The documentation described a system that no longer exists, and in two
places described the opposite of what the code now does.
- The layout section documented `<recording-root>/users/<owner-id>/<rel>`
for private recordings and `shared/<rel>` for shared ones. That resolver
was deleted: recordings are stored owner-independently at
`<recording-root>/<rel>`, because one physical file is shared by every
user who asked for it. The organised layouts and the component
sanitisation rules are now documented as they are implemented.
- The config reference claimed persisted queue recovery "is tolerant of
corruption" and "starts with an empty transfer queue instead of aborting
server boot". The queue now fails closed: a damaged database is rebuilt
from the recovery history, and a database ahead of every surviving
history refuses to start. An operator following the old text would have
expected silent recovery from a condition that is deliberately fatal.
- `download.read` / `download.write` were still listed as grantable
permissions after their removal, and `recording.write` after its split.
bin/dvr_doctor.sh looked for `downloads_state.json` and summarised it with
jq. That file never existed under this name, and the queue it stood for is
now a B+Tree, so the section printed "(absent)" and skipped its summary
exactly when an operator needed it. It now reports the repository and its
recovery generations: the CURRENT pointer, the retained generation pair,
journal sizes, the fail-closed case where a database has no history, and a
warning when the recovery directory shares a filesystem with the database
— which survives a corrupt file but not the loss of the volume it exists
to protect against.
CHANGELOG records the three breaking changes: the non-migrating queue, the
permission split, and the moved recording files.
A single write permission could not express the policy the DVR needs: a
user who may request a recording is not necessarily one who may cancel
someone else's, and neither implies the right to delete a file. Replace it
with recording.create, recording.manage and recording.delete, and map each
action onto the one it actually needs:
- create private/shared -> recording.create
- edit, cancel, manage rules -> recording.manage
- delete, system retention sweep -> recording.delete
The split renumbers every permission bit above recording.read, so
CURRENT_PERMISSION_SCHEMA_VERSION is bumped to 4 and tokens issued earlier
fail closed at the validator instead of having their bits reinterpreted.
The removed recording.write name now decodes to nothing, so a groups file
that still lists it loses the permission rather than silently gaining one
of the three replacements.
Permission bit values are frozen in a test: they are the wire format, and
reordering the enum would reinterpret every issued token.
New Features
Added a /ready readiness endpoint with clear initializing, exhausted, and ready states.
Improved health-banner behavior for shared provider capacity, disabled providers, aliases, and idle fallback capacity.
Bug Fixes
Improved capacity calculations with shared provider grouping, overflow-safe totals, and empty-capacity handling.
Documentation
Documented liveness, readiness, and detailed status endpoints, including Docker and orchestrator usage.
feat: complete DVR and improve streaming, security, configuration, and UI
Complete the Digital Video Recorder subsystem and add a broad set of
reliability, security, streaming, configuration, processing, and Web UI
improvements across Tuliprox.
DVR:
* complete live recording and provider-aware VOD download support
* add recording queue, workers, scheduling, and recurring recording rules
* add conflict detection and capacity-aware scheduling
* add pause, resume, retry, edit, cancel, and delete workflows
* add recording quotas and configurable retention policies
* add crash recovery and startup reconciliation
* add durable lifecycle notifications with per-channel retries
* add DVR health monitoring and diagnostic tooling
* add secure access to recordings, thumbnails, and subtitles
* add WebSocket notifications for recording and rule changes
* add Web UI management for recordings, rules, progress, and task state
* add RBAC, configuration, documentation, and i18n support
Streaming and HLS:
* fix shared-stream idle handling and release dead provider streams correctly
* stop tee streams when both client and cache consumers are gone
* cancel provisioning probes when client streams terminate
* fix transient HLS origin work accounting and intermittent 503 responses
* make stream buffer byte limits configurable
* make shared subscriber idle timeout configurable
* make initial HLS manifest wait timeout configurable
* add configurable TS chunk packet count
* add configurable HLS refresh failure backoff
* centralize redirect limits and retry jitter handling
* improve provider DNS refresh behavior and failover tuning
* preserve UTF-8 characters in catchup templates
* improve stream history validation and persistence error handling
Security:
* use constant-time credential comparisons
* harden library and media path handling against traversal and symlink escapes
* only trust forwarded client IP headers from configured trusted proxies
* redact credentials and sensitive URL data from logs
* reject invalid authentication status-code configuration
* deny users with unresolved plans or invalid content filters
* improve authentication error handling across proxy and HLS endpoints
Configuration and reliability:
* prevent invalid api-proxy.yml reloads from terminating the running server
* fully validate API proxy configuration before persisting changes
* log configuration and EPG cleanup failures instead of silently discarding them
* keep the last valid configuration active after failed hot reloads
* align backend and shared media-server validation
* remove duplicated path and normalization logic
* improve DNS-store recovery and Windows rename fallback handling
* reject invalid duration, timestamp, and numeric conversions safely
* fix playlist bouquet save error handling
* fix provider record update detection
* fix cache boundary handling
* improve startup and persistence failure diagnostics
Filtering, search, sorting, and processing:
* add field-scoped playlist explorer search
* centralize shared stream-history search field definitions
* extend the filter DSL with string, set, and numeric operators
* add EPG ID, channel number, and detected quality as filterable fields
* add filter dry-run preview API with match statistics and samples
* report filter syntax errors with line and column information
* add natural numeric-aware sorting
* add quality-aware channel deduplication
* add accent-independent deduplication
* move natural sorting and quality detection helpers into shared code
* persist explorer search-field selection across reloads
User plans and content access:
* add reusable API user plans for capability tiers
* support inherited cluster and connection limits with per-user overrides
* add plan-level and user-level content filters
* enforce content filters across Xtream, M3U, direct playback, resource access,
stream info, short EPG, categories, and XMLTV
* add trial plans with automatic expiry and Trial status
* add plan selection and content filtering to the user editor
* add full plan management to the API configuration Web UI
* migrate the API user database to schema V7 with plan and filter persistence
Web UI and accessibility:
* add live logging console to the stats page
* improve login error handling and prevent duplicate authentication requests
* add keyboard navigation to tabs, menus, tables, and search
* add ARIA roles, labels, validation state, and live-region feedback
* add confirmation dialogs for destructive actions
* add unsaved-change warnings and Ctrl/Cmd+S shortcuts
* add loading, progress, empty, and in-flight states across views
* improve dropdown and single-selection behavior
* add clipboard and credential-copy helpers
* persist table pagination and explorer search preferences
* improve error recovery when UI context providers are unavailable
* remove multiple panic-prone unwrap and browser API paths
* replace remaining hardcoded UI strings with translation keys
Maintenance:
* resolve backend and frontend compiler and Clippy warnings
* update packages and test fixtures
* consolidate duplicated helpers and validation logic
* improve documentation for configuration, filters, plans, DVR, and REST APIs
* add and update tests for migrations, filters, deduplication, sorting,
configuration, streaming, and accessibility behavior
- **New Features**
- Added configurable QoS snapshot compaction to periodically reclaim storage from expired snapshots.
- Compaction runs daily by default and can be disabled by setting the interval to `0`.
- QoS config hot-reload now recognizes compaction interval changes.
- Older saved snapshot checkpoints remain compatible with the new setting.
- **Documentation**
- Updated configuration examples and reverse-proxy QoS documentation to include `compaction_interval_secs`, its default, and disable behavior.
* **New Features**
* Added a STRM export option to control whether generated folder/file names use media metadata or the processed title.
* STRM naming now prefers the processed title by default; enabling the option switches to metadata-derived names.
* Added a UI chip/tag and editor control for the setting.
* **Documentation**
* Updated STRM configuration docs with the new option, its default, and its effect.
* Added localization text for the setting in supported languages.
* **Tests**
* Added/updated tests to verify filename behavior for videos and series with and without the option.
* **New Features**
* Catch-up streams can now auto-detect whether to serve direct video or an HLS playlist.
* Added archive-aware HLS session/identity handling and improved upstream user-agent propagation for manifests.
* Enhanced M3U timeshift/archiving, including nested handling and native Flussonic archive support; Short EPG can advertise archive availability.
* **Bug Fixes**
* Provider session headers now persist across retries and deferred-open scenarios.
* Legacy HLS routing is now cache-aware; seek detection improvements.
* Stalker errors now better redact sensitive URL details.
* Fix: Preserve VOD client range requests
* **Tests**
* Expanded coverage for probing, archive/timeshift resolution, header overlay rules, and related routing.
* **New Features**
* Added **Force MPEG-TS** / `disable_hls_streaming` for Xtream live streams, rewriting live `.m3u8` requests to `.ts`.
* Added UI controls and option indicators, with localized labels in English, Arabic, and Russian.
* **Documentation**
* Clarified MPEG-TS behavior and added an Xtream example configuration.
* **Bug Fixes**
* Improved live-stream playback routing/extension handling and related permission-failure responses.
* Refined provider allocation and grace-period handling for more consistent connection admission.
* **New Features**
* Added configurable mapping stages for `mapping.yml`: `processing` (default) and `after_epg`.
* `after_epg` mappings now run after EPG enrichment and can react to enriched EPG fields.
* **Bug Fixes**
* Stage-aware playlist mapping: if no mappings match, the source is left unconsumed.
* Mapping directory merges now reject conflicting stages for the same mapping id and report both files clearly.
* **Documentation**
* Updated mapping DSL and target `processing_order` docs to describe stage timing and guarantees.
* **Tests**
* Added coverage for stage-restricted mapping behavior, merge conflicts, and AfterEpg timing.
Bug Fixes
- Input forms now consistently update when switching between configured sources.
- Improved filter matching for captions/titles and more accurate type handling for live/video/series (including series-info variants).
New Features
- Mapping DSL now supports reading @input and @type as metadata sources, while rejecting assignments to them.
- Regex capture results are now more consistently exposed across captures (by index and name).
Tests
- Added WASM browser coverage for input switching and updated coverage for filter/mapping behavior.
Documentation
- Updated mapping DSL documentation and changelog to reflect @input/@type read-only behavior and capture access rules.
New Features
- Added first-class Stalker/Ministra portal support, including live, VOD, series, playback-link refresh, and bulk EPG ingestion.
- Added Stalker configuration and batch/CSV support in the Web UI.
- Added playlist preview and playback handling for Stalker inputs, with support for partial refreshes.
* feat: key shared hls sessions by origin id
* feat: support hls content encoding
* fix: coderabbitai findings
* Fix: Custom headers are lost on provider://
In the manual redirect path, the abstract provider:// URL is compared against the resolved HTTP URL.
This causes the request to be marked as "scrubbed" before the first real redirect even occurs, stripping out headers like X-API-Key.
Shared HLS cache session feature and aligns the runtime, cache, provisioning, recovery, custom-response, and documentation paths with the new shared-session model.
* Fixed sanitizing url scheme batch and provder
* local date in Stream history
* Fixed EPG programme time display to render in local timezone for improved readability.
* Improved stream history date range filtering to accurately use local date boundaries.
* Enhanced credential sanitization for stream URLs to properly mask sensitive information.
* Fix EPG path selection for mixed Xtream/M3U targets
* Fix EPG selection and complete Xtream series_info for input/custom requests
* Add configurable interner GC tuning
* Fix: Copy url in frontend does not resolve provider://
* Fix: Filter editor on demand validation
* Fix: redirect to login screen if auto logout happens
* Sorce ordinal by category and channel index
* Parsing UserApiRequest from request body or query
* CSS stylings
* media tools refactoring
* xtream info parsing now number/string fields
DarkBreakpoint