Bug: Schedules Direct Token Missing

[Grosner300]

StreamMasterAPI.1-20250525-Relevant.log

Describe the Bug

Log file shows errors indicating TOKEN_MISSING... (see attached log file).
No EPG downloaded.
The Schedule Direct Subscribed Line Ups vanish but after a few minutes, they reappear.

Steps to Reproduce

Enable Schedules Direct
Set EPG Days to download to a new number.
Add Schedule Direct Username and Password
Wait for EPG to update.
See log file contains messages.

Stream Master Version

0.15.0

Relevant Logs

\n\n"2025-05-25 18:35:15","Warning","0","","Token cleared.",\n"2025-05-25 18:35:15","Error","0","","/20141201/lineups: 401 Unauthorized : Token=29047...\n{""response"":""TOKEN_MISSING"",""code"":1004,""serverID"":""20141201.web"",""message"":""Access to account via JSON has been disabled due to 1000 requests for images without presenting a token. Please contact Schedules Direct support: service@schedulesdirect.org for more information or create a support ticket: https:\/\/www.schedulesdirect.org\/lineupsupport"",""token"":""*** redacted *** "",""datetime"":""2025-05-23T19:10:01Z""}",\n\n"2025-05-25 18:35:15","Warning","0","","Token cleared.",\n"2025-05-25 18:35:15","Warning","0","","Token cleared.",\n"2025-05-25 18:35:15","Error","0","","/20141201/token: 401 Unauthorized : Token=...\n{""response"":""TOKEN_MISSING"",""code"":1004,""serverID"":""20141201.web"",""message"":""Access to account via JSON has been disabled due to 1000 requests for images without presenting a token.

Relevant Configuration

Schedules Direct: Enabled
User Name and Password (set to valid values)
Enable Series Poster Art: Unchecked
Series Poster Aspect Ratio: 2x3
Artwork Size MD: Sm
EPG Days to Download: 6
Use Single image for EPG: Unchecked

Verification

• I have included COMPLETE logs, not just error messages
• I have provided detailed reproduction steps
• I have checked for similar issues before creating this report
• I have tried the latest release to see if the issue has already been fixed
• I understand that incomplete reports may be closed without investigation

[carlreid]

Thanks @Grosner300. I've made some adjustments on the pr-128 image tag which I hope show up as errors being logged for you. Could you try run it and see if you see any changes regarding it?

I'm still not 100% sure what is causing this. It might be either the token is not being read correctly and then left off these requests (should now throw an exception on the new changes) or I wonder if there's additional redirects causing the token header to be dropped.

Anyway, the PR changes should help diagnose it some more.

[Grosner300]

Carl, It appears that Schedule Direct has locked my account, and this may be a root cause of the issue concerning the messages I sent to you. I’m guessing that at some point requests were sent from Stream Master without a token and that may have triggered the account lock. The account does not appear to automatically unlock after the midnight reset documented in their API. In monitoring today’s traffic to SD: After the initial login credentials are sent to Schedules Direct, the following message is returned: { "response": "TOKEN_MISSING", "code": 1004, "serverID": "20141201.web", "message": "Access to account via JSON has been disabled due to 1000 requests for images without presenting a token. Please contact Schedules Direct support: ***@***.******@***.***> for more information or create a support ticket: https://www.schedulesdirect.org/lineupsupport", "token": "CAFEDEADBEEFCAFEDEADBEEFCAFEDEADBEEFCAFE", "datetime": "2025-05-23T19:10:01Z" I have just now reached out to SD to unblock my account. Note that I cannot test the latest pull of Stream Master until after they unblock my account. Thanks! Gary From: Carl Reid ***@***.***> Sent: Tuesday, May 27, 2025 10:51 AM To: carlreid/StreamMaster ***@***.***> Cc: Gary Rosner ***@***.***>; Mention ***@***.***> Subject: Re: [carlreid/StreamMaster] Bug: Schedules Direct Token Missing (Issue #127) [https://avatars.githubusercontent.com/u/33623601?s=20&v=4]carlreid left a comment (carlreid/StreamMaster#127)<#127 (comment)> Thanks @Grosner300<https://github.com/Grosner300>. I've made some adjustments on the pr-128 image tag which I hope show up as errors being logged for you. Could you try run it and see if you see any changes regarding it? I'm still not 100% sure what is causing this. It might be either the token is not being read correctly and then left off these requests (should now throw an exception on the new changes) or I wonder if there's additional redirects causing the token header to be dropped. Anyway, the PR changes should help diagnose it some more. — Reply to this email directly, view it on GitHub<#127 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AF4DUDYV4Z3KKRQLANX47MT3AR3UNAVCNFSM6AAAAAB54CRBJ2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDSMJSHAYTQOBXGI>. You are receiving this because you were mentioned.Message ID: ***@***.******@***.***>>

[carlreid]

I’m guessing that at some point requests were sent from Stream Master without a token and that may have triggered the account lock. The account does not appear to automatically unlock after the midnight reset documented in their API.

Ah, sorry to hear that has happened. I've been trying to download some EPG and image content, where everything appears to be going fine from what I can tell in debug mode.

Hopefully Schedules Direct might be able to give context as to which requests were made causing the lock-out. Otherwise when the account is unlocked, I think that the additional safeguards on pr-128 tag ought to prevent it from happening, simply bad adding a 10 minute timeout if TOKEN_MISSING is encountered.

[Grosner300]

Thank you for pr-128 and the additional logging.

Please see attached log file for error related excerpts from the full StreamMasterAPI.log file.
Observations:

1. It appears to me: the INVALID_USER response is received because a refreshed token is immediately cleared before the next request.
2. streammaster.xmltv file is encountering unexpected end of file.
3. Image downloads work without blocking the SD account.

StreamMasterAPI-Excerpts-20250529.log

[carlreid]

Thanks for the logs. I wonder if it's something to do with multithreading and the underlying token stored in StreamMaster. I've updated pr-128 with a different approach to handling the token which should avoid those kinds of things, I hope.

It appears to me: the INVALID_USER response is received because a refreshed token is immediately cleared before the next request.

Unfortunately the logs order doesn't always meet the logic flow in the code. In that case, the Token cleared. entry is because the INVALID_USER is handled, where it clears the token right away (it is assuming invalid credentials), then the following log is from other code handling the response later and logging what Schedules Direct returned. So I think this is fine.

streammaster.xmltv file is encountering unexpected end of file.

Seems odd. I think this should be investigated later if it persists.

Image downloads work without blocking the SD account.

Glad to hear.

If you could try pr-128 and see if it works around the INVALID_USER issue, that would be great.

[Grosner300]

If you could try pr-128 and see if it works around the INVALID_USER issue, that would be great.

Finding:
The INVALID_USER still occurs. I think we identified the cause as a timing or Schedules Direct propagation issue:

Event Sequence:

• Token is cleared then requested.
• Token received.
• Token is used (69 milliseconds later).
• Result is INVALID_USER and status 403.
• Breakpoint here and wait 2-3 seconds.
• Exact same request sent again and this time it works.

Analysis
From the packet capture it appears the request using the refreshed (new) fails when there is not enough time between the receipt of a valid token from Schedules Direct and the use of this token. If high speed refresh happens too frequently, max image download message is returned (because too many images were requested without valid token).

This image includes about a 3 second delay we added to demonstrate that with a little extra time, the same request will work.

Suggestion:
After obtaining a token, check the Schedule Direct status to be sure the new token is available (perhaps checking values: time stamps, token expiration, etc.).
https://github.com/SchedulesDirect/JSON-Service/wiki/API-20141201#getting-status