From 353bd009ed7e93b9c436c3d588ca6e4d16fd66e3 Mon Sep 17 00:00:00 2001
From: MasutaYunikon <quentinmail974@gmail.com>
Date: Tue, 14 Apr 2026 20:55:53 +0200
Subject: [PATCH] =?UTF-8?q?fix:=20Deux=20corrections=20:=20=20=20=20=20=20?=
 =?UTF-8?q?oauth/start=20=E2=80=94=20X-Plex-Client-Identifier=20ajout?=
 =?UTF-8?q?=C3=A9=20dans=20le=20body=20du=20POST=20(Plex=20l'exige=20dans?=
 =?UTF-8?q?=20le=20body=20pour=20la=20cr=C3=A9ation=20du=20pin,=20pas=20ju?=
 =?UTF-8?q?ste=20dans=20les=20headers).=20forwardUrl=20pointe=20maintenant?=
 =?UTF-8?q?=20vers=20https://plex.tv=20au=20lieu=20d'=C3=AAtre=20vide=20?=
 =?UTF-8?q?=E2=80=94=20sans=20=C3=A7a=20Plex=20ne=20valide=20pas=20le=20pi?=
 =?UTF-8?q?n=20c=C3=B4t=C3=A9=20serveur.=20=20=20=20=20=20oauth/poll=20?=
 =?UTF-8?q?=E2=80=94=20X-Plex-Client-Identifier=3Dfankarr=20pass=C3=A9=20e?=
 =?UTF-8?q?n=20query=20param=20sur=20l'URL=20du=20GET.=20Plex=20exige=20qu?=
 =?UTF-8?q?e=20le=20m=C3=AAme=20clientID=20que=20celui=20utilis=C3=A9=20lo?=
 =?UTF-8?q?rs=20de=20la=20cr=C3=A9ation=20soit=20pr=C3=A9sent=20pour=20r?=
 =?UTF-8?q?=C3=A9cup=C3=A9rer=20le=20token.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 server/index.ts | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/server/index.ts b/server/index.ts
index 3a1522e..eb72040 100644
--- a/server/index.ts
+++ b/server/index.ts
@@ -1342,13 +1342,14 @@ app.post('/api/plex/oauth/start', requireAuth, async (_req, res) => {
         const data = await plexFetch(`${PLEX_TV_API}/pins`, {
             method : 'POST',
             headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body   : new URLSearchParams({ strong: 'true' }).toString(),
+            body   : new URLSearchParams({ strong: 'true', 'X-Plex-Client-Identifier': 'fankarr' }).toString(),
         })
         const pinId   = data.id
         const pinCode = data.code
         if (!pinId || !pinCode) throw new Error('Pin non reçu')
 
-        const authUrl = `https://app.plex.tv/auth#?clientID=fankarr&code=${pinCode}&context[device][product]=FanKarr&forwardUrl=`
+        // forwardUrl doit pointer vers une URL accessible pour que Plex valide le pin
+        const authUrl = `https://app.plex.tv/auth#?clientID=fankarr&code=${pinCode}&context%5Bdevice%5D%5Bproduct%5D=FanKarr&forwardUrl=https%3A%2F%2Fplex.tv`
         logger.info('plex', `OAuth démarré — pinId ${pinId}`)
         res.json({ ok: true, pinId, pinCode, authUrl })
     } catch (err) {
@@ -1362,11 +1363,11 @@ app.post('/api/plex/oauth/start', requireAuth, async (_req, res) => {
 app.get('/api/plex/oauth/poll/:pinId', requireAuth, async (req, res) => {
     const pinId = String(req.params.pinId)
     try {
-        const data = await plexFetch(`${PLEX_TV_API}/pins/${pinId}`)
+        // Le clientID doit correspondre exactement à celui utilisé pour créer le pin
+        const data = await plexFetch(`${PLEX_TV_API}/pins/${pinId}?X-Plex-Client-Identifier=fankarr`)
         const token = data.authToken
         if (!token) { res.json({ ok: false, pending: true }); return }
 
-        // Token récupéré — récupérer les serveurs
         const resources = await plexFetch(
             'https://plex.tv/api/v2/resources?includeHttps=1&includeRelay=1&includeIPv6=1',
             { headers: { 'X-Plex-Token': token } }