Security:
- Fixed unauthenticated SSRF in /api/stream/proxy and /api/stream/ts-proxy
- proxy allowlist had escape hatch via pathname.endsWith('.m3u8') bypass
- ts-proxy had no destination validation at all
- Both could fetch internal services (127.0.0.1, 169.254.169.254)
- Added streamProxy.helper.js with domain allowlist, private IP blocking,
and http(s)-only enforcement applied to both endpoints
- Removed dead megaplay-1.buzz; added vid-tube.site, norami.top,
kryntal.top, akirax.buzz to allowlist
- Added SECURITY.md with vulnerability reporting policy
Bug fix:
- Fixed dotenv.config() loading after static imports -- helpers reading
process.env at top level never received .env values. Changed to
import 'dotenv/config' as first import
Config:
- Added STREAM_PROXY_DOMAINS env var for custom allowlist
- Added STREAM_PROXY_REFERER env var for custom CDN Referer
New endpoints:
- GET /api/stream/proxy?url= — M3U8 playlist proxy with URL rewriting
Rewrites relative .m3u8 and .ts URLs to proxy endpoints
Adds CORS headers for cross-origin playback
Validates allowed streaming domains
- GET /api/stream/ts-proxy?url= — TS video segment proxy
Proxies .ts segments with proper Content-Type and caching
Fixes:
- seasons.extractor.js: Now extracts from watch page sidebar instead of broken AJAX endpoint
- watchOrder.extractor.js: Now extracts from watch page sidebar (trending/related)
- mirror.helper.js: 404 responses no longer mark mirrors as failed
Only connection errors trigger mirror failover
Endpoint-specific 404s break immediately without retry
38 total endpoints, 34/34 passing with 0 errors
New endpoints:
- GET /api/stream/resolve — Resolves actual m3u8/mp4 URLs from embed player URLs
Follows chain: vidtube.site → megaplay API → m3u8 playlist
Returns url, type, qualities, subtitles, skipData
- GET /api/stream/qualities — Parses M3U8 playlists for available quality options
Returns sorted quality list with resolution, bandwidth, URLs
New extractors:
- streamResolver.extractor.js — Full stream resolution pipeline
- resolveStreamUrl(): Resolves embed → actual video URL
- parseM3u8Qualities(): Parses master playlists for qualities
- normalizeServerName(): Maps VidPlay-1 → vidplay, HD-1 → hd
- extractSubtitles(): Extracts subtitle tracks from API responses
Enhancements:
- streamInfo.extractor.js: Added session establishment before AJAX calls
- Server list now includes normalizedName field for each server
- Stream info now includes type (hls/mp4) and backup URL
- Server list includes typeLabel (SUB/HSUB/DUB)
- Session cookies properly maintained for AJAX stream endpoints
Architecture:
- Embed API domain mapping (vidtube.site → megaplay-1.buzz)
- M3U8 parser supports master and media playlists
- Subtitle extraction from multiple API response formats
- 36 total endpoints (was 34)
New Endpoints (4 new routes):
- GET /api/upcoming — upcoming anime releases from homepage
- GET /api/top-rankings?sort=top|newest — ranked anime with sort modes
- GET /api/recently-updated?tab=all|dub|sub — filtered recent updates
- GET /api/completed — finished anime series from homepage
Enhanced Filter (/api/filter):
- Added source parameter (18 source material types)
- Added epMin/epMax for episode range filtering
- Added excludeWatchlist parameter for logged-in users
- Added season parameter (spring/summer/fall/winter)
New Config IDs:
- SOURCE_IDS: 18 source material type mappings
- SEASON_IDS: 4 broadcast season mappings
- EXTENDED_TYPE_IDS: Added tv-short and tv-special types
Total endpoints: 34 (was 30)
OpenAPI spec updated with new endpoints
CHANGELOG.md updated with comprehensive change history
- apiRoutes.js: Moved imports outside comment block (caused 500 on all endpoints)
- test.js: Deleted orphaned duplicate code after function close
- random.controller.js: Removed stray closing brace breaking try/catch
- cache.helper.js: Added missing MAX_CACHE_SIZE constant
These bugs were introduced by sed insert commands placing code in wrong positions.
The API was returning 500 FUNCTION_INVOCATION_FAILED on all endpoints.
- Box-style header comments (Project, Author, License) on every file
- Section headers using double-line box decorators
- Feature markers (// ---- FEATURE: XYZ ----) before every major function
- JSDoc comments for EVERY function with @param, @returns, @example
- Inline notes (NOTE, WARNING, TIP) for non-obvious logic
- Footer END markers on every module
- Matched code style to AlisaReactionBot repository
- All files now searchable by feature name via grep
Author: Shinei Nouzen <157171073+Shineii86@users.noreply.github.com>
- Add /api/watch endpoint for watch page data
- Add /api/az-list for alphabetical browsing
- Add /api/new-release and /api/newly-added
- Add /api/status for ongoing/completed lists
- Add /api/trending-sidebar for sidebar data
- Update README with all new endpoints
- Update CHANGELOG
- Express.js server with Vercel deployment support
- Complete API endpoints for anikototv.to anime data
- Home, search, info, episodes, stream, schedule endpoints
- Category filtering and genre support
- Caching system with 5-minute TTL
- CORS configuration
- Public documentation page
- Docker and Render deployment configs
- MIT License
Shinei Nouzen