Arkadiusz Fal 9b5d2b001f Probe before rejecting a credential
Invidious answers a revoked session with 403, not 401, so the failure
reached recordServerOutcome as a plain HTTP error and fell through the
switch: an account whose session died server-side kept reporting
signedIn forever, and credentialRejected was unreachable on the
commonest backend. The roadmap's rule cuts the other way too — a raw
401/403 alone must never reject, because the failure may be about the
operation (someone else's playlist) rather than the login.

recordServerOutcome now treats .unauthorized and HTTP 401/403 alike as
suspicion, not verdict: after the existing basic-auth-proxy exclusion,
it hands the account to a new CredentialProbeService, which re-asks the
server with a harmless authenticated read — Invidious's auth
subscriptions endpoint with the same SID, Piped's subscriptions with
the same token. Only a probe-level 401/403 marks the account
credentialRejected; success means the original failure was
operation-specific and the account stays signedIn; an unreachable
probe records exactly that, and anything ambiguous leaves the status
alone.

The probe applies its verdict only if the account still exists and
still holds the credential it tested — a replacement or an identity
flip mid-flight drops the answer, and a dropped answer starts no
cooldown, so the login the user just fixed is examined without delay.
One probe per account may be in flight; an answered probe stands for a
cooldown before the next suspicion re-asks.

With rejection finally reachable, the existing machinery engages on
its own: the validators fall back to local data, server mutations
pause, and a successful call or re-sign-in lifts the mark.
2026-09-01 23:56:26 +02:00
2026-04-18 20:37:24 +02:00
2026-08-23 11:04:21 +00:00
2026-04-18 20:37:24 +02:00
2026-04-18 20:37:24 +02:00
2026-04-18 20:37:24 +02:00
2026-04-18 20:37:24 +02:00
2026-04-18 20:37:24 +02:00
2026-04-18 20:37:24 +02:00
2026-04-18 20:37:24 +02:00
2026-04-18 20:37:24 +02:00
2026-08-23 12:46:11 +02:00
2026-04-23 15:45:49 +02:00
2026-04-18 20:37:24 +02:00
2026-04-18 20:38:00 +02:00
2021-11-10 00:25:38 +01:00
2026-07-18 17:38:43 +02:00

Yattee logo

Yattee

Privacy oriented video player for iOS, tvOS and macOS

AGPL v3 GitHub issues GitHub pull requests

Discord

Yattee 2 is in the works! A new version of the app is being built with a refreshed experience. It pairs with the new Yattee Server — a self-hosted backend powered by yt-dlp that supports 1000+ sites. Join the TestFlight beta to try early builds, and check the new documentation site at docs.yattee.stream for guides, roadmap and changelog.

Features

  • Native user interface built with SwiftUI with customization settings
  • Player queue and history
  • Player component with custom controls, gestures and support for 4K playback
  • Fullscreen, Picture in Picture and background audio playback
  • SponsorBlock, configurable categories to skip

License

Yattee and its components is shared on AGPL v3 license.

Description
Privacy oriented video player for iOS, tvOS and macOS
Readme AGPL-3.0 344 MiB
Languages
Swift 96.9%
Ruby 2.7%
C 0.3%