mirror of
https://github.com/R0m1k3/xtremflow.git
synced 2026-10-12 01:36:20 +02:00
Security: - Replace unsalted SHA-256 password hashing with bcrypt (lazy rehash on login) - Add authenticated /api/xtream-api gateway: Xtream credentials are injected server-side and never sent to the frontend; /api/playlists no longer returns passwords - Redact credentials from all logs (login body, proxy/FFmpeg/scheduler URLs) - Add auth to recordings, EPG, season-passes and streaming routes (HttpOnly session cookie for hls.js; loopback bypass for local FFmpeg) - Lock player postMessage to same-origin in both directions - Vendor and pin hls.js 1.6.7 / mpegts.js 1.7.3 (drop CDN @latest) - Fix rate limiter (client IP was never resolved), add login rate limit, restrict CORS, add CSP Report-Only, block private-IP SSRF targets, fix path traversal in recording log retrieval, chmod 777 -> 770 - Remove dead HiveService (seeded admin/admin into IndexedDB with SHA-256) - Fix authMiddleware not populating 'user' context (getPlaylist ignored the logged-in user; admin purge always returned 403) Streaming: - New FfmpegSessionManager: process registry, idle reaper (4 min live / 15 min VOD), orphan cleanup at startup, clean SIGTERM shutdown, fast-fail with stderr instead of 30 s timeout - Quality selection (source/high/medium/low) for live and VOD; source mode streams with -c:v copy (zero transcoding); selector wired into the player - Concurrent recordings (MAX_CONCURRENT_RECORDINGS, default 2); conflicts retry on the next tick instead of silently failing - Lower live latency (HLS window 20 -> 10 segments, liveSync 10 -> 3) - Fix recording log lookup (.mp4 vs .mkv mismatch) Design: - Replace hardcoded colors with AppColors tokens (12 files) - web/theme.css syncs HTML players with the Flutter palette - DPAD/keyboard navigation (arrow-key focus, player shortcuts) - Tooltips on player icon buttons, Semantics on content cards - Remove 7 dead widgets broken since the Stitch merge Quality: - bin/test/: 21 unit tests (bcrypt, redaction, traversal, SSRF, recording conflicts) plus a quality-selector widget test - GitHub Actions CI (analyze + test + build web) - Archive stale status docs into docs/archive/ Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
68 lines
1.7 KiB
Dart
68 lines
1.7 KiB
Dart
class Playlist {
|
|
final String id;
|
|
final String userId;
|
|
final String name;
|
|
final String serverUrl;
|
|
final String username;
|
|
final String password;
|
|
final String? dns;
|
|
final DateTime createdAt;
|
|
final DateTime updatedAt;
|
|
|
|
Playlist({
|
|
required this.id,
|
|
required this.userId,
|
|
required this.name,
|
|
required this.serverUrl,
|
|
required this.username,
|
|
required this.password,
|
|
this.dns,
|
|
required this.createdAt,
|
|
required this.updatedAt,
|
|
});
|
|
|
|
factory Playlist.fromMap(Map<String, dynamic> map) {
|
|
return Playlist(
|
|
id: map['id'] as String,
|
|
userId: map['user_id'] as String,
|
|
name: map['name'] as String,
|
|
serverUrl: map['server_url'] as String,
|
|
username: map['username'] as String,
|
|
password: map['password'] as String,
|
|
dns: map['dns'] as String?,
|
|
createdAt: DateTime.parse(map['created_at'] as String),
|
|
updatedAt: DateTime.parse(map['updated_at'] as String),
|
|
);
|
|
}
|
|
|
|
Map<String, dynamic> toJson() {
|
|
return {
|
|
'id': id,
|
|
'userId': userId,
|
|
'name': name,
|
|
'serverUrl': serverUrl,
|
|
'username': username,
|
|
// Never expose the Xtream password to clients; the backend injects
|
|
// credentials server-side (see xtream_api_handler.dart).
|
|
'password': '',
|
|
'dns': dns,
|
|
'createdAt': createdAt.toIso8601String(),
|
|
'updatedAt': updatedAt.toIso8601String(),
|
|
};
|
|
}
|
|
|
|
Map<String, dynamic> toMap() {
|
|
return {
|
|
'id': id,
|
|
'user_id': userId,
|
|
'name': name,
|
|
'server_url': serverUrl,
|
|
'username': username,
|
|
'password': password,
|
|
'dns': dns,
|
|
'created_at': createdAt.toIso8601String(),
|
|
'updated_at': updatedAt.toIso8601String(),
|
|
};
|
|
}
|
|
}
|