Files
xtremflow/lib/features/iptv/screens/playlist_selection_screen.dart
T
MichaelandClaude Fable 5 60d3f42901 feat: security hardening, streaming overhaul, design polish, tests
Security:
- Replace unsalted SHA-256 password hashing with bcrypt (lazy rehash on login)
- Add authenticated /api/xtream-api gateway: Xtream credentials are injected
  server-side and never sent to the frontend; /api/playlists no longer
  returns passwords
- Redact credentials from all logs (login body, proxy/FFmpeg/scheduler URLs)
- Add auth to recordings, EPG, season-passes and streaming routes
  (HttpOnly session cookie for hls.js; loopback bypass for local FFmpeg)
- Lock player postMessage to same-origin in both directions
- Vendor and pin hls.js 1.6.7 / mpegts.js 1.7.3 (drop CDN @latest)
- Fix rate limiter (client IP was never resolved), add login rate limit,
  restrict CORS, add CSP Report-Only, block private-IP SSRF targets,
  fix path traversal in recording log retrieval, chmod 777 -> 770
- Remove dead HiveService (seeded admin/admin into IndexedDB with SHA-256)
- Fix authMiddleware not populating 'user' context (getPlaylist ignored the
  logged-in user; admin purge always returned 403)

Streaming:
- New FfmpegSessionManager: process registry, idle reaper (4 min live /
  15 min VOD), orphan cleanup at startup, clean SIGTERM shutdown,
  fast-fail with stderr instead of 30 s timeout
- Quality selection (source/high/medium/low) for live and VOD; source mode
  streams with -c:v copy (zero transcoding); selector wired into the player
- Concurrent recordings (MAX_CONCURRENT_RECORDINGS, default 2); conflicts
  retry on the next tick instead of silently failing
- Lower live latency (HLS window 20 -> 10 segments, liveSync 10 -> 3)
- Fix recording log lookup (.mp4 vs .mkv mismatch)

Design:
- Replace hardcoded colors with AppColors tokens (12 files)
- web/theme.css syncs HTML players with the Flutter palette
- DPAD/keyboard navigation (arrow-key focus, player shortcuts)
- Tooltips on player icon buttons, Semantics on content cards
- Remove 7 dead widgets broken since the Stitch merge

Quality:
- bin/test/: 21 unit tests (bcrypt, redaction, traversal, SSRF, recording
  conflicts) plus a quality-selector widget test
- GitHub Actions CI (analyze + test + build web)
- Archive stale status docs into docs/archive/

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-06-10 10:07:18 +02:00

299 lines
10 KiB
Dart

import 'package:flutter/material.dart';
import 'package:flutter_riverpod/flutter_riverpod.dart';
import 'package:go_router/go_router.dart';
import 'package:google_fonts/google_fonts.dart';
import '../../../core/services/playlist_api_service.dart';
import '../../../core/models/playlist_config.dart';
import '../../../core/theme/app_colors.dart';
import '../../auth/providers/auth_provider.dart';
import '../providers/xtream_provider.dart';
/// Provider for fetching playlists from API
final playlistsProvider = FutureProvider<List<PlaylistConfig>>((ref) async {
final service = PlaylistApiService();
return service.getPlaylists();
});
class PlaylistSelectionScreen extends ConsumerWidget {
const PlaylistSelectionScreen({super.key});
@override
Widget build(BuildContext context, WidgetRef ref) {
final currentUser = ref.watch(authProvider).currentUser;
final playlistsAsync = ref.watch(playlistsProvider);
return Scaffold(
extendBodyBehindAppBar: true,
appBar: AppBar(
title: Text(
'Select Playlist',
style: GoogleFonts.roboto(
fontWeight: FontWeight.w600,
color: AppColors.textPrimary,
),
),
backgroundColor: Colors.transparent,
elevation: 0,
actions: [
if (currentUser?.isAdmin ?? false)
IconButton(
icon: const Icon(
Icons.admin_panel_settings,
color: AppColors.textSecondary,
),
onPressed: () => context.go('/admin'),
tooltip: 'Admin Panel',
),
IconButton(
icon: const Icon(Icons.logout, color: AppColors.textSecondary),
onPressed: () async {
await ref.read(authProvider.notifier).logout();
if (context.mounted) {
context.go('/login');
}
},
tooltip: 'Logout',
),
],
),
body: Container(
decoration: const BoxDecoration(
gradient: LinearGradient(
begin: Alignment.topCenter,
end: Alignment.bottomCenter,
colors: [
AppColors.surfaceContainerLowest,
AppColors.background,
AppColors.baseLevel0,
],
),
),
child: SafeArea(
child: LayoutBuilder(
builder: (context, constraints) {
// Safety: if constraints are invalid, show loading spinner
if (!constraints.maxWidth.isFinite ||
constraints.maxWidth <= 0 ||
!constraints.maxHeight.isFinite ||
constraints.maxHeight <= 0) {
return const Center(
child: CircularProgressIndicator(color: AppColors.primary),
);
}
return playlistsAsync.when(
loading: () => const Center(
child: CircularProgressIndicator(color: AppColors.primary),
),
error: (error, stack) => Center(
child: Column(
mainAxisAlignment: MainAxisAlignment.center,
children: [
const Icon(
Icons.error_outline,
size: 64,
color: AppColors.error,
),
const SizedBox(height: 16),
Text(
'Error loading playlists',
style: GoogleFonts.outfit(
fontSize: 18,
color: AppColors.textSecondary,
),
),
const SizedBox(height: 8),
ElevatedButton(
onPressed: () => ref.refresh(playlistsProvider),
style: ElevatedButton.styleFrom(
backgroundColor: AppColors.primary,
foregroundColor: AppColors.textPrimary,
),
child: Text('Retry', style: GoogleFonts.inter()),
),
],
),
),
data: (playlists) {
if (playlists.isEmpty) {
return Center(
child: Column(
mainAxisAlignment: MainAxisAlignment.center,
children: [
const Icon(
Icons.playlist_remove,
size: 64,
color: Colors.white24,
),
const SizedBox(height: 16),
Text(
'No playlists available',
style: GoogleFonts.outfit(
fontSize: 18,
color: Colors.white60,
),
),
const SizedBox(height: 8),
Text(
currentUser?.isAdmin ?? false
? 'Add playlists in Admin Panel'
: 'Contact administrator',
style: GoogleFonts.inter(
fontSize: 14,
color: Colors.white38,
),
),
],
),
);
}
// Simple Wrap layout - no grid, no NaN-prone calculations
return SingleChildScrollView(
padding: const EdgeInsets.fromLTRB(48, 32, 48, 48),
child: Wrap(
spacing: 32,
runSpacing: 32,
children: playlists.map((playlist) {
return SizedBox(
width: 340,
height: 240,
child: _PlaylistCard(
playlist: playlist,
onTap: () {
ref
.read(selectedPlaylistProvider.notifier)
.state = playlist;
context.go('/dashboard');
},
),
);
}).toList(),
),
);
},
);
},
),
),
),
);
}
}
class _PlaylistCard extends StatefulWidget {
final PlaylistConfig playlist;
final VoidCallback onTap;
const _PlaylistCard({
required this.playlist,
required this.onTap,
});
@override
State<_PlaylistCard> createState() => _PlaylistCardState();
}
class _PlaylistCardState extends State<_PlaylistCard> {
bool _isHovered = false;
@override
Widget build(BuildContext context) {
return MouseRegion(
onEnter: (_) => setState(() => _isHovered = true),
onExit: (_) => setState(() => _isHovered = false),
cursor: SystemMouseCursors.click,
child: GestureDetector(
onTap: widget.onTap,
child: AnimatedContainer(
duration: const Duration(milliseconds: 200),
decoration: BoxDecoration(
color: _isHovered
? Colors.white.withOpacity(0.1)
: Colors.white.withOpacity(0.03),
borderRadius: BorderRadius.circular(24),
border: Border.all(
color: _isHovered
? AppColors.primary.withOpacity(0.5)
: Colors.white.withOpacity(0.08),
width: 1.5,
),
boxShadow: _isHovered
? [
BoxShadow(
color: AppColors.primary.withOpacity(0.2),
blurRadius: 30,
spreadRadius: -5,
offset: const Offset(0, 10),
),
]
: [],
),
padding: const EdgeInsets.all(24),
child: Column(
mainAxisAlignment: MainAxisAlignment.center,
crossAxisAlignment: CrossAxisAlignment.start,
children: [
AnimatedContainer(
duration: const Duration(milliseconds: 200),
width: 56,
height: 56,
decoration: BoxDecoration(
gradient: _isHovered
? AppColors.primaryGradient
: LinearGradient(
begin: Alignment.topLeft,
end: Alignment.bottomRight,
colors: [
Colors.white.withOpacity(0.1),
Colors.white.withOpacity(0.05),
],
),
shape: BoxShape.circle,
boxShadow: _isHovered
? [
BoxShadow(
color: AppColors.primary.withOpacity(0.4),
blurRadius: 16,
offset: const Offset(0, 4),
),
]
: [],
),
child: Icon(
Icons.playlist_play_rounded,
size: 32,
color: _isHovered ? Colors.white : Colors.white70,
),
),
const SizedBox(height: 20),
Text(
widget.playlist.name,
style: GoogleFonts.outfit(
fontSize: 22,
fontWeight: FontWeight.bold,
color: Colors.white,
height: 1.2,
),
maxLines: 2,
overflow: TextOverflow.ellipsis,
),
const SizedBox(height: 8),
Text(
Uri.tryParse(widget.playlist.dns)?.host ?? widget.playlist.dns,
style: GoogleFonts.inter(
fontSize: 13,
color: Colors.white38,
letterSpacing: 0.5,
),
maxLines: 1,
overflow: TextOverflow.ellipsis,
),
],
),
),
),
);
}
}