Fix VTV streams: return direct URLs to client, update FPTPlay URLs, add canthotv fallback, add CORS proxy, fix AES-128 key URI rewriting in proxy

vtv_api.py

@@ -1,11 +1,14 @@
 """
 VTV Channels API - Backend endpoints for VTV1-VTV10 + VTVPrime
 Fetches stream URLs from multiple sources with fallback chain:
-  1. VTVGO failover (vtvdigital.vn) - primary, proxied for VPN users
-  2. xemtv.net PHP endpoints - fresh signed URLs
-  3. FPTPlay CDN - fallback
-ALL stream URLs are returned via proxy to avoid geo-blocking on client side.
-EPG data scraped from https://vtv.vn/lich-phat-song.htm
+  1. FPTPlay CDN - primary (direct URLs, client fetches directly)
+  2. VTVGO failover (vtvdigital.vn) - secondary
+  3. canthotv.vn - fallback for VTV6/VTV10
+  4. xemtv.net PHP endpoints - last resort (often blocked by Cloudflare)
+
+KEY CHANGE: Stream URLs are returned DIRECTLY to client (not proxied through server).
+This avoids server-side 403/404 issues since the client browser (with VPN) fetches directly.
+CORS is handled by the client-side player using hls.js with corsConfig.
 """
 import re, time, threading
 import requests
@@ -24,21 +27,7 @@ router = APIRouter()
 UA = {
     "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36",
     "Accept-Language": "vi-VN,vi;q=0.9",
-    "Referer": "https://hd.xemtv.net/",
-}
-
-XEMTV_PHP_ENDPOINTS = {
-    "vtv1":  "https://hd.xemtv.net/kenh/vtv1.php",
-    "vtv2":  "https://hd.xemtv.net/kenh/vtv2.php",
-    "vtv3":  "https://hd.xemtv.net/kenh/vtv3.php",
-    "vtv4":  "https://hd.xemtv.net/kenh/vtv4.php",
-    "vtv5":  "https://hd.xemtv.net/kenh/vtv5.php",
-    "vtv6":  "https://hd.xemtv.net/kenh/vtv6.php",
-    "vtv7":  "https://hd.xemtv.net/kenh/vtv7.php",
-    "vtv8":  "https://hd.xemtv.net/kenh/vtv8.php",
-    "vtv9":  "https://hd.xemtv.net/kenh/vtv9.php",
-    "vtv10": "https://hd.xemtv.net/kenh/vtv10.php",
-    "vtvprime": "https://hd.xemtv.net/kenh/vtvprime.php",
+    "Referer": "https://fptplay.vn/",
 }
 
 CHANNEL_NAMES = {
@@ -55,7 +44,21 @@ CHANNEL_NAMES = {
     "vtvprime": "VTVPrime",
 }
 
-# VTVGO failover CDN - PRIMARY source for all channels (VTV1-9)
+# ===== FPTPlay CDN - PRIMARY source =====
+FPTPLAY_URLS = {
+    "vtv1":  "https://live.fptplay53.net/fnxch2/vtv1hd_abr.smil/chunklist.m3u8",
+    "vtv2":  "https://live.fptplay53.net/fnxch2/vtv2hd_abr.smil/chunklist.m3u8",
+    "vtv3":  "https://live.fptplay53.net/fnxch2/vtv3hd_abr.smil/chunklist.m3u8",
+    "vtv4":  "https://live.fptplay53.net/fnxch2/vtv4hd_abr.smil/chunklist.m3u8",
+    "vtv5":  "https://live.fptplay53.net/fnxhd1/vtv5hd_vhls.smil/chunklist.m3u8",
+    "vtv6":  "https://live-a.fptplay53.net/live/media/vtv6/live247-hls-avc/vtv6-avc1_5600000=10000-mp4a_131600=20000.m3u8",
+    "vtv7":  "https://live.fptplay53.net/fnxhd1/vtv7hd_vhls.smil/chunklist.m3u8",
+    "vtv8":  "https://live.fptplay53.net/epzhd1/vtv8hd_vhls.smil/chunklist.m3u8",
+    "vtv9":  "https://live.fptplay53.net/fnxhd1/vtv9hd_vhls.smil/chunklist.m3u8",
+    "vtv10": "https://live.fptplay53.net/fnxch2/vtvcantho_abr.smil/chunklist.m3u8",
+}
+
+# ===== VTVGO failover CDN - SECONDARY source =====
 VTVGO_FAILOVER = {
     "vtv1":  "https://vtvgolive-failover.vtvdigital.vn/vtvgo/vtv1-manifest.m3u8",
     "vtv2":  "https://vtvgolive-failover.vtvdigital.vn/vtvgo/vtv2-manifest.m3u8",
@@ -68,35 +71,30 @@ VTVGO_FAILOVER = {
     "vtv9":  "https://vtvgolive-failover.vtvdigital.vn/vtvgo/vtv9-manifest.m3u8",
 }
 
-# FPTPlay CDN - fallback source
-FPTPLAY_URLS = {
-    "vtv1":  "https://live.fptplay53.net/fnxch2/vtv1hd_abr.smil/chunklist.m3u8",
-    "vtv2":  "https://live.fptplay53.net/fnxch2/vtv2hd_abr.smil/chunklist.m3u8",
-    "vtv3":  "https://live.fptplay53.net/fnxch2/vtv3hd_abr.smil/chunklist.m3u8",
-    "vtv4":  "https://live.fptplay53.net/fnxch2/vtv4hd_abr.smil/chunklist.m3u8",
-    "vtv5":  "https://live-a.fptplay53.net/live/media/VTV5HD/live_hls_avc/index.m3u8",
-    "vtv6":  "https://live-a.fptplay53.net/live/media/vtv6/live247-hls-avc/vtv6-avc1_5600000=10000-mp4a_131600=20000.m3u8",
-    "vtv7":  "https://live.fptplay53.net/fnxhd1/vtv7hd_vhls.smil/chunklist_b5000000.m3u8",
-    "vtv8":  "https://live.fptplay53.net/epzhd1/vtv8hd_vhls.smil/chunklist.m3u8",
-    "vtv9":  "https://live.fptplay53.net/fnxhd1/vtv9hd_vhls.smil/chunklist.m3u8",
-    "vtv10": "https://live.fptplay53.net/fnxch2/vtvcantho_abr.smil/chunklist.m3u8",
+# ===== canthotv.vn - FALLBACK =====
+CANTHOTV_URLS = {
+    "vtv6":  "https://live.canthotv.vn/live/tv/chunklist.m3u8",
+    "vtv10": "https://live.canthotv.vn/live/tv/chunklist.m3u8",
 }
 
-# Additional fallback URLs for VTV6 and VTV10
-VTV6_ALL_SOURCES = [
-    "https://vtvgolive-failover.vtvdigital.vn/vtvgo/vtv6-manifest.m3u8",
-    "https://live-a.fptplay53.net/live/media/vtv6/live247-hls-avc/vtv6-avc1_5600000=10000-mp4a_131600=20000.m3u8",
-    "https://live.canthotv.vn/live/tv/chunklist.m3u8",
-]
-
-VTV10_ALL_SOURCES = [
-    "https://live.fptplay53.net/fnxch2/vtvcantho_abr.smil/chunklist.m3u8",
-    "https://live.canthotv.vn/live/tv/chunklist.m3u8",
-]
+# ===== xemtv.net PHP endpoints - LAST RESORT =====
+XEMTV_PHP_ENDPOINTS = {
+    "vtv1":  "https://hd.xemtv.net/kenh/vtv1.php",
+    "vtv2":  "https://hd.xemtv.net/kenh/vtv2.php",
+    "vtv3":  "https://hd.xemtv.net/kenh/vtv3.php",
+    "vtv4":  "https://hd.xemtv.net/kenh/vtv4.php",
+    "vtv5":  "https://hd.xemtv.net/kenh/vtv5.php",
+    "vtv6":  "https://hd.xemtv.net/kenh/vtv6.php",
+    "vtv7":  "https://hd.xemtv.net/kenh/vtv7.php",
+    "vtv8":  "https://hd.xemtv.net/kenh/vtv8.php",
+    "vtv9":  "https://hd.xemtv.net/kenh/vtv9.php",
+    "vtv10": "https://hd.xemtv.net/kenh/vtv10.php",
+    "vtvprime": "https://hd.xemtv.net/kenh/vtvprime.php",
+}
 
 _vtv_cache = {}
 _vtv_lock = threading.Lock()
-_CACHE_TTL = 180
+_CACHE_TTL = 120
 
 
 def _cached(key):
@@ -111,15 +109,6 @@ def _set_cache(key, data):
         _vtv_cache[key] = {'t': time.time(), 'd': data}
 
 
-def _proxy_url(url):
-    """Wrap an external URL through our proxy so client browser never connects directly."""
-    if not url:
-        return url
-    if url.startswith('/api/proxy/'):
-        return url
-    return '/api/proxy/m3u8/vtv?url=' + quote(url, safe='')
-
-
 def extract_m3u8_from_html(html):
     if not html:
         return None
@@ -140,37 +129,24 @@ def fetch_xemtv_stream(channel_id):
     php_url = XEMTV_PHP_ENDPOINTS.get(channel_id)
     if not php_url:
         return None
-    try:
-        r = requests.get(php_url, headers=UA, timeout=15, allow_redirects=True)
-        if r.status_code == 200:
-            m3u8 = extract_m3u8_from_html(r.text)
-            if m3u8:
-                return m3u8
-    except:
-        pass
-    return None
-
-
-def fetch_fptplay_stream(channel_id):
-    url = FPTPLAY_URLS.get(channel_id)
-    if not url:
-        return None
     try:
         headers = {
             "User-Agent": UA["User-Agent"],
-            "Referer": "https://fptplay.vn/",
-            "Origin": "https://fptplay.vn"
+            "Accept-Language": "vi-VN,vi;q=0.9",
+            "Referer": "https://hd.xemtv.net/",
+            "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
         }
-        r = requests.get(url, headers=headers, timeout=15, allow_redirects=True)
-        if r.status_code == 200:
-            return url
+        r = requests.get(php_url, headers=headers, timeout=15, allow_redirects=True)
+        if r.status_code == 200 and "cloudflare" not in r.text.lower() and "just a moment" not in r.text.lower():
+            m3u8 = extract_m3u8_from_html(r.text)
+            if m3u8:
+                return m3u8
     except:
         pass
     return None
 
 
 def _verify_stream_url(url, timeout=8):
-    """Quick check if a stream URL is actually serving content."""
     if not url:
         return False
     try:
@@ -179,33 +155,38 @@ def _verify_stream_url(url, timeout=8):
             headers["Referer"] = "https://vtv.vn/"
         elif "fptplay" in url:
             headers["Referer"] = "https://fptplay.vn/"
+            headers["Origin"] = "https://fptplay.vn"
+        elif "canthotv" in url:
+            headers["Referer"] = "https://canthotv.vn/"
         verify_ssl = "vtvdigital" not in url
         r = requests.get(url, headers=headers, timeout=timeout, allow_redirects=True, verify=verify_ssl)
-        if r.status_code == 200 and b"#EXTM3U" in r.content[:200]:
-            base = url.rsplit('/', 1)[0] + '/'
+        if r.status_code == 200 and b"#EXTM3U" in r.content[:500]:
             lines = r.text.strip().split('\n')
-            for line in lines:
-                line = line.strip() if isinstance(line, str) else line.strip()
-                if line and not line.startswith('#'):
-                    sub_url = line if line.startswith('http') else base + line
-                    try:
-                        sub_r = requests.get(sub_url, headers=headers, timeout=timeout,
-                                             allow_redirects=True, verify=verify_ssl)
-                        if sub_r.status_code == 200 and b"#EXTM3U" in sub_r.content[:200]:
-                            return True
-                    except:
-                        pass
-                    break
+            has_ts = any('.ts' in line.lower() for line in lines if not line.startswith('#'))
+            has_sub = any('.m3u8' in line.lower() for line in lines if not line.startswith('#'))
+            if has_ts:
+                return True
+            if has_sub:
+                for line in lines:
+                    line = line.strip()
+                    if line and not line.startswith('#') and '.m3u8' in line:
+                        sub_url = line if line.startswith('http') else url.rsplit('/', 1)[0] + '/' + line
+                        try:
+                            sub_r = requests.get(sub_url, headers=headers, timeout=timeout, allow_redirects=True, verify=verify_ssl)
+                            if sub_r.status_code == 200 and b"#EXTM3U" in sub_r.content[:500]:
+                                sub_lines = sub_r.text.strip().split('\n')
+                                has_real_ts = any('.ts' in l.lower() for l in sub_lines if not l.startswith('#'))
+                                if has_real_ts:
+                                    return True
+                        except:
+                            pass
+                        break
         return False
     except:
         return False
 
 
 def fetch_vtv_stream(channel_id):
-    """
-    Fetch VTV stream URL with multi-source fallback chain.
-    Returns a PROXIED URL so client browser never connects directly.
-    """
     channel_id = channel_id.lower().strip()
     name_map = {
         'vtvct': 'vtv10', 'vtv-can-tho': 'vtv10', 'vtv can tho': 'vtv10',
@@ -218,78 +199,36 @@ def fetch_vtv_stream(channel_id):
     cached = _cached(channel_id)
     if cached is not None:
         return cached
-
     result = None
-
-    # VTV6 special: try all sources
-    if channel_id == 'vtv6':
-        xemtv_url = fetch_xemtv_stream('vtv6')
-        if xemtv_url:
-            result = _proxy_url(xemtv_url)
-            _set_cache(channel_id, result)
-            return result
-        for src in VTV6_ALL_SOURCES:
-            if _verify_stream_url(src):
-                result = _proxy_url(src)
-                _set_cache(channel_id, result)
-                return result
-        result = _proxy_url(VTV6_ALL_SOURCES[0])
-        _set_cache(channel_id, result)
-        return result
-
-    # VTV10 special: no VTVGO failover
-    if channel_id == 'vtv10':
-        xemtv_url = fetch_xemtv_stream('vtv10')
-        if xemtv_url:
-            result = _proxy_url(xemtv_url)
-            _set_cache(channel_id, result)
-            return result
-        for src in VTV10_ALL_SOURCES:
-            if _verify_stream_url(src):
-                result = _proxy_url(src)
-                _set_cache(channel_id, result)
-                return result
-        result = _proxy_url(VTV10_ALL_SOURCES[0])
-        _set_cache(channel_id, result)
-        return result
-
-    # VTVPrime
     if channel_id == 'vtvprime':
         xemtv_url = fetch_xemtv_stream('vtvprime')
         if xemtv_url:
-            result = _proxy_url(xemtv_url)
+            result = xemtv_url
             _set_cache(channel_id, result)
             return result
         _set_cache(channel_id, None)
         return None
-
-    # VTV1-VTV9: VTVGO failover primary, xemtv secondary
-    if channel_id in VTVGO_FAILOVER:
-        failover_url = VTVGO_FAILOVER[channel_id]
-        if _verify_stream_url(failover_url):
-            result = _proxy_url(failover_url)
-            _set_cache(channel_id, result)
-            return result
-        result = _proxy_url(failover_url)
-        _set_cache(channel_id, result)
-        return result
-
-    # Fallback: xemtv
+    sources = []
+    fpt_url = FPTPLAY_URLS.get(channel_id)
+    if fpt_url:
+        sources.append(fpt_url)
+    vtvgo_url = VTVGO_FAILOVER.get(channel_id)
+    if vtvgo_url:
+        sources.append(vtvgo_url)
+    cantho_url = CANTHOTV_URLS.get(channel_id)
+    if cantho_url:
+        sources.append(cantho_url)
     xemtv_url = fetch_xemtv_stream(channel_id)
     if xemtv_url:
-        result = _proxy_url(xemtv_url)
-        _set_cache(channel_id, result)
-        return result
-
-    # Fallback: FPTPlay
-    fpt_url = fetch_fptplay_stream(channel_id)
-    if fpt_url:
-        result = _proxy_url(fpt_url)
-        _set_cache(channel_id, result)
-        return result
-
-    _set_cache(channel_id, None)
-    return None
+        sources.append(xemtv_url)
+    for src in sources:
+        if _verify_stream_url(src):
+            result = src
+            break
+    if result is None and sources:
+        result = sources[0]
+    _set_cache(channel_id, result)
+    return result
 
 
 @router.get("/api/vtv/streams")
@@ -330,7 +269,6 @@ def proxy_page(url: str = Query(...)):
 
 @router.get("/api/proxy/m3u8/vtv")
 def proxy_vtv_m3u8(url: str = Query(...)):
-    """Proxy m3u8 manifest + rewrite ALL sub-manifest/segment URLs to go through proxy."""
     try:
         headers = {"User-Agent": UA["User-Agent"], "Accept": "*/*"}
         if "fptplay" in url:
@@ -343,23 +281,28 @@ def proxy_vtv_m3u8(url: str = Query(...)):
             headers["Origin"] = "https://vtv.vn"
         elif "canthotv" in url:
             headers["Referer"] = "https://canthotv.vn/"
-
         verify_ssl = "vtvdigital" not in url
         r = requests.get(url, headers=headers, timeout=15, allow_redirects=True, verify=verify_ssl)
         if r.status_code != 200:
             return Response(status_code=502, content="upstream error")
-
         content = r.text
         lines = content.split('\n')
         rewritten = []
         base_url = url.rsplit('/', 1)[0] + '/'
-
         for line in lines:
             line = line.strip()
             if not line:
                 rewritten.append(line)
                 continue
             if line.startswith('#'):
+                if 'URI=' in line:
+                    line = re.sub(
+                        r'URI="([^"]+)"',
+                        lambda m: 'URI="' + ("/api/proxy/seg/vtv?url=" + quote(m.group(1), safe="")
+                                   if not m.group(1).startswith('http')
+                                   else "/api/proxy/seg/vtv?url=" + quote(m.group(1), safe="")) + '"',
+                        line
+                    )
                 rewritten.append(line)
                 continue
             seg_url = line
@@ -367,7 +310,6 @@ def proxy_vtv_m3u8(url: str = Query(...)):
                 seg_url = base_url + seg_url
             proxy_seg = "/api/proxy/seg/vtv?url=" + quote(seg_url, safe="")
             rewritten.append(proxy_seg)
-
         return Response(
             content='\n'.join(rewritten).encode("utf-8"),
             media_type="application/vnd.apple.mpegurl",
@@ -379,7 +321,6 @@ def proxy_vtv_m3u8(url: str = Query(...)):
 
 @router.get("/api/proxy/seg/vtv")
 def proxy_vtv_segment(url: str = Query(...)):
-    """Proxy individual segments. Also handles sub-manifests (nested m3u8)."""
     try:
         headers = {"User-Agent": UA["User-Agent"], "Accept": "*/*"}
         if "fptplay" in url:
@@ -390,14 +331,11 @@ def proxy_vtv_segment(url: str = Query(...)):
             headers["Origin"] = "https://vtv.vn"
         elif "canthotv" in url:
             headers["Referer"] = "https://canthotv.vn/"
-
         verify_ssl = "vtvdigital" not in url
         r = requests.get(url, headers=headers, timeout=30, allow_redirects=True, verify=verify_ssl)
         if r.status_code != 200:
             return Response(status_code=502, content="upstream error")
-
         data = r.content
-
         if b"#EXTM3U" in data[:500] or ".m3u8" in url:
             lines = data.decode("utf-8", errors="replace").split('\n')
             rewritten = []
@@ -405,6 +343,14 @@ def proxy_vtv_segment(url: str = Query(...)):
             for line in lines:
                 line_s = line.strip()
                 if not line_s or line_s.startswith('#'):
+                    if 'URI=' in line_s:
+                        line_s = re.sub(
+                            r'URI="([^"]+)"',
+                            lambda m: 'URI="' + ("/api/proxy/seg/vtv?url=" + quote(m.group(1), safe="")
+                                       if not m.group(1).startswith('http')
+                                       else "/api/proxy/seg/vtv?url=" + quote(m.group(1), safe="")) + '"',
+                            line_s
+                        )
                     rewritten.append(line_s)
                 else:
                     seg_url = line_s
@@ -416,10 +362,8 @@ def proxy_vtv_segment(url: str = Query(...)):
                 media_type="application/vnd.apple.mpegurl",
                 headers={"Access-Control-Allow-Origin": "*", "Cache-Control": "no-cache"}
             )
-
         if len(data) > 188 and data[0:4] == b'\x89PNG' and data[188] == 0x47:
             data = data[188:]
-
         return Response(
             content=data,
             media_type="video/mp2t",
@@ -429,7 +373,28 @@ def proxy_vtv_segment(url: str = Query(...)):
         return Response(status_code=502, content="proxy error")
 
 
-# EPG
+@router.get("/api/cors-proxy")
+def cors_proxy(url: str = Query(...)):
+    try:
+        headers = {"User-Agent": UA["User-Agent"]}
+        if "fptplay" in url:
+            headers["Referer"] = "https://fptplay.vn/"
+            headers["Origin"] = "https://fptplay.vn"
+        elif "vtvdigital" in url:
+            headers["Referer"] = "https://vtv.vn/"
+        elif "canthotv" in url:
+            headers["Referer"] = "https://canthotv.vn/"
+        verify_ssl = "vtvdigital" not in url
+        r = requests.get(url, headers=headers, timeout=30, allow_redirects=True, verify=verify_ssl)
+        resp_headers = {"Access-Control-Allow-Origin": "*"}
+        if "Content-Type" in r.headers:
+            resp_headers["Content-Type"] = r.headers["Content-Type"]
+        return Response(content=r.content, status_code=r.status_code, headers=resp_headers)
+    except Exception as e:
+        return Response(status_code=502, content=str(e))
+
+
+# ===== EPG =====
 _epg_cache = {}
 _epg_cache_time = 0
 _EPG_CACHE_TTL = 1800