eb-player 2.1.2 → 2.1.3

package/dist/build/ebplayer.bundle.js

@@ -4,7 +4,7 @@
     (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.EBPlayer = {}));
 })(this, (function (exports) { 'use strict';
 
-    var __EB_PLAYER_VERSION__ = "2.1.2";
+    var __EB_PLAYER_VERSION__ = "2.1.3";
 
     /**
      * Finite State Machine for player playback state transitions.
@@ -5119,6 +5119,7 @@
             this.retryInterval = retryInterval;
             this.expirationMarginInSeconds = expirationMarginInSeconds;
             this.lastTokenResponse = null;
+            this.sourceUrl = null;
             this.resetAttemptCounterTimeout = null;
             this.inFlightFetch = null;
         }
@@ -5437,8 +5438,17 @@
                     }
                     break;
             }
+            // Query-param tokens (easy_b/venom/bunny) carry a prefix-scoped `token_path`
+            // and share one grant across manifests and segments, so the grant must be
+            // minted against the asset-level source URL rather than whichever URL
+            // triggered this refresh. Akamai's path-segment mechanic is scoped
+            // differently and is deliberately left on the requested URL.
+            const sharesPrefixScopedGrant = this.tokenType === TOKEN_TYPES.EASY_B
+                || this.tokenType === TOKEN_TYPES.VENOM
+                || this.tokenType === TOKEN_TYPES.BUNNY;
+            const fetchSrc = (sharesPrefixScopedGrant && this.sourceUrl) ? this.sourceUrl : srcUrl.toString();
             try {
-                const tokenResponse = await this.fetchToken({ src: srcUrl.toString() });
+                const tokenResponse = await this.fetchToken({ src: fetchSrc });
                 if (tokenResponse === null) {
                     return url;
                 }
@@ -5759,33 +5769,39 @@
      * Segment (fragment) CDN token signing — shared primitive.
      *
      * Extends CDN token signing from manifests to segments, behind an opt-in flag
-     * (`EngineSettings.signSegmentsWithCdnToken`). Each segment is signed with the
-     * grant carried by its OWN parent playlist — read from `context.frag.baseurl`,
-     * the object hls.js itself parsed that fragment from — never from any store,
-     * cache, or shared manager state. This makes cross-rendition mis-signing
-     * structurally impossible rather than merely unlikely.
-     *
-     * CRITICAL: this module must never acquire or refresh a token. It only reads
-     * data already present on the fragment context handed to it by hls.js. Any
-     * acquisition call here would reintroduce the single-slot cache reuse in
-     * `CDNTokenManager.lastTokenResponse`, which hands one rendition's grant to
-     * another — the exact failure this design forbids.
-     *
-     * Token expiry model (CDN-04, D-07): a segment carries whatever grant its
-     * parent playlist carried when hls.js parsed it. Live playlists reload on
-     * their own cadence, so their fragments pick up refreshed grants with no
-     * refresh machinery here — reload IS the refresh path. VOD playlists are
-     * parsed exactly once by hls.js 1.6.10 (its level controller only
-     * (re)requests a playlist it has none of, or one that is live), so a VOD
-     * asset's segment grants are frozen at first parse for the asset's entire
-     * duration. If a token's lifetime is shorter than the asset's duration, later
-     * segments will be rejected by the edge and surface through the existing
-     * error/retry path. This is an accepted operational constraint — the token
-     * service's lifetime must exceed the longest VOD asset — not an oversight;
-     * D-07 chose reload-cadence refresh and CONTEXT.md defers a proactive
-     * near-expiry refresh path with a named revisit condition (a real asset shown
-     * to outlive its grant). No timer, interval, or scheduled re-fetch belongs in
-     * this module.
+     * (`EngineSettings.signSegmentsWithCdnToken`). The fast path signs each segment
+     * with the grant carried by its OWN parent playlist — read from
+     * `context.frag.baseurl`, the object hls.js itself parsed that fragment from.
+     *
+     * Token expiry model (CDN-04, D-07, revised):
+     *
+     * `frag.baseurl` is a string frozen at the moment hls.js parsed the level
+     * playlist. Live playlists reload on their own cadence, so their fragments pick
+     * up refreshed grants for free — reload IS the refresh path. VOD playlists are
+     * parsed exactly once by hls.js 1.6.10 (its level controller only (re)requests a
+     * playlist it has none of, or one that is live), so for VOD that string never
+     * changes. Pure transfer alone therefore pins a VOD asset's segments to the
+     * first grant for the asset's entire duration, and every segment 403s once that
+     * grant lapses — the condition CONTEXT.md named as D-07's revisit trigger, since
+     * observed in production (a ~294s grant against a ~26min asset).
+     *
+     * So when the inherited grant is inside the manager's expiry margin, this module
+     * now defers to the shared grant via `updateUrlWithTokenParams` rather than
+     * copying a dead string.
+     *
+     * Why sharing a grant across renditions is safe (supersedes this module's
+     * previous prohibition): the token service derives `token_path` from the
+     * directory of the URL it signs, and `token_path` is a PREFIX scope. An
+     * asset-level grant returns 200 on every rendition beneath it — verified live
+     * across all four renditions of a real asset. The hazard this module previously
+     * guarded against — one rendition's grant handed to another — is real ONLY for a
+     * rendition-scoped grant, and that is prevented at its source by
+     * `CDNTokenManager.sourceUrl`, which pins acquisition of the shared grant to the
+     * asset-level source URL. The invariant is therefore "the shared grant must be
+     * asset-level", not "segments must never refresh".
+     *
+     * Still true: no timer, interval, or scheduled re-fetch belongs in this module.
+     * Refresh here is demand-driven, on the load that needs it.
      */
     // ---------------------------------------------------------------------------
     // Supported token-type family (D-03) — query-param tokens only. Akamai's
@@ -5851,6 +5867,23 @@
             return segmentUrl;
         }
     }
+    /**
+     * Reads the `expires` value off a parent playlist URL, or null when the URL
+     * carries no token at all or cannot be parsed. Used to decide between the pure
+     * transfer fast path and a shared-grant refresh.
+     */
+    function readPlaylistGrantExpiry(parentPlaylistUrl) {
+        try {
+            const playlistUrl = new URL(parentPlaylistUrl);
+            const token = playlistUrl.searchParams.get('token');
+            if (!token)
+                return { hasToken: false, expires: null };
+            return { hasToken: true, expires: playlistUrl.searchParams.get('expires') };
+        }
+        catch {
+            return { hasToken: false, expires: null };
+        }
+    }
     /**
      * Returns a loader constructor extending `BaseLoader`: construct the base,
      * bind the inherited `load`, then assign an own `load` property that reads
@@ -5905,8 +5938,36 @@
                     originalLoad(context, loadConfig, callbacks);
                     return;
                 }
-                context.url = signSegmentUrlFromPlaylist(context.url, baseUrl);
-                originalLoad(context, loadConfig, callbacks);
+                const { hasToken, expires } = readPlaylistGrantExpiry(baseUrl);
+                // Parent playlist carried no grant: nothing to transfer, and nothing to
+                // refresh — an unsigned playlist means this path is not token-protected.
+                if (!hasToken) {
+                    originalLoad(context, loadConfig, callbacks);
+                    return;
+                }
+                // Fast path: the inherited grant is still good. Pure synchronous transfer,
+                // no manager involvement, no network.
+                if (!tokenSource.isTokenExpired(expires)) {
+                    context.url = signSegmentUrlFromPlaylist(context.url, baseUrl);
+                    originalLoad(context, loadConfig, callbacks);
+                    return;
+                }
+                // Inherited grant is expired or inside the expiry margin. For VOD this is
+                // terminal — hls.js will never re-parse the playlist, so the frozen
+                // baseurl can never recover on its own. Defer to the shared asset-level
+                // grant, which `CDNTokenManager.sourceUrl` keeps broad enough to cover
+                // this segment.
+                tokenSource.updateUrlWithTokenParams({ url: context.url })
+                    .then((updatedUrl) => {
+                    context.url = updatedUrl;
+                    originalLoad(context, loadConfig, callbacks);
+                })
+                    .catch(() => {
+                    // Token error: fall back to the inherited grant rather than emitting an
+                    // unsigned request, and let the edge's 403 drive hls.js's own retry.
+                    context.url = signSegmentUrlFromPlaylist(context.url, baseUrl);
+                    originalLoad(context, loadConfig, callbacks);
+                });
             };
         }
         function SegmentTokenLoader(loaderConfig) {
@@ -6279,6 +6340,11 @@
             // stream URL is loaded rather than config.src which always points at the main stream.
             let src = this.loadSourceUrl || config.src || '';
             if (this.tokenManager && src) {
+                // Pin shared-grant acquisition to the asset-level source URL before the
+                // first fetch. The token service scopes `token_path` to the directory of
+                // the URL it signs, so a grant minted against a level playlist (as an ABR
+                // switch would trigger) is rendition-scoped and 403s on every sibling.
+                this.tokenManager.sourceUrl = src;
                 src = await this.tokenManager.updateUrlWithTokenParams({ url: src });
                 // Guard: abort if detached during token URL update
                 if (this.detached) {