Skip to content

feat: optional access key - #71

Merged
TenGosc007 merged 20 commits into
mainfrom
feat/optional-access-key
Oct 16, 2026
Merged

feat: optional access key#71
TenGosc007 merged 20 commits into
mainfrom
feat/optional-access-key

Conversation

@TenGosc007

@TenGosc007 TenGosc007 commented Oct 14, 2026

Copy link
Copy Markdown
Collaborator

Summary

initialize(accessKey, libraryId) no longer requires a non-empty API access
key — public playback needs no credentials. Passing a blank key (or
null/undefined) selects playback-only mode on both platforms:
management, upload, and broadcast calls report not-initialized errors until
a real key is provided.

On iOS a blank key reaches the SDK as nil, so public playback sends no
AccessKey header. On Android the bridge no longer rejects blank keys —
upstream BunnyStreamConfig still requires a non-blank key (tracked by a
TODO in BunnyStreamPlayerModule), so Android keyless playback unblocks
automatically with a future native SDK release.

The example app gates features accordingly: Direct video play and resume
positions work with just a library ID, while library lists, uploads, and
broadcasting stay gated on the API key. Docs updated to describe the
playback-only mode.

Type of Change

  • Bug fix
  • Feature
  • Documentation
  • Refactor or cleanup
  • CI/build/release
  • Breaking change

Affected Areas

  • TurboModule / native modules
  • API client
  • Upload
  • Player (VOD)
  • Player (live)
  • Broadcaster
  • Codegen / spec files
  • Example app
  • Documentation
  • Build or package configuration

Testing

  • yarn typecheck
  • yarn lint
  • yarn test — 261 tests incl. new keyless-initialization and
    playback-only example tests
  • Android example builds (yarn android in example/) —
    :bunny.net_stream-react-native:assembleRelease
  • iOS example builds (yarn ios in example/)
  • Manual playback/upload/broadcast test
  • Not run, reason: iOS verified by swiftc -parse on changed files and
    upstream SDK source review; manual playback verification pending on
    device.

Library User Impact

Public API change: initialize accepts string | null | undefined for
accessKey (previously string, blank values threw). A blank key selects
playback-only mode — BunnyStreamApi, BunnyStreamUpload, and
BunnyStreamBroadcaster report not-initialized errors until a real key is
provided. Fully backward compatible: existing callers with a real key see
no behavior change.

Platform note: iOS keyless playback works today; Android keyless playback
is unblocked at the bridge but still requires an upstream
bunny-stream-android change (BunnyStreamConfig rejects blank keys) —
documented via a TODO in BunnyStreamPlayerModule.kt.

AI Assistance

  • No substantial AI assistance was used.
  • AI helped with this PR; I reviewed and understand the final changes.

Checklist

  • The PR is focused on one clear change.
  • native-sdk-baselines.json points to a public, merged native SDK commit or tag when native APIs are required.
  • Public API or behavior changes are documented (README / docs).
  • Tests or manual verification are included where appropriate.
  • No secrets, access keys, private URLs, certificates, or provisioning profiles are included.

@TenGosc007 TenGosc007 self-assigned this Oct 14, 2026
@TenGosc007
TenGosc007 changed the base branch from main to chore/skd-update October 14, 2026 09:36
@TenGosc007
TenGosc007 added this pull request to stack #72 October 14, 2026 09:36
@TenGosc007
TenGosc007 marked this pull request as ready for review October 15, 2026 18:32
Base automatically changed from chore/skd-update to main October 16, 2026 11:45
TenGosc007 and others added 14 commits October 16, 2026 13:45
@TenGosc007 @devin-ai-integration
feat: allow blank access key for playback-only initialization
3bfc142 
Public playback needs no API credentials: initialize('', libraryId)
selects playback-only mode, while management, upload, and broadcast
calls report not-initialized errors until a real key is provided.

On iOS a blank key reaches the SDK as nil, so public playback sends no
AccessKey header. On Android the bridge no longer rejects blank keys;
upstream BunnyStreamConfig still requires a non-blank key, tracked by a
TODO in BunnyStreamPlayerModule.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@TenGosc007 @devin-ai-integration
feat(example): support playback-only mode without an access key
b11846d 
The example now initializes with just a library ID — an empty access key
selects playback-only mode. Home gates features accordingly: direct play
and resume positions need only the library ID, while library lists,
uploads, and broadcasting stay gated on the API key. Settings lets the
key be left empty and explains the difference.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@TenGosc007
refactor(example): remove lazy PermissionsAndroid import
56a9269
@TenGosc007 @devin-ai-integration
chore(android): point playback-only TODO at upstream PR #83
c53e757 
Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@TenGosc007 @devin-ai-integration
feat(android): consume PR #83 SDK build for keyless playback
e06178a 
Bump the Android baseline to pull/83/head (3bd37c9), staged locally as
net.bunny:*:4.2.0-pr83. The nullable BunnyStreamConfig.accessKey there
means playback-only initialization now works on Android: the bridge maps
a blank key to null and the upstream SDK restricts keyless instances to
the public /play endpoints, failing management calls with a terminal
InvalidState before any network I/O.

publishToMavenLocal requires GPG signing upstream, so
scripts/publish-android-sdk.mjs now builds the modules and stages
unsigned AAR+POM+module metadata into ~/.m2/repository directly
(including :recording, which the old script skipped). mavenLocal() is
registered last in android/build.gradle so released versions still
resolve from Maven Central; -PbunnyStreamSdkVersion overrides the pin.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@TenGosc007 @devin-ai-integration
feat(example): add direct live playback and use configured key everyw…
48c8fb2 
…here

Direct live play mirrors the upstream Android demo play-a-stream-by-id
flow: a new modal on the Home screen accepts a stream ID (defaulting to
the configured library) and opens the live player without listing, which
keeps it usable in playback-only mode — public live streams resolve via
the SDK /live/{id}/play endpoint.

Also fixes token-auth signing keys leaking from .env directly: Player,
VideoList, and LiveStreams screens now sign playback tokens with the
configured (stored) access key, so a key entered via Settings is honored.
The live player getLiveStream enrichment is skipped entirely in
playback-only mode instead of logging a missing-key failure, and the
unconfigured empty-state message now says listing needs an API key.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@TenGosc007 @devin-ai-integration
refactor(example): share the direct-play dialog between VOD and live
0b8d5d7 
DirectVideoPlayModal and DirectLivePlayModal were near-identical (load
last-used values, field + library inputs, cancel/confirm row). Extract the
common UI and state into DirectPlayModal; the wrappers now only supply the
labels, env defaults, and their own storage keys.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@TenGosc007 @devin-ai-integration
feat(example): clarify the optional API key in Settings
e1d8263 
The key field placeholder now says it can be left empty, and the hint
below it reflects the current mode: full access with a key, playback-only
without one.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@TenGosc007 @devin-ai-integration
fix(example): key speed-picker rows by index
efcdeda 
key={row[0]} produced an undefined key — and the React "unique key"
warning — whenever the speeds list was short enough to leave an empty
second row.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@TenGosc007 @devin-ai-integration
test(example): match the new API-key placeholder in Settings
87e3484 
Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@TenGosc007
chore(agents): add explicit git commit/push policy for AI agents
d48075b
@TenGosc007
chore(android): update SDK baseline to main after PR #83 merge
1b25a8c
@TenGosc007
chore(android): update SDK baseline to 4.2.0 release
e624bbd
@TenGosc007 @devin-ai-integration
fix(example): restore message constant exports used by tests
e071052 
src/__tests__/example.playbackErrors.test.ts imports ACCESS_DENIED_MESSAGE
and NOT_FOUND_MESSAGE via requireActual; unexporting them broke the suite.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@TenGosc007
TenGosc007 force-pushed the feat/optional-access-key branch from 369d260 to e071052 Compare October 16, 2026 11:45
TenGosc007 and others added 6 commits October 16, 2026 15:20
@TenGosc007 @devin-ai-integration
chore(android): pin SDK build with PR #87 User-Agent format
1a8823c 
Bumps mavenVersion to a mavenLocal build of main@641565e (merge of #87),
which composes the User-Agent as platform UA + bunny-stream-android/<ver>
(<device type>) + integrator. The wrapper already forwards its version as
the integrator, so requests now carry e.g. Dalvik/2.1.0 (...)
bunny-stream-android/4.2.1-pr87 (mobile) bunny-stream-react-native/<ver>.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@TenGosc007
chore(android): pin SDK build with PR #88 Widevine L3 fix
39cb4a6 
PR #88 merged into main at 08bff6a after 4.2.0 was tagged, superseding
the previous 4.2.1-pr87 pin (641565e). This local mavenLocal build
carries both #87 (User-Agent format) and #88 (Enterprise DRM limits
on Widevine L3 devices).
@TenGosc007 @devin-ai-integration
feat(android): bridge Enterprise DRM security-level handling
04ec2fe 
Intersect setVideoQuality overrides with the SDK's L3 rendition cap so a
quality request cannot exceed what the license allows — "auto" previously
wiped the cap entirely. Surface the SDK's pre-load security-level refusal
as a structured onError (nativeCode ERROR_CODE_DRM_SYSTEM_ERROR) instead
of only a message string, so JS can classify it as terminal.

The example maps the media3 DRM error family to a "can't be played on
this device" state with no retry — the hardware level cannot change.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@TenGosc007 @devin-ai-integration
docs(android): document Enterprise DRM bridging
f50a67f 
Document the new drm/ package in ARCHITECTURE.md, describe the Widevine
L3 cap and security-level refusal in the secure-playback and
handle-errors guides, and note the cap intersection on the public
VideoQualityPreference type. Renames the view helper to drmMaxVideoSize
to mirror the SDK's naming.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@TenGosc007 @devin-ai-integration
chore(android): pin stable 4.2.1 SDK release
b32f1bc 
4.2.1 is now published to Maven Central (tag 08bff6a) and already
contains the PR #87 User-Agent format and PR #88 Widevine L3 handling,
so the local 4.2.1-pr88 mavenLocal pin is no longer needed.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
@TenGosc007
chore: bump version to 1.0.0
f561414
@TenGosc007
TenGosc007 merged commit 2e6819d into main Oct 16, 2026
3 checks passed
@TenGosc007
TenGosc007 deleted the feat/optional-access-key branch October 16, 2026 14:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jakubboguski jakubboguski jakubboguski approved these changes

Assignees

@TenGosc007 TenGosc007

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@TenGosc007 @jakubboguski