Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/playsuisse.py (Python)

Code before:
                url
            }
            thumbnail16x9 {
                ...ImageDetails
            }
            thumbnail2x3 {
                ...ImageDetails
            }
            thumbnail16x9WithTitle {
                ...ImageDetails
            }
            thumbnail2x3WithTitle {
                ...ImageDetails
            }
        }
        fragment ImageDetails on AssetImage {
            id
            url
        }'''

    def _get_media_data(self, media_id):
        # NOTE In the web app, the "locale" header is used to switch between languages,
        # However this doesn't seem to take effect when passing the header here.
        response = self._download_json(
            'https://4bbepzm4ef.execute-api.eu-central-1.amazonaws.com/prod/graphql',
            media_id, data=json.dumps({
                'operationName': 'AssetWatch',
                'query': self._GRAPHQL_QUERY,
                'variables': {'assetId': media_id}
            }).encode('utf-8'),
            headers={'Content-Type': 'application/json', 'locale': 'de'})

        return response['data']['assetV2']

    def _real_extract(self, url):
        media_id = self._match_id(url)
        media_data = self._get_media_data(media_id)
        info = self._extract_single(media_data)
        if media_data.get('episodes'):
            info.update({
                '_type': 'playlist',
                'entries': map(self._extract_single, media_data['episodes']),
            })
        return info

    def _extract_single(self, media_data):
        thumbnails = traverse_obj(media_data, lambda k, _: k.startswith('thumbnail'))

        formats, subtitles = [], {}
        for media in traverse_obj(media_data, 'medias', default=[]):
            if not media.get('url') or media.get('type') != 'HLS':

Review comment (security):
`_perform_login` won't be called if the user does not provide credentials. This check needs to be done in `_real_extract` or `_real_initialize`. But does passing cookies (instead of user/pass) work for this site? Ideally we would check if an auth cookie is in the cookiejar (use `self._get_cookies()`) instead of checking for user/pass

Code after:
            name
            description
            duration
            episodeNumber
            seasonNumber
            seriesName
            medias {
                type
                url
            }
            thumbnail16x9 {
                ...ImageDetails
            }
            thumbnail2x3 {
                ...ImageDetails
            }
            thumbnail16x9WithTitle {
                ...ImageDetails
            }
            thumbnail2x3WithTitle {
                ...ImageDetails
            }
        }
        fragment ImageDetails on AssetImage {
            id
            url
        }'''
    _LOGIN_BASE_URL = 'https://login.srgssr.ch/srgssrlogin.onmicrosoft.com'
    _LOGIN_PATH = 'B2C_1A__SignInV2'
    _ID_TOKEN = None

    def _perform_login(self, username, password):
        login_page = self._download_webpage(
            'https://www.playsuisse.ch/api/sso/login', None, note='Downloading login page',
            query={'x': 'x', 'locale': 'de', 'redirectUrl': 'https://www.playsuisse.ch/'})
        settings = self._search_json(r'var\s+SETTINGS\s*=', login_page, 'settings', None)

        csrf_token = settings['csrf']
        query = {'tx': settings['transId'], 'p': self._LOGIN_PATH}

        status = traverse_obj(self._download_json(
            f'{self._LOGIN_BASE_URL}/{self._LOGIN_PATH}/SelfAsserted', None, 'Logging in',
            query=query, headers={'X-CSRF-TOKEN': csrf_token}, data=urlencode_postdata({
                'request_type': 'RESPONSE',
                'signInName': username,
                'password': password
            }), expected_status=400), ('status', {int_or_none}))
        if status == 400:
            raise ExtractorError('Invalid username or password', expected=True)

        urlh = self._request_webpage(