1 files changed, 7 insertions, 8 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport-media.js b/packages/meshbay-hub/src/meshbay_hub/static/transport-media.js
index f94eb40..cf53c08 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport-media.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport-media.js
@@ -106,18 +106,17 @@ extendTransport(class {
    * `language`, to leave whatever is stored unchanged.
    */
   async setTmdbConfig(token, language, signFn) {
+    const tok = token === undefined ? null : token;
+    const lang = language === undefined ? null : language;
     const msg = await this._sendAndWait({
-      type: 'tmdb_config', v: '0.7',
-      token: token === undefined ? null : token,
-      language: language === undefined ? null : language,
+      type: 'tmdb_config', v: '0.7', token: tok, language: lang,
     });
     if (msg.type === 'error') throw new Error(msg.detail);
     if (msg.type === 'admin_challenge') {
-      // Must match the node's subject byte-for-byte (apps/video_meta.py
-      // _do_tmdb_config) — the token itself is never part of the subject
-      // (it would end up in the audit log in plaintext), only whether one
-      // was supplied. The language is not a secret, so it appears as-is.
-      const subject = `custom_token=${token ? 'yes' : 'no'},language=${language || 'default'}`;
+      // Must match the node's subject byte for byte (apps/video_meta.py
+      // _do_tmdb_config). The token is named by its SHA-256, never written:
+      // the subject ends up in the audit log.
+      const subject = await window.MeshBayCrypto.tmdbConfigSubject(tok, lang);
       return this._authorizeAdminOp(msg, 'tmdb_config', subject, signFn);
     }
     return msg;