1 files changed, 31 insertions, 27 deletions

diff --git a/server/src/request_info.rs b/server/src/request_info.rs
index 3a1023f..3468c58 100644
--- a/server/src/request_info.rs
+++ b/server/src/request_info.rs
@@ -4,8 +4,11 @@
     Copyright (C) 2026 metamuffin <metamuffin.org>
 */
 
-use crate::ui::error::{MyError, MyResult};
-use anyhow::anyhow;
+use crate::{
+    State,
+    auth::token_to_user,
+    ui::error::{MyError, MyResult},
+};
 use jellycommon::jellyobject::ObjectBuffer;
 use jellyui::RenderInfo;
 use rocket::{
@@ -13,11 +16,13 @@ use rocket::{
     http::{MediaType, Status},
     request::{FromRequest, Outcome},
 };
+use std::sync::Arc;
 
 pub struct RequestInfo<'a> {
     pub lang: &'a str,
     pub accept: Accept,
     pub user: Option<ObjectBuffer>,
+    pub state: Arc<State>,
 }
 
 #[async_trait]
@@ -33,19 +38,20 @@ impl<'r> FromRequest<'r> for RequestInfo<'r> {
 
 impl<'a> RequestInfo<'a> {
     pub async fn from_request_ut(request: &'a Request<'_>) -> MyResult<Self> {
+        let state: &Arc<State> = request.rocket().state().unwrap();
         Ok(Self {
             lang: accept_language(request),
             accept: Accept::from_request_ut(request),
-            user: None,
-            // session: session_from_request(request).await?,
+            user: user_from_request(state, request)?,
+            state: state.clone(),
         })
     }
-    pub fn render_info(&self) -> RenderInfo<'a> {
+    pub fn render_info(&'a self) -> RenderInfo<'a> {
         RenderInfo {
             lang: self.lang,
             status_message: None,
             user: self.user.as_ref().map(|u| u.as_object()),
-            config: CONF.ui,
+            config: &self.state.config.ui,
         }
     }
 }
@@ -77,7 +83,7 @@ impl Accept {
     }
 }
 
-pub(super) fn accept_language<'a>(request: &'a Request<'_>) -> &'a str {
+fn accept_language<'a>(request: &'a Request<'_>) -> &'a str {
     request
         .headers()
         .get_one("accept-language")
@@ -93,27 +99,25 @@ pub(super) fn accept_language<'a>(request: &'a Request<'_>) -> &'a str {
         .unwrap_or("en")
 }
 
-pub(super) async fn user_from_request(req: &Request<'_>) -> Result<Session, MyError> {
-    if cfg!(feature = "bypass-auth") {
-        Ok(bypass_auth_session()?)
-    } else {
-        let token = req
-            .query_value("session")
-            .map(|e| e.unwrap())
-            .or_else(|| req.query_value("api_key").map(|e| e.unwrap()))
-            .or_else(|| req.headers().get_one("X-MediaBrowser-Token"))
-            .or_else(|| {
-                req.headers()
-                    .get_one("Authorization")
-                    .and_then(parse_jellyfin_auth)
-            }) // for jellyfin compat
-            .or(req.cookies().get("session").map(|cookie| cookie.value()))
-            .ok_or(anyhow!("not logged in"))?;
+fn user_from_request(state: &State, req: &Request<'_>) -> Result<Option<ObjectBuffer>, MyError> {
+    let Some(token) = req
+        .query_value("session")
+        .map(|e| e.unwrap())
+        .or_else(|| req.query_value("api_key").map(|e| e.unwrap()))
+        .or_else(|| req.headers().get_one("X-MediaBrowser-Token"))
+        .or_else(|| {
+            req.headers()
+                .get_one("Authorization")
+                .and_then(parse_jellyfin_auth)
+        }) // for jellyfin compat
+        .or(req.cookies().get("session").map(|cookie| cookie.value()))
+    else {
+        return Ok(None);
+    };
 
-        // jellyfin urlescapes the token for *some* requests
-        let token = token.replace("%3D", "=");
-        Ok(token_to_user(&token)?)
-    }
+    // jellyfin urlescapes the token for *some* requests
+    let token = token.replace("%3D", "=");
+    Ok(Some(token_to_user(state, &token)?))
 }
 
 fn parse_jellyfin_auth(h: &str) -> Option<&str> {