@codenkay/video-nsgplayer-core 4.0.0 → 5.1.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 5.1.0
+
+### Minor Changes
+
+- Add `streaming.mediaProxyUrlBuilder` so playlists, segments, and encryption keys are loaded through a same-origin proxy. The playback API rejects the browser origin and does not send CORS headers.
+- Leave URLs that are already on the page origin unchanged, so a rewritten playlist is not proxied twice.
+- Recognize `/live/` and `/hls-web-live/` playlists for direct `sourceUrl` playback, including when the live address is nested in a proxy `url` parameter.
+- Send same-origin encryption-key requests with the site cookie and without a bearer token. The playback credential stays in the query string.
+
+## 5.0.0
+
+### Minor Changes
+
+- Update meta data
+
 ## 4.0.0
 
 ### Major Changes

package/README.md

@@ -2,6 +2,8 @@
 
 Framework-agnostic HLS video player engine for NSG.
 
+**Try it:** [nsgplayer-sample-react](https://github.com/codenannu/nsgplayer-sample-react) (npm package homepage). Also [Next.js BFF](https://github.com/codenannu/nsgplayer-sample-nextjs) · [Angular](https://github.com/codenannu/nsgplayer-sample-angular).
+
 ## Install
 
 ```bash

package/dist/index.cjs

@@ -53,7 +53,9 @@ __export(index_exports, {
   getLiveEdgeTime: () => getLiveEdgeTime,
   isAtLiveEdge: () => isAtLiveEdge,
   isEncryptionKeyUrl: () => isEncryptionKeyUrl,
+  isLivePlaylistUrl: () => isLivePlaylistUrl,
   isPlainObject: () => isPlainObject,
+  isSameOriginHttpUrl: () => isSameOriginHttpUrl,
   mergePlayerConfig: () => mergePlayerConfig,
   redactObject: () => redactObject,
   redactSensitive: () => redactSensitive,
@@ -309,6 +311,7 @@ var SKIP_DEEP_SCAN_KEYS = /* @__PURE__ */ new Set([
   "getsource",
   "refreshsource",
   "keyproxyurlbuilder",
+  "mediaproxyurlbuilder",
   "getkeyaccesstoken"
 ]);
 var SECRET_SCAN_MAX_DEPTH = 32;
@@ -393,6 +396,7 @@ function mergePlayerConfig(partial) {
         ...DEFAULT_PLAYER_CONFIG.streaming.hls,
         ...partial?.streaming?.hls
       },
+      mediaProxyUrlBuilder: partial?.streaming?.mediaProxyUrlBuilder,
       keyProxyUrlBuilder: partial?.streaming?.keyProxyUrlBuilder,
       getKeyAccessToken: partial?.streaming?.getKeyAccessToken,
       keyProxyMaxFailures: partial?.streaming?.keyProxyMaxFailures
@@ -834,6 +838,26 @@ function seekToLiveEdge(media, options) {
   return { moved: true, edge };
 }
 
+// src/streaming/mediaUrl.ts
+var LIVE_PLAYLIST_PATH = /\/(?:hls-web-live|live)\//i;
+function isLivePlaylistUrl(value) {
+  if (LIVE_PLAYLIST_PATH.test(value)) return true;
+  try {
+    const parsed = new URL(value, "http://localhost");
+    const inner = parsed.searchParams.get("url");
+    return Boolean(inner && LIVE_PLAYLIST_PATH.test(inner));
+  } catch {
+    return false;
+  }
+}
+function isSameOriginHttpUrl(value, baseOrigin) {
+  try {
+    return new URL(value, baseOrigin).origin === new URL(baseOrigin).origin;
+  } catch {
+    return false;
+  }
+}
+
 // src/streaming/authParamsLoader.ts
 var ENC_KEY_PATH_RE = /enc\.key$/i;
 var BUILTIN_LOADER_NAMES = /* @__PURE__ */ new Set(["XhrLoader", "FetchLoader"]);
@@ -903,8 +927,16 @@ function rewriteHlsRequestUrl(rawUrl, store, options = {}, baseOrigin = typeof l
       mobile: snapshot.mobile
     });
   }
-  if (!store.hasParams()) return parsed.toString();
-  return store.applyToUrl(rawUrl, baseOrigin);
+  const withAuth = store.hasParams() ? store.applyToUrl(rawUrl, baseOrigin) : parsed.toString();
+  return applyMediaProxy(withAuth, options, baseOrigin);
+}
+function applyMediaProxy(url, options, baseOrigin) {
+  if (!options.mediaProxyUrlBuilder) return url;
+  if (isSameOriginHttpUrl(url, baseOrigin)) return url;
+  return options.mediaProxyUrlBuilder({
+    url,
+    videoId: options.videoId
+  });
 }
 function createLoaderStats() {
   const now = performance.now();
@@ -935,12 +967,14 @@ function isProxyUpstreamBlocked(status, contentType, bodyHead, errorText) {
   return false;
 }
 async function fetchEncryptionKeyBytes(url, accessToken, signal) {
-  const headers = accessToken ? { Authorization: `Bearer ${accessToken}`, Accept: "*/*" } : void 0;
+  const pageOrigin = typeof location !== "undefined" ? location.origin : "http://localhost";
+  const sameOrigin = isSameOriginHttpUrl(url, pageOrigin);
+  const headers = !sameOrigin && accessToken ? { Authorization: `Bearer ${accessToken}`, Accept: "*/*" } : void 0;
   try {
     const response = await fetch(url, {
       method: "GET",
       ...headers ? { headers } : {},
-      credentials: "omit",
+      credentials: sameOrigin ? "same-origin" : "omit",
       cache: "no-store",
       signal
     });
@@ -1231,7 +1265,7 @@ function createAuthParamsLoader(HlsModule, store, options = {}) {
         const originalUrl = context.url;
         const isKey = isEncryptionKeyUrl(originalUrl);
         if (!isKey) {
-          if (store.hasParams()) {
+          if (store.hasParams() || options.mediaProxyUrlBuilder) {
             context.url = rewriteHlsRequestUrl(originalUrl, store, {
               ...options,
               keyProxyUrlBuilder: void 0
@@ -1356,7 +1390,7 @@ var HlsEngine = class {
     if (videoEl.canPlayType("application/vnd.apple.mpegurl")) {
       this.supportMode = "native";
       this.options.callbacks.onSupportMode?.("native");
-      videoEl.src = this.options.authParams.applyToUrl(playbackUrl);
+      videoEl.src = this.playbackRequestUrl(playbackUrl);
       this.bindMediaEvents();
       this.bindNativeTextTracks();
       this.options.callbacks.onStateChange?.("ready");
@@ -1381,6 +1415,7 @@ var HlsEngine = class {
     } = this.options;
     const loader = createAuthParamsLoader(Hls, authParams, {
       videoId,
+      mediaProxyUrlBuilder: this.options.mediaProxyUrlBuilder,
       keyProxyUrlBuilder,
       getKeyAccessToken,
       keyProxyMaxFailures: this.options.keyProxyMaxFailures
@@ -1409,7 +1444,7 @@ var HlsEngine = class {
       loader
     });
     this.hls.attachMedia(videoEl);
-    this.hls.loadSource(authParams.applyToUrl(playbackUrl));
+    this.hls.loadSource(this.playbackRequestUrl(playbackUrl));
     this.hls.on(Hls.Events.MANIFEST_PARSED, (_event, data) => {
       if (this.destroyed) return;
       this.qualities = (data.levels ?? []).map((level, index) => ({
@@ -1587,13 +1622,20 @@ var HlsEngine = class {
     if (this.supportMode === "native" && this.options.videoEl) {
       const time = this.options.videoEl.currentTime;
       const wasPaused = this.options.videoEl.paused;
-      this.options.videoEl.src = this.options.authParams.applyToUrl(
-        this.options.playbackUrl
-      );
+      this.options.videoEl.src = this.playbackRequestUrl(this.options.playbackUrl);
       this.options.videoEl.currentTime = time;
       if (!wasPaused) void this.options.videoEl.play();
     }
   }
+  playbackRequestUrl(playbackUrl) {
+    return rewriteHlsRequestUrl(playbackUrl, this.options.authParams, {
+      videoId: this.options.videoId,
+      mediaProxyUrlBuilder: this.options.mediaProxyUrlBuilder,
+      keyProxyUrlBuilder: this.options.keyProxyUrlBuilder,
+      getKeyAccessToken: this.options.getKeyAccessToken,
+      keyProxyMaxFailures: this.options.keyProxyMaxFailures
+    });
+  }
   resumeAfterAuthRenew() {
     this.networkRecoveryCount = 0;
     this.hls?.startLoad();
@@ -1858,7 +1900,7 @@ function createVideoPlayer(options) {
         const source = {
           url: options.sourceUrl,
           expiresAt: Date.now() + 24 * 60 * 60 * 1e3,
-          live: /\/hls-web-live\//i.test(options.sourceUrl)
+          live: isLivePlaylistUrl(options.sourceUrl)
         };
         sourceManager.applyDirectSource(source);
         playbackUrl = source.url;
@@ -1888,6 +1930,7 @@ function createVideoPlayer(options) {
         startPosition: config.player.startPosition,
         volume: config.player.volume,
         videoId: options.videoId,
+        mediaProxyUrlBuilder: config.streaming.mediaProxyUrlBuilder,
         keyProxyUrlBuilder: config.streaming.keyProxyUrlBuilder,
         // Enterprise AES key auth (see authParamsLoader):
         // 1) keyProxyUrlBuilder BFF — max 2 failures then circuit
@@ -2219,6 +2262,7 @@ function createVideoPlayer(options) {
         streaming: {
           engine: "hls",
           hls: { ...config.streaming.hls, ...partial?.streaming?.hls },
+          mediaProxyUrlBuilder: partial?.streaming?.mediaProxyUrlBuilder ?? config.streaming.mediaProxyUrlBuilder,
           keyProxyUrlBuilder: partial?.streaming?.keyProxyUrlBuilder ?? config.streaming.keyProxyUrlBuilder,
           getKeyAccessToken: partial?.streaming?.getKeyAccessToken ?? config.streaming.getKeyAccessToken ?? (() => authManager.getAccessToken()),
           keyProxyMaxFailures: partial?.streaming?.keyProxyMaxFailures ?? config.streaming.keyProxyMaxFailures
@@ -2267,7 +2311,9 @@ function createVideoPlayer(options) {
   getLiveEdgeTime,
   isAtLiveEdge,
   isEncryptionKeyUrl,
+  isLivePlaylistUrl,
   isPlainObject,
+  isSameOriginHttpUrl,
   mergePlayerConfig,
   redactObject,
   redactSensitive,