From: Jason Dove <1695733+jasongdove@users.noreply.github.com>
Date: Wed, 31 Jan 2024 15:08:23 -0600
Subject: [PATCH] auto generate jwt token for channel preview (#1588)

---
 CHANGELOG.md                  |  6 +-----
 ErsatzTV/JwtHelper.cs         | 13 +++++++++++++
 ErsatzTV/Pages/Channels.razor |  5 ++---
 3 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bcab56e05..1a5bd44e2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,11 +12,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
   - Data protection keys will now be persisted under ErsatzTV's config folder instead of being recreated at startup
 - Fix bug updating/replacing Jellyfin movies
   - A deep scan can be used to fix all movies, otherwise any future updates made to JF movies will correctly sync to ETV
-
-### Changed
-- Pass through `access_token` query param from `Channels` page url to streaming endpoints
-  - This parameter isn't normally needed on the `Channels` page, since the web UI is not protected with JWT
-  - Its only purpose is to allow playback of authenticated channels in the web UI
+- Automatically generate JWT tokens to allow channel previews of protected streams 
 
 ## [0.8.5-beta] - 2024-01-30
 ### Added
diff --git a/ErsatzTV/JwtHelper.cs b/ErsatzTV/JwtHelper.cs
index 100bbf9e3..8baeb47ef 100644
--- a/ErsatzTV/JwtHelper.cs
+++ b/ErsatzTV/JwtHelper.cs
@@ -1,3 +1,4 @@
+using System.IdentityModel.Tokens.Jwt;
 using System.Text;
 using Microsoft.IdentityModel.Tokens;
 
@@ -17,4 +18,16 @@ public static class JwtHelper
             IssuerSigningKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(issuerSigningKey!));
         }
     }
+    
+    public static string GenerateToken()
+    {
+        var tokenHandler = new JwtSecurityTokenHandler();
+        var tokenDescriptor = new SecurityTokenDescriptor
+        {
+            Expires = DateTime.UtcNow.AddDays(1),
+            SigningCredentials = new SigningCredentials(IssuerSigningKey, SecurityAlgorithms.HmacSha256Signature)
+        };
+        SecurityToken token = tokenHandler.CreateToken(tokenDescriptor);
+        return tokenHandler.WriteToken(token);
+    }
 }
diff --git a/ErsatzTV/Pages/Channels.razor b/ErsatzTV/Pages/Channels.razor
index 4df526c01..bc0b06f8d 100644
--- a/ErsatzTV/Pages/Channels.razor
+++ b/ErsatzTV/Pages/Channels.razor
@@ -184,11 +184,10 @@
 
             var uri = new UriBuilder(NavigationManager.ToAbsoluteUri(NavigationManager.Uri));
             uri.Path = uri.Path.Replace("/channels", $"/iptv/channel/{channel.Number}.m3u8");
-            string query = uri.Query;
             uri.Query = "?mode=segmenter";
-            if (QueryHelpers.ParseQuery(query).TryGetValue("access_token", out StringValues token))
+            if (JwtHelper.IsEnabled)
             {
-                uri.Query += $"&access_token={token.ToString()}";
+                uri.Query += $"&access_token={JwtHelper.GenerateToken()}";
             }
 
             var parameters = new DialogParameters { { "StreamUri", uri.ToString() } };