@codenkay/video-nsgplayer-core 0.1.0 → 0.1.3

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.1.3
+
+- Fix CDN **403 on child HLS playlists/segments** (`stream_N.m3u8`, `.ts`, keys): hls.js now uses an auth-params loader that re-applies signed `token`/`expires` query params on every request, not only the master playlist.
+- Preserve optional `streaming.keyProxyUrlBuilder` through config merge.
+
+## 0.1.2
+
+- Fix `InternalError: too much recursion` / stack overflow in `assertNoSecretsInConfig` when `createVideoPlayer` options include an `HTMLVideoElement` mount or credential callbacks.
+- Secret scanning is now plain-object only, iterative, depth-capped, and does not deep-walk `mount` / `auth` / `playback`.
+- Harden `redactObject` against circular graphs.
+
+## 0.1.1
+
+- Live-edge and config scan hardening.
+
 ## 0.1.0
 
 - Initial release

package/dist/index.cjs

@@ -44,15 +44,19 @@ __export(index_exports, {
   PlaybackSourceManager: () => PlaybackSourceManager,
   PlayerErrorCode: () => PlayerErrorCode,
   RefreshManager: () => RefreshManager,
+  SECRET_SCAN_MAX_DEPTH: () => SECRET_SCAN_MAX_DEPTH,
   assertNoSecretsInConfig: () => assertNoSecretsInConfig,
+  createAuthParamsLoader: () => createAuthParamsLoader,
   createPlayerError: () => createPlayerError,
   createVideoPlayer: () => createVideoPlayer,
   getLiveEdgeTime: () => getLiveEdgeTime,
   isAtLiveEdge: () => isAtLiveEdge,
+  isPlainObject: () => isPlainObject,
   mergePlayerConfig: () => mergePlayerConfig,
   redactObject: () => redactObject,
   redactSensitive: () => redactSensitive,
   redactValue: () => redactValue,
+  rewriteHlsRequestUrl: () => rewriteHlsRequestUrl,
   seekToLiveEdge: () => seekToLiveEdge,
   themeToCssVars: () => themeToCssVars
 });
@@ -206,7 +210,7 @@ var AuthManager = class {
 
 // src/config/defaults.ts
 var PLAYBACK_RATES = [0.5, 0.75, 1, 1.25, 1.5, 2];
-var PACKAGE_VERSION = "0.1.0";
+var PACKAGE_VERSION = "0.1.3";
 var DEFAULT_PLAYER_BEHAVIOR = {
   autoplay: true,
   startMuted: true,
@@ -292,22 +296,83 @@ var FORBIDDEN_SECRET_KEYS = [
   "basicauthpassword",
   "password"
 ];
+var SKIP_DEEP_SCAN_KEYS = /* @__PURE__ */ new Set([
+  "mount",
+  "auth",
+  "playback",
+  "gettoken",
+  "getsource",
+  "refreshsource",
+  "keyproxyurlbuilder"
+]);
+var SECRET_SCAN_MAX_DEPTH = 32;
+function isPlainObject(value) {
+  if (value === null || typeof value !== "object") return false;
+  if (Array.isArray(value)) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function normalizeConfigKey(key) {
+  return key.toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+function isForbiddenSecretKey(key) {
+  const lower = normalizeConfigKey(key);
+  return FORBIDDEN_SECRET_KEYS.some((k) => lower.includes(k));
+}
+function throwForbidden(path, key) {
+  throw new Error(
+    `INVALID_CONFIGURATION: Forbidden secret key "${path}${key}" must never be passed to the browser SDK. Keep clientSecret on your server/BFF and use auth.getToken().`
+  );
+}
 function assertNoSecretsInConfig(raw) {
-  if (!raw || typeof raw !== "object") return;
-  const walk = (obj, path) => {
-    for (const [key, value] of Object.entries(obj)) {
-      const lower = key.toLowerCase().replace(/[^a-z0-9]/g, "");
-      if (FORBIDDEN_SECRET_KEYS.some((k) => lower.includes(k))) {
-        throw new Error(
-          `INVALID_CONFIGURATION: Forbidden secret key "${path}${key}" must never be passed to the browser SDK. Keep clientSecret on your server/BFF and use auth.getToken().`
-        );
+  if (!isPlainObject(raw) && !Array.isArray(raw)) return;
+  const seen = /* @__PURE__ */ new WeakSet();
+  const stack = [
+    { value: raw, path: "", depth: 0 }
+  ];
+  while (stack.length > 0) {
+    const current = stack.pop();
+    if (current.depth > SECRET_SCAN_MAX_DEPTH) continue;
+    const { value, path, depth } = current;
+    if (Array.isArray(value)) {
+      if (seen.has(value)) continue;
+      seen.add(value);
+      for (let i = 0; i < value.length; i += 1) {
+        const item = value[i];
+        if (isPlainObject(item) || Array.isArray(item)) {
+          stack.push({ value: item, path: `${path}[${i}]`, depth: depth + 1 });
+        }
+      }
+      continue;
+    }
+    if (!isPlainObject(value)) continue;
+    if (seen.has(value)) continue;
+    seen.add(value);
+    for (const [key, child] of Object.entries(value)) {
+      const normalized = normalizeConfigKey(key);
+      if (isForbiddenSecretKey(key)) {
+        throwForbidden(path, key);
+      }
+      if (normalized === "mount") continue;
+      if (SKIP_DEEP_SCAN_KEYS.has(normalized)) {
+        if (isPlainObject(child)) {
+          for (const nestedKey of Object.keys(child)) {
+            if (isForbiddenSecretKey(nestedKey)) {
+              throwForbidden(`${path}${key}.`, nestedKey);
+            }
+          }
+        }
+        continue;
       }
-      if (value && typeof value === "object" && !Array.isArray(value)) {
-        walk(value, `${path}${key}.`);
+      if (isPlainObject(child) || Array.isArray(child)) {
+        stack.push({
+          value: child,
+          path: path ? `${path}${key}.` : `${key}.`,
+          depth: depth + 1
+        });
       }
     }
-  };
-  walk(raw, "");
+  }
 }
 function mergePlayerConfig(partial) {
   assertNoSecretsInConfig(partial);
@@ -321,7 +386,8 @@ function mergePlayerConfig(partial) {
       hls: {
         ...DEFAULT_PLAYER_CONFIG.streaming.hls,
         ...partial?.streaming?.hls
-      }
+      },
+      keyProxyUrlBuilder: partial?.streaming?.keyProxyUrlBuilder
     },
     logging: { ...DEFAULT_PLAYER_CONFIG.logging, ...partial?.logging },
     debug: { ...DEFAULT_PLAYER_CONFIG.debug, ...partial?.debug },
@@ -395,7 +461,14 @@ var EventEmitter = class {
 
 // src/security/redaction.ts
 var SENSITIVE_KEYS = /^(authorization|cookie|set-cookie|x-api-key|token|accessToken|access_token|clientSecret|password)$/i;
-function redactValue(key, value) {
+var REDACT_MAX_DEPTH = 32;
+function isPlainObject2(value) {
+  if (value === null || typeof value !== "object") return false;
+  if (Array.isArray(value)) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function redactValue(key, value, seen = /* @__PURE__ */ new WeakSet(), depth = 0) {
   if (SENSITIVE_KEYS.test(key)) return "[REDACTED]";
   if (typeof value === "string") {
     if (/^https?:\/\//i.test(value) && /[?&](token|expires)=/i.test(value)) {
@@ -412,15 +485,25 @@ function redactValue(key, value) {
       }
     }
   }
-  if (value && typeof value === "object" && !Array.isArray(value)) {
-    return redactObject(value);
+  if (Array.isArray(value)) {
+    if (depth >= REDACT_MAX_DEPTH || seen.has(value)) return "[REDACTED_CYCLE]";
+    seen.add(value);
+    return value.map(
+      (item, index) => redactValue(String(index), item, seen, depth + 1)
+    );
+  }
+  if (isPlainObject2(value)) {
+    return redactObject(value, seen, depth + 1);
   }
   return value;
 }
-function redactObject(obj) {
+function redactObject(obj, seen = /* @__PURE__ */ new WeakSet(), depth = 0) {
+  if (depth > REDACT_MAX_DEPTH) return { "[REDACTED]": "max_depth" };
+  if (seen.has(obj)) return { "[REDACTED]": "cycle" };
+  seen.add(obj);
   const out = {};
   for (const [key, value] of Object.entries(obj)) {
-    out[key] = redactValue(key, value);
+    out[key] = redactValue(key, value, seen, depth);
   }
   return out;
 }
@@ -480,11 +563,25 @@ var AuthParamsStore = class {
     });
     return out;
   }
+  /** True when at least one auth query param is stored. */
+  hasParams() {
+    return [...this.params.keys()].length > 0;
+  }
+  toString() {
+    return this.params.toString();
+  }
   update(next) {
     this.params = next instanceof URLSearchParams ? new URLSearchParams(next) : new URLSearchParams(next);
   }
+  /**
+   * Merges current auth params onto a target URL, preserving unrelated query keys.
+   * Critical for child HLS playlists/segments that omit signed query params.
+   */
   applyToUrl(rawUrl, baseOrigin) {
-    const target = new URL(rawUrl, baseOrigin ?? (typeof location !== "undefined" ? location.origin : "http://localhost"));
+    const target = new URL(
+      rawUrl,
+      baseOrigin ?? (typeof location !== "undefined" ? location.origin : "http://localhost")
+    );
     this.params.forEach((value, key) => {
       target.searchParams.set(key, value);
     });
@@ -719,6 +816,39 @@ function seekToLiveEdge(media, options) {
   return { moved: true, edge };
 }
 
+// src/streaming/authParamsLoader.ts
+var ENC_KEY_PATH_RE = /\/enc\.key$/i;
+function rewriteHlsRequestUrl(rawUrl, store, options = {}, baseOrigin = typeof location !== "undefined" ? location.origin : "http://localhost") {
+  if (!rawUrl) return rawUrl;
+  const parsed = new URL(rawUrl, baseOrigin);
+  const isKey = ENC_KEY_PATH_RE.test(parsed.pathname);
+  if (isKey && options.keyProxyUrlBuilder && options.videoId) {
+    const snapshot = store.toRecord();
+    return options.keyProxyUrlBuilder({
+      videoId: options.videoId,
+      keyUrl: parsed.toString(),
+      token: snapshot.token,
+      expires: snapshot.expires
+    });
+  }
+  if (!store.hasParams()) return parsed.toString();
+  return store.applyToUrl(rawUrl, baseOrigin);
+}
+function createAuthParamsLoader(HlsClass, store, options = {}) {
+  const BaseLoader = HlsClass.DefaultConfig.loader;
+  return class AuthParamsLoader extends BaseLoader {
+    load(context, config, callbacks) {
+      if (context.url) {
+        try {
+          context.url = rewriteHlsRequestUrl(context.url, store, options);
+        } catch {
+        }
+      }
+      super.load(context, config, callbacks);
+    }
+  };
+}
+
 // src/streaming/HlsEngine.ts
 var HlsEngine = class {
   constructor(options) {
@@ -771,15 +901,16 @@ var HlsEngine = class {
     }
   }
   async startWithHlsJs(Hls, playbackUrl) {
-    const { videoEl, authParams, hlsConfig, callbacks } = this.options;
+    const { videoEl, authParams, hlsConfig, callbacks, videoId, keyProxyUrlBuilder } = this.options;
+    const loader = createAuthParamsLoader(Hls, authParams, {
+      videoId,
+      keyProxyUrlBuilder
+    });
     this.hls = new Hls({
       enableWorker: hlsConfig.enableWorker,
       lowLatencyMode: hlsConfig.lowLatencyMode,
       backBufferLength: hlsConfig.backBufferLength,
-      xhrSetup: (xhr, url) => {
-        void xhr;
-        void url;
-      }
+      loader
     });
     this.hls.attachMedia(videoEl);
     this.hls.loadSource(authParams.applyToUrl(playbackUrl));
@@ -890,7 +1021,18 @@ function generateSessionId() {
   return `ps_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
 }
 function createVideoPlayer(options) {
-  assertNoSecretsInConfig(options);
+  assertNoSecretsInConfig({
+    videoId: options.videoId,
+    sourceUrl: options.sourceUrl,
+    player: options.player,
+    controls: options.controls,
+    theme: options.theme,
+    watermark: options.watermark,
+    streaming: options.streaming,
+    logging: options.logging,
+    debug: options.debug,
+    accessibility: options.accessibility
+  });
   let config = mergePlayerConfig({
     player: options.player,
     controls: options.controls,
@@ -976,6 +1118,8 @@ function createVideoPlayer(options) {
         startMuted: config.player.startMuted,
         startPosition: config.player.startPosition,
         volume: config.player.volume,
+        videoId: options.videoId,
+        keyProxyUrlBuilder: options.streaming?.keyProxyUrlBuilder,
         hlsConfig: config.streaming.hls,
         logger,
         callbacks: {
@@ -1236,7 +1380,8 @@ function createVideoPlayer(options) {
         watermark: { ...config.watermark, ...partial?.watermark },
         streaming: {
           engine: "hls",
-          hls: { ...config.streaming.hls, ...partial?.streaming?.hls }
+          hls: { ...config.streaming.hls, ...partial?.streaming?.hls },
+          keyProxyUrlBuilder: partial?.streaming?.keyProxyUrlBuilder ?? config.streaming.keyProxyUrlBuilder
         },
         logging: { ...config.logging, ...partial?.logging },
         debug: { ...config.debug, ...partial?.debug },
@@ -1273,15 +1418,19 @@ function createVideoPlayer(options) {
   PlaybackSourceManager,
   PlayerErrorCode,
   RefreshManager,
+  SECRET_SCAN_MAX_DEPTH,
   assertNoSecretsInConfig,
+  createAuthParamsLoader,
   createPlayerError,
   createVideoPlayer,
   getLiveEdgeTime,
   isAtLiveEdge,
+  isPlainObject,
   mergePlayerConfig,
   redactObject,
   redactSensitive,
   redactValue,
+  rewriteHlsRequestUrl,
   seekToLiveEdge,
   themeToCssVars
 });