Update server/server.js

server/server.js

@@ -35,17 +35,7 @@ function log(...args) {
 }
 
 // ---------- Room state ----------
-/*
-room = {
-  id, name, hostId,
-  users: Map<socketId, { name, role: 'host'|'cohost'|'member', muted?: boolean }>,
-  track: { url, title, meta, kind, thumb? },
-  isPlaying, anchor, anchorAt,
-  queue: Array<track>
-}
-*/
 const rooms = new Map();
-
 function ensureRoom(roomId) {
   if (!rooms.has(roomId)) {
     rooms.set(roomId, {
@@ -62,7 +52,6 @@ function ensureRoom(roomId) {
   }
   return rooms.get(roomId);
 }
-
 function currentState(room) {
   return {
     track: room.track,
@@ -72,7 +61,6 @@ function currentState(room) {
     queue: room.queue
   };
 }
-
 function membersPayload(room) {
   return [...room.users.entries()].map(([id, u]) => ({
     id,
@@ -82,20 +70,16 @@ function membersPayload(room) {
     isHost: id === room.hostId
   }));
 }
-
-// broadcastMembers uses `io` at runtime (ok because called after io is created)
 function broadcastMembers(roomId) {
   const room = rooms.get(roomId);
   if (!room) return;
   const members = membersPayload(room);
   io.to(roomId).emit('members', { members, roomName: room.name || room.id });
 }
-
 function requireHostOrCohost(room, socketId) {
   const u = room.users.get(socketId);
   return (socketId === room.hostId) || (u && (u.role === 'cohost'));
 }
-
 function normalizeThumb(meta) {
   const candidates = [
     meta?.thumb,
@@ -109,7 +93,6 @@ function normalizeThumb(meta) {
   ].filter(Boolean);
   return candidates[0] || null;
 }
-
 function findUserByName(room, targetNameRaw) {
   if (!targetNameRaw) return null;
   const targetName = String(targetNameRaw).replace(/^@/, '').trim().toLowerCase();
@@ -170,7 +153,7 @@ app.get('/api/lyrics', async (req, res) => {
   } catch (e) { log('/api/lyrics error', e?.message || short(e?.response?.data)); res.status(500).json({ error: e.message }); }
 });
 
-// ---------- YouTube search (YouTube Data API v3; optional) ----------
+// ---------- YouTube search (optional) ----------
 app.get('/api/ytsearch', async (req, res) => {
   try {
     const key = process.env.YT_API_KEY;
@@ -194,58 +177,36 @@ app.get('/api/ytsearch', async (req, res) => {
 });
 
 // ---------- YouTube resolve via VidFly API ----------
-/*
-  This route uses api.vidfly.ai -> expects response shape like:
-  { code: 0, data: { title, cover, duration, items: [ { ext, fps, height, width, label, type, url } ] } }
-*/
 app.get('/api/yt/source', async (req, res) => {
   try {
     let raw = (req.query.url || '').trim();
     if (!raw) return res.status(400).json({ error: 'Missing url' });
-
-    // If input is just a video id, convert
-    if (/^[a-zA-Z0-9_-]{11}$/.test(raw)) {
-      raw = `https://www.youtube.com/watch?v=${raw}`;
-    }
-
+    if (/^[a-zA-Z0-9_-]{11}$/.test(raw)) raw = `https://www.youtube.com/watch?v=${raw}`;
     const vidflyUrl = `https://api.vidfly.ai/api/media/youtube/download?url=${encodeURIComponent(raw)}`;
     log('Calling VidFly API:', vidflyUrl);
-
     const resp = await axios.get(vidflyUrl, { timeout: 20000, validateStatus: () => true });
     const data = resp.data;
-
     if (!data || typeof data !== 'object') {
       log('/api/yt/source vidfly non-object response:', short(data, 1000));
       return res.status(502).json({ error: 'Invalid VidFly response', snippet: short(data, 1000) });
     }
-
     if (Number(data.code) !== 0 || !data.data || !Array.isArray(data.data.items)) {
       log('/api/yt/source vidfly returned error shape:', short(data, 1000));
       return res.status(502).json({ error: 'Invalid VidFly API response', detail: data });
     }
-
     const items = data.data.items;
-
-    // Prefer video_with_audio, pick highest resolution (height) available
     const progressive = items
       .filter(f => f.type === 'video_with_audio')
       .sort((a, b) => (Number(b.height || 0) - Number(a.height || 0)))[0];
-
-    // Fallback: video-only highest resolution
     const videoOnly = items
       .filter(f => f.type === 'video')
       .sort((a, b) => (Number(b.height || 0) - Number(a.height || 0)))[0];
-
-    // Fallback: any item with a URL
     const anyItem = items.find(f => f.url);
-
     const chosen = progressive || videoOnly || anyItem;
-
     if (!chosen || !chosen.url) {
       log('/api/yt/source no playable item found:', short(items, 1200));
       return res.status(502).json({ error: 'No playable format found in VidFly API response' });
     }
-
     res.json({
       url: chosen.url,
       title: data.data.title || raw,
@@ -265,6 +226,84 @@ app.get('/api/yt/source', async (req, res) => {
   }
 });
 
+/*
+  NEW: /api/yt/proxy
+  - Proxies the raw GoogleVideo (redirector) URL so browser won't hit CORS issues.
+  - Supports Range header (seeking).
+  - Validates host by default (only googlevideo.com).
+  - Usage: <video src="/api/yt/proxy?url=<ENCODED_REDIRECTOR_URL>">
+*/
+function isAllowedProxyHost(urlStr) {
+  try {
+    const u = new URL(urlStr);
+    const host = u.hostname.toLowerCase();
+    // default allow only googlevideo redirector hosts; expand list if you use others
+    return host.endsWith('googlevideo.com') || host === 'redirector.googlevideo.com';
+  } catch {
+    return false;
+  }
+}
+
+app.get('/api/yt/proxy', async (req, res) => {
+  try {
+    const raw = (req.query.url || '').trim();
+    if (!raw) return res.status(400).json({ error: 'Missing url' });
+
+    if (!isAllowedProxyHost(raw)) {
+      // If you need to proxy other hosts, update isAllowedProxyHost accordingly.
+      return res.status(400).json({ error: 'Proxy to this host is not allowed by server policy' });
+    }
+
+    // Preserve Range header for partial content requests (seeking)
+    const rangeHeader = req.headers.range || null;
+    const headers = {};
+    if (rangeHeader) headers.Range = rangeHeader;
+
+    log('/api/yt/proxy fetching remote', short(raw, 200), 'Range:', rangeHeader ? rangeHeader.slice(0,120) : 'none');
+
+    // Use axios to stream remote response; allow non-2xx so we can forward status
+    const resp = await axios.get(raw, {
+      responseType: 'stream',
+      timeout: 20000,
+      headers,
+      validateStatus: () => true
+    });
+
+    // Forward key headers from remote to client (if present)
+    const hopByHop = new Set([
+      'transfer-encoding', 'connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization',
+      'te', 'trailer', 'upgrade'
+    ]);
+    const forwardable = ['content-type','content-length','content-range','accept-ranges','cache-control','last-modified','etag'];
+
+    forwardable.forEach(h => {
+      const v = resp.headers[h];
+      if (v !== undefined) res.setHeader(h, v);
+    });
+
+    // Ensure CORS header (app.use(cors()) covers most routes but for streamed responses set explicitly)
+    res.setHeader('Access-Control-Allow-Origin', '*');
+    // allow range requests from browsers
+    res.setHeader('Access-Control-Allow-Headers', 'Range,Accept,Content-Type');
+    // reflect remote status (206 if partial, 200 if full)
+    res.status(resp.status);
+
+    // Pipe the remote stream to the response
+    resp.data.pipe(res);
+
+    // error handling on the stream
+    resp.data.on('error', (err) => {
+      log('/api/yt/proxy remote stream error:', err?.message || String(err));
+      // if response not ended yet, try to send an error
+      try { if (!res.headersSent) res.status(502).json({ error: 'Remote stream error', detail: err?.message || String(err) }); } catch {}
+    });
+  } catch (e) {
+    log('/api/yt/proxy unexpected error:', e?.response?.status ?? e?.message ?? String(e));
+    const detail = e?.response?.data ?? e?.message ?? String(e);
+    res.status(500).json({ error: 'Failed to proxy remote video', detail: short(detail, 800) });
+  }
+});
+
 // ---------- Lobby ----------
 app.get('/api/rooms', (_req, res) => {
   const data = [...rooms.values()]
@@ -295,24 +334,19 @@ io.on('connection', (socket) => {
 
   socket.on('join_room', ({ roomId, name, asHost = false, roomName = null }, ack) => {
     const room = ensureRoom(roomId);
-
     if (asHost || !room.hostId) room.hostId = socket.id;
     if (!room.name && roomName) room.name = String(roomName).trim().slice(0, 60) || null;
-
     const role = socket.id === room.hostId ? 'host' : 'member';
     const cleanName = String(name || 'Guest').slice(0, 40);
     room.users.set(socket.id, { name: cleanName, role });
-
     socket.join(roomId);
     joinedRoom = roomId;
-
     ack?.({
       roomId,
       isHost: socket.id === room.hostId,
       state: currentState(room),
       roomName: room.name || room.id
     });
-
     io.to(roomId).emit('system', { text: `System: ${cleanName} has joined the chat` });
     broadcastMembers(roomId);
   });
@@ -338,7 +372,11 @@ io.on('connection', (socket) => {
     socket.to(roomId).emit('chat_message', { name, text, at: Date.now() });
   });
 
-  // /play request
+  // song_request, song_request_action, set_track, play/pause/seek/ended, admin_command, sync_request...
+  // (The rest of your socket handlers are unchanged — keep them exactly as before.)
+  // For brevity in this snippet, the same socket handlers from your previous file are used:
+  // copy/paste the rest of the socket handlers here (or keep this file from my previous response).
+  // ---------- START socket handlers ----------
   socket.on('song_request', ({ roomId, requester, query }) => {
     const room = rooms.get(roomId);
     if (!room) return;
@@ -440,13 +478,11 @@ io.on('connection', (socket) => {
     if (!room) return;
     const actor = room.users.get(socket.id);
     if (!actor || !(socket.id === room.hostId || actor.role === 'cohost')) return;
-
     const found = findUserByName(room, targetName);
     if (!found) {
       io.to(socket.id).emit('system', { text: `System: User @${targetName} not found` });
       return;
     }
-
     if (cmd === 'kick') {
       const { id } = found;
       io.to(id).emit('system', { text: 'System: You were kicked by the host' });
@@ -495,6 +531,7 @@ io.on('connection', (socket) => {
   });
 });
 
+// start server
 const PORT = process.env.PORT || 3000;
 server.listen(PORT, () => {
   log(`Server running on port ${PORT}`);