Files
MichaelandClaude Fable 5 60d3f42901 feat: security hardening, streaming overhaul, design polish, tests
Security:
- Replace unsalted SHA-256 password hashing with bcrypt (lazy rehash on login)
- Add authenticated /api/xtream-api gateway: Xtream credentials are injected
  server-side and never sent to the frontend; /api/playlists no longer
  returns passwords
- Redact credentials from all logs (login body, proxy/FFmpeg/scheduler URLs)
- Add auth to recordings, EPG, season-passes and streaming routes
  (HttpOnly session cookie for hls.js; loopback bypass for local FFmpeg)
- Lock player postMessage to same-origin in both directions
- Vendor and pin hls.js 1.6.7 / mpegts.js 1.7.3 (drop CDN @latest)
- Fix rate limiter (client IP was never resolved), add login rate limit,
  restrict CORS, add CSP Report-Only, block private-IP SSRF targets,
  fix path traversal in recording log retrieval, chmod 777 -> 770
- Remove dead HiveService (seeded admin/admin into IndexedDB with SHA-256)
- Fix authMiddleware not populating 'user' context (getPlaylist ignored the
  logged-in user; admin purge always returned 403)

Streaming:
- New FfmpegSessionManager: process registry, idle reaper (4 min live /
  15 min VOD), orphan cleanup at startup, clean SIGTERM shutdown,
  fast-fail with stderr instead of 30 s timeout
- Quality selection (source/high/medium/low) for live and VOD; source mode
  streams with -c:v copy (zero transcoding); selector wired into the player
- Concurrent recordings (MAX_CONCURRENT_RECORDINGS, default 2); conflicts
  retry on the next tick instead of silently failing
- Lower live latency (HLS window 20 -> 10 segments, liveSync 10 -> 3)
- Fix recording log lookup (.mp4 vs .mkv mismatch)

Design:
- Replace hardcoded colors with AppColors tokens (12 files)
- web/theme.css syncs HTML players with the Flutter palette
- DPAD/keyboard navigation (arrow-key focus, player shortcuts)
- Tooltips on player icon buttons, Semantics on content cards
- Remove 7 dead widgets broken since the Stitch merge

Quality:
- bin/test/: 21 unit tests (bcrypt, redaction, traversal, SSRF, recording
  conflicts) plus a quality-selector widget test
- GitHub Actions CI (analyze + test + build web)
- Archive stale status docs into docs/archive/

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-06-10 10:07:18 +02:00

333 lines
9.4 KiB
Dart

import 'dart:convert';
/// Xtream API Data Models (lightweight for memory optimization)
class LiveChannel {
final String streamId;
final String name;
final String? streamIcon;
final String? categoryId;
final String streamType;
final String? epgChannelId;
const LiveChannel({
required this.streamId,
required this.name,
this.streamIcon,
this.categoryId,
required this.streamType,
this.epgChannelId,
});
factory LiveChannel.fromJson(Map<String, dynamic> json) {
return LiveChannel(
streamId: json['stream_id']?.toString() ?? '',
name: json['name']?.toString() ?? 'Unknown',
streamIcon: json['stream_icon']?.toString(),
categoryId: json['category_id']?.toString(),
streamType: json['stream_type']?.toString() ?? 'live',
epgChannelId: json['epg_channel_id']?.toString(),
);
}
}
class Movie {
final String streamId;
final String name;
final String? streamIcon;
final String? categoryId;
final String categoryName;
final String? containerExtension;
final String? rating;
final int? durationSecs;
const Movie({
required this.streamId,
required this.name,
this.streamIcon,
this.categoryId,
this.categoryName = '',
this.containerExtension,
this.rating,
this.durationSecs,
});
factory Movie.fromJson(Map<String, dynamic> json) {
// Essayer plusieurs champs possibles pour l'image (différentes API Xtream utilisent différents noms)
final imageUrl = json['stream_icon']?.toString() ??
json['cover']?.toString() ??
json['movie_image']?.toString() ??
json['cover_big']?.toString();
return Movie(
streamId: json['stream_id']?.toString() ?? '',
name: json['name']?.toString() ?? 'Unknown',
streamIcon: imageUrl,
categoryId: json['category_id']?.toString(),
categoryName: json['category_name']?.toString() ?? '',
containerExtension: json['container_extension']?.toString() ?? 'mp4',
rating: json['rating']?.toString(),
durationSecs: int.tryParse(json['duration_secs']?.toString() ?? json['duration']?.toString() ?? '0'),
);
}
}
class Series {
final String seriesId;
final String name;
final String? cover;
final String? categoryId;
final String categoryName;
final String? rating;
const Series({
required this.seriesId,
required this.name,
this.cover,
this.categoryId,
this.categoryName = '',
this.rating,
});
factory Series.fromJson(Map<String, dynamic> json) {
return Series(
seriesId: json['series_id']?.toString() ?? '',
name: json['name']?.toString() ?? 'Unknown',
cover: json['cover']?.toString(),
categoryId: json['category_id']?.toString(),
categoryName: json['category_name']?.toString() ?? '',
rating: json['rating']?.toString(),
);
}
}
/// Season model for series
class Season {
final int seasonNumber;
final String name;
final int episodeCount;
final String? cover;
const Season({
required this.seasonNumber,
required this.name,
required this.episodeCount,
this.cover,
});
factory Season.fromJson(Map<String, dynamic> json) {
return Season(
seasonNumber: int.tryParse(json['season_number']?.toString() ?? '1') ?? 1,
name: json['name']?.toString() ?? 'Season ${json['season_number'] ?? 1}',
episodeCount: int.tryParse(json['episode_count']?.toString() ?? '0') ?? 0,
cover: json['cover']?.toString(),
);
}
}
/// Episode model for series
class Episode {
final String id;
final int episodeNum;
final String title;
final String? containerExtension;
final String? info;
final String? cover;
final int? durationSecs;
const Episode({
required this.id,
required this.episodeNum,
required this.title,
this.containerExtension,
this.info,
this.cover,
this.durationSecs,
});
factory Episode.fromJson(Map<String, dynamic> json) {
return Episode(
id: json['id']?.toString() ?? '',
episodeNum: int.tryParse(json['episode_num']?.toString() ?? '1') ?? 1,
title: json['title']?.toString() ?? 'Episode ${json['episode_num'] ?? 1}',
containerExtension: json['container_extension']?.toString() ?? 'mkv',
info: json['info']?.toString(),
cover: json['custom_cover']?.toString() ?? json['cover']?.toString(),
durationSecs: int.tryParse(json['duration_secs']?.toString() ?? '0'),
);
}
}
/// Series info with seasons and episodes
class SeriesInfo {
final String seriesId;
final String name;
final String? cover;
final String? plot;
final String? cast;
final String? director;
final String? genre;
final String? releaseDate;
final String? rating;
final List<Season> seasons;
final Map<int, List<Episode>> episodes;
const SeriesInfo({
required this.seriesId,
required this.name,
this.cover,
this.plot,
this.cast,
this.director,
this.genre,
this.releaseDate,
this.rating,
required this.seasons,
required this.episodes,
});
factory SeriesInfo.fromJson(Map<String, dynamic> json) {
final seasonsData = json['seasons'] as List<dynamic>? ?? [];
final seasons = seasonsData.map((s) => Season.fromJson(s as Map<String, dynamic>)).toList();
final episodesData = json['episodes'] as Map<String, dynamic>? ?? {};
final episodes = <int, List<Episode>>{};
episodesData.forEach((seasonNum, episodesList) {
final seasonInt = int.tryParse(seasonNum) ?? 1;
final episodeList = (episodesList as List<dynamic>?)
?.map((e) => Episode.fromJson(e as Map<String, dynamic>))
.toList() ?? [];
episodes[seasonInt] = episodeList;
});
final info = json['info'] as Map<String, dynamic>? ?? {};
return SeriesInfo(
seriesId: json['series_id']?.toString() ?? info['series_id']?.toString() ?? '',
name: info['name']?.toString() ?? json['name']?.toString() ?? 'Unknown',
cover: info['cover']?.toString() ?? json['cover']?.toString(),
plot: info['plot']?.toString(),
cast: info['cast']?.toString(),
director: info['director']?.toString(),
genre: info['genre']?.toString(),
releaseDate: info['releaseDate']?.toString(),
rating: info['rating']?.toString(),
seasons: seasons,
episodes: episodes,
);
}
}
class Category {
final String categoryId;
final String categoryName;
const Category({
required this.categoryId,
required this.categoryName,
});
factory Category.fromJson(Map<String, dynamic> json) {
return Category(
categoryId: json['category_id']?.toString() ?? '',
categoryName: json['category_name']?.toString() ?? 'Unknown',
);
}
}
class ShortEPG {
final String? nowPlaying;
final String? nextPlaying;
final double? progress; // 0.0 to 1.0
const ShortEPG({
this.nowPlaying,
this.nextPlaying,
this.progress,
});
factory ShortEPG.fromJson(Map<String, dynamic> json) {
final epgListings = json['epg_listings'] as List?;
if (epgListings == null || epgListings.isEmpty) {
return const ShortEPG();
}
String? nowTitle;
String? nextTitle;
double? currentProgress;
final now = DateTime.now();
// Helper to decode Base64 encoded title with proper UTF-8 support
String decodeTitle(String? encodedTitle) {
if (encodedTitle == null || encodedTitle.isEmpty) return '';
try {
// Try Base64 decode with UTF-8 encoding
final bytes = base64Decode(encodedTitle);
return utf8.decode(bytes, allowMalformed: true);
} catch (_) {
// Not Base64, return as-is
return encodedTitle;
}
}
// Helper to parse timestamp (Unix epoch or ISO format)
DateTime? parseTimestamp(dynamic value) {
if (value == null) return null;
final strValue = value.toString();
// Try parsing as Unix timestamp (seconds)
final intValue = int.tryParse(strValue);
if (intValue != null) {
return DateTime.fromMillisecondsSinceEpoch(intValue * 1000);
}
// Try parsing as ISO date string
return DateTime.tryParse(strValue);
}
for (var i = 0; i < epgListings.length; i++) {
final listing = epgListings[i] as Map<String, dynamic>;
// Parse start/stop timestamps (can be 'start', 'start_timestamp', or Unix epoch)
final start = parseTimestamp(listing['start']) ??
parseTimestamp(listing['start_timestamp']);
final stop = parseTimestamp(listing['stop']) ??
parseTimestamp(listing['end']) ??
parseTimestamp(listing['stop_timestamp']);
if (start != null && stop != null) {
if (now.isAfter(start) && now.isBefore(stop)) {
// Decode title (may be Base64 encoded)
nowTitle = decodeTitle(listing['title']?.toString());
final duration = stop.difference(start).inSeconds;
final elapsed = now.difference(start).inSeconds;
if (duration > 0) {
currentProgress = elapsed / duration;
}
// Get next item
if (i + 1 < epgListings.length) {
final nextListing = epgListings[i + 1] as Map<String, dynamic>;
nextTitle = decodeTitle(nextListing['title']?.toString());
}
break;
}
}
}
return ShortEPG(
nowPlaying: nowTitle,
nextPlaying: nextTitle,
progress: currentProgress,
);
}
}