Files
xtremflow/lib/core/api/api_client.dart
T
MichaelandClaude Fable 5 60d3f42901 feat: security hardening, streaming overhaul, design polish, tests
Security:
- Replace unsalted SHA-256 password hashing with bcrypt (lazy rehash on login)
- Add authenticated /api/xtream-api gateway: Xtream credentials are injected
  server-side and never sent to the frontend; /api/playlists no longer
  returns passwords
- Redact credentials from all logs (login body, proxy/FFmpeg/scheduler URLs)
- Add auth to recordings, EPG, season-passes and streaming routes
  (HttpOnly session cookie for hls.js; loopback bypass for local FFmpeg)
- Lock player postMessage to same-origin in both directions
- Vendor and pin hls.js 1.6.7 / mpegts.js 1.7.3 (drop CDN @latest)
- Fix rate limiter (client IP was never resolved), add login rate limit,
  restrict CORS, add CSP Report-Only, block private-IP SSRF targets,
  fix path traversal in recording log retrieval, chmod 777 -> 770
- Remove dead HiveService (seeded admin/admin into IndexedDB with SHA-256)
- Fix authMiddleware not populating 'user' context (getPlaylist ignored the
  logged-in user; admin purge always returned 403)

Streaming:
- New FfmpegSessionManager: process registry, idle reaper (4 min live /
  15 min VOD), orphan cleanup at startup, clean SIGTERM shutdown,
  fast-fail with stderr instead of 30 s timeout
- Quality selection (source/high/medium/low) for live and VOD; source mode
  streams with -c:v copy (zero transcoding); selector wired into the player
- Concurrent recordings (MAX_CONCURRENT_RECORDINGS, default 2); conflicts
  retry on the next tick instead of silently failing
- Lower live latency (HLS window 20 -> 10 segments, liveSync 10 -> 3)
- Fix recording log lookup (.mp4 vs .mkv mismatch)

Design:
- Replace hardcoded colors with AppColors tokens (12 files)
- web/theme.css syncs HTML players with the Flutter palette
- DPAD/keyboard navigation (arrow-key focus, player shortcuts)
- Tooltips on player icon buttons, Semantics on content cards
- Remove 7 dead widgets broken since the Stitch merge

Quality:
- bin/test/: 21 unit tests (bcrypt, redaction, traversal, SSRF, recording
  conflicts) plus a quality-selector widget test
- GitHub Actions CI (analyze + test + build web)
- Archive stale status docs into docs/archive/

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-06-10 10:07:18 +02:00

100 lines
2.5 KiB
Dart

import 'package:dio/dio.dart';
import 'package:flutter/foundation.dart';
import 'dart:html' as html;
/// API Client for communicating with the backend
class ApiClient {
static final ApiClient _instance = ApiClient._internal();
factory ApiClient() => _instance;
late final Dio _dio;
String? _token;
ApiClient._internal() {
_dio = Dio(BaseOptions(
baseUrl: _getBaseUrl(),
headers: {'Content-Type': 'application/json'},
connectTimeout: const Duration(seconds: 60),
receiveTimeout: const Duration(seconds: 60),
),);
// Debug-only logging; request bodies are never logged (login payloads
// contain passwords).
if (kDebugMode) {
_dio.interceptors.add(LogInterceptor(
requestBody: false,
responseBody: false,
),);
}
// Restore token from localStorage on initialization
_restoreTokenFromStorage();
}
/// Restore token from localStorage on app startup
void _restoreTokenFromStorage() {
final storedToken = getStoredToken();
if (storedToken != null) {
_token = storedToken;
_dio.options.headers['Authorization'] = 'Bearer $storedToken';
}
}
/// Get base URL (same origin for production)
String _getBaseUrl() {
// Use current origin for API calls
return '';
}
/// Set authentication token
void setToken(String? token) {
_token = token;
if (token != null) {
_dio.options.headers['Authorization'] = 'Bearer $token';
// Store in localStorage for persistence
html.window.localStorage['auth_token'] = token;
} else {
_dio.options.headers.remove('Authorization');
html.window.localStorage.remove('auth_token');
}
}
/// Get stored token from localStorage
String? getStoredToken() {
return html.window.localStorage['auth_token'];
}
/// Restore token from localStorage
void restoreToken() {
final storedToken = getStoredToken();
if (storedToken != null) {
setToken(storedToken);
}
}
/// Clear token
void clearToken() {
setToken(null);
}
/// GET request
Future<Response> get(String path) async {
return _dio.get(path);
}
/// POST request
Future<Response> post(String path, {dynamic data}) async {
return _dio.post(path, data: data);
}
/// PUT request
Future<Response> put(String path, {dynamic data}) async {
return _dio.put(path, data: data);
}
/// DELETE request
Future<Response> delete(String path) async {
return _dio.delete(path);
}
}