mirror of
https://github.com/R0m1k3/xtremflow.git
synced 2026-10-11 17:30:00 +02:00
Security: - Replace unsalted SHA-256 password hashing with bcrypt (lazy rehash on login) - Add authenticated /api/xtream-api gateway: Xtream credentials are injected server-side and never sent to the frontend; /api/playlists no longer returns passwords - Redact credentials from all logs (login body, proxy/FFmpeg/scheduler URLs) - Add auth to recordings, EPG, season-passes and streaming routes (HttpOnly session cookie for hls.js; loopback bypass for local FFmpeg) - Lock player postMessage to same-origin in both directions - Vendor and pin hls.js 1.6.7 / mpegts.js 1.7.3 (drop CDN @latest) - Fix rate limiter (client IP was never resolved), add login rate limit, restrict CORS, add CSP Report-Only, block private-IP SSRF targets, fix path traversal in recording log retrieval, chmod 777 -> 770 - Remove dead HiveService (seeded admin/admin into IndexedDB with SHA-256) - Fix authMiddleware not populating 'user' context (getPlaylist ignored the logged-in user; admin purge always returned 403) Streaming: - New FfmpegSessionManager: process registry, idle reaper (4 min live / 15 min VOD), orphan cleanup at startup, clean SIGTERM shutdown, fast-fail with stderr instead of 30 s timeout - Quality selection (source/high/medium/low) for live and VOD; source mode streams with -c:v copy (zero transcoding); selector wired into the player - Concurrent recordings (MAX_CONCURRENT_RECORDINGS, default 2); conflicts retry on the next tick instead of silently failing - Lower live latency (HLS window 20 -> 10 segments, liveSync 10 -> 3) - Fix recording log lookup (.mp4 vs .mkv mismatch) Design: - Replace hardcoded colors with AppColors tokens (12 files) - web/theme.css syncs HTML players with the Flutter palette - DPAD/keyboard navigation (arrow-key focus, player shortcuts) - Tooltips on player icon buttons, Semantics on content cards - Remove 7 dead widgets broken since the Stitch merge Quality: - bin/test/: 21 unit tests (bcrypt, redaction, traversal, SSRF, recording conflicts) plus a quality-selector widget test - GitHub Actions CI (analyze + test + build web) - Archive stale status docs into docs/archive/ Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
100 lines
2.5 KiB
Dart
100 lines
2.5 KiB
Dart
import 'package:dio/dio.dart';
|
|
import 'package:flutter/foundation.dart';
|
|
import 'dart:html' as html;
|
|
|
|
/// API Client for communicating with the backend
|
|
class ApiClient {
|
|
static final ApiClient _instance = ApiClient._internal();
|
|
factory ApiClient() => _instance;
|
|
|
|
late final Dio _dio;
|
|
String? _token;
|
|
|
|
ApiClient._internal() {
|
|
_dio = Dio(BaseOptions(
|
|
baseUrl: _getBaseUrl(),
|
|
headers: {'Content-Type': 'application/json'},
|
|
connectTimeout: const Duration(seconds: 60),
|
|
receiveTimeout: const Duration(seconds: 60),
|
|
),);
|
|
|
|
// Debug-only logging; request bodies are never logged (login payloads
|
|
// contain passwords).
|
|
if (kDebugMode) {
|
|
_dio.interceptors.add(LogInterceptor(
|
|
requestBody: false,
|
|
responseBody: false,
|
|
),);
|
|
}
|
|
|
|
// Restore token from localStorage on initialization
|
|
_restoreTokenFromStorage();
|
|
}
|
|
|
|
/// Restore token from localStorage on app startup
|
|
void _restoreTokenFromStorage() {
|
|
final storedToken = getStoredToken();
|
|
if (storedToken != null) {
|
|
_token = storedToken;
|
|
_dio.options.headers['Authorization'] = 'Bearer $storedToken';
|
|
}
|
|
}
|
|
|
|
/// Get base URL (same origin for production)
|
|
String _getBaseUrl() {
|
|
// Use current origin for API calls
|
|
return '';
|
|
}
|
|
|
|
/// Set authentication token
|
|
void setToken(String? token) {
|
|
_token = token;
|
|
if (token != null) {
|
|
_dio.options.headers['Authorization'] = 'Bearer $token';
|
|
// Store in localStorage for persistence
|
|
html.window.localStorage['auth_token'] = token;
|
|
} else {
|
|
_dio.options.headers.remove('Authorization');
|
|
html.window.localStorage.remove('auth_token');
|
|
}
|
|
}
|
|
|
|
/// Get stored token from localStorage
|
|
String? getStoredToken() {
|
|
return html.window.localStorage['auth_token'];
|
|
}
|
|
|
|
/// Restore token from localStorage
|
|
void restoreToken() {
|
|
final storedToken = getStoredToken();
|
|
if (storedToken != null) {
|
|
setToken(storedToken);
|
|
}
|
|
}
|
|
|
|
/// Clear token
|
|
void clearToken() {
|
|
setToken(null);
|
|
}
|
|
|
|
/// GET request
|
|
Future<Response> get(String path) async {
|
|
return _dio.get(path);
|
|
}
|
|
|
|
/// POST request
|
|
Future<Response> post(String path, {dynamic data}) async {
|
|
return _dio.post(path, data: data);
|
|
}
|
|
|
|
/// PUT request
|
|
Future<Response> put(String path, {dynamic data}) async {
|
|
return _dio.put(path, data: data);
|
|
}
|
|
|
|
/// DELETE request
|
|
Future<Response> delete(String path) async {
|
|
return _dio.delete(path);
|
|
}
|
|
}
|