Files
xtremflow/lib/mobile/features/auth/screens/mobile_login_screen.dart
T
MichaelandClaude Fable 5 60d3f42901 feat: security hardening, streaming overhaul, design polish, tests
Security:
- Replace unsalted SHA-256 password hashing with bcrypt (lazy rehash on login)
- Add authenticated /api/xtream-api gateway: Xtream credentials are injected
  server-side and never sent to the frontend; /api/playlists no longer
  returns passwords
- Redact credentials from all logs (login body, proxy/FFmpeg/scheduler URLs)
- Add auth to recordings, EPG, season-passes and streaming routes
  (HttpOnly session cookie for hls.js; loopback bypass for local FFmpeg)
- Lock player postMessage to same-origin in both directions
- Vendor and pin hls.js 1.6.7 / mpegts.js 1.7.3 (drop CDN @latest)
- Fix rate limiter (client IP was never resolved), add login rate limit,
  restrict CORS, add CSP Report-Only, block private-IP SSRF targets,
  fix path traversal in recording log retrieval, chmod 777 -> 770
- Remove dead HiveService (seeded admin/admin into IndexedDB with SHA-256)
- Fix authMiddleware not populating 'user' context (getPlaylist ignored the
  logged-in user; admin purge always returned 403)

Streaming:
- New FfmpegSessionManager: process registry, idle reaper (4 min live /
  15 min VOD), orphan cleanup at startup, clean SIGTERM shutdown,
  fast-fail with stderr instead of 30 s timeout
- Quality selection (source/high/medium/low) for live and VOD; source mode
  streams with -c:v copy (zero transcoding); selector wired into the player
- Concurrent recordings (MAX_CONCURRENT_RECORDINGS, default 2); conflicts
  retry on the next tick instead of silently failing
- Lower live latency (HLS window 20 -> 10 segments, liveSync 10 -> 3)
- Fix recording log lookup (.mp4 vs .mkv mismatch)

Design:
- Replace hardcoded colors with AppColors tokens (12 files)
- web/theme.css syncs HTML players with the Flutter palette
- DPAD/keyboard navigation (arrow-key focus, player shortcuts)
- Tooltips on player icon buttons, Semantics on content cards
- Remove 7 dead widgets broken since the Stitch merge

Quality:
- bin/test/: 21 unit tests (bcrypt, redaction, traversal, SSRF, recording
  conflicts) plus a quality-selector widget test
- GitHub Actions CI (analyze + test + build web)
- Archive stale status docs into docs/archive/

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-06-10 10:07:18 +02:00

278 lines
11 KiB
Dart

import 'package:flutter/material.dart';
import 'package:flutter_riverpod/flutter_riverpod.dart';
import 'package:go_router/go_router.dart';
import 'package:google_fonts/google_fonts.dart';
import '../../../../features/auth/providers/auth_provider.dart';
import '../../../../core/theme/app_colors.dart';
import '../../../../core/widgets/glass_container.dart';
import '../../../theme/mobile_theme.dart';
class MobileLoginScreen extends ConsumerStatefulWidget {
const MobileLoginScreen({super.key});
@override
ConsumerState<MobileLoginScreen> createState() => _MobileLoginScreenState();
}
class _MobileLoginScreenState extends ConsumerState<MobileLoginScreen> {
final _formKey = GlobalKey<FormState>();
final _usernameController = TextEditingController();
final _passwordController = TextEditingController();
bool _obscurePassword = true;
@override
void initState() {
super.initState();
// Pre-fill for convenience (as requested in original file)
_usernameController.text = 'admin';
_passwordController.text = 'admin';
}
@override
void dispose() {
_usernameController.dispose();
_passwordController.dispose();
super.dispose();
}
Future<void> _handleLogin() async {
if (!_formKey.currentState!.validate()) return;
final auth = ref.read(authProvider.notifier);
final success = await auth.login(
_usernameController.text.trim(),
_passwordController.text,
);
if (success && mounted) {
context.go('/playlists');
}
}
@override
Widget build(BuildContext context) {
final authState = ref.watch(authProvider);
return Theme(
data: MobileTheme.darkTheme,
child: Scaffold(
resizeToAvoidBottomInset: false,
backgroundColor: AppColors.background,
body: Stack(
fit: StackFit.expand,
children: [
// Cinematic Background Gradient
Container(
decoration: const BoxDecoration(
gradient: LinearGradient(
begin: Alignment.topLeft,
end: Alignment.bottomRight,
colors: [
AppColors.baseLevel0,
AppColors.surfaceContainerLowest,
AppColors.baseLevel0,
],
),
),
),
// Ambient Glow Top Left
Positioned(
top: -100,
left: -100,
child: Container(
width: 300,
height: 300,
decoration: BoxDecoration(
shape: BoxShape.circle,
color: AppColors.primary.withOpacity(0.15),
boxShadow: [
BoxShadow(
color: AppColors.primary.withOpacity(0.15),
blurRadius: 150,
spreadRadius: 50,
),
],
),
),
),
// Content
Center(
child: SingleChildScrollView(
padding: const EdgeInsets.all(24.0),
child: GlassContainer.floating(
borderRadius: 24,
padding: const EdgeInsets.all(32),
child: Column(
mainAxisSize: MainAxisSize.min,
children: [
// Logo / Icon
Container(
width: 80,
height: 80,
decoration: BoxDecoration(
color: AppColors.surfaceContainer,
shape: BoxShape.circle,
border: Border.all(color: AppColors.outlineVariant),
),
child: const Icon(
Icons.live_tv_rounded,
color: AppColors.onSurface,
size: 40,
),
),
const SizedBox(height: 24),
Text(
'XtremFlow',
style: GoogleFonts.spaceGrotesk(
fontSize: 32,
fontWeight: FontWeight.w700,
color: AppColors.onSurface,
letterSpacing: -1.0,
),
),
Text(
'Mobile Edition',
style: GoogleFonts.inter(
fontSize: 14,
color: AppColors.onSurfaceVariant,
letterSpacing: 0.5,
),
),
const SizedBox(height: 48),
// Form
Form(
key: _formKey,
child: Column(
children: [
_buildInput(
controller: _usernameController,
label: 'Username',
icon: Icons.person_outline_rounded,
),
const SizedBox(height: 16),
_buildInput(
controller: _passwordController,
label: 'Password',
icon: Icons.lock_outline_rounded,
isPassword: true,
obscureText: _obscurePassword,
onTogglePassword: () => setState(() => _obscurePassword = !_obscurePassword),
onSubmitted: (_) => _handleLogin(),
),
if (authState.errorMessage != null) ...[
const SizedBox(height: 24),
Container(
padding: const EdgeInsets.symmetric(horizontal: 16, vertical: 8),
decoration: BoxDecoration(
color: AppColors.error.withOpacity(0.1),
borderRadius: BorderRadius.circular(8),
border: Border.all(color: AppColors.error.withOpacity(0.3)),
),
child: Text(
authState.errorMessage!,
style: GoogleFonts.inter(color: AppColors.error, fontSize: 13),
textAlign: TextAlign.center,
),
),
],
const SizedBox(height: 32),
Container(
width: double.infinity,
height: 50,
decoration: BoxDecoration(
gradient: AppColors.primaryGradient,
borderRadius: BorderRadius.circular(12),
boxShadow: [
BoxShadow(
color: AppColors.glowPrimary(0.4),
blurRadius: 16,
offset: const Offset(0, 4),
),
],
),
child: FilledButton(
onPressed: authState.isLoading ? null : _handleLogin,
style: FilledButton.styleFrom(
backgroundColor: Colors.transparent,
foregroundColor: Colors.white,
shape: RoundedRectangleBorder(borderRadius: BorderRadius.circular(12)),
elevation: 0,
).copyWith(
overlayColor: WidgetStateProperty.all(AppColors.onSurface.withOpacity(0.1)),
),
child: authState.isLoading
? const SizedBox(
width: 24,
height: 24,
child: CircularProgressIndicator(strokeWidth: 2, color: Colors.white),
)
: Text(
'Sign In',
style: GoogleFonts.inter(fontWeight: FontWeight.w600, fontSize: 16, color: Colors.white),
),
),
),
],
),
),
],
),
),
),
),
],
),
),
);
}
Widget _buildInput({
required TextEditingController controller,
required String label,
required IconData icon,
bool isPassword = false,
bool obscureText = false,
VoidCallback? onTogglePassword,
Function(String)? onSubmitted,
}) {
return TextFormField(
controller: controller,
obscureText: obscureText,
style: GoogleFonts.inter(color: AppColors.onSurface),
decoration: InputDecoration(
labelText: label,
labelStyle: GoogleFonts.inter(color: AppColors.onSurfaceVariant),
prefixIcon: Icon(icon, color: AppColors.onSurfaceVariant),
suffixIcon: isPassword
? IconButton(
icon: Icon(obscureText ? Icons.visibility_outlined : Icons.visibility_off_outlined, color: AppColors.outline),
onPressed: onTogglePassword,
)
: null,
filled: true,
fillColor: AppColors.surfaceContainerLow,
border: OutlineInputBorder(
borderRadius: BorderRadius.circular(12),
borderSide: BorderSide.none,
),
enabledBorder: OutlineInputBorder(
borderRadius: BorderRadius.circular(12),
borderSide: BorderSide.none,
),
focusedBorder: OutlineInputBorder(
borderRadius: BorderRadius.circular(12),
borderSide: const BorderSide(color: AppColors.primaryContainer, width: 2),
),
contentPadding: const EdgeInsets.symmetric(horizontal: 16, vertical: 16),
),
validator: (value) => (value == null || value.trim().isEmpty) ? 'Required' : null,
onFieldSubmitted: onSubmitted,
);
}
}