v2.45.2 — JWT-Auth für yt-proxy: X-API-Key komplett entfernt, Bearer-Token überall

lib/config/app_config.dart

@@ -6,24 +6,6 @@ class AppConfig {
   static const logUrl = 'https://baka-net.de';
   static const authUrl = 'https://baka-net.de/auth';
 
-  // API-Key – XOR-obfuskiert, damit `strings` keinen Klartext zeigt.
-  // Key: "melo-cloud-2026-secret-key" XOR 0x55
-  static const _xorKey = 0x55;
-  static const _obfuscatedKeyBytes = <int>[
-    0x38, 0x30, 0x39, 0x3A, 0x78, 0x36, 0x39, 0x3A, 0x20, 0x31,
-    0x78, 0x67, 0x65, 0x67, 0x63, 0x78, 0x26, 0x30, 0x36, 0x27,
-    0x30, 0x21, 0x78, 0x3E, 0x30, 0x2C,
-  ];
-
-  /// API-Key: dart-define überschreibt; sonst fällt auf XOR-deobfuskierten Key zurück.
-  static String get ytProxyApiKey {
-    final env = const String.fromEnvironment('MELO_API_KEY');
-    if (env.isNotEmpty) return env;
-    return String.fromCharCodes(
-      _obfuscatedKeyBytes.map((b) => b ^ _xorKey),
-    );
-  }
-
   // Feature-Toggles
   static bool sendeDiagnosedaten = true;
 }

lib/services/cloud_service.dart

@@ -36,9 +36,7 @@ class CloudService {
 
   Map<String, String> get _authHeader {
     final token = AuthService().token;
-    final headers = <String, String>{
+    final headers = <String, String>{};
-      'X-API-Key': AppConfig.ytProxyApiKey,
-    };
     if (token != null && token.isNotEmpty) {
       headers['Authorization'] = 'Bearer $token';
     }

lib/services/download_service.dart

@@ -10,7 +10,7 @@ import '../models/song.dart';
 import '../database/db_helper.dart';
 import '../utils/audio_validator.dart';
 import 'melo_logger.dart';
-import '../config/app_config.dart';
+import 'auth_service.dart';
 import '../main.dart'; // für notificationsPlugin
 import '../utils/sanitize.dart';
 
@@ -25,8 +25,7 @@ class DownloadService extends ChangeNotifier {
   DownloadService._();
 
   static const String _proxyBasisUrl = 'https://yt.baka-net.de';
-  static String get _apiKey => AppConfig.ytProxyApiKey;
+  static Map<String, String> get _authHeader => AuthService().authHeader;
-  static Map<String, String> get _authHeader => {'X-API-Key': _apiKey};
 
   static const String _channelId = 'de.baka.melo.downloads';
   static const int _notifyProgressId = 100;

lib/services/musik_scanner.dart

@@ -10,7 +10,7 @@ import '../database/db_helper.dart';
 import '../utils/audio_validator.dart';
 import 'id3_reader.dart';
 import '../services/melo_logger.dart';
-import '../config/app_config.dart';
+import 'auth_service.dart';
 
 class MusikScanner {
   static final MusikScanner _instanz = MusikScanner._();
@@ -501,7 +501,7 @@ class MusikScanner {
 
         final antwort = await http.get(
           Uri.parse(url),
-          headers: {'X-API-Key': AppConfig.ytProxyApiKey},
+          headers: AuthService().authHeader,
         ).timeout(
           const Duration(seconds: 10),
         );