fix(stream): let a stream token authorize direct/remux delivery

[JonahMMay]

Symptom: Tizen: Roger Rabbit (HDR10, direct play) ends on "This HDR source requires video encoding, but no validated HDR-preserving or tone-map recipe is installed." Iron Man (progressive remux) fails too.

Cause: HandleStream rejects userID == 0 before looking at the session, so a request that StreamTokenAuth already authorized via the session-bound ?st= grant is 401'd. The HLS manifest/segment handlers accept that case; the progressive/direct one didn't. Tizen plays the plan URL with no bearer, so every GET /api/v2/stream/{id} 401'd (server logs: getPlaybackMedia 401 authentication_required auth_class=anonymous), smarttv's failure recovery replanned to copy-HLS (Not supported format for this DV/HDR source), and the final replan refused with the tone-map message.

Reproduced on the live server with a real plan token: 206 on root /stream/{id}, 401 on /api/v1/stream/{id} and /api/v2/stream/{id}.

Fix: allow userID == 0 when apimw.IsStreamTokenAuthorized. The session load still enforces the session's media-authorization mode (header-auth sessions still require a user) and ownership when an identity is present.

Test: TestHandleStream_StreamTokenAuthorizesAnonymousDelivery runs the real middleware: no credential → 401, token for another session → 401, bound token → 200. Invariant anchor added.

🤖 Generated with Claude Code

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: e563a2c7-430e-4677-87a7-ce254053d64d

📥 Commits

Reviewing files that changed from the base of the PR and between faa3206 and 4c3dd93.

📒 Files selected for processing (3)

• internal/api/handlers/stream.go
• internal/api/handlers/stream_token_delivery_test.go
• scripts/prairie-invariants.txt

 ___________________________________________________________________________
< This code is one line away from greatness-and 40 lines away from clarity. >
 ---------------------------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}