@codenkay/video-nsgplayer-core 3.0.0 → 3.0.2

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 3.0.2
+
+- Fix pack/build regression on AES `enc.key`: do **not** statically import
+  `XhrLoader` from `hls.js` (second module copy after npm pack broke key loads).
+- Resolve builtin loader via same-module `DefaultConfig` + composition unwrap
+  (`Symbol` stash / WeakMap) so nested wrappers never replace real XhrLoader.
+- Key auth order: BFF (≤2) → **signed-query without Bearer** → Bearer only on
+  401/403. Query-only fetch uses no custom headers (CORS simple request).
+- `keyProxyMaxFailures` circuit breaker retained.
+
+## 3.0.1
+
+- Permanent AES key path: dedicated key loader with **session circuit breaker**
+  (`keyProxyMaxFailures` default **2**). A Cloudflare-blocked BFF is not hammered
+  by hls.js retries (previously 9–10× `/hls-key` 502s).
+- After the circuit opens, the session uses AuthManager Bearer (or signed-query XHR) only.
+- Host apps with `AUTH_MODE=browser` should omit `keyProxyUrlBuilder` entirely.
+
 ## 3.0.0
 
 ### Major Changes

package/dist/index.cjs

@@ -39,6 +39,7 @@ __export(index_exports, {
   DEFAULT_THEME: () => DEFAULT_THEME,
   DEFAULT_WATERMARK: () => DEFAULT_WATERMARK,
   EventEmitter: () => EventEmitter,
+  KEY_PROXY_MAX_FAILURES: () => KEY_PROXY_MAX_FAILURES,
   PACKAGE_VERSION: () => PACKAGE_VERSION,
   PLAYBACK_RATES: () => PLAYBACK_RATES,
   PlaybackSourceManager: () => PlaybackSourceManager,
@@ -212,7 +213,7 @@ var AuthManager = class {
 
 // src/config/defaults.ts
 var PLAYBACK_RATES = [0.5, 0.75, 1, 1.25, 1.5, 2];
-var PACKAGE_VERSION = "2.0.1";
+var PACKAGE_VERSION = "3.0.2";
 var DEFAULT_PLAYER_BEHAVIOR = {
   autoplay: true,
   startMuted: true,
@@ -391,7 +392,8 @@ function mergePlayerConfig(partial) {
         ...partial?.streaming?.hls
       },
       keyProxyUrlBuilder: partial?.streaming?.keyProxyUrlBuilder,
-      getKeyAccessToken: partial?.streaming?.getKeyAccessToken
+      getKeyAccessToken: partial?.streaming?.getKeyAccessToken,
+      keyProxyMaxFailures: partial?.streaming?.keyProxyMaxFailures
     },
     logging: { ...DEFAULT_PLAYER_CONFIG.logging, ...partial?.logging },
     debug: { ...DEFAULT_PLAYER_CONFIG.debug, ...partial?.debug },
@@ -831,9 +833,13 @@ function seekToLiveEdge(media, options) {
 }
 
 // src/streaming/authParamsLoader.ts
-var import_hls = require("hls.js");
 var ENC_KEY_PATH_RE = /enc\.key$/i;
 var BUILTIN_LOADER_NAMES = /* @__PURE__ */ new Set(["XhrLoader", "FetchLoader"]);
+var BUILTIN_LOADER_REF = /* @__PURE__ */ Symbol.for(
+  "@codenkay/video-nsgplayer-core/builtin-hls-loader"
+);
+var builtinLoaderByHls = /* @__PURE__ */ new WeakMap();
+var KEY_PROXY_MAX_FAILURES = 2;
 function isEncryptionKeyUrl(rawUrl, baseOrigin = typeof location !== "undefined" ? location.origin : "http://localhost") {
   try {
     return ENC_KEY_PATH_RE.test(new URL(rawUrl, baseOrigin).pathname);
@@ -841,18 +847,34 @@ function isEncryptionKeyUrl(rawUrl, baseOrigin = typeof location !== "undefined"
     return /enc\.key/i.test(rawUrl);
   }
 }
-function resolveBuiltinHlsLoader(HlsClass) {
-  if (typeof import_hls.XhrLoader === "function") {
-    return import_hls.XhrLoader;
+function isBuiltinLoaderName(name) {
+  return BUILTIN_LOADER_NAMES.has(name);
+}
+function rememberBuiltin(HlsClass, loader) {
+  if (isBuiltinLoaderName(typeof loader.name === "string" ? loader.name : "")) {
+    builtinLoaderByHls.set(HlsClass, loader);
   }
+  return loader;
+}
+function getStashedBuiltinLoader(loader) {
+  return loader[BUILTIN_LOADER_REF];
+}
+function resolveBuiltinHlsLoader(HlsClass) {
+  const cached = builtinLoaderByHls.get(HlsClass);
+  if (cached) return cached;
   const start = HlsClass.DefaultConfig.loader;
   let current = start;
   const seen = /* @__PURE__ */ new Set();
   while (current && !seen.has(current)) {
     seen.add(current);
     const name = typeof current.name === "string" ? current.name : "";
-    if (BUILTIN_LOADER_NAMES.has(name)) {
-      return current;
+    if (isBuiltinLoaderName(name)) {
+      return rememberBuiltin(HlsClass, current);
+    }
+    const stashed = getStashedBuiltinLoader(current);
+    if (stashed) {
+      current = stashed;
+      continue;
     }
     const parentCtor = Object.getPrototypeOf(current.prototype)?.constructor;
     if (!parentCtor || parentCtor === Object || parentCtor === Function) {
@@ -860,7 +882,8 @@ function resolveBuiltinHlsLoader(HlsClass) {
     }
     current = parentCtor;
   }
-  return start;
+  const fallback = builtinLoaderByHls.get(HlsClass);
+  return fallback ?? start;
 }
 function rewriteHlsRequestUrl(rawUrl, store, options = {}, baseOrigin = typeof location !== "undefined" ? location.origin : "http://localhost") {
   if (!rawUrl) return rawUrl;
@@ -894,68 +917,230 @@ function createLoaderStats() {
     buffering: { start: 0, first: 0, end: 0 }
   };
 }
-async function loadEncryptionKeyWithFetch(context, callbacks, accessToken, signal) {
-  const stats = createLoaderStats();
-  stats.loading.first = performance.now();
-  const headers = {
-    Accept: "*/*",
-    ...context.headers
-  };
-  if (accessToken) {
-    headers.Authorization = `Bearer ${accessToken}`;
-  }
-  const response = await fetch(context.url, {
-    method: "GET",
-    headers,
-    credentials: "omit",
-    cache: "no-store",
-    signal
-  });
-  if (!response.ok) {
-    callbacks.onError(
-      {
-        code: response.status,
-        text: response.statusText || `enc.key HTTP ${response.status}`
-      },
-      context,
+function isProxyUpstreamBlocked(status, contentType, bodyHead, errorText) {
+  if (status === 0 || status === 502 || status === 503 || status === 504) {
+    return true;
+  }
+  if (status === 403 || status === 401) return true;
+  if (contentType?.includes("text/html")) return true;
+  if (/<!DOCTYPE|<html|Just a moment|Cloudflare|blocked/i.test(bodyHead)) {
+    return true;
+  }
+  if (errorText && /Cloudflare|HTML|DOCTYPE|blocked|502/i.test(errorText)) {
+    return true;
+  }
+  return false;
+}
+async function fetchEncryptionKeyBytes(url, accessToken, signal) {
+  const headers = accessToken ? { Authorization: `Bearer ${accessToken}`, Accept: "*/*" } : void 0;
+  try {
+    const response = await fetch(url, {
+      method: "GET",
+      ...headers ? { headers } : {},
+      credentials: "omit",
+      cache: "no-store",
+      signal
+    });
+    if (!response.ok) {
+      return {
+        ok: false,
+        status: response.status,
+        text: response.statusText || `enc.key HTTP ${response.status}`,
+        cors: false,
+        response
+      };
+    }
+    const data = await response.arrayBuffer();
+    const head = new TextDecoder().decode(data.slice(0, 32));
+    if (/<!DOCTYPE|<html/i.test(head)) {
+      return {
+        ok: false,
+        status: 403,
+        text: "enc.key returned HTML (CDN challenge/block), not an AES key",
+        cors: false,
+        response
+      };
+    }
+    return {
+      ok: true,
+      data,
       response,
-      stats
-    );
-    return;
+      url: response.url || url
+    };
+  } catch (error) {
+    if (error instanceof DOMException && error.name === "AbortError") {
+      return {
+        ok: false,
+        status: 0,
+        text: "enc.key fetch aborted/timeout",
+        cors: false,
+        response: null
+      };
+    }
+    const cors = error instanceof TypeError || error instanceof Error && /Failed to fetch|NetworkError|CORS/i.test(error.message);
+    return {
+      ok: false,
+      status: 0,
+      text: error instanceof Error ? error.message : "enc.key fetch failed",
+      cors,
+      response: null
+    };
   }
-  const data = await response.arrayBuffer();
+}
+function reportKeySuccess(context, callbacks, result) {
+  const stats = createLoaderStats();
   const end = performance.now();
+  stats.loading.first = stats.loading.start;
   stats.loading.end = end;
-  stats.loaded = data.byteLength;
-  stats.total = data.byteLength;
-  const head = new TextDecoder().decode(data.slice(0, 32));
-  if (/<!DOCTYPE|<html/i.test(head)) {
+  stats.loaded = result.data.byteLength;
+  stats.total = result.data.byteLength;
+  callbacks.onSuccess(
+    {
+      url: result.url,
+      data: result.data,
+      code: result.response.status
+    },
+    stats,
+    context,
+    result.response
+  );
+}
+async function loadEncryptionKeyEnterprise(context, callbacks, plan, signal, state) {
+  const stats = createLoaderStats();
+  const canTryProxy = Boolean(plan.proxyUrl) && !state.circuitOpen && state.proxyFailures < plan.maxProxyFailures;
+  if (canTryProxy && plan.proxyUrl) {
+    while (!state.circuitOpen && state.proxyFailures < plan.maxProxyFailures && !signal.aborted) {
+      state.proxyFailures += 1;
+      try {
+        const response = await fetch(plan.proxyUrl, {
+          method: "GET",
+          headers: { Accept: "*/*" },
+          credentials: "same-origin",
+          cache: "no-store",
+          signal
+        });
+        const contentType = response.headers.get("content-type");
+        const data = await response.arrayBuffer();
+        const head = new TextDecoder().decode(data.slice(0, 64));
+        if (response.ok && !isProxyUpstreamBlocked(response.status, contentType, head)) {
+          const end = performance.now();
+          stats.loading.end = end;
+          stats.loaded = data.byteLength;
+          stats.total = data.byteLength;
+          callbacks.onSuccess(
+            {
+              url: response.url || plan.proxyUrl,
+              data,
+              code: response.status
+            },
+            stats,
+            { ...context, url: plan.proxyUrl },
+            response
+          );
+          return "ok";
+        }
+        if (isProxyUpstreamBlocked(
+          response.status,
+          contentType,
+          head,
+          response.statusText
+        )) {
+          if (response.status === 502 || contentType?.includes("text/html") || /Cloudflare|DOCTYPE|blocked/i.test(head)) {
+            state.circuitOpen = true;
+            break;
+          }
+          continue;
+        }
+        callbacks.onError(
+          {
+            code: response.status,
+            text: `enc.key proxy HTTP ${response.status}`
+          },
+          { ...context, url: plan.proxyUrl },
+          response,
+          stats
+        );
+        return "ok";
+      } catch (error) {
+        if (error instanceof DOMException && error.name === "AbortError") {
+          callbacks.onError(
+            { code: 0, text: "enc.key proxy aborted/timeout" },
+            context,
+            null,
+            stats
+          );
+          return "ok";
+        }
+        state.circuitOpen = true;
+        break;
+      }
+    }
+    state.circuitOpen = true;
+  }
+  const queryResult = await fetchEncryptionKeyBytes(
+    plan.signedKeyUrl,
+    null,
+    signal
+  );
+  if (queryResult.ok) {
+    reportKeySuccess(
+      { ...context, url: plan.signedKeyUrl },
+      callbacks,
+      queryResult
+    );
+    return "ok";
+  }
+  const needsBearer = Boolean(plan.accessToken) && (queryResult.status === 401 || queryResult.status === 403);
+  if (needsBearer && plan.accessToken) {
+    const bearerResult = await fetchEncryptionKeyBytes(
+      plan.signedKeyUrl,
+      plan.accessToken,
+      signal
+    );
+    if (bearerResult.ok) {
+      reportKeySuccess(
+        { ...context, url: plan.signedKeyUrl },
+        callbacks,
+        bearerResult
+      );
+      return "ok";
+    }
+    if (bearerResult.cors) {
+      return "try_xhr";
+    }
     callbacks.onError(
       {
-        code: 403,
-        text: "enc.key returned HTML (CDN challenge/block), not an AES key"
+        code: bearerResult.status,
+        text: bearerResult.text
       },
-      context,
-      response,
+      { ...context, url: plan.signedKeyUrl },
+      bearerResult.response,
       stats
     );
-    return;
+    return "ok";
   }
-  callbacks.onSuccess(
+  if (queryResult.cors || queryResult.status === 0) {
+    return "try_xhr";
+  }
+  callbacks.onError(
     {
-      url: response.url || context.url,
-      data,
-      code: response.status
+      code: queryResult.status,
+      text: queryResult.text
     },
-    stats,
-    context,
-    response
+    { ...context, url: plan.signedKeyUrl },
+    queryResult.response,
+    stats
   );
+  return "ok";
 }
 function createAuthParamsLoader(HlsClass, store, options = {}) {
   const BaseLoader = resolveBuiltinHlsLoader(HlsClass);
-  return class AuthParamsLoader {
+  rememberBuiltin(HlsClass, BaseLoader);
+  const maxProxyFailures = typeof options.keyProxyMaxFailures === "number" && options.keyProxyMaxFailures >= 0 ? options.keyProxyMaxFailures : KEY_PROXY_MAX_FAILURES;
+  const keyProxyState = { proxyFailures: 0, circuitOpen: false };
+  class AuthParamsLoader {
     constructor(config) {
+      this.context = null;
       this.keyAbort = null;
       this.inner = new BaseLoader(config);
       this.stats = this.inner.stats;
@@ -963,14 +1148,16 @@ function createAuthParamsLoader(HlsClass, store, options = {}) {
     abort() {
       this.keyAbort?.abort();
       this.keyAbort = null;
-      this.inner.abort?.();
+      this.inner.abort();
     }
     destroy() {
       this.keyAbort?.abort();
       this.keyAbort = null;
+      this.context = null;
       this.inner.destroy();
     }
     load(context, config, callbacks) {
+      this.context = context;
       if (!context.url) {
         this.inner.load(context, config, callbacks);
         return;
@@ -978,92 +1165,70 @@ function createAuthParamsLoader(HlsClass, store, options = {}) {
       try {
         const originalUrl = context.url;
         const isKey = isEncryptionKeyUrl(originalUrl);
-        const usingKeyProxy = Boolean(
-          isKey && options.keyProxyUrlBuilder && options.videoId
-        );
-        const signedKeyUrl = isKey ? rewriteHlsRequestUrl(originalUrl, store, {
-          ...options,
-          keyProxyUrlBuilder: void 0
-        }) : context.url;
-        context.url = rewriteHlsRequestUrl(originalUrl, store, options);
-        if (usingKeyProxy) {
-          const accessToken = options.getKeyAccessToken?.() ?? null;
-          if (!accessToken) {
-            this.inner.load(context, config, callbacks);
-            return;
+        if (!isKey) {
+          if (store.hasParams()) {
+            context.url = rewriteHlsRequestUrl(originalUrl, store, {
+              ...options,
+              keyProxyUrlBuilder: void 0
+            });
           }
-          const proxyCallbacks = {
-            ...callbacks,
-            onError: (error, errContext, networkDetails, stats) => {
-              const code = error?.code;
-              const retryable = code === 0 || code === 502 || code === 403 || code === 401 || /Cloudflare|HTML|DOCTYPE|blocked/i.test(error?.text ?? "");
-              if (!retryable) {
-                callbacks.onError(error, errContext, networkDetails, stats);
-                return;
-              }
-              this.keyAbort?.abort();
-              this.keyAbort = new AbortController();
-              const bearerContext = { ...context, url: signedKeyUrl };
-              void loadEncryptionKeyWithFetch(
-                bearerContext,
-                callbacks,
-                accessToken,
-                this.keyAbort.signal
-              ).catch((fetchError) => {
-                callbacks.onError(
-                  {
-                    code: 0,
-                    text: fetchError instanceof Error ? fetchError.message : error.text || "enc.key proxy and Bearer fetch failed"
-                  },
-                  bearerContext,
-                  null,
-                  stats
-                );
-              });
-            }
-          };
-          this.inner.load(context, config, proxyCallbacks);
+          this.inner.load(context, config, callbacks);
           return;
         }
-        if (isKey && typeof options.getKeyAccessToken === "function") {
-          const accessToken = options.getKeyAccessToken() ?? null;
-          if (accessToken) {
-            this.keyAbort?.abort();
-            this.keyAbort = new AbortController();
-            const timeoutMs = typeof config?.timeout === "number" && config.timeout > 0 ? config.timeout : 2e4;
-            const timer = setTimeout(() => this.keyAbort?.abort(), timeoutMs);
-            void loadEncryptionKeyWithFetch(
-              context,
-              callbacks,
-              accessToken,
-              this.keyAbort.signal
-            ).catch((error) => {
-              const stats = createLoaderStats();
-              const aborted = error instanceof DOMException && error.name === "AbortError";
-              if (!aborted && (error instanceof TypeError || error instanceof Error && /Failed to fetch|NetworkError|CORS/i.test(error.message))) {
-                this.inner.load(context, config, callbacks);
-                return;
-              }
-              callbacks.onError(
-                {
-                  code: 0,
-                  text: aborted ? "enc.key fetch aborted/timeout" : error instanceof Error ? error.message : "enc.key fetch failed"
-                },
-                context,
-                null,
-                stats
-              );
-            }).finally(() => {
-              clearTimeout(timer);
-            });
-            return;
+        const signedKeyUrl = rewriteHlsRequestUrl(originalUrl, store, {
+          ...options,
+          keyProxyUrlBuilder: void 0
+        });
+        const proxyConfigured = Boolean(
+          options.keyProxyUrlBuilder && options.videoId
+        );
+        const proxyUrl = proxyConfigured && !keyProxyState.circuitOpen ? rewriteHlsRequestUrl(originalUrl, store, options) : null;
+        const accessToken = options.getKeyAccessToken?.() ?? null;
+        this.keyAbort?.abort();
+        this.keyAbort = new AbortController();
+        const timeoutMs = typeof config?.timeout === "number" && config.timeout > 0 ? config.timeout : 2e4;
+        const timer = setTimeout(() => this.keyAbort?.abort(), timeoutMs);
+        void loadEncryptionKeyEnterprise(
+          context,
+          callbacks,
+          {
+            proxyUrl,
+            signedKeyUrl,
+            accessToken,
+            maxProxyFailures
+          },
+          this.keyAbort.signal,
+          keyProxyState
+        ).then((result) => {
+          if (result === "try_xhr") {
+            context.url = signedKeyUrl;
+            this.inner.load(context, config, callbacks);
           }
-        }
+        }).catch((error) => {
+          callbacks.onError(
+            {
+              code: 0,
+              text: error instanceof Error ? error.message : "enc.key load failed"
+            },
+            context,
+            null,
+            createLoaderStats()
+          );
+        }).finally(() => {
+          clearTimeout(timer);
+        });
+        return;
       } catch {
       }
       this.inner.load(context, config, callbacks);
     }
-  };
+  }
+  Object.defineProperty(AuthParamsLoader, BUILTIN_LOADER_REF, {
+    value: BaseLoader,
+    enumerable: false,
+    configurable: false
+  });
+  return AuthParamsLoader;
 }
 
 // src/streaming/HlsEngine.ts
@@ -1128,7 +1293,8 @@ var HlsEngine = class {
     const loader = createAuthParamsLoader(Hls, authParams, {
       videoId,
       keyProxyUrlBuilder,
-      getKeyAccessToken
+      getKeyAccessToken,
+      keyProxyMaxFailures: this.options.keyProxyMaxFailures
     });
     this.hls = new Hls({
       enableWorker: hlsConfig.enableWorker,
@@ -1552,11 +1718,13 @@ function createVideoPlayer(options) {
         volume: config.player.volume,
         videoId: options.videoId,
         keyProxyUrlBuilder: config.streaming.keyProxyUrlBuilder,
-        // Enterprise AES key auth:
-        // 1) keyProxyUrlBuilder (same-origin BFF) when configured
-        // 2) else getKeyAccessToken / AuthManager Bearer via browser fetch
-        // 3) else signed query + XHR (CDN hosts)
+        // Enterprise AES key auth (see authParamsLoader):
+        // 1) keyProxyUrlBuilder BFF — max 2 failures then circuit
+        // 2) signed-query fetch (no Bearer / no CORS preflight)
+        // 3) Bearer only on HTTP 401/403 when getKeyAccessToken is set
+        // 4) signed-query XHR fallback if fetch is CORS-blocked
         getKeyAccessToken: config.streaming.getKeyAccessToken ?? (() => authManager.getAccessToken()),
+        keyProxyMaxFailures: config.streaming.keyProxyMaxFailures,
         hlsConfig: config.streaming.hls,
         logger,
         callbacks: {
@@ -1874,7 +2042,8 @@ function createVideoPlayer(options) {
           engine: "hls",
           hls: { ...config.streaming.hls, ...partial?.streaming?.hls },
           keyProxyUrlBuilder: partial?.streaming?.keyProxyUrlBuilder ?? config.streaming.keyProxyUrlBuilder,
-          getKeyAccessToken: partial?.streaming?.getKeyAccessToken ?? config.streaming.getKeyAccessToken ?? (() => authManager.getAccessToken())
+          getKeyAccessToken: partial?.streaming?.getKeyAccessToken ?? config.streaming.getKeyAccessToken ?? (() => authManager.getAccessToken()),
+          keyProxyMaxFailures: partial?.streaming?.keyProxyMaxFailures ?? config.streaming.keyProxyMaxFailures
         },
         logging: { ...config.logging, ...partial?.logging },
         debug: { ...config.debug, ...partial?.debug },
@@ -1906,6 +2075,7 @@ function createVideoPlayer(options) {
   DEFAULT_THEME,
   DEFAULT_WATERMARK,
   EventEmitter,
+  KEY_PROXY_MAX_FAILURES,
   PACKAGE_VERSION,
   PLAYBACK_RATES,
   PlaybackSourceManager,