@torrent-tv/proxy 2.83.6 → 2.83.8

package/services/viewer/Viewers.js

@@ -201,6 +201,50 @@ export class Viewers {
     return true;
   }
 
+  /**
+   * This viewer has subtitles switched on for this file.
+   *
+   * Said by the request that turns them on, which is the only place that knows
+   * both the person and the file. Registering it here rather than against a
+   * channel is what makes it survive a reconnect and a deliberate rotation of
+   * the association.
+   *
+   * @param {string} consumerId
+   * @param {string} sourceKey
+   * @param {number} fileIndex
+   * @returns {boolean} Whether anybody by that name is known to want them.
+   */
+  wantsCues(consumerId, sourceKey, fileIndex) {
+    const viewer = consumerId ? this.#byId.get(consumerId) : null;
+    if (!viewer || !sourceKey || !Number.isInteger(fileIndex)) {
+      return false;
+    }
+    viewer.wantsCuesFor.add(`${sourceKey}:${fileIndex}`);
+    return true;
+  }
+
+  /**
+   * Who has subtitles switched on for this file.
+   *
+   * The answer is a list of NAMES. Whoever delivers to them resolves a name to
+   * whatever channel that person is reachable on right now, which is the whole
+   * point: the recipients outlive the connection.
+   *
+   * @param {string} sourceKey
+   * @param {number} fileIndex
+   * @returns {string[]}
+   */
+  wantingCues(sourceKey, fileIndex) {
+    const key = `${sourceKey}:${fileIndex}`;
+    const names = [];
+    for (const [consumerId, viewer] of this.#byId) {
+      if (viewer.wantsCuesFor.has(key)) {
+        names.push(consumerId);
+      }
+    }
+    return names;
+  }
+
   /**
    * How many named viewers are watching anything. For the log line and for a
    * check that the registry does not grow.

package/test/client-log-file.test.js

@@ -0,0 +1,110 @@
+/**
+ * @file The browser's log, written beside the proxy's.
+ *
+ * What these hold is the naming, because the name is the whole point: the two
+ * halves of a session have to join without guessing, and a torrent name is
+ * arbitrary bytes chosen by a stranger that is about to become a path.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, readdirSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { createClientLogFiles } from "../utils/client-log-file.js";
+
+/** A directory with a proxy log in it, which is what the sink is given. */
+function aDirectory() {
+  const dir = mkdtempSync(join(tmpdir(), "ttv-client-log-"));
+  return { dir, proxyLog: join(dir, "proxy.log") };
+}
+
+const aSession = (over = {}) => ({
+  sessionId: "abcd1234",
+  startedAt: "2026-09-13T16:05:24.123Z",
+  torrentName: "Reacher.S04E07.1080p.rus.LostFilm.TV.mkv",
+  infoHash: "94dda59fdf252447d6ca5a8775dab2d11a832da5",
+  ...over
+});
+
+test("the file lands beside the proxy log, named by when it started and what is watched", async () => {
+  const { dir, proxyLog } = aDirectory();
+  const logs = createClientLogFiles(proxyLog);
+  logs.write(aSession(), ["first line"]);
+  await logs.close();
+
+  const [name] = readdirSync(dir).filter((f) => f.startsWith("client-"));
+  assert.ok(name, "a client log file was written");
+  // The stamp is UTC and sorts; the session id joins it to the proxy's lines;
+  // the film says which one it is without opening the file.
+  assert.match(name, /^client-20260913-160524-abcd1234-Reacher\.S04E07\.1080p\.rus\.LostFilm\.TV\.mkv-94dda59f\.log$/);
+  assert.equal(readFileSync(join(dir, name), "utf8"), "first line\n");
+});
+
+test("lines from one session go on appending to the one file", async () => {
+  const { dir, proxyLog } = aDirectory();
+  const logs = createClientLogFiles(proxyLog);
+  logs.write(aSession(), ["one", "two"]);
+  logs.write(aSession(), ["three"]);
+  await logs.close();
+
+  const names = readdirSync(dir).filter((f) => f.startsWith("client-"));
+  assert.equal(names.length, 1);
+  assert.equal(readFileSync(join(dir, names[0]), "utf8"), "one\ntwo\nthree\n");
+});
+
+test("a session that has not chosen a film yet still gets its own file", async () => {
+  // The page opening, a proxy being chosen, a connection failing — all before
+  // any torrent exists, and all worth keeping.
+  const { dir, proxyLog } = aDirectory();
+  const logs = createClientLogFiles(proxyLog);
+  logs.write(aSession({ torrentName: "", infoHash: "" }), ["before any film"]);
+  await logs.close();
+
+  const [name] = readdirSync(dir).filter((f) => f.startsWith("client-"));
+  assert.match(name, /-no-torrent-yet\.log$/);
+});
+
+test("the file keeps its name when the film arrives mid-session", async () => {
+  // Keyed by the session, not by the name: the earlier lines belong to the same
+  // viewing and must not start a second file.
+  const { dir, proxyLog } = aDirectory();
+  const logs = createClientLogFiles(proxyLog);
+  logs.write(aSession({ torrentName: "", infoHash: "" }), ["before"]);
+  logs.write(aSession(), ["after"]);
+  await logs.close();
+
+  const names = readdirSync(dir).filter((f) => f.startsWith("client-"));
+  assert.equal(names.length, 1);
+  assert.match(names[0], /-no-torrent-yet\.log$/);
+  assert.equal(readFileSync(join(dir, names[0]), "utf8"), "before\nafter\n");
+});
+
+test("a hostile torrent name cannot escape the directory", async () => {
+  const { dir, proxyLog } = aDirectory();
+  const logs = createClientLogFiles(proxyLog);
+  logs.write(aSession({ torrentName: "../../etc/passwd" }), ["x"]);
+  await logs.close();
+
+  const names = readdirSync(dir).filter((f) => f.startsWith("client-"));
+  assert.equal(names.length, 1);
+  assert.ok(!names[0].includes(".."), `no traversal in ${names[0]}`);
+  assert.ok(!names[0].includes("/"), `no separator in ${names[0]}`);
+});
+
+test("two sessions of one film are two files", async () => {
+  const { dir, proxyLog } = aDirectory();
+  const logs = createClientLogFiles(proxyLog);
+  logs.write(aSession({ sessionId: "aaaa1111" }), ["one viewer"]);
+  logs.write(aSession({ sessionId: "bbbb2222", startedAt: "2026-09-13T16:07:11.000Z" }), ["another"]);
+  await logs.close();
+
+  assert.equal(readdirSync(dir).filter((f) => f.startsWith("client-")).length, 2);
+});
+
+test("no proxy log path means nothing is written and nothing throws", async () => {
+  const logs = createClientLogFiles("");
+  logs.write(aSession(), ["dropped"]);
+  await logs.close();
+});

package/test/send-chunk-bytes.test.js

@@ -0,0 +1,86 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { bodySender } from "../services/data-channel-handler.js";
+
+/**
+ * Drives the sender over a body arriving in the given read sizes, and answers
+ * both what reached the far end and what was written — so "the body is
+ * unchanged" is asserted against the body rather than against a length.
+ *
+ * @param {number}   sizeBytes
+ * @param {number[]} readSizes - The sizes the body read hands over, in order.
+ * @returns {{ sent: Buffer[], counted: number, written: Buffer }}
+ */
+function sendBody(sizeBytes, readSizes) {
+  /** @type {Buffer[]} */
+  const sent = [];
+  const sender = bodySender((bytes) => sent.push(Buffer.from(bytes)), sizeBytes);
+  /** @type {Buffer[]} */
+  const written = [];
+  let counted = 0;
+  let next = 0;
+  for (const size of readSizes) {
+    const block = Buffer.alloc(size);
+    for (let index = 0; index < size; index += 1) {
+      block[index] = next & 0xff;
+      next += 1;
+    }
+    written.push(block);
+    counted += sender.push(block);
+  }
+  counted += sender.flush();
+  return { sent, counted, written: Buffer.concat(written) };
+}
+
+test("with no size chosen, one body read is one message", () => {
+  const { sent, counted } = sendBody(0, [1000, 2000, 3]);
+  assert.deepEqual(
+    sent.map((message) => message.length),
+    [1000, 2000, 3]
+  );
+  assert.equal(counted, 3);
+});
+
+test("a smaller size cuts a body read into messages of exactly that size", () => {
+  const { sent, counted } = sendBody(400, [1000]);
+  assert.deepEqual(
+    sent.map((message) => message.length),
+    [400, 400, 200]
+  );
+  assert.equal(counted, 3);
+});
+
+test("a larger size joins body reads until it is filled", () => {
+  const { sent } = sendBody(2500, [1000, 1000, 1000, 1000]);
+  assert.deepEqual(
+    sent.map((message) => message.length),
+    [2500, 1500]
+  );
+});
+
+test("every byte arrives once, in order, whatever the size", () => {
+  for (const size of [0, 1, 7, 400, 2500, 999_999]) {
+    const { sent, written } = sendBody(size, [1000, 3, 5000, 17]);
+    assert.deepEqual(Buffer.concat(sent), written, `size ${size} changed the body`);
+  }
+});
+
+test("a size larger than the whole body still sends it, once, on flush", () => {
+  const { sent, written, counted } = sendBody(10_000, [100, 200]);
+  assert.equal(sent.length, 1);
+  assert.equal(counted, 1);
+  assert.deepEqual(sent[0], written);
+});
+
+test("the count is of messages, which is what a reading is attributed to", () => {
+  // 163 messages for 10 657 210 bytes is the field reading of 2026-09-12; at
+  // 16 KB the same body is 651 of them, and that difference is the measurement.
+  const { counted } = sendBody(16 * 1024, [10_657_210]);
+  assert.equal(counted, Math.ceil(10_657_210 / (16 * 1024)));
+});
+
+test("nothing is sent for an empty body, and flush has nothing to release", () => {
+  const { sent, counted } = sendBody(400, []);
+  assert.deepEqual(sent, []);
+  assert.equal(counted, 0);
+});

package/test/viewer-subtitle-subscription.test.js

@@ -0,0 +1,96 @@
+/**
+ * @file Who wants subtitle cues, and why the answer is a person and not a channel.
+ *
+ * The subscription used to be a `Set<DataChannel>` inside the transport, keyed
+ * by `sourceKey:fileIndex`. Two things followed from that, and both are field
+ * facts rather than worries:
+ *
+ * 1. a seamless reconnect lost subtitles for the rest of the session, because
+ *    the new channel is a different object and nothing re-subscribed it;
+ * 2. the transport had to sniff `/api/subtitles` out of the request path and
+ *    derive a torrent key to build that key at all — application routing and
+ *    torrent identity, inside the layer that is only supposed to carry bytes.
+ *
+ * Held against the viewer instead, both go away by construction: whatever
+ * channel the person is reachable on next, they are still subscribed, and the
+ * transport never learns what a subtitle is.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { Viewers } from "../services/viewer/Viewers.js";
+
+/** An output is only ever held by id here, so the thinnest possible stand-in. */
+const anOutput = (id) => ({ id, viewers: new Set() });
+
+test("a viewer who switched subtitles on is listed for that file", () => {
+  const viewers = new Viewers();
+  viewers.of(anOutput("picture"), "alice");
+
+  assert.equal(viewers.wantsCues("alice", "src-1", 3), true);
+  assert.deepEqual(viewers.wantingCues("src-1", 3), ["alice"]);
+});
+
+test("nobody is listed for a file nobody asked about", () => {
+  const viewers = new Viewers();
+  viewers.of(anOutput("picture"), "alice");
+  viewers.wantsCues("alice", "src-1", 3);
+
+  assert.deepEqual(viewers.wantingCues("src-1", 4), []);
+  assert.deepEqual(viewers.wantingCues("src-2", 3), []);
+});
+
+test("two viewers of one file are both listed, and one file each is kept apart", () => {
+  const viewers = new Viewers();
+  const picture = anOutput("picture");
+  viewers.of(picture, "alice");
+  viewers.of(picture, "bob");
+
+  viewers.wantsCues("alice", "src-1", 0);
+  viewers.wantsCues("bob", "src-1", 0);
+  viewers.wantsCues("bob", "src-1", 1);
+
+  assert.deepEqual(viewers.wantingCues("src-1", 0).sort(), ["alice", "bob"]);
+  assert.deepEqual(viewers.wantingCues("src-1", 1), ["bob"]);
+});
+
+test("the subscription outlives the connection, which is the whole point", () => {
+  // Nothing here mentions a channel, and that is the assertion: the registry
+  // has no way to express "this channel", so a channel dying cannot take a
+  // subscription with it.
+  const viewers = new Viewers();
+  viewers.of(anOutput("picture"), "alice");
+  viewers.wantsCues("alice", "src-1", 3);
+
+  // A reconnect is, from here, nothing at all: the same person is still known.
+  viewers.seen("alice");
+
+  assert.deepEqual(viewers.wantingCues("src-1", 3), ["alice"]);
+});
+
+test("a viewer who has gone is no longer listed", () => {
+  const viewers = new Viewers();
+  const picture = anOutput("picture");
+  viewers.of(picture, "alice");
+  viewers.wantsCues("alice", "src-1", 3);
+
+  viewers.hasGone("alice", (id) => (id === "picture" ? picture : null));
+
+  assert.deepEqual(viewers.wantingCues("src-1", 3), []);
+});
+
+test("an unknown name subscribes to nothing", () => {
+  const viewers = new Viewers();
+  assert.equal(viewers.wantsCues("nobody", "src-1", 3), false);
+  assert.deepEqual(viewers.wantingCues("src-1", 3), []);
+});
+
+test("a request missing the file index registers nothing", () => {
+  const viewers = new Viewers();
+  viewers.of(anOutput("picture"), "alice");
+
+  assert.equal(viewers.wantsCues("alice", "src-1", Number.NaN), false);
+  assert.equal(viewers.wantsCues("alice", "", 3), false);
+  assert.deepEqual(viewers.wantingCues("src-1", 3), []);
+});

package/utils/client-log-file.js

@@ -0,0 +1,151 @@
+/**
+ * @file Where a browser's own log lands: a file beside the proxy's, per session.
+ *
+ * WHY THIS EXISTS. Both halves of every failure this project investigates live
+ * in two places at once — what the proxy did, and what the page saw — and until
+ * now the second half went to the SERVER's standard output on the droplet.
+ * Every release recreates that container and destroys it. On 2026-09-13 a
+ * viewer reported a desync and a frozen picture, and the analysis ran on half
+ * the evidence for exactly this reason.
+ *
+ * Written here instead, next to the proxy's own log, on the same durable
+ * directory (`/data` on the addon host). One file per viewing session, named so
+ * the two halves join without guessing: the session's start, then the torrent.
+ */
+
+import { createWriteStream, mkdirSync, renameSync, statSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+/** One file may reach this before it is rotated. */
+const MAX_BYTES = 16 * 1024 * 1024;
+
+/**
+ * Make a name safe for a file and short enough to read in a directory listing.
+ *
+ * Deliberately strict: a torrent name is arbitrary bytes chosen by a stranger,
+ * and it is about to become a path.
+ *
+ * @param {string} value
+ * @param {number} max
+ * @returns {string}
+ */
+function safeName(value, max) {
+  const cleaned = String(value ?? "")
+    .replace(/[^\p{L}\p{N}._-]+/gu, "-")
+    .replace(/-+/g, "-")
+    .replace(/^[-.]+|[-.]+$/g, "");
+  return cleaned.slice(0, max);
+}
+
+/**
+ * `2026-09-13T16:05:24.123Z` → `20260913-160524`, which sorts and reads.
+ *
+ * @param {string} iso
+ * @returns {string}
+ */
+function stamp(iso) {
+  const when = new Date(iso);
+  const at = Number.isNaN(when.getTime()) ? new Date() : when;
+  const pad = (n) => String(n).padStart(2, "0");
+  return `${at.getUTCFullYear()}${pad(at.getUTCMonth() + 1)}${pad(at.getUTCDate())}` +
+    `-${pad(at.getUTCHours())}${pad(at.getUTCMinutes())}${pad(at.getUTCSeconds())}`;
+}
+
+/**
+ * A sink that writes one session's browser lines to its own file.
+ *
+ * @param {string} proxyLogPath - The proxy's own log file; its directory is
+ *   used, so the two halves are always side by side.
+ * @returns {{ write: (session: object, lines: string[]) => void, close: () => void }}
+ */
+export function createClientLogFiles(proxyLogPath) {
+  const directory = typeof proxyLogPath === "string" && proxyLogPath.length > 0
+    ? dirname(proxyLogPath)
+    : "";
+  /** @type {Map<string, { stream: import("node:fs").WriteStream, path: string, bytes: number }>} */
+  const open = new Map();
+
+  /**
+   * The file for this session, opened on first use.
+   *
+   * Keyed by the session's own id rather than by the name, because the name
+   * gains the torrent the moment one is chosen and the earlier lines — the
+   * page opening, the proxy being chosen, a connection failing — belong to the
+   * same session and must not start a second file.
+   *
+   * @param {{ sessionId: string, startedAt: string, torrentName: string, infoHash: string }} session
+   * @returns {{ stream: import("node:fs").WriteStream, path: string, bytes: number } | null}
+   */
+  function fileFor(session) {
+    if (!directory) return null;
+    const key = session.sessionId;
+    const existing = open.get(key);
+    if (existing) return existing;
+    const film = session.torrentName
+      ? `${safeName(session.torrentName, 60)}-${safeName(session.infoHash, 8)}`
+      : "no-torrent-yet";
+    const path = join(directory, `client-${stamp(session.startedAt)}-${safeName(session.sessionId, 8)}-${film}.log`);
+    try {
+      mkdirSync(directory, { recursive: true });
+      const record = {
+        stream: createWriteStream(path, { flags: "a" }),
+        path,
+        bytes: statSync(path, { throwIfNoEntry: false })?.size ?? 0
+      };
+      // A file that stops being writable must not take the proxy down with it,
+      // and must not be retried on every line.
+      record.stream.on("error", () => open.delete(key));
+      open.set(key, record);
+      return record;
+    } catch {
+      return null;
+    }
+  }
+
+  return {
+    write(session, lines) {
+      const record = fileFor(session);
+      if (!record) return;
+      for (const line of lines) {
+        const text = `${line}\n`;
+        record.bytes += Buffer.byteLength(text);
+        record.stream.write(text);
+      }
+      if (record.bytes >= MAX_BYTES) {
+        try {
+          record.stream.end(() => {
+            try {
+              renameSync(record.path, `${record.path}.1`);
+            } catch {
+              // Renaming a file that has gone leaves nothing to do.
+            }
+          });
+        } catch {
+          // A rotation that cannot happen leaves the file growing, which is
+          // better than losing the session's log to an exception.
+        }
+        open.delete(session.sessionId);
+      }
+    },
+    /**
+     * Finish every open file.
+     *
+     * Awaitable, and that is not a convenience: a write stream opens and
+     * flushes asynchronously, so a process that ends without waiting loses the
+     * last lines of every session — which are the ones a crash is explained by.
+     *
+     * @returns {Promise<void>}
+     */
+    async close() {
+      const ending = [...open.values()].map((record) => new Promise((resolve) => {
+        try {
+          record.stream.end(resolve);
+        } catch {
+          resolve(undefined);
+        }
+      }));
+      open.clear();
+      await Promise.all(ending);
+    }
+  };
+}