Files
MichaelandClaude Fable 5 60d3f42901 feat: security hardening, streaming overhaul, design polish, tests
Security:
- Replace unsalted SHA-256 password hashing with bcrypt (lazy rehash on login)
- Add authenticated /api/xtream-api gateway: Xtream credentials are injected
  server-side and never sent to the frontend; /api/playlists no longer
  returns passwords
- Redact credentials from all logs (login body, proxy/FFmpeg/scheduler URLs)
- Add auth to recordings, EPG, season-passes and streaming routes
  (HttpOnly session cookie for hls.js; loopback bypass for local FFmpeg)
- Lock player postMessage to same-origin in both directions
- Vendor and pin hls.js 1.6.7 / mpegts.js 1.7.3 (drop CDN @latest)
- Fix rate limiter (client IP was never resolved), add login rate limit,
  restrict CORS, add CSP Report-Only, block private-IP SSRF targets,
  fix path traversal in recording log retrieval, chmod 777 -> 770
- Remove dead HiveService (seeded admin/admin into IndexedDB with SHA-256)
- Fix authMiddleware not populating 'user' context (getPlaylist ignored the
  logged-in user; admin purge always returned 403)

Streaming:
- New FfmpegSessionManager: process registry, idle reaper (4 min live /
  15 min VOD), orphan cleanup at startup, clean SIGTERM shutdown,
  fast-fail with stderr instead of 30 s timeout
- Quality selection (source/high/medium/low) for live and VOD; source mode
  streams with -c:v copy (zero transcoding); selector wired into the player
- Concurrent recordings (MAX_CONCURRENT_RECORDINGS, default 2); conflicts
  retry on the next tick instead of silently failing
- Lower live latency (HLS window 20 -> 10 segments, liveSync 10 -> 3)
- Fix recording log lookup (.mp4 vs .mkv mismatch)

Design:
- Replace hardcoded colors with AppColors tokens (12 files)
- web/theme.css syncs HTML players with the Flutter palette
- DPAD/keyboard navigation (arrow-key focus, player shortcuts)
- Tooltips on player icon buttons, Semantics on content cards
- Remove 7 dead widgets broken since the Stitch merge

Quality:
- bin/test/: 21 unit tests (bcrypt, redaction, traversal, SSRF, recording
  conflicts) plus a quality-selector widget test
- GitHub Actions CI (analyze + test + build web)
- Archive stale status docs into docs/archive/

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-06-10 10:07:18 +02:00

6.9 KiB

name, colors, typography, rounded, spacing
name colors typography rounded spacing
Cyber-Cinematic Glass
surface surface-dim surface-bright surface-container-lowest surface-container-low surface-container surface-container-high surface-container-highest on-surface on-surface-variant inverse-surface inverse-on-surface outline outline-variant surface-tint primary on-primary primary-container on-primary-container inverse-primary secondary on-secondary secondary-container on-secondary-container tertiary on-tertiary tertiary-container on-tertiary-container error on-error error-container on-error-container primary-fixed primary-fixed-dim on-primary-fixed on-primary-fixed-variant secondary-fixed secondary-fixed-dim on-secondary-fixed on-secondary-fixed-variant tertiary-fixed tertiary-fixed-dim on-tertiary-fixed on-tertiary-fixed-variant background on-background surface-variant
#121317 #121317 #38393d #0d0e12 #1a1b20 #1f1f24 #292a2e #343439 #e3e2e7 #c1c6d7 #e3e2e7 #2f3035 #8b90a0 #414755 #adc6ff #adc6ff #002e69 #4b8eff #00285c #005bc1 #c6c5cf #2f3037 #4a4b53 #bcbbc4 #c6c6c7 #2f3131 #909191 #282a2a #ffb4ab #690005 #93000a #ffdad6 #d8e2ff #adc6ff #001a41 #004493 #e3e1eb #c6c5cf #1a1b22 #46464e #e2e2e2 #c6c6c7 #1a1c1c #454747 #121317 #e3e2e7 #343439
headline-xl headline-lg headline-md body-lg body-md label-lg label-sm
fontFamily fontSize fontWeight lineHeight letterSpacing
Space Grotesk 48px 700 1.1 -0.02em
fontFamily fontSize fontWeight lineHeight letterSpacing
Space Grotesk 32px 600 1.2 -0.01em
fontFamily fontSize fontWeight lineHeight
Space Grotesk 24px 500 1.3
fontFamily fontSize fontWeight lineHeight
Inter 18px 400 1.6
fontFamily fontSize fontWeight lineHeight
Inter 16px 400 1.5
fontFamily fontSize fontWeight lineHeight letterSpacing
Inter 14px 600 1.2 0.05em
fontFamily fontSize fontWeight lineHeight letterSpacing
Inter 12px 500 1.2 0.02em
sm DEFAULT md lg xl full
0.25rem 0.5rem 0.75rem 1rem 1.5rem 9999px
base xs sm md lg xl gutter margin
8px 4px 12px 24px 48px 80px 24px 32px

Brand & Style

The design system is built for a high-performance media environment where immersion is paramount. It targets power users who value speed, technical precision, and a premium aesthetic. The style is a sophisticated blend of Glassmorphism and Futuristic Minimalism.

The UI should feel like a high-tech command center—unobtrusive when consuming content but sharp and responsive during management tasks. By utilizing deep-space charcoals and translucent layers, the system creates a sense of infinite depth. The emotional response should be one of "effortless control" and "high-fidelity quality," achieved through high-contrast accents against an ultra-dark backdrop.

Colors

The palette is optimized for OLED displays and low-light environments. The primary color is a vibrant neon blue, used sparingly for critical actions and active states to guide the eye without causing fatigue.

The background hierarchy uses #0F1014 for the base canvas and #181920 for elevated surfaces and containers. Grays are used exclusively for metadata and inactive iconography, ensuring they recede behind primary content. Accent gradients should transition from the primary blue into a deep cyan to simulate a "glowing" light source within the interface.

Typography

This design system utilizes a dual-font strategy to balance technical aesthetics with readability. Space Grotesk is used for headlines and hero sections to provide a sharp, geometric, and futuristic "tech" feel. Its distinctive letterforms reinforce the platform's advanced capabilities.

Inter is employed for all functional UI elements, body text, and labels. Its neutral, systematic nature ensures that dense media metadata remains legible at small sizes. All labels should be treated with a slight tracking increase to enhance clarity against dark backgrounds.

Layout & Spacing

The layout philosophy follows a 12-column fluid grid for desktop, transitioning to a flexible single-column layout for mobile. A strict 8px rhythmic system ensures visual consistency across all components.

Spacing is used to create "visual islands," grouping related media controls while leaving generous margins around content to maintain a premium, airy feel. Components should utilize dynamic padding that scales based on the container size, ensuring the interface never feels cramped, even when managing large libraries.

Elevation & Depth

Depth in this design system is achieved through Glassmorphism and layering rather than traditional drop shadows. Surfaces are defined by three distinct tiers:

  1. Base (Level 0): Pure #0F1014 background.
  2. Surface (Level 1): Translucent layers with a backdrop-filter: blur(20px) and a 1px border at 10% white opacity.
  3. Floating (Level 2): High-blur containers with a subtle inner glow (1px, top-left) in the primary accent color at 20% opacity.

Shadows, when used, are extra-diffused and tinted with the primary blue or charcoal to maintain the "light-from-within" aesthetic.

Shapes

The design system employs a Rounded shape language to soften the futuristic edge and make the platform feel more approachable.

  • Cards and Modals: Use rounded-xl (1.5rem) to emphasize the glass container effect.
  • Buttons and Inputs: Use rounded-lg (1rem) for a modern, tactile feel.
  • Media Thumbnails: Use a consistent 0.5rem radius to prevent the UI from feeling too sharp or aggressive.

Components

Buttons

Primary buttons use a solid gradient of #007AFF to a slightly lighter cyan, featuring a subtle outer glow on hover. Secondary buttons should be "Ghost" style with a 1px border and a glass background.

Cards

Media cards are the core component. They must feature a dark semi-transparent overlay at the bottom for metadata, utilizing the backdrop-blur effect. On hover, the border opacity should increase from 10% to 40%.

Input Fields

Inputs are dark-filled containers (#181920) with a 1px border that glows blue upon focus. Placeholder text should be a soft gray to maintain low visual noise.

Chips & Badges

Used for genres or status indicators. They should be pill-shaped with a low-opacity background tint of the primary color and high-contrast white text.

Progress Bars

Streaming progress bars use the primary accent color with a subtle neon glow effect (box-shadow). The "track" behind the progress should be a dark charcoal with 50% opacity.

Navigation Sidebar

A vertical glass panel on the left with a constant backdrop blur. Active states are indicated by a vertical blue "light bar" on the left edge of the menu item.