API Access Without Authentication for Specific Devices/IPs

[krasty633]

Hello NextPVR Team,

I am using NextPVR in a Docker environment and would like to access the recording.list API method automatically. Currently, this is only possible with a valid session, which makes automated access difficult.

Feature request:
Please allow specific devices or IP addresses to access the API without additional authentication, or alternatively provide a permanent API token for a device.

Purpose:
To query recording status for monitoring or similar automation tasks


Thank you for considering this request!

[mvallevand]

Did you to get a token is pretty simple with most languages so I don't see the need to fully open API access. There is already Home Assistant integration (untested) here https://github.com/breendan/ha-nextpvr that shows how to get the tuners status in python in more detail then I ever coded.

I do see use case to easily get the recording status remotely using the current unautenticated access logic but the current call http://localhost:8866/services/service?m...ormat=json can return username and passwords so a safer method would be better However I would caution that any automation or action that could shutdown or restart the server could in theory corrupt files and the database even when not recording so better to manually check before doing maintenance.

I like the thought of permanent tokens but I still think that some two factor is necessary

Martin

[sub]

There was a <PermanentSIDs> setting you could specify in config.xml, but checking it just now, it looks like it only applies to very specific scenarios, so not usable for that.

If you'd been running natively, without docker, you could likely have already had it work automatically by specifying whatever made up sid, because there is rules about requests about auto allowing from 127.0.0.1

[sub]

Can your just run nscripthelper to give you the info?

This will basically do the request for you, and make sure it has a valid sid etc, and return xml.