* docs(playback): plan protocol v3 server implementation * docs(playback): incorporate protocol v3 review * feat(playback): implement protocol v3 server * fix(playback): persist empty route diagnostics * feat(playback): harden protocol v3 HDR routing * feat(playback): complete protocol v3 client contract * fix(playback): harden protocol v3 recovery * fix(playback): restore dovi_rpu strip filter for DV remuxes The v3 work renamed the Dolby Vision strip recipe to a dovi_split=mode=bl bitstream filter that does not exist in stock FFmpeg or jellyfin-ffmpeg; the probe failed closed on every deployment, disabling the new validated DV7-to-HDR10 route and regressing the previously working dovi_rpu=strip=1 remux path from main. Restore dovi_rpu across the probe, remux and HLS copy arguments, and the recipe-card constant. Also from review: validate the remux DV mode for every profile (garbage modes on non-P7 sources silently no-opped), reject preserve mode for P7 outright (a base-layer-only remux cannot preserve dual-layer DV), tag dvhe sample entries only for the explicit v3 preserve recipe so legacy web/jellycompat remuxes keep their pre-v3 hev1 labeling, and honor the token-frozen DV mode in the proxy remux path instead of legacy-auto. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(playback): correct v3 planner policy and contract validation Review fixes to the v3 planner and wire contracts: - Bar Profile 7 sources from the non-strip progressive remux route: a base-layer-only remux can never deliver native dual-layer DV, so the planner no longer emits plans claiming validated Dolby Vision while the executed remux drops the enhancement layer. - Accept the device-quirks feature flag from either capability location, matching every other dual-location feature check. - Treat legacy hdr_unknown rows as HDR10 for HDR10-capable clients with a degradation warning instead of leaving them unplayable under v3. - Honor bandwidth_cap_kbps as a hard ceiling in every quality mode and wire the previously dead Metered signal into conservative auto rungs. - Degrade to the validated source-quality route instead of a terminal when only an implicit quality reduction demanded an unsupported transcode; explicit user-selected rungs keep terminal behavior. - Bound inner capability lists and strings; compare attempt keys exactly instead of case-folded; make ParseTrackIDV3 strict about canonical numerics; accept dvdsub/pgssub/dvbsub aliases and stop promising burn-in for unknown subtitle codecs; probe every h264 encoder rather than requiring libx264; normalize the file-level bitrate fallback. - Evaluate subtitle renderability against the engine each candidate route executes on, not always media3_direct. - Pin the with-quirks attempt-key preimage arity in the cross-language fixture so the Kotlin client stays in lockstep. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(playback): harden v3 control-plane reliability Review fixes to the v3 session, store, and handler layer: - Bound concurrent replans with a slot semaphore: each replan pins a pooled connection for its advisory lock while issuing further store queries from the same pool, so an unbounded recovery storm could turn every connection into a lock holder and deadlock the server. - Make CompleteReplan a real compare-and-swap (base-revision predicate, ErrReplanSupersededV3) and map BeginReplan insert races to a replay instead of a raw unique violation. - Fingerprint start requests (request_digest column): an attempt ID reused with different input is now a 409-style conflict rather than a silent replay, and both replay paths check session liveness so dead sessions surface as retryable terminals. - Pre-delete expired attempt rows on SaveAttempt so a retry during the cleanup window cannot wedge on an unreachable conflict. - Align the in-memory store's semantics with Postgres and add DB-backed planstore tests (SILO_TEST_DATABASE_URL), including a regression test inserting every route-event name against the real CHECK constraint. - Session manager: v3 route-set updates own RemuxDVMode outright so a replan onto an SDR source clears a stale strip mode; replacement reservations survive unrelated legacy stream updates; replacement admission excludes the replaced session explicitly instead of decrementing totals it may no longer be part of; the admission CAS loop is bounded and decider errors are logged. - Map transient store failures to 500s instead of terminal 404/403s; authorize route events via identity-only projections after the rate limiter; keep sanitized diagnostics deterministic. - Merge the server-computed durable plan key into replan exclusions so unreproducible client history cannot re-select the failed route. - Remap tracks only when the effective edition changes (a same-file replan no longer switches audio to a lookalike track) and remap ID-only subtitle selections on edition fallback. - Cache the v3/shadow feature flags for five seconds instead of one settings SELECT per playback request; stop remote transports best-effort when the start call times out; carry dvm/tid claims and the transport-scoped job identity through the legacy audio-change re-mint; index playback_route_events(received_at) for the retention delete; run store maintenance for DB-less deployments too. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(transcode): reap idle node jobs and gate WebVTT conversion - Add an idle reaper to the transcode node: a job untouched by manifest or segment requests for ten minutes is closed and unregistered. After a v3 replan retires a transport ID, a stale in-flight stream token could resurrect the old job via reconstruct and encode to end-of-file for nobody; jobs waiting on readiness count registration as access and are never reaped mid-wait, and reaping keeps the recipe so a still-valid token reconstructs on the next hit. - Reject bitmap subtitle tracks (PGS) on the .vtt conversion path with 415 before headers are written instead of spawning an ffmpeg command that always fails mid-response, and make the extract-format override fall back to source-driven mapping for bitmap codecs. - Drain error bodies on non-202 node responses so the HTTP transport can reuse connections. - Pin the transcode-dir cleanup separator-boundary semantics with a regression test (a session ID sharing another's prefix must not retain foreign directories). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(playback): close v3 planner policy gaps from review - Clamp the final transcode bitrate to bandwidth_cap_kbps: the ladder has no rung below 480p/1500kbps, so lower caps were silently exceeded even though the cap is documented as a hard delivery ceiling. - Treat video-only media as audio-compatible instead of forcing an AAC conversion (or an audio_conversion_unsupported terminal) onto a file with no audio stream. Tracks whose codec failed to probe keep the gate. - Only promise a bitmap subtitle sidecar for embedded PGS with an engine that renders embedded bitmap: external/downloaded bitmap and embedded DVD/DVB published artifact URLs that always failed at fetch. They now fall through to burn-in or its terminal. - Accept client_video_transformations_v1 from either client_features or the nested context when validating client-executor transformations, matching the planner's dual-source reads. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(playback): probe and execute DV remuxes with one ffmpeg binary The v3 transformation registry probed the configured playback.ffmpeg_path while progressive remux execution resolved the process-global discovery path, so a deployment where only one binary carries dovi_rpu could plan a server_dv7_to_hdr10 route and then fail it at stream time. Resolution now goes through a shared ResolveFFmpegPath (configured path first, discovery fallback — the same rule the transcode pipeline already used), the dovi_rpu probe is cached per binary path, and the stream handler and proxy worker pass their configured path into ServeRemuxWithDVMode. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(playback): harden v3 replan identity and control-plane limits - Seed failure-replan track selections from the durable current plan before overlaying the request: after an alternate-version fallback the normalized request still carries requested-edition track IDs, so a replan omitting unchanged tracks was rejected as a track/file mismatch. - Remap ID-only audio selections across edition changes (parse the ID to an index like the subtitle remap already does) instead of leaving a stale file-bound ID to fail validation. - Release the node planner reservation when a prepared remote transport rolls back after the node accepted the job; repeated failed starts could otherwise pin max-job/bandwidth budgets for the full reservation age. - Size the replan semaphore below the PostgreSQL pool via a store capacity advisor: with max_connections at or below the fixed bound, advisory-lock holders could starve the inner store queries they need to finish. - Contain shadow-planner panics with a recover boundary; it runs on a bare goroutine where an escaped panic kills the process for what is telemetry-only work. Document why the memory store's session lock is deliberately a no-op. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(transcode): serialize node job teardown against reconstructs - Look up and touch manifest/segment sessions in one critical section so the idle reaper cannot unregister a job between the lookup and its liveness refresh. - Re-validate each reap candidate under the per-session lifecycle lock before closing it: Close removes the output directory, and without the lock it could race a token reconstruct and wipe the segments the fresh ffmpeg is writing. - Take the lifecycle lock in handleStop so a stop racing a RequireReady start's readiness wait blocks until registration and tears the job down, instead of 404ing and orphaning the ffmpeg until the reaper. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
294 lines
9.9 KiB
Go
294 lines
9.9 KiB
Go
package handlers
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"errors"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"os"
|
|
"testing"
|
|
|
|
"github.com/go-chi/chi/v5"
|
|
|
|
"github.com/Silo-Server/silo-server/internal/models"
|
|
"github.com/Silo-Server/silo-server/internal/playback"
|
|
)
|
|
|
|
type hookedSessionManager struct {
|
|
*playback.SessionManager
|
|
beginTransportHook func()
|
|
}
|
|
|
|
type errStreamFileResolver struct {
|
|
err error
|
|
}
|
|
|
|
func (r errStreamFileResolver) GetByID(context.Context, int) (*models.MediaFile, error) {
|
|
return nil, r.err
|
|
}
|
|
|
|
func (m *hookedSessionManager) BeginTransport(sessionID string) error {
|
|
if m.beginTransportHook != nil {
|
|
m.beginTransportHook()
|
|
}
|
|
return m.SessionManager.BeginTransport(sessionID)
|
|
}
|
|
|
|
func TestHandleStream_AbortsSessionWhenDirectPlayFileDisappearsAfterPreflight(t *testing.T) {
|
|
filePath := writePlaybackTestMediaFile(t, "movie.mkv")
|
|
file := &models.MediaFile{
|
|
ID: 42,
|
|
ContentID: "movie-1",
|
|
FilePath: filePath,
|
|
Duration: 3600,
|
|
}
|
|
baseMgr := playback.NewSessionManager(0, 0)
|
|
session, err := baseMgr.StartSession(1, "profile-1", 42, playback.PlayDirect, false)
|
|
if err != nil {
|
|
t.Fatalf("StartSession: %v", err)
|
|
}
|
|
|
|
adminStore := &recordingPlaybackAdminStore{}
|
|
syncer := &recordingSessionSyncer{}
|
|
marker := &recordingMissingMarker{}
|
|
sessionMgr := &hookedSessionManager{
|
|
SessionManager: baseMgr,
|
|
beginTransportHook: func() {
|
|
_ = os.Remove(filePath)
|
|
},
|
|
}
|
|
handler := NewStreamHandler(sessionMgr, testPlaybackFileResolver{file: file})
|
|
handler.AdminStore = adminStore
|
|
handler.SessionSyncer = syncer
|
|
handler.MissingMarker = marker
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/stream/"+session.ID, nil)
|
|
req = req.WithContext(newAuthorizedPlaybackContext())
|
|
req = withPlaybackRouteParam(req, "session_id", session.ID)
|
|
|
|
rr := httptest.NewRecorder()
|
|
handler.HandleStream(rr, req)
|
|
|
|
if rr.Code != http.StatusNotFound {
|
|
t.Fatalf("status = %d, body = %s", rr.Code, rr.Body.String())
|
|
}
|
|
if _, err := baseMgr.GetSession(session.ID); !errors.Is(err, playback.ErrSessionNotFound) {
|
|
t.Fatalf("GetSession error = %v, want %v", err, playback.ErrSessionNotFound)
|
|
}
|
|
if len(marker.ids) != 1 || marker.ids[0] != 42 {
|
|
t.Fatalf("marked ids = %v, want [42]", marker.ids)
|
|
}
|
|
if len(adminStore.deleted) != 1 || adminStore.deleted[0] != session.ID {
|
|
t.Fatalf("deleted sessions = %v, want [%s]", adminStore.deleted, session.ID)
|
|
}
|
|
if len(adminStore.history) != 0 {
|
|
t.Fatalf("history entries = %d, want 0", len(adminStore.history))
|
|
}
|
|
if syncer.calls == 0 {
|
|
t.Fatal("expected session sync after abort")
|
|
}
|
|
}
|
|
|
|
func TestHandleStream_KeepsSessionWhenLookupFailsForNonMissingReason(t *testing.T) {
|
|
baseMgr := playback.NewSessionManager(0, 0)
|
|
session, err := baseMgr.StartSession(1, "profile-1", 42, playback.PlayDirect, false)
|
|
if err != nil {
|
|
t.Fatalf("StartSession: %v", err)
|
|
}
|
|
|
|
adminStore := &recordingPlaybackAdminStore{}
|
|
syncer := &recordingSessionSyncer{}
|
|
handler := NewStreamHandler(baseMgr, errStreamFileResolver{err: errors.New("db unavailable")})
|
|
handler.AdminStore = adminStore
|
|
handler.SessionSyncer = syncer
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/stream/"+session.ID, nil)
|
|
req = req.WithContext(newAuthorizedPlaybackContext())
|
|
req = withPlaybackRouteParam(req, "session_id", session.ID)
|
|
|
|
rr := httptest.NewRecorder()
|
|
handler.HandleStream(rr, req)
|
|
|
|
if rr.Code != http.StatusInternalServerError {
|
|
t.Fatalf("status = %d, body = %s", rr.Code, rr.Body.String())
|
|
}
|
|
if _, err := baseMgr.GetSession(session.ID); err != nil {
|
|
t.Fatalf("GetSession error = %v, want live session", err)
|
|
}
|
|
if len(adminStore.deleted) != 0 {
|
|
t.Fatalf("deleted sessions = %v, want none", adminStore.deleted)
|
|
}
|
|
if syncer.calls != 0 {
|
|
t.Fatalf("sync calls = %d, want 0", syncer.calls)
|
|
}
|
|
}
|
|
|
|
// TestHandleSubtitle_ListDownloadedSubtitlesErrorReturns500 pins the fix for
|
|
// issue #248: a failure listing downloaded subtitles must surface as a 500 with
|
|
// an "internal_error" code, not be swallowed and reported to the client as a
|
|
// generic "Subtitle track not found" 404 (which made a real backing-store
|
|
// failure look like an intermittent client-side subtitle bug).
|
|
func TestHandleSubtitle_ListDownloadedSubtitlesErrorReturns500(t *testing.T) {
|
|
// No external or embedded tracks, so track index 0 falls through to the
|
|
// downloaded-subtitle branch that queries the repository.
|
|
file := &models.MediaFile{
|
|
ID: 42,
|
|
ContentID: "movie-1",
|
|
FilePath: "/tmp/movie.mkv",
|
|
Duration: 3600,
|
|
}
|
|
baseMgr := playback.NewSessionManager(0, 0)
|
|
session, err := baseMgr.StartSession(1, "profile-1", 42, playback.PlayDirect, false)
|
|
if err != nil {
|
|
t.Fatalf("StartSession: %v", err)
|
|
}
|
|
|
|
handler := NewStreamHandler(baseMgr, testPlaybackFileResolver{file: file})
|
|
handler.SubtitleRepo = &handlerMockSubtitleRepo{listErr: errors.New("db unavailable")}
|
|
handler.S3Client = newMockS3ClientForHandler()
|
|
handler.S3Bucket = "test-bucket"
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/stream/"+session.ID+"/subtitles/0.vtt", nil)
|
|
req = req.WithContext(newAuthorizedPlaybackContext())
|
|
routeCtx := chi.NewRouteContext()
|
|
routeCtx.URLParams.Add("session_id", session.ID)
|
|
routeCtx.URLParams.Add("track", "0.vtt")
|
|
req = req.WithContext(context.WithValue(req.Context(), chi.RouteCtxKey, routeCtx))
|
|
|
|
rr := httptest.NewRecorder()
|
|
handler.HandleSubtitle(rr, req)
|
|
|
|
if rr.Code != http.StatusInternalServerError {
|
|
t.Fatalf("status = %d, body = %s", rr.Code, rr.Body.String())
|
|
}
|
|
var body struct {
|
|
Error string `json:"error"`
|
|
}
|
|
if err := json.Unmarshal(rr.Body.Bytes(), &body); err != nil {
|
|
t.Fatalf("decode error body: %v (body = %s)", err, rr.Body.String())
|
|
}
|
|
if body.Error != "internal_error" {
|
|
t.Fatalf("error code = %q, want %q (body = %s)", body.Error, "internal_error", rr.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestHandleSubtitle_NilMediaFileReturns404(t *testing.T) {
|
|
baseMgr := playback.NewSessionManager(0, 0)
|
|
session, err := baseMgr.StartSession(1, "profile-1", 42, playback.PlayDirect, false)
|
|
if err != nil {
|
|
t.Fatalf("StartSession: %v", err)
|
|
}
|
|
|
|
handler := NewStreamHandler(baseMgr, errStreamFileResolver{})
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/stream/"+session.ID+"/subtitles/0.vtt", nil)
|
|
req = req.WithContext(newAuthorizedPlaybackContext())
|
|
routeCtx := chi.NewRouteContext()
|
|
routeCtx.URLParams.Add("session_id", session.ID)
|
|
routeCtx.URLParams.Add("track", "0.vtt")
|
|
req = req.WithContext(context.WithValue(req.Context(), chi.RouteCtxKey, routeCtx))
|
|
|
|
rr := httptest.NewRecorder()
|
|
handler.HandleSubtitle(rr, req)
|
|
|
|
if rr.Code != http.StatusNotFound {
|
|
t.Fatalf("status = %d, body = %s; want 404", rr.Code, rr.Body.String())
|
|
}
|
|
}
|
|
|
|
// A .vtt request for a bitmap (PGS) embedded track must be rejected up front:
|
|
// PGS passes the burn-in guard because it is deliverable as .sup, but it has
|
|
// no text to convert, so forcing WebVTT would spawn an ffmpeg that always
|
|
// fails after the 200 and headers are committed.
|
|
func TestHandleSubtitle_BitmapTrackVTTRequestReturns415(t *testing.T) {
|
|
file := &models.MediaFile{
|
|
ID: 42,
|
|
ContentID: "movie-1",
|
|
FilePath: "/tmp/movie.mkv",
|
|
Duration: 3600,
|
|
SubtitleTracks: []models.SubtitleTrack{
|
|
{Index: 0, Language: "eng", Codec: "hdmv_pgs_subtitle"},
|
|
},
|
|
}
|
|
baseMgr := playback.NewSessionManager(0, 0)
|
|
session, err := baseMgr.StartSession(1, "profile-1", 42, playback.PlayDirect, false)
|
|
if err != nil {
|
|
t.Fatalf("StartSession: %v", err)
|
|
}
|
|
|
|
handler := NewStreamHandler(baseMgr, testPlaybackFileResolver{file: file})
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/stream/"+session.ID+"/subtitles/0.vtt", nil)
|
|
req = req.WithContext(newAuthorizedPlaybackContext())
|
|
routeCtx := chi.NewRouteContext()
|
|
routeCtx.URLParams.Add("session_id", session.ID)
|
|
routeCtx.URLParams.Add("track", "0.vtt")
|
|
req = req.WithContext(context.WithValue(req.Context(), chi.RouteCtxKey, routeCtx))
|
|
|
|
rr := httptest.NewRecorder()
|
|
handler.HandleSubtitle(rr, req)
|
|
|
|
if rr.Code != http.StatusUnsupportedMediaType {
|
|
t.Fatalf("status = %d, body = %s; want 415", rr.Code, rr.Body.String())
|
|
}
|
|
var body struct {
|
|
Error string `json:"error"`
|
|
}
|
|
if err := json.Unmarshal(rr.Body.Bytes(), &body); err != nil {
|
|
t.Fatalf("decode error body: %v (body = %s)", err, rr.Body.String())
|
|
}
|
|
if body.Error != "unsupported_media_type" {
|
|
t.Fatalf("error code = %q, want %q", body.Error, "unsupported_media_type")
|
|
}
|
|
}
|
|
|
|
func TestSubtitleSourceFileIDPinsURLAcrossEffectiveFileSwitch(t *testing.T) {
|
|
session := &playback.Session{MediaFileID: 200, RequestedMediaFileID: 100}
|
|
|
|
request := httptest.NewRequest(http.MethodGet, "/subtitles/4.vtt?file_id=100", nil)
|
|
fileID, err := subtitleSourceFileID(request, session)
|
|
if err != nil {
|
|
t.Fatalf("subtitleSourceFileID: %v", err)
|
|
}
|
|
if fileID != 100 {
|
|
t.Fatalf("fileID = %d, want original subtitle source 100", fileID)
|
|
}
|
|
|
|
request = httptest.NewRequest(http.MethodGet, "/subtitles/4.vtt?file_id=300", nil)
|
|
if _, err := subtitleSourceFileID(request, session); err == nil {
|
|
t.Fatal("expected unrelated subtitle source file to be rejected")
|
|
}
|
|
}
|
|
|
|
func TestHandleTransportStartFailure_KeepsSessionForNonMissingError(t *testing.T) {
|
|
filePath := writePlaybackTestMediaFile(t, "movie.mkv")
|
|
file := &models.MediaFile{
|
|
ID: 42,
|
|
ContentID: "movie-1",
|
|
FilePath: filePath,
|
|
Duration: 3600,
|
|
}
|
|
baseMgr := playback.NewSessionManager(0, 0)
|
|
session, err := baseMgr.StartSession(1, "profile-1", 42, playback.PlayDirect, false)
|
|
if err != nil {
|
|
t.Fatalf("StartSession: %v", err)
|
|
}
|
|
|
|
adminStore := &recordingPlaybackAdminStore{}
|
|
syncer := &recordingSessionSyncer{}
|
|
handler := NewStreamHandler(baseMgr, testPlaybackFileResolver{file: file})
|
|
handler.AdminStore = adminStore
|
|
handler.SessionSyncer = syncer
|
|
|
|
handler.handleTransportStartFailure(context.Background(), session, file, errors.New("ffmpeg unavailable"))
|
|
|
|
if _, err := baseMgr.GetSession(session.ID); err != nil {
|
|
t.Fatalf("GetSession error = %v, want live session", err)
|
|
}
|
|
if len(adminStore.deleted) != 0 {
|
|
t.Fatalf("deleted sessions = %v, want none", adminStore.deleted)
|
|
}
|
|
if syncer.calls != 0 {
|
|
t.Fatalf("sync calls = %d, want 0", syncer.calls)
|
|
}
|
|
}
|