Fix Vidmoly session verification and preserve upload denial causes

lib/vidmoly-upload.js

@@ -104,23 +104,30 @@ class VidmolyUploader {
     });
 
     const body = await res.text();
-    if (res.status === 401 || res.status === 403 || /incorrect|invalid|wrong/i.test(body)) {
+    if (res.status === 401) {
       throw new Error('Vidmoly Login fehlgeschlagen: Falscher Username oder Passwort');
     }
     if (res.status < 200 || res.status >= 300) {
       throw new Error(`Vidmoly Login fehlgeschlagen: HTTP ${res.status}`);
     }
-    if (!this.cookies.has('vidmoly_session')) {
+    let loginPayload = null;
+    try { loginPayload = JSON.parse(body); } catch {}
+    if (Number(loginPayload?.otp_required) === 1) {
+      throw new Error('Vidmoly Login fehlgeschlagen: OTP erforderlich');
+    }
+    if (!this.cookies.get('vidmoly_session')) {
       throw new Error('Vidmoly Login fehlgeschlagen: Keine Session erhalten (vidmoly_session fehlt)');
     }
 
-    // Probe the upload API so downstream getUploadParams() has a warm path.
-    const probe = await this._fetch(`${BASE_URL}/api/upload/config`);
+    const probe = await this._fetch(`${BASE_URL}/api/auth/me`);
     const probeBody = await probe.text();
     let probeJson = null;
     try { probeJson = JSON.parse(probeBody); } catch {}
-    if (!probeJson || !probeJson.sess_id || !probeJson.upload_url) {
-      throw new Error('Vidmoly Login fehlgeschlagen: Session konnte nicht verifiziert werden (API-Probe)');
+    if (probe.status < 200 || probe.status >= 300) {
+      throw new Error(`Vidmoly Login fehlgeschlagen: Sitzungsprüfung HTTP ${probe.status}`);
+    }
+    if (!probeJson?.user || typeof probeJson.user !== 'object' || Array.isArray(probeJson.user) || !Object.keys(probeJson.user).length) {
+      throw new Error('Vidmoly Login fehlgeschlagen: Sitzungsprüfung enthält keinen Benutzer');
     }
   }
 
@@ -133,17 +140,36 @@ class VidmolyUploader {
     const res = await this._fetch(`${BASE_URL}/api/upload/config`);
     const body = await res.text();
     let payload = null;
-    try { payload = JSON.parse(body); } catch {
+    try { payload = JSON.parse(body); } catch {}
+    const errorCode = String(payload?.message || payload?.statusMessage || '');
+    if (/\bDISK_FULL\b/.test(errorCode)) {
+      throw new Error('Vidmoly: Speicherplatz des Accounts voll (disk full)');
+    }
+    if (/\bUPLOAD_IP_BLACKLIST\b/.test(errorCode)) {
+      throw new Error('Vidmoly: Upload für diese IP-Adresse gesperrt');
+    }
+    if (/\bUPLOAD_DISABLED\b/.test(errorCode)) {
+      throw new Error('Vidmoly: Upload für diesen Account deaktiviert');
+    }
+    if (res.status < 200 || res.status >= 300) {
+      throw new Error(`Vidmoly: Upload-Konfiguration HTTP ${res.status}`);
+    }
+    if (!payload) {
       throw new Error('Vidmoly: /api/upload/config lieferte kein JSON — evtl. nicht eingeloggt?');
     }
-    if (!payload || !payload.sess_id || !payload.upload_url) {
+    if (typeof payload.sess_id !== 'string' || !payload.sess_id.trim() || typeof payload.upload_url !== 'string' || !payload.upload_url.trim()) {
       throw new Error('Vidmoly: /api/upload/config unvollständig (sess_id/upload_url fehlt)');
     }
+    let uploadUrl;
+    try { uploadUrl = new URL(payload.upload_url); } catch {}
+    if (!uploadUrl || !['http:', 'https:'].includes(uploadUrl.protocol) || uploadUrl.username || uploadUrl.password) {
+      throw new Error('Vidmoly: Ungültige Upload-Server-Adresse');
+    }
     return {
       uploadUrl: payload.upload_url,
       // Fields verified from a real browser POST capture.
       // to_json=1 forces a JSON response instead of an HTML redirect page.
-      params: { sess_id: payload.sess_id, to_json: '1', fld_id: '0' },
+      params: { sess_id: payload.sess_id, tos: '1', to_json: '1', fld_id: '0' },
       fileFieldName: 'file'
     };
   }