cineworld_uk 3.1.0 → 4.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 140adb25b3739c911cd583ddf7a292476389a550
-  data.tar.gz: f97eed368e77a6f857f619152c9c9d13bab72f05
+SHA256:
+  metadata.gz: edfbb0e8f7d6238e878f4018a643befca62b662fffc47cad72367c2e404e9ee7
+  data.tar.gz: a0d59a9aa4d3227794fda2f78c00de9e59c62321b3cba3a50dbbd8611856cc82
 SHA512:
-  metadata.gz: 981368088d34508277ede0f077f0de5bf736b61c5d16425d01abe0624947c5900e034e7b7c20f43f663c4d79f88c8cf9ea33f2aaefe4007b63c1c981fb6e8714
-  data.tar.gz: 424e8ec87306e6a6665192c8a7a3b0f10f871af422c2e2cae44befc940da62a8f5fa282015e5c5eb1acd073f51bfa6dd1990ce56aa524da6123796abe39eabf9
+  metadata.gz: aefe630b3ad344c2fbced398fc49c5fb9686387331f2cdea072f6dc96ef0893db42af90a6d277117cc7cd1b6ab4505b2fff3e64e859f79896503a71462934a89
+  data.tar.gz: cd3ad38fb9b9404504e5379ae03943424d56370b6ce2b0bcda069c9f64fa33a2802ce54dcb567740689408e882bda8e86cba3127193fb510f46fc73b2610c030

data/.agents/setup

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$repo_root"
+
+echo 'Checking native gem build prerequisites'
+missing=()
+for package in ca-certificates curl build-essential pkg-config libyaml-dev libssl-dev zlib1g-dev; do
+  if ! dpkg-query -W -f='${Status}' "$package" 2>/dev/null | grep -q 'install ok installed'; then
+    missing+=("$package")
+  fi
+done
+if ((${#missing[@]})); then
+  sudo apt-get update -qq
+  sudo env DEBIAN_FRONTEND=noninteractive apt-get install -y "${missing[@]}"
+fi
+
+export PATH="$HOME/.local/bin:$PATH"
+if ! command -v mise >/dev/null; then
+  echo 'Installing mise'
+  curl --fail --silent --show-error --location https://mise.run | sh
+fi
+
+ruby_version="$(tr -d '[:space:]' < .ruby-version)"
+echo "Installing Ruby $ruby_version"
+MISE_RUBY_COMPILE=false mise install "ruby@$ruby_version"
+
+# Make the pinned Ruby available to later Amp commands in login shells.
+if [[ ! -f "$HOME/.bash_profile" ]]; then
+  printf '[ ! -f "$HOME/.profile" ] || . "$HOME/.profile"\n' > "$HOME/.bash_profile"
+fi
+marker="# Cineworld orb Ruby environment: $repo_root"
+if ! grep -Fqx "$marker" "$HOME/.bash_profile"; then
+  cat >> "$HOME/.bash_profile" <<EOF
+
+$marker
+case "\$PWD" in
+  "$repo_root"|"$repo_root"/*)
+    export PATH="\$HOME/.local/share/mise/shims:\$HOME/.local/bin:\$PATH"
+    export MISE_IDIOMATIC_VERSION_FILE_ENABLE_TOOLS=ruby
+    ;;
+esac
+EOF
+fi
+
+echo 'Installing gem dependencies (no Cineworld token required)'
+mise exec "ruby@$ruby_version" -- bundle config set --local path "$HOME/.cache/cineworld_uk/bundle"
+mise exec "ruby@$ruby_version" -- bundle check || mise exec "ruby@$ruby_version" -- bundle install --jobs 4 --retry 3
+mise reshim
+mise exec "ruby@$ruby_version" -- ruby --version

data/.github/workflows/test.yml

@@ -0,0 +1,43 @@
+name: Tests
+
+on: [push, pull_request]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        ruby-version: ['3.3', '3.4', '4.0']
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby-version }}
+          bundler-cache: true
+      - run: bundle exec rake test
+
+  package:
+    strategy:
+      matrix:
+        include:
+          - runner: ubuntu-latest
+            platform: x86_64-linux-gnu
+          - runner: ubuntu-24.04-arm
+            platform: aarch64-linux-gnu
+          - runner: macos-15
+            platform: arm64-darwin
+          - runner: macos-15-intel
+            platform: x86_64-darwin
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.4'
+          bundler-cache: true
+      - run: bundle exec rake 'package:native[${{ matrix.platform }}]'
+      - run: CINEWORLD_PACKAGE="$(echo pkg/*.gem)" bundle exec ruby test/package_test.rb
+      - uses: actions/upload-artifact@v4
+        with:
+          name: gem-${{ matrix.platform }}
+          path: pkg/*.gem

data/.gitignore

@@ -15,3 +15,4 @@ spec/reports
 test/tmp
 test/version_tmp
 tmp
+.amp/portals/*

data/.ruby-version

@@ -0,0 +1 @@
+3.4.7

data/CHANGELOG.md

@@ -2,6 +2,27 @@
 All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## 4.1.0 - 2026-10-15
+
+### Added
+- Explicit guest token acquisition and renewal with `CineworldUk.acquire_token!`, using the standalone `curl-impersonate` CLI without Python or a browser.
+- Platform-specific gems bundle curl-impersonate 2.2.3 for x86-64/ARM64 glibc Linux and macOS, with pinned archive checksums, upstream notices, and native package CI checks. No separate executable installation is needed on these platforms.
+- Optional executable path for token acquisition. Existing caller-supplied tokens continue to work without the CLI.
+- Expiry checks and authentication errors for unavailable commands, blocked pages, and missing or invalid page tokens; failed acquisition preserves the previous token.
+
+## 4.0.0 - 2026-10-15
+
+### Changed
+- Retrieve cinemas and performances from the Vista API instead of the retired iOS API.
+- Require a caller-supplied guest JWT through `CineworldUk.token`; token acquisition and renewal remain the caller's responsibility.
+- `Performance.at` accepts inclusive `from:` and `to:` business dates, defaulting to today in London and the following 13 days rather than discovering all screening dates.
+- Use one request per cinema per requested day, reusing related film, cinema and attribute data. Share cached cinema data with address lookups.
+- Convert advertised session times to UTC using Vista's explicit offsets and preserve session-specific formats.
+
+### Added
+- `CineworldUk::AuthenticationError` for missing tokens and HTTP 401 responses.
+- Orb setup for the pinned Ruby version and gem dependencies.
+
 ## 3.1.0 - 2016-09-11
 
 ### Fixed

data/README.md

@@ -1,12 +1,9 @@
 # CineworldUk
 
-A simple gem to parse the [Cineworld UK](http://cineworld.co.uk) cinema times (using their iOS API) and spit out useful formatted info.
+A gem to retrieve [Cineworld UK](https://www.cineworld.co.uk) cinemas and showtimes using the Vista API.
 
 [![Gem Version](https://badge.fury.io/rb/cineworld_uk.svg)](https://badge.fury.io/rb/cineworld_uk)
-[![Code Climate](https://codeclimate.com/github/andycroll/cineworld_uk/badges/gpa.svg)](https://codeclimate.com/github/andycroll/cineworld_uk)
-[![Test Coverage](https://codeclimate.com/github/andycroll/cineworld_uk/badges/coverage.svg)](https://codeclimate.com/github/andycroll/cineworld_uk/coverage)
-[![Build Status](https://travis-ci.org/andycroll/cineworld_uk.svg?branch=master)](https://travis-ci.org/andycroll/cineworld_uk)
-[![Inline docs](http://inch-ci.org/github/andycroll/cineworld_uk.svg?branch=master)](http://inch-ci.org/github/andycroll/cineworld_uk)
+[![Tests](https://github.com/andycroll/cineworld_uk/actions/workflows/.travis.yml/badge.svg)](https://github.com/andycroll/cineworld_uk/actions)
 
 ## Installation
 
@@ -28,13 +25,94 @@ The gem conforms to the API set down in the `cinebase` gem, [andycroll/cinebase]
 
 Performance titles are sanitized as much as possible, removing 'screening type' information and 'dimension' as well as standardising all the theatre/cultural event naming (NT Live, Royal Opera House etc).
 
+### Authentication
+
+Acquire a guest JWT explicitly before retrieving data:
+
+```ruby
+require 'cineworld_uk'
+
+CineworldUk.acquire_token!
+CineworldUk::Cinema.all
+```
+
+This shells out to **`curl-impersonate`**, not ordinary system `curl`, using its
+Chrome 150 TLS/HTTP profile. No Python, Chrome, JavaScript execution or browser
+cookies are needed. Platform-specific gem packages include the pinned
+`curl-impersonate` 2.2.3 executable and its upstream licence notices. RubyGems
+and Bundler automatically select the matching package for:
+
+- glibc Linux: x86-64 and ARM64 (`x86_64-linux-gnu`, `aarch64-linux-gnu`)
+- macOS: Intel and Apple Silicon (`x86_64-darwin`, `arm64-darwin`)
+
+The executable runs directly from the installed gem. There are no separate
+installation commands, PATH changes, or runtime downloads on these platforms.
+
+When installing from Git, forcing the source (`ruby`) gem, or using another
+platform (including Alpine/musl and Windows), install a compatible
+[curl-impersonate release](https://github.com/lexiforest/curl-impersonate/releases/tag/v2.2.3)
+with `--impersonate chrome150` support yourself. For an x86-64 Linux checkout:
+
+```sh
+mkdir -p "$HOME/.local/bin"
+curl -fL https://github.com/lexiforest/curl-impersonate/releases/download/v2.2.3/curl-impersonate-v2.2.3.x86_64-linux-gnu.tar.gz \
+  | tar -xz -C "$HOME/.local/bin" curl-impersonate
+export PATH="$HOME/.local/bin:$PATH"
+```
+
+Other platforms have separate assets on the release page. You can also specify
+the executable path:
+
+```ruby
+CineworldUk.acquire_token!(curl: '/opt/curl-impersonate/curl-impersonate')
+```
+
+The method returns the token and sets `CineworldUk.token` in memory. It reads
+`__NEXT_DATA__.props.pageProps.environment.gasToken` from the ticketing site's
+root page, even when the page displays a 404. It checks the declared expiry,
+but decoding the JWT does not verify its signature. A blocked page, expired or
+missing token, missing executable, or failed command raises
+`CineworldUk::AuthenticationError` and leaves any previous token unchanged.
+Requests time out after 30 seconds. Certificate verification remains enabled;
+redirects are not followed, and subprocess arguments are passed without a shell.
+Cloudflare may still block requests on other networks or after website changes.
+
+Alternatively, supply your own current guest JWT without the `Bearer ` prefix;
+this requires no external executable:
+
+```ruby
+CineworldUk.token = ENV.fetch('CINEWORLD_TOKEN')
+```
+
+The gem sends `Authorization: Bearer ...` and `Connect-Region-Code: GB` to
+`digital-api.cineworld.co.uk`. Normal API calls never acquire or renew a token
+automatically.
+
+Missing tokens and HTTP 401 responses raise `CineworldUk::AuthenticationError`.
+Call `CineworldUk.acquire_token!` again, or set `CineworldUk.token` with a fresh
+token, before retrying. Tokens are never persisted by the gem. Other HTTP
+failures raise an error rather than returning an empty schedule. Redirects are
+not followed, so credentials are not forwarded to another host.
+
+There is no verified fixed token lifetime. Its declared lifetime is `exp - iat`
+seconds. The website reloads to renew after 90% of that interval. To inspect
+your token locally without printing it (decoding does not verify its signature):
+
+```ruby
+require 'base64'
+payload = CineworldUk.token.split('.').fetch(1)
+claims = JSON.parse(Base64.urlsafe_decode64(payload))
+puts "Lifetime: #{claims.fetch('exp') - claims.fetch('iat')} seconds"
+puts "Expires: #{Time.at(claims.fetch('exp')).utc}"
+```
+
 ### Cinema
 
 ``` ruby
 CineworldUk::Cinema.all
 #=> [<CineworldUK::Cinema ...>, <CineworldUK::Cinema ...>, ...]
 
-cinema = CineworldUk::Cinema.new(3)
+cinema = CineworldUk::Cinema.new(14)
 #=> <CineworldUK::Cinema ...>
 
 cinema.adr
@@ -42,7 +120,7 @@ cinema.adr
   street_address:   'Brighton Marina Village',
   extended_address: nil,
   locality:         'Brighton',
-  region:           nil,
+  region:           'East Sussex',
   postal_code:      'BN2 5UF',
   country:          'United Kingdom'
 }
@@ -54,7 +132,7 @@ cinema.full_name
 #=> 'Cineworld Brighton'
 
 cinema.id
-#=> '3'
+#=> 14
 
 cinema.postal_code
 #=> 'BN2 5UF'
@@ -62,38 +140,80 @@ cinema.postal_code
 
 ### Performances
 
+`at` accepts a numeric Vista cinema ID (`14`, `'14'` or `'014'` for Brighton),
+not a Boxoffice ID such as `X079B`. Dates are inclusive **business dates**.
+Without dates, it fetches today in London and the following 13 days; it does not
+discover every future screening date.
+
+```ruby
+day = Date.new(2026, 10, 14)
+performances = CineworldUk::Performance.at(14, from: day, to: day)
+```
+
+This makes **one HTTP request per cinema per requested day**, including empty
+days. Cinema names, film titles and attributes come from the same response—no
+extra cinema or film lookups are needed. `Cinema.all` separately fetches and
+caches the cinema list in memory, shared by name and address lookups. Performance
+responses are not cached across calls, so reuse the returned array when possible.
+
+Advertised session times (`startsAt`), not feature start times (`filmStartsAt`),
+are converted to UTC using the offsets supplied by Vista. Recognized session
+attributes populate the existing dimension and variant fields; unknown attributes
+are ignored. No seat-availability or booking operations are performed.
+
 ``` ruby
-CineworldUk::Performance.at(3)
+CineworldUk::Performance.at(14)
 #=> [<CineworldUK::Performance ...>, <CineworldUK::Performance ...>, ...]
 
-performance = CineworldUk::Performance.at(3).first
+performance = performances.first
 #=> <CineworldUK::Performance ...>
 
 performance.film_name
-#=> 'Star Wars: The Force Awakens'
+#=> 'Other Mommy'
 
 performance.dimension
 #=> '2d'
 
 performance.variant
-#=> ['imax', 'kids']
+#=> ['audio_described']
 
 performance.starting_at
-#=> 2016-02-04 13:00:20 UTC
+#=> 2026-10-14 14:40:00 UTC
 
 performance.showing_on
-#=> #<Date: 2016-02-04 ((2457423j,0s,0n),+0s,2299161j)>
+#=> Date.new(2026, 10, 14)
 
 performance.booking_url
-#=> "http://www.cineworld.co.uk/booking?performance=..."
+#=> "https://web.cineworld.co.uk/order/showtimes/014-165507/seats"
 
 performance.cinema_name
 #=> 'Brighton'
 
 performance.cinema_id
-#=> 3
+#=> 14
 ```
 
+## Building release packages
+
+```sh
+bundle exec rake build         # Portable source gem; external curl-impersonate required
+bundle exec rake package:all   # Four platform gems with bundled executables
+```
+
+To build and check just one platform on a matching host:
+
+```sh
+bundle exec rake 'package:native[x86_64-linux-gnu]'
+CINEWORLD_PACKAGE=pkg/cineworld_uk-4.1.0-x86_64-linux-gnu.gem bundle exec ruby test/package_test.rb
+```
+
+Native packaging downloads pinned upstream archives at **build time**, verifies
+their SHA-256 digests, and includes the executable, licence files and source
+provenance. Archives and built gems stay in ignored `pkg/`, not Git. CI builds
+and installation-tests each platform on its corresponding runner and saves the
+gems as workflow artifacts; it does not publish them. Publish the source and
+platform gems together for automatic platform selection to work for users.
+
 ## Contributing
 
 1. Fork it

data/Rakefile

@@ -2,6 +2,7 @@
 require "bundler/gem_tasks"
 
 require 'rake/testtask'
+load File.expand_path('tasks/package.rake', __dir__)
 
 Rake::TestTask.new do |t|
   t.libs << 'lib/cineworld_uk'
@@ -14,7 +15,7 @@ Rake::TestTask.new do |t|
 end
 
 Rake::TestTask.new do |t|
-  t.libs << 'lib/picturehouse_uk'
+  t.libs << 'lib/cineworld_uk'
   t.name = :live
   t.test_files = FileList[
     'test/live/*_test.rb'
@@ -35,6 +36,7 @@ end
 desc 'Recreate test fixtures'
 task :fixtures do
   require 'cineworld_uk'
+  CineworldUk.token = ENV.fetch("CINEWORLD_TOKEN")
 
   def js_fixture(name)
     File.expand_path("../test/fixtures/#{name}.json", __FILE__)
@@ -47,45 +49,11 @@ task :fixtures do
     file.write api.cinema_list
   end
 
-  File.open(js_fixture('api/cinema-detail-3'), 'w') do |file|
-    puts '* API Cinema Detail Brighton'
-    file.write api.cinema_detail(3)
-  end
-
-  File.open(js_fixture('api/cinema-detail-96'), 'w') do |file|
-    puts '* API Cinema Detail Birmingham NEC'
-    file.write api.cinema_detail(96)
-  end
-
-  File.open(js_fixture('api/cinema-detail-21'), 'w') do |file|
-    puts '* API Cinema Detail Edinburgh'
-    file.write api.cinema_detail(21)
-  end
-
-  File.open(js_fixture('api/cinema-detail-10'), 'w') do |file|
-    puts '* API Cinema Detail Chelsea'
-    file.write api.cinema_detail(10)
-  end
-
-  File.open(js_fixture('api/film-list'), 'w') do |file|
-    puts '* API Film List'
-    file.write api.film_list
-  end
-
-  File.open(js_fixture('api/film-list-comingsoon'), 'w') do |file|
-    puts '* API Film List Coming Soon'
-    file.write api.film_list_comingsoon
-  end
-
-  File.open(js_fixture('api/performances-tomorrow-3'), 'w') do |file|
+  File.open(js_fixture('api/performances-tomorrow-14'), 'w') do |file|
     puts '* API Performances in Brighton Tomorrow'
-    file.write api.performances(3, Date.today + 1)
+    file.write api.performances(14, Date.today + 1)
   end
 
-  File.open(js_fixture('api/dates-3'), 'w') do |file|
-    puts '* API Dates Brighton Tomorrow'
-    file.write api.dates(3)
-  end
 end
 
 task :default => :test

data/cineworld_uk.gemspec

@@ -12,16 +12,19 @@ Gem::Specification.new do |spec|
   spec.homepage      = 'https://github.com/andycroll/cineworld_uk'
   spec.licenses      = %w(AGPL MIT)
 
-  spec.files         = `git ls-files`.split($RS)
+  spec.files         = `git ls-files`.split("\n")
   spec.executables   = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
   spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
   spec.require_paths = ['lib']
 
-  spec.add_development_dependency 'bundler', '~> 1.3'
-  spec.add_development_dependency 'codeclimate-test-reporter'
+  spec.add_development_dependency 'bundler', '>= 2.0'
+  spec.add_development_dependency 'minitest-mock'
   spec.add_development_dependency 'minitest-reporters'
   spec.add_development_dependency 'rake'
+  spec.add_development_dependency 'simplecov', '< 1'
   spec.add_development_dependency 'webmock'
 
-  spec.add_runtime_dependency 'cinebase', '~> 3.0.0'
+  spec.add_runtime_dependency 'base64', '~> 0.3'
+  spec.add_runtime_dependency 'cinebase', '~> 5.0'
+  spec.add_runtime_dependency 'nokogiri', '>= 1.11'
 end

data/lib/cineworld_uk/cinema.rb

@@ -25,8 +25,9 @@ module CineworldUk
     # @return [Hash<Integer => String>]
     def self.id_names_hash
       @id_names_hash ||= cinema_list_json.each_with_object({}) do |hash, result|
-        result[hash['id']] =
-          hash['name'].gsub('London - ', '').gsub(' - ', ': ')
+        name = hash['displayName']
+        id_key = hash['id'].to_i
+        result[id_key] = name.gsub('London - ', '').gsub(' - ', ': ') if name
       end
     end
 
@@ -49,7 +50,9 @@ module CineworldUk
     #       }
     # @note Uses the standard method naming as at http://microformats.org/wiki/adr
     def adr
-      CineworldUk::Internal::Parser::Api::CinemaAddress.new(@id).to_hash
+      CineworldUk::Internal::Parser::Api::CinemaAddress.new(
+        @id, self.class.send(:cinema_list_json)
+      ).to_hash
     end
 
     # Brand of the cinema
@@ -158,7 +161,7 @@ module CineworldUk
     # @api private
     def self.cinema_list_json
       @cinema_list_json ||=
-        JSON.parse(api.cinema_list)['cinemas']
+        JSON.parse(api.cinema_list)['body']['cinemas']
     end
     private_class_method :cinema_list_json
   end

data/lib/cineworld_uk/internal/api_response.rb

@@ -1,72 +1,115 @@
-require 'net/http'
+# frozen_string_literal: true
+
+require "net/http"
+require "json"
+require "date"
+require "time"
 
 module CineworldUk
-  # @api private
   module Internal
-    # @api private
+    # Adapts Vista responses to the parsers' cinema/film/event vocabulary.
     class ApiResponse
-      # Basic cinema list of ids/names
-      # @return [String] JSON encoded
-      def cinema_list
-        response('cinema/list', full: true)
-      end
-
-      # List of dates on which there are screening for this cinema id
-      # @param [Fixnum] id the id of the cinema
-      # @return [String] JSON encoded
-      def dates(id)
-        response('dates', cinema: id)
-      end
+      BASE_URL = "https://digital-api.cineworld.co.uk/ocapi/v1/"
+      ATTRIBUTES = {
+        "3D" => "3d", "IMAX" => "imax", "AD" => "audio-described",
+        "Subtitled" => "subbed", "Subtitles" => "subbed",
+        "Autism Friendly" => "autism-friendly",
+        "Movies for Juniors" => "junior",
+        "Unlimited Screening" => "unlimited-screening", "Q&A" => "qa"
+      }.freeze
 
-      # Detail about a specific cinema
-      # @param [Fixnum] id the id of the cinema
-      # @return [String] JSON encoded
-      def cinema_detail(id)
-        response('cinema/detail', cinema: id)
-      end
-
-      # List of all currently showing films
-      # @return [String] JSON encoded
-      def film_list
-        response('film/list', full: true)
-      end
-
-      # List of all upcoming films
-      # @return [String] JSON encoded
-      def film_list_comingsoon
-        response('film/list/comingsoon', full: true)
+      def cinema_list
+        cinemas = fetch("sites").fetch("sites").map do |site|
+          address = site.fetch("contactDetails", {}).fetch("addressV2", {})
+          {
+            "id" => site.fetch("id"),
+            "displayName" => site.fetch("name").fetch("text"),
+            "addressInfo" => {
+              "address1" => address.dig("line1", "text"),
+              "city" => address.dig("line2", "text"),
+              "state" => address.dig("line3", "text"),
+              "postalCode" => address.dig("line4", "text")
+            }
+          }
+        end
+        JSON.generate("body" => { "cinemas" => cinemas })
       end
 
-      # All screenings from a specific cinema on a specific date
-      # @param [Fixnum] cinema_id the id of the cinema
-      # @param [Date] date a single date in the future
-      # @return [String] JSON encoded
       def performances(cinema_id, date)
-        response('performances', cinema: cinema_id,
-                                 date: date.strftime('%Y%m%d'))
+        site_id = cinema_id.to_s.rjust(3, "0")
+        response = fetch("showtimes/by-business-date/#{date.iso8601}",
+                         "siteIds" => site_id)
+        related = response.fetch("relatedData")
+        films = related.fetch("films").to_h { |film| [film.fetch("id"), film] }
+        attributes = related.fetch("attributes").to_h do |attr|
+          [attr.fetch("id"), attr]
+        end
+        normalized_films = []
+        events = response.fetch("showtimes").map do |showtime|
+          film = films.fetch(showtime.fetch("filmId"))
+          attrs = showtime.fetch("attributeIds", []).filter_map do |id|
+            attribute = attributes.fetch(id)
+            ATTRIBUTES[attribute.dig("shortName", "text")] ||
+              ATTRIBUTES[attribute.dig("name", "text")]
+          end
+          attrs << "3d" if showtime["requires3dGlasses"]
+          # Formats belong to a session, not to the film as a whole.
+          id = showtime.fetch("id")
+          normalized_films << {
+            "id" => id,
+            "name" => film.fetch("title").fetch("text"),
+            "attributeIds" => attrs
+          }
+          starts_at = showtime.fetch("schedule").fetch("startsAt")
+          {
+            "filmId" => id, "attributeIds" => attrs,
+            "eventDateTime" => Time.iso8601(starts_at).utc.iso8601,
+            "bookingLink" =>
+              "https://web.cineworld.co.uk/order/showtimes/#{id}/seats"
+          }
+        end
+        site = related.fetch("sites").detect do |item|
+          item.fetch("id") == site_id
+        end
+        JSON.generate(
+          "body" => {
+            "films" => normalized_films, "events" => events,
+            "cinemaName" => site&.dig("name", "text")
+          }
+        )
       end
 
       private
 
-      # @api private
-      # mixin the default hash
-      DEFAULTS = { key: 'ios', territory: 'GB' }
-
-      def fetch(uri, limit = 10)
-        fail ArgumentError, 'too many HTTP redirects' if limit == 0
-
-        case response = Net::HTTP.get_response(URI(uri))
-        when Net::HTTPSuccess then response.body
-        when Net::HTTPRedirection then fetch(response['location'], limit - 1)
-        else response.code
+      def fetch(path, query = {})
+        token = CineworldUk.token
+        if !token.is_a?(String) || token.strip.empty?
+          raise AuthenticationError,
+                "Set CineworldUk.token to a current guest JWT " \
+                "before fetching data"
+        end
+        uri = URI(BASE_URL + path)
+        uri.query = URI.encode_www_form(query) unless query.empty?
+        request = Net::HTTP::Get.new(uri)
+        request["Authorization"] = "Bearer #{token}"
+        request["Connect-Region-Code"] = "GB"
+        request["Accept"] = "application/json"
+        response = Net::HTTP.start(
+          uri.host, uri.port, use_ssl: true, open_timeout: 10, read_timeout: 30
+        ) do |http|
+          http.request(request)
+        end
+        case response
+        when Net::HTTPSuccess
+          JSON.parse(response.body)
+        when Net::HTTPUnauthorized
+          raise AuthenticationError,
+                "Vista rejected the guest token; " \
+                "supply a fresh token with CineworldUk.token="
+        else
+          # Omit response bodies and never redirect credentials to another host.
+          raise "Vista HTTP error #{response.code}"
         end
-      end
-
-      def response(path, hash)
-        uri = URI::HTTPS.build(host:  'www.cineworld.co.uk',
-                               path:  "/api/#{path}",
-                               query: URI.encode_www_form(hash.merge(DEFAULTS)))
-        fetch(uri)
       end
     end
   end