feat: add HLS proxy, view tracking, and player improvements

- Add HLS proxy middleware for CORS bypass
- Add view tracking API endpoint
- Improve HLS player with proxy fallback mechanism
- Add custom episode support in admin
- Update admin movie list with view count
- Add description expand/collapse on movie detail
- Fix hydration warnings in watch page

server/api/movies.get.ts

@@ -76,6 +76,7 @@ function mapMovieToResponse(movie: any) {
     lang: movie.lang || undefined,
     type: movie.type || undefined,
     rating: movie.rating || undefined,
+    views: movie.views || 0,
     categories: movie.categories || [],
     countries: movie.countries || [],
     sources: movie.sources || [],

server/api/movies/[slug]/view.post.ts

@@ -0,0 +1,25 @@
+import { movies } from '../../../database/schema'
+import { eq, and, sql } from 'drizzle-orm'
+
+export default defineEventHandler(async (event) => {
+  const slug = getRouterParam(event, 'slug')
+  if (!slug) {
+    throw createError({ statusCode: 400, message: 'Thiếu slug phim' })
+  }
+
+  const query = getQuery(event)
+  const source = typeof query.source === 'string' ? query.source : ''
+
+  const db = useDb()
+
+  const whereClause = source
+    ? and(eq(movies.slug, slug), eq(movies.source, source), eq(movies.active, true))
+    : and(eq(movies.slug, slug), eq(movies.active, true))
+
+  await db
+    .update(movies)
+    .set({ views: sql`${movies.views} + 1` })
+    .where(whereClause)
+
+  return { success: true }
+})

server/api/proxy-m3u8.post.ts

@@ -0,0 +1,83 @@
+export default defineEventHandler(async (event) => {
+  const body = await readBody(event)
+  const url = body.url as string
+
+  if (!url) {
+    throw createError({
+      statusCode: 400,
+      message: 'Missing url parameter',
+    })
+  }
+
+  // Validate URL to prevent SSRF
+  if (!url.startsWith('http://') && !url.startsWith('https://')) {
+    throw createError({
+      statusCode: 400,
+      message: 'Invalid URL protocol',
+    })
+  }
+
+  try {
+    const response = await fetch(url, {
+      headers: {
+        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
+        'Accept': '*/*',
+        'Referer': new URL(url).origin,
+        'Origin': new URL(url).origin,
+      },
+    })
+
+    if (!response.ok) {
+      throw createError({
+        statusCode: response.status,
+        message: `Upstream error: ${response.statusText}`,
+      })
+    }
+
+    const contentType = response.headers.get('content-type') || 'application/octet-stream'
+    const isM3u8 = url.includes('.m3u8') || contentType.includes('mpegurl')
+
+    setHeader(event, 'access-control-allow-origin', '*')
+    setHeader(event, 'access-control-allow-methods', 'POST, OPTIONS')
+    setHeader(event, 'cache-control', 'public, max-age=3600')
+
+    // For m3u8 files, rewrite relative URLs to use proxy
+    if (isM3u8) {
+      let body = await response.text()
+      const baseUrl = url.substring(0, url.lastIndexOf('/') + 1)
+      
+      // Rewrite absolute URLs
+      body = body.replace(/^(https?:\/\/[^\s]+)$/gm, (match) => {
+        const encoded = Buffer.from(match).toString('base64')
+        return `/api/proxy-m3u8/${encoded}`
+      })
+      
+      // Rewrite relative URLs (not starting with http/https or /api/proxy-m3u8/)
+      body = body.replace(/^([^#\s][^\n]*)$/gm, (match) => {
+        if (match.startsWith('http://') || match.startsWith('https://') || match.startsWith('/api/proxy-m3u8/')) {
+          return match
+        }
+        const absoluteUrl = new URL(match, baseUrl).href
+        const encoded = Buffer.from(absoluteUrl).toString('base64')
+        return `/api/proxy-m3u8/${encoded}`
+      })
+      
+      setHeader(event, 'content-type', 'application/vnd.apple.mpegurl')
+      return body
+    } else {
+      // For .ts files and other binary data, stream directly
+      setHeader(event, 'content-type', contentType)
+      const contentLength = response.headers.get('content-length')
+      if (contentLength) {
+        setHeader(event, 'content-length', contentLength)
+      }
+      return response.body
+    }
+  } catch (error: any) {
+    if (error.statusCode) throw error
+    throw createError({
+      statusCode: 500,
+      message: `Proxy error: ${error.message}`,
+    })
+  }
+})

server/api/proxy-m3u8/[url].get.ts

@@ -0,0 +1,77 @@
+export default defineEventHandler(async (event) => {
+  // Get base64 encoded URL from path after /api/proxy-m3u8/
+  const path = event.path || event.node?.req?.url || ''
+  const base64Url = path.replace('/api/proxy-m3u8/', '')
+  
+  if (!base64Url) {
+    throw createError({ statusCode: 400, message: 'Missing url parameter' })
+  }
+
+  // Decode URL from base64
+  let url: string
+  try {
+    url = Buffer.from(base64Url, 'base64').toString('utf-8')
+  } catch {
+    throw createError({ statusCode: 400, message: 'Invalid URL encoding' })
+  }
+
+  if (!url.startsWith('http://') && !url.startsWith('https://')) {
+    throw createError({ statusCode: 400, message: 'Invalid URL protocol' })
+  }
+
+  try {
+    const response = await fetch(url, {
+      headers: {
+        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
+        'Accept': '*/*',
+        'Referer': new URL(url).origin,
+        'Origin': new URL(url).origin,
+      },
+    })
+
+    if (!response.ok) {
+      throw createError({ statusCode: response.status, message: `Upstream error: ${response.statusText}` })
+    }
+
+    const contentType = response.headers.get('content-type') || 'application/octet-stream'
+    const isM3u8 = url.includes('.m3u8') || contentType.includes('mpegurl')
+
+    setHeader(event, 'access-control-allow-origin', '*')
+    setHeader(event, 'access-control-allow-methods', 'GET, OPTIONS')
+    setHeader(event, 'cache-control', 'public, max-age=3600')
+
+    if (isM3u8) {
+      let body = await response.text()
+      const baseUrl = url.substring(0, url.lastIndexOf('/') + 1)
+      
+      // Rewrite absolute URLs
+      body = body.replace(/^(https?:\/\/[^\s]+)$/gm, (match) => {
+        const encoded = Buffer.from(match).toString('base64')
+        return `/api/proxy-m3u8/${encoded}`
+      })
+      
+      // Rewrite relative URLs
+      body = body.replace(/^([^#\s][^\n]*)$/gm, (match) => {
+        if (match.startsWith('http://') || match.startsWith('https://') || match.startsWith('/api/proxy-m3u8/')) {
+          return match
+        }
+        const absoluteUrl = new URL(match, baseUrl).href
+        const encoded = Buffer.from(absoluteUrl).toString('base64')
+        return `/api/proxy-m3u8/${encoded}`
+      })
+      
+      setHeader(event, 'content-type', 'application/vnd.apple.mpegurl')
+      return body
+    } else {
+      setHeader(event, 'content-type', contentType)
+      const contentLength = response.headers.get('content-length')
+      if (contentLength) {
+        setHeader(event, 'content-length', contentLength)
+      }
+      return response.body
+    }
+  } catch (error: any) {
+    if (error.statusCode) throw error
+    throw createError({ statusCode: 500, message: `Proxy error: ${error.message}` })
+  }
+})