fix(streaming): let a container's broker_secret override STREAMING_BROKER_SECRET

backend/handler/streaming/config.py

@@ -442,7 +442,7 @@ def _resolve_one(
         container_label=container_label if isinstance(container_label, str) else None,
         memory_card_sync=card_sync,
         clears_stale_saves=clears_stale_saves,
-        broker_secret=STREAMING_BROKER_SECRET or str(entry.get("broker_secret", "")),
+        broker_secret=str(entry.get("broker_secret") or STREAMING_BROKER_SECRET),
         library_path=str(entry.get("library_path") or LIBRARY_BASE_PATH).rstrip("/"),
         capabilities=capabilities,
         state_transfer=state_transfer_limits(emulator),

backend/tests/endpoints/test_streaming.py

@@ -342,6 +342,32 @@ def test_get_config_warns_on_missing_platform(client, access_token, caplog):
     assert "missing platform/host" in caplog.text
 
 
+def test_a_container_broker_secret_overrides_the_env_secret():
+    """Containers with different BROKER_SECRETs each authenticate with their own."""
+    with patch("handler.streaming.config.STREAMING_BROKER_SECRET", "from-env"):
+        container = resolve_entry({**_webstation(), "broker_secret": "from-config"})
+    assert container is not None
+    assert container.broker_secret == "from-config"
+
+
+@pytest.mark.parametrize(
+    "configured", [{}, {"broker_secret": None}, {"broker_secret": ""}]
+)
+def test_a_container_without_a_broker_secret_falls_back_to_the_env_secret(configured):
+    with patch("handler.streaming.config.STREAMING_BROKER_SECRET", "from-env"):
+        container = resolve_entry({**_webstation(), **configured})
+    assert container is not None
+    assert container.broker_secret == "from-env"
+
+
+def test_a_blank_broker_secret_with_no_env_secret_sends_none():
+    """A bare `broker_secret:` key is YAML null, not the secret "None"."""
+    with patch("handler.streaming.config.STREAMING_BROKER_SECRET", ""):
+        container = resolve_entry({**_webstation(), "broker_secret": None})
+    assert container is not None
+    assert container.broker_secret == ""
+
+
 def test_a_config_warning_does_not_print_the_broker_secret(
     client, access_token, caplog
 ):

env.template

@@ -204,7 +204,7 @@ AUTHENTIK_SECRET_KEY=  # Authentik secret key
 AUTHENTIK_BOOTSTRAP_PASSWORD=  # Initial Authentik admin bootstrap password
 
 # Emulator Streaming
-STREAMING_BROKER_SECRET=  # Shared secret matching streaming containers' BROKER_SECRET, required for broker auth
+STREAMING_BROKER_SECRET=  # BROKER_SECRET for streaming containers that set no broker_secret in config.yml
 STREAMING_SAVE_TIMEOUT=45  # Seconds to wait for a broker save-and-exit (raise if a broker has SAVE_WAIT > 45)
 STREAMING_LAUNCH_TIMEOUT=600  # Seconds a webstation activate may take, covering pkg/archive extraction before the emulator starts
 STREAMING_STATE_HISTORY_LIMIT=50  # Save states kept per ROM, emulator and user; oldest are pruned past this (0 disables)

examples/config.example.yml

@@ -228,7 +228,7 @@
 #       host: https://192.168.1.56:3010  # browser-facing UI, must be https
 #       subfolder: /streaming            # matches the container's SUBFOLDER
 #       # library_path: /mnt/games/library  # only if the container can't mount the library at /romm/library
-#       broker_secret: change-me         # matches the container's BROKER_SECRET
+#       broker_secret: change-me         # the container's BROKER_SECRET; overrides STREAMING_BROKER_SECRET
 #       label: Emulation station
 #       broker_host: http://192.168.1.56:3010  # server-to-broker URL, when RomM can't dial `host` itself
 #       platforms: