# 1. 注册（仅首个用户为管理员，重复注册为普通用户）
$ curl -s -w "\n[%{http_code}]\n" -X POST http://localhost:8136/auth/users \
    -H 'Content-Type: application/json' \
    -d '{"username":"admin","email":"admin@example.com","password":"q1w2e3r4"}'
{"id":"3dcefdeb-254b-40f9-beeb-e1d7dd547241","createdDate":"2026-10-29T10:13:23.469473Z","lastUsed":"2026-10-29T10:13:23.469473Z","device":"curl","token":"W5zY5ejXbN56Ugj5goFkNkWjNapfZxfJ6_BnQ77EBzjeFWmWoO-Ygs74MGidjqOfuU8md1n2V-G4m7Rfd25_Rw"}
[201]

# 2. 登录已有账号
$ curl -s -w "\n[%{http_code}]\n" -X POST http://localhost:8136/auth/sessions \
    -H 'Content-Type: application/json' \
    -d '{"login":"admin","password":"q1w2e3r4"}'
{"id":"78e78078-6c80-419a-986c-f1ac01a56f6d","createdDate":"2026-10-29T10:34:18.100827Z","lastUsed":"2026-10-29T10:34:18.100827Z","device":"curl","token":"VA-pPK1MRZVcyu6GqELk4yP4AcxXeXpAxtU3Rui2svv3kqQAy3Fjidw5l06IuiTfsfjYyQD9F2jKx5vK4AoZUg"}
[201]

# 创建（管理员会话）
$ curl -s -w "\n[%{http_code}]\n" -X POST http://localhost:8136/auth/keys \
    -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
    -d '{"name":"docdemo","claims":{"permissions":["core.read","core.play"]}}'
{"id":"ee1691bb-0946-4e90-81a3-8b176121282a","name":"docdemo","claims":{"permissions":["core.read","core.play"]},"token":"y8WgTX_qztDG-uJQbW8vZCp2aVN4g9Y82DE9Ml8HnPsNggaR-DAvPUNnJ_3mIqlagUBDUXwjwxpbwAxqAv3E9w"}
[201]

# 使用（X-Api-Key 调媒体库）
$ curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8136/api/shows \
    -H "X-Api-Key: y8WgTX_qztDG-uJQbW8vZCp2aVN4g9Y82DE9Ml8HnPsNggaR-DAvPUNnJ_3mIqlagUBDUXwjwxpbwAxqAv3E9w"
200

# 用会话换正式 JWT（Traefik 内部做的事，手动可复现）
$ curl -s http://localhost:8136/auth/jwt -H "Authorization: Bearer $TOKEN" | cut -d. -f2 | python3 -c "import sys,base64,json;s=sys.stdin.read().strip();s+='='*(-len(s)%4);print(json.dumps(json.loads(base64.urlsafe_b64decode(s)),ensure_ascii=False))" | head -c 300
{"exp": 1793273658, "iat": 1793270058, "iss": "http://localhost:8136", "jti": "b32056cb-91cd-4e81-9d06-9aa52d28f7ba", "permissions": ["users.read", "users.write", "users.delete", "apikeys.read", "apikeys.write", "core.read", "core.write", "core.play", "scanner.trigger", "scanner.guess", "scanner.sea

# 登出指定会话（按会话 id 删除，id 取登录响应的 id 字段）
$ curl -s -w "\n[%{http_code}]\n" -X DELETE http://localhost:8136/auth/sessions/78e78078-6c80-419a-986c-f1ac01a56f6d \
    -H "Authorization: Bearer $TOKEN"
{"id":"78e78078-6c80-419a-986c-f1ac01a56f6d","createdDate":"2026-10-29T10:34:18.100827Z","lastUsed":"2026-10-29T10:34:18.100827Z","device":"curl"}
[200]

$ curl -s http://localhost:8136/swagger/ | grep -oE '/[a-z]+/(swagger/doc\.json|openapi\.json)'
/api/swagger/doc.json
/auth/swagger/doc.json
/scanner/openapi.json
/video/swagger/doc.json

$ curl -s http://localhost:8136/api/swagger/doc.json | python3 -c "
import json,sys
d=json.load(sys.stdin)
print(d['info'])
print('paths:', len(d['paths']))"
{'title': 'Kyoo API', 'description': 'Kyoo media browser API (unofficial doc)', 'version': '5.0.0'}
paths: 56

# 空库列表（游客可读）
$ curl -s http://localhost:8136/api/shows
{"items":[],"this":"http://127.0.0.1:8136/api/shows","next":null}

# 详情：不存在的 slug
$ curl -s -w "\n[%{http_code}]\n" http://localhost:8136/api/shows/not-exist-slug
{"status":404,"message":"No show found with the slug or id: not-exist-slug","details":null}
[404]

# 1. 注册视频（rendering 为容器内路径的 sha1，part=null 单文件）
$ RENDER=$(printf '/video/Big Buck Bunny (2008).mp4' | sha1sum | cut -d' ' -f1)
$ curl -s -w "\n[%{http_code}]\n" -X POST http://localhost:8136/api/videos \
    -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
    -d "[{\"path\":\"/video/Big Buck Bunny (2008).mp4\",\"rendering\":\"$RENDER\",\"part\":null,\"version\":1,\"guess\":{\"title\":\"Big Buck Bunny\",\"kind\":\"movie\",\"years\":[2008],\"from\":\"kyoo-doc-demo\",\"history\":[]}}]"
{"id":"adea946d-2258-4a9f-832a-b28d2e8f287a","path":"/video/Big Buck Bunny (2008).mp4","rendering":"9f784aa9c03cbeaaf95ff595519ea7265c6e040d","part":null,"version":1,"guess":{"title":"Big Buck Bunny","kind":"movie","years":[2008],"from":"kyoo-doc-demo","history":[]}}
[201]

# 2. 未匹配队列
$ curl -s http://localhost:8136/api/videos/unmatched -H "Authorization: Bearer $TOKEN"
{"items":[{"id":"adea946d-2258-4a9f-832a-b28d2e8f287a","path":"/video/Big Buck Bunny (2008).mp4","rendering":"9f784aa9c03cbeaaf95ff595519ea7265c6e040d","part":null,"version":1,"guess":{"from":"kyoo-doc-demo","kind":"movie","title":"Big Buck Bunny","years":[2008],"history":[]},"createdAt":"2026-10-29T10:15:40.044Z","updatedAt":"2026-10-29T10:15:40.044Z"}],"this":"http://127.0.0.1:8136/api/videos/unmatched","next":null}

# 3. 文件名识别结果
$ curl -s http://localhost:8136/api/videos/guesses -H "Authorization: Bearer $TOKEN"
{"paths":["/video/Big Buck Bunny (2008).mp4"],"guesses":{},"unmatched":["/video/Big Buck Bunny (2008).mp4"]}

# 上报观看进度（载荷缺 videoId，用 slug 字段触达校验）
$ curl -s -w "\n[%{http_code}]\n" -X POST http://localhost:8136/api/profiles/me/history \
    -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
    -d '[{"slug":"some-episode","percent":45.5,"addedDate":"2026-10-29T12:00:00Z","playedDate":"2026-10-29T12:00:00Z"}]'
{"status":422,"message":"Validation error.","details":{"type":"body","validator":{"schema":{"type":"array","items":{"type":"object","allOf":[{"type":"object","required":["percent","time","playedDate","videoId"],"properties":{"percent":{"minimum":0,"maximum":100,"anyOf":[{"format":"integer","default":0,"type":"string"},{"minimum":0,"maximum":100,"type":"integer"}]},"time":{"minimum":0,"description":"When this episode was stopped (in seconds since the start). This value is null if the entry was never watched or is finished.","anyOf":[{"format":"integer","default":0,"type":"string"},{"minimum":0,"description":"When this episode was stopped (in seconds since the start). This value is null if the entry was never watched or is finished."
[422]

# 空历史的继续观看
$ curl -s http://localhost:8136/api/profiles/me/nextup -H "Authorization: Bearer $TOKEN"
{"items":[],"this":"http://127.0.0.1:8136/api/profiles/me/nextup","next":null}

# 1. 询问播放信息 → 302 重定向
$ curl -s -I http://localhost:8136/api/videos/adea946d-2258-4a9f-832a-b28d2e8f287a/info \
    -H "Authorization: Bearer $TOKEN" | grep -iE 'HTTP/|location'
HTTP/1.1 302 Found
Location: /video/L3ZpZGVvL0JpZyBCdWNrIEJ1bm55ICgyMDA4KS5tcDQ/info

# 2. 跟随重定向拿 ffprobe 元数据
$ curl -s -L http://localhost:8136/api/videos/adea946d-2258-4a9f-832a-b28d2e8f287a/info \
    -H "Authorization: Bearer $TOKEN" | head -c 600
{"path":"/video/Big Buck Bunny (2008).mp4","container":"mov,mp4,m4a,3gp,3g2,mj2","duration":10.0,"video":{"codec":"h264","language":"und","duration":10.0,"bitrate":3997620,"width":1280,"height":720,"aspectRatio":1.7777778,"frameRate":"25/1","pixelFormat":"yuv420p"},"audio":[{"codec":"aac","language":"eng","duration":10.0,"bitrate":69392,"channels":2,"sampleRate":"44100","default":true,"forced":false}],"fonts":[],"chapters":[]}

# 3. 原画质直连（Range 请求分片）
$ curl -s -o /dev/null -L -w "final:%{http_code} size:%{size_download} type:%{content_type}\n" \
    http://localhost:8136/api/videos/adea946d-2258-4a9f-832a-b28d2e8f287a/direct \
    -H "Authorization: Bearer $TOKEN" -r 0-1000
final:206 size:1001 type:video/mp4

# 用户列表（管理员）
$ curl -s http://localhost:8136/auth/users -H "Authorization: Bearer $TOKEN" | head -c 300
{"items":[{"id":"b1d2fc8d-1f73-4c8a-a132-b966450e5e38","username":"admin","email":"admin@example.com","hasPassword":true,"createdDate":"2026-10-29T10:13:23.467403Z","lastSeen":"2026-10-29T10:34:18.28068Z","claims":{"permissions":["users.read","users.write","users.delete","apikeys.read","apikeys.writ

# 注册
$ curl -s -w "\n[%{http_code}]\n" -X POST http://localhost:8136/auth/users \
    -H 'Content-Type: application/json' \
    -d '{"username":"demo1","email":"demo1@example.com","password":"q1w2e3r4"}'
{"id":"2192ac55-9d65-4032-883b-61bf3bbcb893","createdDate":"2026-10-29T10:36:01.467754Z","lastUsed":"2026-10-29T10:36:01.467754Z","device":"curl","token":"FoABpbFSgtSO2DURyuFXX-UHJUF9ssUDRYRT8Lcex-dThxSLbUKD6NEBWS8ieUuFoEm473Db94pCBVh30ywHPg"}
[201]

# demo1 会话访问用户列表 → 权限不足
$ curl -s -w "\n[%{http_code}]\n" http://localhost:8136/auth/users \
    -H "Authorization: Bearer FoABpbFSgtSO2DURyuFXX-UHJUF9ssUDRYRT8Lcex-dThxSLbUKD6NEBWS8ieUuFoEm473Db94pCBVh30ywHPg"
{"status":403,"message":"Missing permissions: users.read.","details":null}
[403]

import requests

BASE = "http://localhost:8136"

class Kyoo:
    def __init__(self, base=BASE, apikey=None):
        self.base, self.apikey = base, apikey
    def _h(self):
        return {"X-Api-Key": self.apikey} if self.apikey else {}
    def shows(self, first=50):
        r = requests.get(f"{self.base}/api/shows", params={"first": first},
                         headers=self._h(), timeout=10)
        r.raise_for_status()
        return r.json()["items"]
    def play_info(self, video_id: str):
        # 302 会携带 /video/<base64url>/info，跟随即得 ffprobe JSON
        r = requests.get(f"{self.base}/api/videos/{video_id}/info",
                         headers=self._h(), timeout=10, allow_redirects=True)
        return r.json()

if __name__ == "__main__":
    kyoo = Kyoo(apikey="y8WgTX_...")   # 换成你自己的 key（/auth/keys 创建）
    print(kyoo.shows())

#!/usr/bin/env bash
# kyoo-call.sh —— 用账号密码调 Kyoo API 的最小脚本
set -euo pipefail
BASE="${BASE:-http://localhost:8136}"
TOKEN=$(curl -s -X POST "$BASE/auth/sessions" \
  -H 'Content-Type: application/json' \
  -d "{\"login\":\"${KYOO_USER:?}\",\"password\":\"${KYOO_PASS:?}\"}" \
  | python3 -c "import json,sys;print(json.load(sys.stdin)['token'])")
curl -s "$BASE$1" -H "Authorization: Bearer $TOKEN" | python3 -m json.tool
# 用法：KYOO_USER=admin KYOO_PASS=q1w2e3r4 ./kyoo-call.sh /api/shows

$ curl -s -w "\n[%{http_code}]\n" -X POST http://localhost:8136/auth/sessions \
    -H 'Content-Type: application/json' \
    -d '{"username":"admin","password":"q1w2e3r4"}'
{"status":422,"message":"Key: 'LoginDto.Login' Error:Field validation for 'Login' failed on the 'required' tag","details":null}
[422]

$ curl -s -w "\n[%{http_code}]\n" http://localhost:8136/api/entries/some-slug -H "Authorization: Bearer bad-token"
{"status":403,"message":"Invalid JWT","details":null}
[403]

$ curl -s -w "\n[%{http_code}]\n" http://localhost:8136/auth/users -H "Authorization: Bearer <空值>"
{"status":401,"message":"Invalid bearer format.","details":null}
[401]