# Nexo Player

Samsung Tizen IPTV player with a PHP/MySQL activation and playlist backend.

## Included features

- M3U and Xtream playlists with multiple saved playlists.
- Live TV, movies, series, favorites, history and resume playback.
- AVPlay, native HTML5, hls.js and mpegts.js playback fallbacks.
- Audio/subtitle selection, external subtitles, subtitle delay and screen modes.
- XMLTV EPG current/next/previous programme display with M3U and Xtream catch-up playback.
- Preferred HLS quality, buffer size, audio language and subtitle language.
- Encrypted Xtream passwords, per-install device authentication and signed proxy links.
- Stripe activation with idempotent webhook processing.
- Secure customer links, CSRF-protected admin sessions, audit log and pagination.
- Server synchronization, diagnostics, backup/import and local cache controls.

## Local quality commands

```powershell
npm run check
npm test
npm run build
```

`npm run build` creates a clean application under `build/app` and excludes old archives,
logs, signatures and nested distribution files. Sign the clean directory using your Tizen
certificate profile before production installation.

## Backend deployment

1. Use PHP 8.1+ with PDO MySQL, cURL, OpenSSL and mbstring.
2. Create a database and import `backend/schema.sql` for a new installation.
3. Configure the environment variables listed in `.env.example` through the hosting panel.
4. Generate `APP_KEY` with at least 32 random characters and never change it after encrypting playlists.
5. Generate the admin hash:

   ```bash
   php -r "echo password_hash('your-password', PASSWORD_DEFAULT), PHP_EOL;"
   ```

6. For an existing database, run:

   ```bash
   php backend/bin/migrate.php
   php backend/bin/encrypt-playlist-secrets.php
   ```

7. Keep `ALLOW_LEGACY_DEVICE_CLAIM=false`. Enable it only during a short, supervised
   migration window for devices created before per-install tokens.
8. Configure Stripe webhook `https://your-domain/backend/stripe_webhook.php` for
   `checkout.session.completed`.
9. Set the deployed backend URL in `app/js/config.js`, run the quality command and package
   the clean build.

## Operational notes

- Existing devices without a token remain blocked by default. During a controlled migration,
  briefly enable legacy claiming, deploy the TV update, monitor `device.claimed`, then disable it.
- The IPTV proxies only accept signed, expiring links, active subscriptions, public IP targets and
  hosts associated with the device playlist or approved metadata hosts.
- Back up MySQL and `APP_KEY` together. Losing `APP_KEY` makes encrypted Xtream passwords unreadable.
- Keep old ZIP/WGT files outside source control. They are historical artifacts and are not production builds.
