From cd49e80293a8eda68b3141afb3c9cd091327ab62 Mon Sep 17 00:00:00 2001
From: Dustin <dustinhaehnel44@gmail.com>
Date: Mon, 3 Aug 2026 02:49:30 +0200
Subject: [PATCH] =?UTF-8?q?v2.45.2=20=E2=80=94=20JWT-Auth=20f=C3=BCr=20yt-?=
 =?UTF-8?q?proxy:=20X-API-Key=20komplett=20entfernt,=20Bearer-Token=20?=
 =?UTF-8?q?=C3=BCberall?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 lib/config/app_config.dart         | 18 ------------------
 lib/services/cloud_service.dart    |  4 +---
 lib/services/download_service.dart |  5 ++---
 lib/services/musik_scanner.dart    |  4 ++--
 4 files changed, 5 insertions(+), 26 deletions(-)

diff --git a/lib/config/app_config.dart b/lib/config/app_config.dart
index 46fd932..3c125ab 100644
--- a/lib/config/app_config.dart
+++ b/lib/config/app_config.dart
@@ -6,24 +6,6 @@ class AppConfig {
   static const logUrl = 'https://baka-net.de';
   static const authUrl = 'https://baka-net.de/auth';
 
-  // API-Key – XOR-obfuskiert, damit `strings` keinen Klartext zeigt.
-  // Key: "melo-cloud-2026-secret-key" XOR 0x55
-  static const _xorKey = 0x55;
-  static const _obfuscatedKeyBytes = <int>[
-    0x38, 0x30, 0x39, 0x3A, 0x78, 0x36, 0x39, 0x3A, 0x20, 0x31,
-    0x78, 0x67, 0x65, 0x67, 0x63, 0x78, 0x26, 0x30, 0x36, 0x27,
-    0x30, 0x21, 0x78, 0x3E, 0x30, 0x2C,
-  ];
-
-  /// API-Key: dart-define überschreibt; sonst fällt auf XOR-deobfuskierten Key zurück.
-  static String get ytProxyApiKey {
-    final env = const String.fromEnvironment('MELO_API_KEY');
-    if (env.isNotEmpty) return env;
-    return String.fromCharCodes(
-      _obfuscatedKeyBytes.map((b) => b ^ _xorKey),
-    );
-  }
-
   // Feature-Toggles
   static bool sendeDiagnosedaten = true;
 }
diff --git a/lib/services/cloud_service.dart b/lib/services/cloud_service.dart
index fc789fd..d98967f 100644
--- a/lib/services/cloud_service.dart
+++ b/lib/services/cloud_service.dart
@@ -36,9 +36,7 @@ class CloudService {
 
   Map<String, String> get _authHeader {
     final token = AuthService().token;
-    final headers = <String, String>{
-      'X-API-Key': AppConfig.ytProxyApiKey,
-    };
+    final headers = <String, String>{};
     if (token != null && token.isNotEmpty) {
       headers['Authorization'] = 'Bearer $token';
     }
diff --git a/lib/services/download_service.dart b/lib/services/download_service.dart
index 13251f6..b09b719 100644
--- a/lib/services/download_service.dart
+++ b/lib/services/download_service.dart
@@ -10,7 +10,7 @@ import '../models/song.dart';
 import '../database/db_helper.dart';
 import '../utils/audio_validator.dart';
 import 'melo_logger.dart';
-import '../config/app_config.dart';
+import 'auth_service.dart';
 import '../main.dart'; // für notificationsPlugin
 import '../utils/sanitize.dart';
 
@@ -25,8 +25,7 @@ class DownloadService extends ChangeNotifier {
   DownloadService._();
 
   static const String _proxyBasisUrl = 'https://yt.baka-net.de';
-  static String get _apiKey => AppConfig.ytProxyApiKey;
-  static Map<String, String> get _authHeader => {'X-API-Key': _apiKey};
+  static Map<String, String> get _authHeader => AuthService().authHeader;
 
   static const String _channelId = 'de.baka.melo.downloads';
   static const int _notifyProgressId = 100;
diff --git a/lib/services/musik_scanner.dart b/lib/services/musik_scanner.dart
index df34407..1acd9c3 100644
--- a/lib/services/musik_scanner.dart
+++ b/lib/services/musik_scanner.dart
@@ -10,7 +10,7 @@ import '../database/db_helper.dart';
 import '../utils/audio_validator.dart';
 import 'id3_reader.dart';
 import '../services/melo_logger.dart';
-import '../config/app_config.dart';
+import 'auth_service.dart';
 
 class MusikScanner {
   static final MusikScanner _instanz = MusikScanner._();
@@ -501,7 +501,7 @@ class MusikScanner {
 
         final antwort = await http.get(
           Uri.parse(url),
-          headers: {'X-API-Key': AppConfig.ytProxyApiKey},
+          headers: AuthService().authHeader,
         ).timeout(
           const Duration(seconds: 10),
         );