@codenkay/video-nsgplayer-core 0.1.0 → 0.1.3

package/dist/index.d.ts

@@ -1,3 +1,5 @@
+import Hls, { LoaderContext, LoaderConfiguration, LoaderCallbacks } from 'hls.js';
+
 /** Player lifecycle states. */
 type PlayerState = "idle" | "loading" | "ready" | "playing" | "paused" | "buffering" | "renewing" | "ended" | "error" | "destroyed";
 type HlsSupportMode = "hls.js" | "native" | "unsupported";
@@ -166,6 +168,7 @@ type PlayerConfig = Required<{
     streaming: {
         engine: "hls";
         hls: Required<NonNullable<StreamingConfig["hls"]>>;
+        keyProxyUrlBuilder?: StreamingConfig["keyProxyUrlBuilder"];
     };
     logging: Required<LoggingConfig>;
     debug: Required<DebugConfig>;
@@ -239,14 +242,30 @@ type PlayerEventMap = {
 };
 
 declare const PLAYBACK_RATES: readonly [0.5, 0.75, 1, 1.25, 1.5, 2];
-declare const PACKAGE_VERSION = "0.1.0";
+declare const PACKAGE_VERSION = "0.1.3";
 declare const DEFAULT_PLAYER_BEHAVIOR: Required<PlayerBehaviorConfig>;
 declare const DEFAULT_CONTROLS: Required<ControlsConfig>;
 declare const DEFAULT_THEME: Required<ThemeConfig>;
 declare const DEFAULT_WATERMARK: Required<WatermarkConfig>;
 declare const DEFAULT_PLAYER_CONFIG: PlayerConfig;
+/** Hard cap so pathological graphs cannot blow the stack. */
+declare const SECRET_SCAN_MAX_DEPTH = 32;
+/**
+ * True only for JSON-like plain objects (`{}` / `Object.create(null)`).
+ * Excludes DOM nodes, class instances, arrays, dates, etc.
+ */
+declare function isPlainObject(value: unknown): value is Record<string, unknown>;
+/**
+ * Scans plain config objects for forbidden secret key names.
+ *
+ * Enterprise guarantees:
+ * - Never deep-walks DOM / host / class instances (plain-object only)
+ * - Does not descend into `mount` / `auth` / `playback` (shallow key check only)
+ * - Cycle-safe via WeakSet
+ * - Depth-capped + iterative (no call-stack recursion)
+ */
 declare function assertNoSecretsInConfig(raw: unknown): void;
-declare function mergePlayerConfig(partial?: Partial<{
+type PlayerConfigPartial = Partial<{
     player: Partial<PlayerBehaviorConfig>;
     controls: Partial<ControlsConfig>;
     theme: Partial<ThemeConfig>;
@@ -254,12 +273,13 @@ declare function mergePlayerConfig(partial?: Partial<{
     streaming: {
         engine?: "hls";
         hls?: Partial<PlayerConfig["streaming"]["hls"]>;
-        keyProxyUrlBuilder?: unknown;
+        keyProxyUrlBuilder?: PlayerConfig["streaming"]["keyProxyUrlBuilder"];
     };
     logging: Partial<PlayerConfig["logging"]>;
     debug: Partial<PlayerConfig["debug"]>;
     accessibility: Partial<PlayerConfig["accessibility"]>;
-}>): PlayerConfig;
+}>;
+declare function mergePlayerConfig(partial?: PlayerConfigPartial): PlayerConfig;
 /** Maps theme colors to CSS custom properties for UI adapters. */
 declare function themeToCssVars(theme: Required<ThemeConfig>): Record<string, string>;
 
@@ -326,7 +346,14 @@ declare class AuthParamsStore {
     constructor(initial?: URLSearchParams | Record<string, string>);
     getSnapshot(): URLSearchParams;
     toRecord(): Record<string, string>;
+    /** True when at least one auth query param is stored. */
+    hasParams(): boolean;
+    toString(): string;
     update(next: URLSearchParams | Record<string, string>): void;
+    /**
+     * Merges current auth params onto a target URL, preserving unrelated query keys.
+     * Critical for child HLS playlists/segments that omit signed query params.
+     */
     applyToUrl(rawUrl: string, baseOrigin?: string): string;
 }
 
@@ -359,6 +386,8 @@ type HlsEngineOptions = {
     startMuted: boolean;
     startPosition?: number;
     volume?: number;
+    videoId?: string;
+    keyProxyUrlBuilder?: StreamingConfig["keyProxyUrlBuilder"];
     hlsConfig: {
         enableWorker: boolean;
         lowLatencyMode: boolean;
@@ -370,6 +399,11 @@ type HlsEngineOptions = {
 };
 /**
  * Dual-path HLS engine: hls.js when supported, otherwise native Safari HLS.
+ *
+ * Signed CDN playback requires auth query params on *every* HLS request
+ * (master, media playlist, segments, keys). hls.js only receives the signed
+ * master URL via loadSource; child URIs are relative and unsigned unless a
+ * custom loader re-applies AuthParamsStore on each request.
  */
 declare class HlsEngine {
     private readonly options;
@@ -541,7 +575,27 @@ declare class RefreshManager {
     private renew;
 }
 
-declare function redactValue(key: string, value: unknown): unknown;
-declare function redactObject(obj: Record<string, unknown>): Record<string, unknown>;
+type HlsLoader = new (config: object) => {
+    load(context: LoaderContext, config: LoaderConfiguration, callbacks: LoaderCallbacks<LoaderContext>): void;
+    destroy(): void;
+};
+type AuthParamsLoaderOptions = {
+    videoId?: string;
+    keyProxyUrlBuilder?: StreamingConfig["keyProxyUrlBuilder"];
+};
+/**
+ * Rewrites an HLS request URL so signed auth query params are present.
+ * Master playlists are signed on loadSource; child playlists / segments / keys
+ * are relative and would otherwise be fetched unsigned → CDN 403.
+ */
+declare function rewriteHlsRequestUrl(rawUrl: string, store: AuthParamsStore, options?: AuthParamsLoaderOptions, baseOrigin?: string): string;
+/**
+ * hls.js loader that re-applies live AuthParamsStore credentials on every
+ * manifest / level / fragment / key request.
+ */
+declare function createAuthParamsLoader(HlsClass: typeof Hls, store: AuthParamsStore, options?: AuthParamsLoaderOptions): HlsLoader;
+
+declare function redactValue(key: string, value: unknown, seen?: WeakSet<object>, depth?: number): unknown;
+declare function redactObject(obj: Record<string, unknown>, seen?: WeakSet<object>, depth?: number): Record<string, unknown>;
 
-export { type AccessibilityConfig, type AnalyticsConfig, type AuthConfig, AuthManager, AuthParamsStore, type AuthToken, type AuthTokenProviderContext, type BufferedRange, type ControlsConfig, type CreateVideoPlayerOptions, DEFAULT_CONTROLS, DEFAULT_LIVE_EDGE_TOLERANCE_SECONDS, DEFAULT_PLAYER_BEHAVIOR, DEFAULT_PLAYER_CONFIG, DEFAULT_THEME, DEFAULT_WATERMARK, type DebugConfig, EventEmitter, type HlsQualityLevel, type HlsSupportMode, type LiveMediaSnapshot, type LoggingConfig, PACKAGE_VERSION, PLAYBACK_RATES, type PlayIconPreset, type PlaybackCredentialConfig, type PlaybackRate, type PlaybackSource, type PlaybackSourceContext, PlaybackSourceManager, type PlayerBehaviorConfig, type PlayerConfig, type PlayerDiagnostics, type PlayerError, PlayerErrorCode, type PlayerEventMap, type PlayerSkipSeconds, type PlayerState, type PlayerZoomLevel, type QualitySelection, RefreshManager, type SeekToLiveResult, type StreamingConfig, type ThemeConfig, type VideoPlayer, type WatermarkConfig, assertNoSecretsInConfig, createPlayerError, createVideoPlayer, getLiveEdgeTime, isAtLiveEdge, mergePlayerConfig, redactObject, redactSensitive, redactValue, seekToLiveEdge, themeToCssVars };
+export { type AccessibilityConfig, type AnalyticsConfig, type AuthConfig, AuthManager, AuthParamsStore, type AuthToken, type AuthTokenProviderContext, type BufferedRange, type ControlsConfig, type CreateVideoPlayerOptions, DEFAULT_CONTROLS, DEFAULT_LIVE_EDGE_TOLERANCE_SECONDS, DEFAULT_PLAYER_BEHAVIOR, DEFAULT_PLAYER_CONFIG, DEFAULT_THEME, DEFAULT_WATERMARK, type DebugConfig, EventEmitter, type HlsQualityLevel, type HlsSupportMode, type LiveMediaSnapshot, type LoggingConfig, PACKAGE_VERSION, PLAYBACK_RATES, type PlayIconPreset, type PlaybackCredentialConfig, type PlaybackRate, type PlaybackSource, type PlaybackSourceContext, PlaybackSourceManager, type PlayerBehaviorConfig, type PlayerConfig, type PlayerDiagnostics, type PlayerError, PlayerErrorCode, type PlayerEventMap, type PlayerSkipSeconds, type PlayerState, type PlayerZoomLevel, type QualitySelection, RefreshManager, SECRET_SCAN_MAX_DEPTH, type SeekToLiveResult, type StreamingConfig, type ThemeConfig, type VideoPlayer, type WatermarkConfig, assertNoSecretsInConfig, createAuthParamsLoader, createPlayerError, createVideoPlayer, getLiveEdgeTime, isAtLiveEdge, isPlainObject, mergePlayerConfig, redactObject, redactSensitive, redactValue, rewriteHlsRequestUrl, seekToLiveEdge, themeToCssVars };

package/dist/index.js

@@ -146,7 +146,7 @@ var AuthManager = class {
 
 // src/config/defaults.ts
 var PLAYBACK_RATES = [0.5, 0.75, 1, 1.25, 1.5, 2];
-var PACKAGE_VERSION = "0.1.0";
+var PACKAGE_VERSION = "0.1.3";
 var DEFAULT_PLAYER_BEHAVIOR = {
   autoplay: true,
   startMuted: true,
@@ -232,22 +232,83 @@ var FORBIDDEN_SECRET_KEYS = [
   "basicauthpassword",
   "password"
 ];
+var SKIP_DEEP_SCAN_KEYS = /* @__PURE__ */ new Set([
+  "mount",
+  "auth",
+  "playback",
+  "gettoken",
+  "getsource",
+  "refreshsource",
+  "keyproxyurlbuilder"
+]);
+var SECRET_SCAN_MAX_DEPTH = 32;
+function isPlainObject(value) {
+  if (value === null || typeof value !== "object") return false;
+  if (Array.isArray(value)) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function normalizeConfigKey(key) {
+  return key.toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+function isForbiddenSecretKey(key) {
+  const lower = normalizeConfigKey(key);
+  return FORBIDDEN_SECRET_KEYS.some((k) => lower.includes(k));
+}
+function throwForbidden(path, key) {
+  throw new Error(
+    `INVALID_CONFIGURATION: Forbidden secret key "${path}${key}" must never be passed to the browser SDK. Keep clientSecret on your server/BFF and use auth.getToken().`
+  );
+}
 function assertNoSecretsInConfig(raw) {
-  if (!raw || typeof raw !== "object") return;
-  const walk = (obj, path) => {
-    for (const [key, value] of Object.entries(obj)) {
-      const lower = key.toLowerCase().replace(/[^a-z0-9]/g, "");
-      if (FORBIDDEN_SECRET_KEYS.some((k) => lower.includes(k))) {
-        throw new Error(
-          `INVALID_CONFIGURATION: Forbidden secret key "${path}${key}" must never be passed to the browser SDK. Keep clientSecret on your server/BFF and use auth.getToken().`
-        );
+  if (!isPlainObject(raw) && !Array.isArray(raw)) return;
+  const seen = /* @__PURE__ */ new WeakSet();
+  const stack = [
+    { value: raw, path: "", depth: 0 }
+  ];
+  while (stack.length > 0) {
+    const current = stack.pop();
+    if (current.depth > SECRET_SCAN_MAX_DEPTH) continue;
+    const { value, path, depth } = current;
+    if (Array.isArray(value)) {
+      if (seen.has(value)) continue;
+      seen.add(value);
+      for (let i = 0; i < value.length; i += 1) {
+        const item = value[i];
+        if (isPlainObject(item) || Array.isArray(item)) {
+          stack.push({ value: item, path: `${path}[${i}]`, depth: depth + 1 });
+        }
+      }
+      continue;
+    }
+    if (!isPlainObject(value)) continue;
+    if (seen.has(value)) continue;
+    seen.add(value);
+    for (const [key, child] of Object.entries(value)) {
+      const normalized = normalizeConfigKey(key);
+      if (isForbiddenSecretKey(key)) {
+        throwForbidden(path, key);
+      }
+      if (normalized === "mount") continue;
+      if (SKIP_DEEP_SCAN_KEYS.has(normalized)) {
+        if (isPlainObject(child)) {
+          for (const nestedKey of Object.keys(child)) {
+            if (isForbiddenSecretKey(nestedKey)) {
+              throwForbidden(`${path}${key}.`, nestedKey);
+            }
+          }
+        }
+        continue;
       }
-      if (value && typeof value === "object" && !Array.isArray(value)) {
-        walk(value, `${path}${key}.`);
+      if (isPlainObject(child) || Array.isArray(child)) {
+        stack.push({
+          value: child,
+          path: path ? `${path}${key}.` : `${key}.`,
+          depth: depth + 1
+        });
       }
     }
-  };
-  walk(raw, "");
+  }
 }
 function mergePlayerConfig(partial) {
   assertNoSecretsInConfig(partial);
@@ -261,7 +322,8 @@ function mergePlayerConfig(partial) {
       hls: {
         ...DEFAULT_PLAYER_CONFIG.streaming.hls,
         ...partial?.streaming?.hls
-      }
+      },
+      keyProxyUrlBuilder: partial?.streaming?.keyProxyUrlBuilder
     },
     logging: { ...DEFAULT_PLAYER_CONFIG.logging, ...partial?.logging },
     debug: { ...DEFAULT_PLAYER_CONFIG.debug, ...partial?.debug },
@@ -335,7 +397,14 @@ var EventEmitter = class {
 
 // src/security/redaction.ts
 var SENSITIVE_KEYS = /^(authorization|cookie|set-cookie|x-api-key|token|accessToken|access_token|clientSecret|password)$/i;
-function redactValue(key, value) {
+var REDACT_MAX_DEPTH = 32;
+function isPlainObject2(value) {
+  if (value === null || typeof value !== "object") return false;
+  if (Array.isArray(value)) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function redactValue(key, value, seen = /* @__PURE__ */ new WeakSet(), depth = 0) {
   if (SENSITIVE_KEYS.test(key)) return "[REDACTED]";
   if (typeof value === "string") {
     if (/^https?:\/\//i.test(value) && /[?&](token|expires)=/i.test(value)) {
@@ -352,15 +421,25 @@ function redactValue(key, value) {
       }
     }
   }
-  if (value && typeof value === "object" && !Array.isArray(value)) {
-    return redactObject(value);
+  if (Array.isArray(value)) {
+    if (depth >= REDACT_MAX_DEPTH || seen.has(value)) return "[REDACTED_CYCLE]";
+    seen.add(value);
+    return value.map(
+      (item, index) => redactValue(String(index), item, seen, depth + 1)
+    );
+  }
+  if (isPlainObject2(value)) {
+    return redactObject(value, seen, depth + 1);
   }
   return value;
 }
-function redactObject(obj) {
+function redactObject(obj, seen = /* @__PURE__ */ new WeakSet(), depth = 0) {
+  if (depth > REDACT_MAX_DEPTH) return { "[REDACTED]": "max_depth" };
+  if (seen.has(obj)) return { "[REDACTED]": "cycle" };
+  seen.add(obj);
   const out = {};
   for (const [key, value] of Object.entries(obj)) {
-    out[key] = redactValue(key, value);
+    out[key] = redactValue(key, value, seen, depth);
   }
   return out;
 }
@@ -420,11 +499,25 @@ var AuthParamsStore = class {
     });
     return out;
   }
+  /** True when at least one auth query param is stored. */
+  hasParams() {
+    return [...this.params.keys()].length > 0;
+  }
+  toString() {
+    return this.params.toString();
+  }
   update(next) {
     this.params = next instanceof URLSearchParams ? new URLSearchParams(next) : new URLSearchParams(next);
   }
+  /**
+   * Merges current auth params onto a target URL, preserving unrelated query keys.
+   * Critical for child HLS playlists/segments that omit signed query params.
+   */
   applyToUrl(rawUrl, baseOrigin) {
-    const target = new URL(rawUrl, baseOrigin ?? (typeof location !== "undefined" ? location.origin : "http://localhost"));
+    const target = new URL(
+      rawUrl,
+      baseOrigin ?? (typeof location !== "undefined" ? location.origin : "http://localhost")
+    );
     this.params.forEach((value, key) => {
       target.searchParams.set(key, value);
     });
@@ -659,6 +752,39 @@ function seekToLiveEdge(media, options) {
   return { moved: true, edge };
 }
 
+// src/streaming/authParamsLoader.ts
+var ENC_KEY_PATH_RE = /\/enc\.key$/i;
+function rewriteHlsRequestUrl(rawUrl, store, options = {}, baseOrigin = typeof location !== "undefined" ? location.origin : "http://localhost") {
+  if (!rawUrl) return rawUrl;
+  const parsed = new URL(rawUrl, baseOrigin);
+  const isKey = ENC_KEY_PATH_RE.test(parsed.pathname);
+  if (isKey && options.keyProxyUrlBuilder && options.videoId) {
+    const snapshot = store.toRecord();
+    return options.keyProxyUrlBuilder({
+      videoId: options.videoId,
+      keyUrl: parsed.toString(),
+      token: snapshot.token,
+      expires: snapshot.expires
+    });
+  }
+  if (!store.hasParams()) return parsed.toString();
+  return store.applyToUrl(rawUrl, baseOrigin);
+}
+function createAuthParamsLoader(HlsClass, store, options = {}) {
+  const BaseLoader = HlsClass.DefaultConfig.loader;
+  return class AuthParamsLoader extends BaseLoader {
+    load(context, config, callbacks) {
+      if (context.url) {
+        try {
+          context.url = rewriteHlsRequestUrl(context.url, store, options);
+        } catch {
+        }
+      }
+      super.load(context, config, callbacks);
+    }
+  };
+}
+
 // src/streaming/HlsEngine.ts
 var HlsEngine = class {
   constructor(options) {
@@ -711,15 +837,16 @@ var HlsEngine = class {
     }
   }
   async startWithHlsJs(Hls, playbackUrl) {
-    const { videoEl, authParams, hlsConfig, callbacks } = this.options;
+    const { videoEl, authParams, hlsConfig, callbacks, videoId, keyProxyUrlBuilder } = this.options;
+    const loader = createAuthParamsLoader(Hls, authParams, {
+      videoId,
+      keyProxyUrlBuilder
+    });
     this.hls = new Hls({
       enableWorker: hlsConfig.enableWorker,
       lowLatencyMode: hlsConfig.lowLatencyMode,
       backBufferLength: hlsConfig.backBufferLength,
-      xhrSetup: (xhr, url) => {
-        void xhr;
-        void url;
-      }
+      loader
     });
     this.hls.attachMedia(videoEl);
     this.hls.loadSource(authParams.applyToUrl(playbackUrl));
@@ -830,7 +957,18 @@ function generateSessionId() {
   return `ps_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
 }
 function createVideoPlayer(options) {
-  assertNoSecretsInConfig(options);
+  assertNoSecretsInConfig({
+    videoId: options.videoId,
+    sourceUrl: options.sourceUrl,
+    player: options.player,
+    controls: options.controls,
+    theme: options.theme,
+    watermark: options.watermark,
+    streaming: options.streaming,
+    logging: options.logging,
+    debug: options.debug,
+    accessibility: options.accessibility
+  });
   let config = mergePlayerConfig({
     player: options.player,
     controls: options.controls,
@@ -916,6 +1054,8 @@ function createVideoPlayer(options) {
         startMuted: config.player.startMuted,
         startPosition: config.player.startPosition,
         volume: config.player.volume,
+        videoId: options.videoId,
+        keyProxyUrlBuilder: options.streaming?.keyProxyUrlBuilder,
         hlsConfig: config.streaming.hls,
         logger,
         callbacks: {
@@ -1176,7 +1316,8 @@ function createVideoPlayer(options) {
         watermark: { ...config.watermark, ...partial?.watermark },
         streaming: {
           engine: "hls",
-          hls: { ...config.streaming.hls, ...partial?.streaming?.hls }
+          hls: { ...config.streaming.hls, ...partial?.streaming?.hls },
+          keyProxyUrlBuilder: partial?.streaming?.keyProxyUrlBuilder ?? config.streaming.keyProxyUrlBuilder
         },
         logging: { ...config.logging, ...partial?.logging },
         debug: { ...config.debug, ...partial?.debug },
@@ -1212,15 +1353,19 @@ export {
   PlaybackSourceManager,
   PlayerErrorCode,
   RefreshManager,
+  SECRET_SCAN_MAX_DEPTH,
   assertNoSecretsInConfig,
+  createAuthParamsLoader,
   createPlayerError,
   createVideoPlayer,
   getLiveEdgeTime,
   isAtLiveEdge,
+  isPlainObject,
   mergePlayerConfig,
   redactObject,
   redactSensitive,
   redactValue,
+  rewriteHlsRequestUrl,
   seekToLiveEdge,
   themeToCssVars
 };