Studio 414

// Node/Express example (copy to server)
const express = require('express');
const crypto = require('crypto');
const app = express();
app.use(express.json());

// Simple signing secret (rotate in production)
const SIGNING_KEY = process.env.SIGNING_KEY || 'replace-with-secure-key';

function signUrl(path, ttlSeconds=60){
  const expires = Math.floor(Date.now()/1000) + ttlSeconds;
  const signature = crypto.createHmac('sha256', SIGNING_KEY).update(path + '|' + expires).digest('hex');
  return { url: `http://your.cdn${path}?exp=${expires}&sig=${signature}`, expires };
}

app.post('/api/getSignedUrl', (req,res)=>{
  const { asset, prefer } = req.body;
  // validate auth/session/license here (IP checks, user rights)
  // choose HLS path
  const path = `/hls/${asset}/playlist.m3u8`;
  const signed = signUrl(path, 60); // 60s TTL
  res.json({ url: signed.url, type: 'hls', token: signed.sig, expires: signed.expires });
});

app.listen(3000);

// Key rotation flow (server)
// 1) Generate random AES key (16 bytes) per period
// 2) Store key on server, map to key id and expiry
// 3) Provide a signed URL to the key URI (e.g. /keys/abcd.key?exp=...&sig=...)
// 4) Playlist references the key URI; player (hls.js) will fetch key using signed URL

// Key server must validate requester and only return key if authorized.

// DASH requires MPD packaging and CENC/sample-AES encryption. Use packagers like
// Shaka Packager (https://github.com/google/shaka-packager) to produce DASH+HLS with separate
// key rotation and license server. The license server (Widevine/PlayReady) is enterprise-level.