From ed2d8680e46a582399a6b0d7e73bdad4c2a86049 Mon Sep 17 00:00:00 2001
From: Tobias Gesellchen <tobias@gesellix.de>
Date: Sun, 15 Feb 2026 18:54:06 +0100
Subject: [PATCH] fix: align streaming_token with Bose protocol to avoid 502
 errors

---
 pkg/service/handlers/handlers_marge.go      | 15 +++++++++++++--
 pkg/service/handlers/handlers_marge_test.go | 13 +++++++++++++
 pkg/service/setup/setup.go                  |  1 +
 3 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/pkg/service/handlers/handlers_marge.go b/pkg/service/handlers/handlers_marge.go
index b533979..26fca83 100644
--- a/pkg/service/handlers/handlers_marge.go
+++ b/pkg/service/handlers/handlers_marge.go
@@ -204,9 +204,20 @@ func (s *Server) HandleMargeStreamingToken(w http.ResponseWriter, _ *http.Reques
 	// In a real production environment, this would be a JWT or similar signed token.
 	// Some speakers might expect a specific format; we use a distinctive prefix
 	// to indicate it's a locally generated token.
-	token := "st-local-token-" + strconv.FormatInt(time.Now().Unix(), 10)
-	w.Header().Set("Authorization", "Bearer "+token)
+	tokenValue := "st-local-token-" + strconv.FormatInt(time.Now().Unix(), 10)
+	bearerToken := models.NewBearerToken(tokenValue)
+
+	data, err := xml.Marshal(bearerToken)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/vnd.bose.streaming-v1.2+xml")
+	w.Header().Set("Authorization", bearerToken.GetAuthHeader())
 	w.WriteHeader(http.StatusOK)
+	_, _ = w.Write([]byte(xml.Header))
+	_, _ = w.Write(data)
 }
 
 // HandleMargeCustomerSupport handles Marge customer support uploads.
diff --git a/pkg/service/handlers/handlers_marge_test.go b/pkg/service/handlers/handlers_marge_test.go
index e9f7f37..e2d9dcb 100644
--- a/pkg/service/handlers/handlers_marge_test.go
+++ b/pkg/service/handlers/handlers_marge_test.go
@@ -471,10 +471,23 @@ func TestMargeAdvancedFeatures(t *testing.T) {
 			t.Errorf("Expected status OK, got %v", res.Status)
 		}
 
+		contentType := res.Header.Get("Content-Type")
+		if contentType != "application/vnd.bose.streaming-v1.2+xml" {
+			t.Errorf("Invalid content type: %s", contentType)
+		}
+
 		token := res.Header.Get("Authorization")
 		if !strings.HasPrefix(token, "Bearer st-local-token-") {
 			t.Errorf("Invalid token header: %s", token)
 		}
+
+		body, _ := io.ReadAll(res.Body)
+		if !strings.Contains(string(body), "<bearertoken") {
+			t.Errorf("Response body missing <bearertoken: %s", body)
+		}
+		if !strings.Contains(string(body), token) {
+			t.Errorf("Response body missing token value: %s", body)
+		}
 	})
 
 	t.Run("CustomerSupport", func(t *testing.T) {
diff --git a/pkg/service/setup/setup.go b/pkg/service/setup/setup.go
index aea56c5..01bc60b 100644
--- a/pkg/service/setup/setup.go
+++ b/pkg/service/setup/setup.go
@@ -279,6 +279,7 @@ func (m *Manager) checkIsMigrated(summary *MigrationSummary, deviceIP string) {
 	// Case 2: /etc/hosts + Trust CA Migration
 	// Check if /etc/hosts contains redirections for Bose domains
 	client := m.NewSSH(deviceIP)
+
 	hostsContent, err := client.Run("cat /etc/hosts")
 	if err == nil {
 		boseDomains := []string{