1 files changed, 10 insertions, 9 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport-media.js b/packages/meshbay-hub/src/meshbay_hub/static/transport-media.js
index f94eb40..ca015b9 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport-media.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport-media.js
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: LGPL-3.0-or-later
+// Part of MeshBay's protocol layer, under the LGPL so that any client may use it.
 // What the media apps ask the node for: TMDB and MusicBrainz metadata, audio
 // transcoding, subtitles, and the video stream.
 //
@@ -99,25 +101,24 @@ extendTransport(class {
    * queried in (e.g. "fr-FR") — one for the whole node, since both are one
    * operator's shared credential/cache, not a per-group concern (see
    * setTmdbEnabled below for the per-group on/off switch). Signed like
-   * setAppsEnabled/updateRoot — an unsigned change would let any
+   * setAppsEnabled — an unsigned change would let any
    * member alter outbound third-party network traffic the operator never
    * agreed to (docs/MESHBAY_DESIGN.md §9.7, §6.5). `token: ''` explicitly clears
    * a previously-set custom token; omit it (undefined/null), like
    * `language`, to leave whatever is stored unchanged.
    */
   async setTmdbConfig(token, language, signFn) {
+    const tok = token === undefined ? null : token;
+    const lang = language === undefined ? null : language;
     const msg = await this._sendAndWait({
-      type: 'tmdb_config', v: '0.7',
-      token: token === undefined ? null : token,
-      language: language === undefined ? null : language,
+      type: 'tmdb_config', v: '0.7', token: tok, language: lang,
     });
     if (msg.type === 'error') throw new Error(msg.detail);
     if (msg.type === 'admin_challenge') {
-      // Must match the node's subject byte-for-byte (apps/video_meta.py
-      // _do_tmdb_config) — the token itself is never part of the subject
-      // (it would end up in the audit log in plaintext), only whether one
-      // was supplied. The language is not a secret, so it appears as-is.
-      const subject = `custom_token=${token ? 'yes' : 'no'},language=${language || 'default'}`;
+      // Must match the node's subject byte for byte (apps/video_meta.py
+      // _do_tmdb_config). The token is named by its SHA-256, never written:
+      // the subject ends up in the audit log.
+      const subject = await window.MeshBayCrypto.tmdbConfigSubject(tok, lang);
       return this._authorizeAdminOp(msg, 'tmdb_config', subject, signFn);
     }
     return msg;