From aa9e78f85834e35b9df4c12edc23f53ef67036de Mon Sep 17 00:00:00 2001
From: Shokkstokk <shokkstokk@users.noreply.github.com>
Date: Fri, 5 Jun 2026 00:12:17 +0000
Subject: [PATCH] fix: allow unauthenticated access to SD poster proxy endpoint

ProgramViewSet.get_permissions() was falling through to Authenticated()
for the poster action since it wasn't in permission_classes_by_action.
Add explicit AllowAny check for the poster action.
---
 apps/epg/api_views.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/apps/epg/api_views.py b/apps/epg/api_views.py
index fd83f2de..6961b79e 100644
--- a/apps/epg/api_views.py
+++ b/apps/epg/api_views.py
@@ -471,6 +471,8 @@ class ProgramViewSet(viewsets.ModelViewSet):
     _sd_poster_error_cache: dict = {}
 
     def get_permissions(self):
+        if self.action == 'poster':
+            return [AllowAny()]
         try:
             return [perm() for perm in permission_classes_by_action[self.action]]
         except KeyError: