Files
xtremflow/lib/features/iptv/widgets/movies_tab.dart
T
MichaelandClaude Fable 5 60d3f42901 feat: security hardening, streaming overhaul, design polish, tests
Security:
- Replace unsalted SHA-256 password hashing with bcrypt (lazy rehash on login)
- Add authenticated /api/xtream-api gateway: Xtream credentials are injected
  server-side and never sent to the frontend; /api/playlists no longer
  returns passwords
- Redact credentials from all logs (login body, proxy/FFmpeg/scheduler URLs)
- Add auth to recordings, EPG, season-passes and streaming routes
  (HttpOnly session cookie for hls.js; loopback bypass for local FFmpeg)
- Lock player postMessage to same-origin in both directions
- Vendor and pin hls.js 1.6.7 / mpegts.js 1.7.3 (drop CDN @latest)
- Fix rate limiter (client IP was never resolved), add login rate limit,
  restrict CORS, add CSP Report-Only, block private-IP SSRF targets,
  fix path traversal in recording log retrieval, chmod 777 -> 770
- Remove dead HiveService (seeded admin/admin into IndexedDB with SHA-256)
- Fix authMiddleware not populating 'user' context (getPlaylist ignored the
  logged-in user; admin purge always returned 403)

Streaming:
- New FfmpegSessionManager: process registry, idle reaper (4 min live /
  15 min VOD), orphan cleanup at startup, clean SIGTERM shutdown,
  fast-fail with stderr instead of 30 s timeout
- Quality selection (source/high/medium/low) for live and VOD; source mode
  streams with -c:v copy (zero transcoding); selector wired into the player
- Concurrent recordings (MAX_CONCURRENT_RECORDINGS, default 2); conflicts
  retry on the next tick instead of silently failing
- Lower live latency (HLS window 20 -> 10 segments, liveSync 10 -> 3)
- Fix recording log lookup (.mp4 vs .mkv mismatch)

Design:
- Replace hardcoded colors with AppColors tokens (12 files)
- web/theme.css syncs HTML players with the Flutter palette
- DPAD/keyboard navigation (arrow-key focus, player shortcuts)
- Tooltips on player icon buttons, Semantics on content cards
- Remove 7 dead widgets broken since the Stitch merge

Quality:
- bin/test/: 21 unit tests (bcrypt, redaction, traversal, SSRF, recording
  conflicts) plus a quality-selector widget test
- GitHub Actions CI (analyze + test + build web)
- Archive stale status docs into docs/archive/

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-06-10 10:07:18 +02:00

506 lines
18 KiB
Dart

import 'dart:async';
import 'package:flutter/material.dart';
import 'package:flutter_riverpod/flutter_riverpod.dart';
import 'package:google_fonts/google_fonts.dart';
import '../../../core/models/playlist_config.dart';
import '../../../core/theme/app_colors.dart';
import '../../../core/utils/responsive_layout.dart';
import '../../../core/widgets/hero_carousel.dart';
import '../../../core/widgets/glass_container.dart';
import '../../../core/widgets/tv_focusable_card.dart';
import '../providers/watch_history_provider.dart';
import '../models/xtream_models.dart';
import '../providers/xtream_provider.dart';
import '../providers/settings_provider.dart';
import '../screens/player_screen.dart';
class MoviesTab extends ConsumerStatefulWidget {
final PlaylistConfig playlist;
const MoviesTab({super.key, required this.playlist});
@override
ConsumerState<MoviesTab> createState() => _MoviesTabState();
}
class _MoviesTabState extends ConsumerState<MoviesTab> {
final ScrollController _scrollController = ScrollController();
final TextEditingController _searchController = TextEditingController();
final List<Movie> _movies = [];
List<Movie>? _searchResults;
String _searchQuery = '';
bool _isLoading = false;
bool _isSearching = false;
bool _hasMore = true;
int _currentOffset = 0;
static const int _pageSize = 100;
Timer? _searchDebounce;
@override
void initState() {
super.initState();
_loadMoreMovies();
_scrollController.addListener(_onScroll);
}
@override
void dispose() {
_scrollController.dispose();
_searchController.dispose();
_searchDebounce?.cancel();
super.dispose();
}
void _onScroll() {
if (_scrollController.position.pixels >=
_scrollController.position.maxScrollExtent * 0.8) {
_loadMoreMovies();
}
}
void _onSearchChanged(String query) {
_searchDebounce?.cancel();
setState(() {
_searchQuery = query;
if (query.isEmpty) {
_searchResults = null;
_isSearching = false;
}
});
if (query.length >= 2) {
_searchDebounce = Timer(const Duration(milliseconds: 500), () {
_performSearch(query);
});
}
}
Future<void> _performSearch(String query) async {
if (query.isEmpty) return;
setState(() => _isSearching = true);
try {
final service = ref.read(xtreamServiceProvider(widget.playlist));
final results = await service.searchMovies(query);
if (mounted && _searchQuery == query) {
setState(() {
_searchResults = results;
_isSearching = false;
});
}
} catch (e) {
if (mounted) {
setState(() => _isSearching = false);
}
}
}
Future<void> _loadMoreMovies() async {
if (_isLoading || !_hasMore) return;
setState(() {
_isLoading = true;
});
try {
final service = ref.read(xtreamServiceProvider(widget.playlist));
final newMovies = await service.getMoviesPaginated(
offset: _currentOffset,
limit: _pageSize,
);
setState(() {
_movies.addAll(newMovies);
_currentOffset += _pageSize;
_hasMore = newMovies.length == _pageSize;
_isLoading = false;
});
} catch (e) {
setState(() {
_isLoading = false;
});
if (mounted) {
ScaffoldMessenger.of(context).showSnackBar(
SnackBar(content: Text('Failed to load movies: $e')),
);
}
}
}
String? _formatRating(String? rating) {
if (rating == null || rating.isEmpty) return null;
final value = double.tryParse(rating);
if (value != null) {
return value.toStringAsFixed(1);
}
return rating;
}
String _getProxiedImageUrl(String? originalUrl) {
if (originalUrl == null || originalUrl.isEmpty) return '';
if (originalUrl.startsWith('http://')) {
return '/api/xtream/$originalUrl';
}
return originalUrl;
}
Future<void> _playMovie(Movie movie) async {
ref.read(watchHistoryProvider.notifier).markMovieWatched(movie.streamId);
Duration? movieDuration;
if (movie.durationSecs != null && movie.durationSecs! > 0) {
movieDuration = Duration(seconds: movie.durationSecs!);
} else {
final service = ref.read(xtreamServiceProvider(widget.playlist));
final durationSecs = await service.getVodDuration(movie.streamId);
if (durationSecs != null && durationSecs > 0) {
movieDuration = Duration(seconds: durationSecs);
}
}
if (!mounted) return;
Navigator.push(
context,
MaterialPageRoute(
builder: (context) => PlayerScreen(
streamId: movie.streamId,
title: movie.name,
playlist: widget.playlist,
streamType: StreamType.vod,
containerExtension: movie.containerExtension ?? 'mp4',
duration: movieDuration,
),
),
);
}
@override
Widget build(BuildContext context) {
final settings = ref.watch(iptvSettingsProvider);
final watchHistory = ref.watch(watchHistoryProvider);
List<Movie> displayMovies;
if (_searchQuery.isNotEmpty && _searchResults != null) {
displayMovies = _searchResults!;
} else {
displayMovies = settings.moviesKeywords.isEmpty
? _movies
: _movies
.where((m) => settings.matchesMoviesFilter(m.categoryName))
.toList();
}
const double gridItemRatio = 0.65;
final int crossAxisCount = ResponsiveLayout.value(
context,
mobile: 3,
tablet: 5,
desktop: 7,
);
return Scaffold(
backgroundColor: Colors.transparent,
body: CustomScrollView(
controller: _scrollController,
slivers: [
// Header (Floating Glass)
SliverToBoxAdapter(
child: Padding(
padding: const EdgeInsets.fromLTRB(24, 16, 24, 24),
child: GlassContainer.glass(
borderRadius: 100,
padding:
const EdgeInsets.symmetric(horizontal: 24, vertical: 12),
child: Row(
children: [
Text(
'Movies',
style: GoogleFonts.spaceGrotesk(
fontSize: 24,
fontWeight: FontWeight.w700,
color: AppColors.onSurface,
),
),
const Spacer(),
// Search Bar
Container(
width: 300,
height: 40,
decoration: BoxDecoration(
color: AppColors.surfaceContainerLow,
borderRadius: BorderRadius.circular(100),
border: Border.all(
color: AppColors.outlineVariant,
width: 1,
),
),
padding: const EdgeInsets.symmetric(horizontal: 16),
child: Row(
children: [
Icon(
Icons.search,
size: 20,
color: AppColors.outline,
),
const SizedBox(width: 8),
Expanded(
child: TextField(
controller: _searchController,
style: GoogleFonts.inter(
fontSize: 14,
color: AppColors.onSurface,
),
decoration: InputDecoration(
hintText: 'Search movies...',
hintStyle:
GoogleFonts.inter(color: AppColors.outline),
border: InputBorder.none,
isDense: true,
contentPadding:
const EdgeInsets.only(bottom: 12),
),
onChanged: _onSearchChanged,
),
),
if (_isSearching)
const SizedBox(
width: 16,
height: 16,
child: CircularProgressIndicator(
strokeWidth: 2,
color: AppColors.onSurface,
),
),
if (_searchQuery.isNotEmpty)
GestureDetector(
onTap: () {
_searchController.clear();
_onSearchChanged('');
},
child: Icon(
Icons.close,
size: 16,
color: AppColors.onSurface,
),
),
],
),
),
],
),
),
),
),
// Hero Carousel (Only when not searching)
if (_searchQuery.isEmpty && displayMovies.isNotEmpty)
SliverToBoxAdapter(
child: Padding(
padding: const EdgeInsets.only(bottom: 32),
child: HeroCarousel(
items: displayMovies
.take(5)
.map(
(m) => HeroCarouselItem(
id: m.streamId,
title: m.name,
imageUrl: _getProxiedImageUrl(m.streamIcon),
subtitle: m.rating != null
? '${_formatRating(m.rating)} ★'
: null,
onPlay: () => _playMovie(m),
onTap: () => _playMovie(m),
),
)
.toList(),
),
),
),
// Movies Grid
SliverPadding(
padding: const EdgeInsets.symmetric(horizontal: 24),
sliver: SliverGrid(
gridDelegate: SliverGridDelegateWithFixedCrossAxisCount(
crossAxisCount: crossAxisCount,
crossAxisSpacing: 20,
mainAxisSpacing: 20,
childAspectRatio: gridItemRatio,
),
delegate: SliverChildBuilderDelegate(
(context, index) {
if (index >= displayMovies.length) return null;
final movie = displayMovies[index];
final isWatched = watchHistory.isMovieWatched(movie.streamId);
return TvFocusableCard(
onTap: () => _playMovie(movie),
borderRadius: 12,
semanticLabel: 'Film ${movie.name}',
child: Stack(
fit: StackFit.expand,
children: [
// Poster Image
ClipRRect(
borderRadius: BorderRadius.circular(12),
child: movie.streamIcon != null &&
movie.streamIcon!.isNotEmpty
? Image.network(
_getProxiedImageUrl(movie.streamIcon),
fit: BoxFit.cover,
errorBuilder: (ctx, err, stack) => Container(
color: AppColors.surfaceContainerLow,
child: Center(
child: Icon(
Icons.movie,
size: 48,
color: AppColors.outline,
),
),
),
)
: Container(
color: AppColors.surfaceContainerLow,
child: Center(
child: Icon(
Icons.movie,
size: 48,
color: AppColors.outline,
),
),
),
),
// Gradient Overlay
Positioned(
left: 0,
right: 0,
bottom: 0,
height: 80,
child: Container(
decoration: BoxDecoration(
gradient: LinearGradient(
begin: Alignment.topCenter,
end: Alignment.bottomCenter,
colors: [
Colors.transparent,
AppColors.baseLevel0.withOpacity(0.9),
],
),
borderRadius: const BorderRadius.vertical(
bottom: Radius.circular(12),
),
),
),
),
// Rating Badge
if (movie.rating != null && movie.rating!.isNotEmpty)
Positioned(
top: 8,
right: 8,
child: Container(
padding: const EdgeInsets.symmetric(
horizontal: 6,
vertical: 2,
),
decoration: BoxDecoration(
color: AppColors.background.withOpacity(0.7),
borderRadius: BorderRadius.circular(4),
border: Border.all(
color: AppColors.outlineVariant),
),
child: Row(
mainAxisSize: MainAxisSize.min,
children: [
const Icon(
Icons.star,
size: 10,
color: AppColors.ratingGold,
),
const SizedBox(width: 4),
Text(
_formatRating(movie.rating)!,
style: GoogleFonts.inter(
fontSize: 10,
fontWeight: FontWeight.bold,
color: AppColors.onSurface,
),
),
],
),
),
),
// Title
Positioned(
left: 12,
right: 12,
bottom: 12,
child: Column(
crossAxisAlignment: CrossAxisAlignment.start,
mainAxisSize: MainAxisSize.min,
children: [
Text(
movie.name,
style: GoogleFonts.inter(
color: AppColors.onSurface,
fontSize: 13,
fontWeight: FontWeight.w600,
shadows: [
const Shadow(
color: AppColors.background,
blurRadius: 4,
),
],
),
maxLines: 2,
overflow: TextOverflow.ellipsis,
),
if (isWatched)
Padding(
padding: const EdgeInsets.only(top: 4),
child: Text(
'WATCHED',
style: GoogleFonts.inter(
color: AppColors.primary,
fontSize: 10,
fontWeight: FontWeight.bold,
),
),
),
],
),
),
],
),
);
},
childCount: displayMovies.length,
),
),
),
// Loader
if (_isLoading)
const SliverToBoxAdapter(
child: Padding(
padding: EdgeInsets.all(32),
child: Center(
child: CircularProgressIndicator(color: AppColors.onSurface),
),
),
),
const SliverPadding(padding: EdgeInsets.only(bottom: 50)),
],
),
);
}
}