From d0a2a1ee6afa5c320a3f4e31cdfc5c10492c86ed Mon Sep 17 00:00:00 2001
From: Michael SCHAL <michaelschal@gmail.com>
Date: Mon, 9 Mar 2026 14:00:28 +0100
Subject: [PATCH] feat: Implement Xtream proxy handler with SSRF protection and
 M3U8 URL rewriting, resolving 502 proxy errors.

---
 bin/api/proxy_handler.dart | 18 ++++++++++++++++--
 task.md                    |  1 +
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/bin/api/proxy_handler.dart b/bin/api/proxy_handler.dart
index 7f47e84..720a889 100644
--- a/bin/api/proxy_handler.dart
+++ b/bin/api/proxy_handler.dart
@@ -13,9 +13,7 @@ class ProxyHandler {
 
   static const _allowedHeaders = [
     'content-type',
-    'content-length',
     'content-range',
-    'transfer-encoding',
     'accept-ranges',
     'cache-control',
   ];
@@ -134,6 +132,7 @@ class ProxyHandler {
 
         final client = http.Client();
         try {
+          print('[Proxy] Forwarding to: $targetUrl');
           final proxyRequest = http.Request(request.method, targetUrl);
           proxyRequest.headers.addAll(proxyHeaders);
           proxyRequest.followRedirects = true;
@@ -157,6 +156,21 @@ class ProxyHandler {
             }
           }
 
+          // Special case for API requests (JSON list of channels etc.)
+          // If it's not a Range request and looks like JSON, read it fully
+          final isJson =
+              response.headers['content-type']?.contains('json') == true;
+          final isRange = request.headers.containsKey('range');
+
+          if (isJson && !isRange) {
+            final bytes = await response.stream.toBytes();
+            return Response(
+              response.statusCode,
+              body: bytes,
+              headers: responseHeaders,
+            );
+          }
+
           return Response(
             response.statusCode,
             body: response.stream,
diff --git a/task.md b/task.md
index cc84fa4..7a24ace 100644
--- a/task.md
+++ b/task.md
@@ -22,6 +22,7 @@ Refonte du Guide TV pour inclure les catégories et corriger l'EPG.
 - [x] Correction Connectivité Mobile (Auto-origin + Manuel Override)
 - [x] Compatibilité Streaming iOS (HLS Live + Proxy Streaming)
 - [x] Correction Chemins HLS Relatifs (Bug chemins absolus FFmpeg)
+- [x] Résolution Erreur 502 Proxy (Nettoyage Headers + API Buffer)
 
 ## Progress Log