Clear user config

CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.1.1] - 2026-05-29
+
+### Removed
+- **MoviesMod provider**: Permanently removed — `moviesmod.farm` returns HTTP 403 with Cloudflare managed challenge (`cf-mitigated: challenge`). No server-side workaround exists without a browser runtime.
+- **VidZee provider**: Permanently removed — hardcoded AES-256-GCM salt is no longer valid against VidZee's current API key blob, causing all decryption to fail.
+
+### Fixed
+- **LordFlix provider**: Updated upstream domain (`network.hasta-la-vista.site` → `snowhouse.lordflix.club`) and refreshed server list (10 servers).
+- **Docker startup crash**: Added missing `COPY proxy ./proxy` to both build and runtime stages in `Dockerfile` — `apiServer.js` unconditionally requires `./proxy/proxyServer` at startup.
+
+---
+
 ## [1.1.0] - 2026-05-16
 
 ## Dependency Security

Dockerfile

@@ -12,6 +12,7 @@ RUN npm install --omit=dev
 # Copy only required source (avoid sending screenshots, node_modules already installed)
 COPY apiServer.js ./
 COPY providers ./providers
+COPY proxy ./proxy
 COPY public ./public
 COPY utils ./utils
 COPY README.md ./
@@ -33,6 +34,7 @@ COPY --from=build /app/node_modules ./node_modules
 COPY --from=build /app/apiServer.js ./
 COPY --from=build /app/public ./public
 COPY --from=build /app/providers ./providers
+COPY --from=build /app/proxy ./proxy
 COPY --from=build /app/utils ./utils
 COPY --from=build /app/package.json ./
 COPY --from=build /app/README.md ./

README.md

@@ -6,7 +6,7 @@
   <img src="https://img.shields.io/badge/Node.js-18%2B-brightgreen?style=flat" />
   <img src="https://img.shields.io/badge/Status-Active-success?style=flat" />
   <img src="https://img.shields.io/badge/License-MIT-blue?style=flat" />
-  <img src="https://img.shields.io/badge/Version-1.1.0-informational?style=flat" />
+  <img src="https://img.shields.io/badge/Version-1.1.1-informational?style=flat" />
   <img src="https://img.shields.io/docker/pulls/inside4ndroid/tmdb-embed-api?label=Docker%20Pulls&style=flat" />
 </p>
 
@@ -34,7 +34,7 @@
 
 ## ✨ Features
 - **Multi‑TMDB Key Rotation** – Supply multiple API keys; one is chosen randomly per request.
-- **Provider Aggregation** – Pluggable providers (Showbox/FebBox, 4KHDHub, MoviesMod, VidZee, VixSrc, Videasy, Vidlink, LordFlix, NoTorrent, DahmerMovies) with per‑provider enable toggles + default selection.
+- **Provider Aggregation** – Pluggable providers (Showbox/FebBox, 4KHDHub, VixSrc, Videasy, Vidlink, LordFlix, NoTorrent, DahmerMovies) with per‑provider enable toggles + default selection.
 - **🔥 Plugin System** – Drop new provider files in `providers/` and add its exported function to the registry map (`providers/registry.js` → `providerFunctionMap`).
 - **Dynamic Filtering** – Minimum quality presets, custom JSON quality map, codec exclusion rules (presets + JSON).
 - **Runtime Overrides UI** – Fully interactive web admin at `/` (login protected) writing to `utils/user-config.json`.
@@ -199,7 +199,7 @@ Saving in the UI writes only changed keys. Setting a field to empty removes the
 **Override File:** `utils/user-config.json`
 ```json
 {
-  "defaultProviders": ["4khdhub","moviesmod"],
+  "defaultProviders": ["4khdhub"],
   "tmdbApiKeys": ["KEY_A","KEY_B"],
   "enable4khdhubProvider": true
 }
@@ -227,8 +227,6 @@ The API supports a plugin system. Drop a new provider file in the `providers/` f
 ### Current Built-in Providers
 - `showbox` - Showbox/FebBox streams (requires FebBox JWT cookie)
 - `4khdhub` - 4KHDHub streams
-- `moviesmod` - MoviesMod streams
-- `vidzee` - VidZee streams
 - `vixsrc` - VixSrc streams
 - `videasy` - Videasy streams (10 servers via enc-dec.app)
 - `vidlink` - Vidlink streams (via enc-dec.app)
@@ -246,8 +244,6 @@ The API supports a plugin system. Drop a new provider file in the `providers/` f
    const providerFunctionMap = {
      'Showbox.js': 'getStreamsFromTmdbId',
      '4khdhub.js': 'get4KHDHubStreams',
-     'moviesmod.js': 'getMoviesModStreams',
-     'VidZee.js': 'getVidZeeStreams',
      'vixsrc.js': 'getVixsrcStreams',
      'videasy.js': 'getVideasyStreams',
      'vidlink.js': 'getVidlinkStreams',

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "tmdb-embed-api",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "tmdb-embed-api",
-      "version": "1.1.0",
+      "version": "1.1.1",
       "dependencies": {
         "aromanize": "^0.1.5",
         "axios": "^1.9.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "tmdb-embed-api",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Standalone streaming embed source aggregation API (TMDB ID in, streams out)",
   "main": "apiServer.js",
   "scripts": {

providers/VidZee.js

@@ -1,201 +0,0 @@
-const crypto = require('crypto');
-const axios = require('axios');
-
-const BASE_URL = 'https://core.vidzee.wtf';
-const PLAYER_URL = 'https://player.vidzee.wtf';
-const VIDZEE_HEADERS = {
-    'User-Agent': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.7051.98 Safari/537.36',
-    'Accept': 'application/json, text/javascript, */*; q=0.01',
-    'Accept-Language': 'en-US,en;q=0.9',
-    'Referer': PLAYER_URL,
-    'Origin': PLAYER_URL
-};
-
-// Pad/truncate key string to 32 bytes (UTF-8, mirrors CryptoJS behaviour)
-function getKeyBytes(key) {
-    const encoded = Buffer.from(key, 'utf8');
-    const result = Buffer.alloc(32);
-    encoded.copy(result, 0, 0, Math.min(encoded.length, 32));
-    return result;
-}
-
-// AES-256-CBC decrypt a VidZee stream link.
-// encryptedData is outer-base64 of "ivBase64:cipherBase64"
-async function decryptLink(encryptedData, decryptionKey) {
-    try {
-        if (!encryptedData || !decryptionKey) return '';
-
-        const decoded = Buffer.from(encryptedData, 'base64').toString('utf8');
-        const colonIdx = decoded.indexOf(':');
-        if (colonIdx === -1) return '';
-
-        const ivBase64 = decoded.slice(0, colonIdx);
-        const cipherBase64 = decoded.slice(colonIdx + 1);
-        if (!ivBase64 || !cipherBase64) return '';
-
-        const iv = Buffer.from(ivBase64, 'base64');
-        const cipherBytes = Buffer.from(cipherBase64, 'base64');
-        const keyBytes = getKeyBytes(decryptionKey);
-
-        const decipher = crypto.createDecipheriv('aes-256-cbc', keyBytes, iv);
-        const decrypted = Buffer.concat([decipher.update(cipherBytes), decipher.final()]);
-        return decrypted.toString('utf8');
-    } catch {
-        return '';
-    }
-}
-
-// Derive the real AES-CBC decryption key from VidZee's API-key blob via AES-GCM.
-// Mirrors the TypeScript deriveKey() in the reference implementation.
-async function deriveKey(e) {
-    try {
-        if (!e) return '';
-
-        const t = Buffer.from(e.replace(/\s+/g, ''), 'base64');
-        if (t.length <= 28) return '';
-
-        const n = t.slice(0, 12);   // AES-GCM IV
-        const r = t.slice(12, 28);
-        const a = t.slice(28);
-
-        // i = a || r  (reference: i.set(a, 0); i.set(r, a.length))
-        const i = Buffer.concat([a, r]);
-
-        // AES-256-GCM key = SHA-256 of fixed salt string
-        const l = crypto.createHash('sha256')
-            .update('4f2a9c7d1e8b3a6f0d5c2e9a7b1f4d8c', 'utf8')
-            .digest();
-
-        // WebCrypto passes ciphertext+tag as one buffer; tag is last 16 bytes
-        const ciphertext = i.slice(0, i.length - 16);
-        const authTag = i.slice(i.length - 16);
-
-        const decipher = crypto.createDecipheriv('aes-256-gcm', l, n);
-        decipher.setAuthTag(authTag);
-        const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-        return decrypted.toString('utf8');
-    } catch {
-        return '';
-    }
-}
-
-// Fetch and derive the current decryption key from VidZee's API
-async function fetchDecryptionKey() {
-    try {
-        const response = await axios.get(`${BASE_URL}/api-key`, {
-            headers: VIDZEE_HEADERS,
-            responseType: 'text',
-            timeout: 10000
-        });
-        if (response.status === 200 && response.data) {
-            return await deriveKey(response.data);
-        }
-        return null;
-    } catch {
-        return null;
-    }
-}
-
-const getVidZeeStreams = async (tmdbId, mediaType, seasonNum, episodeNum) => {
-    if (!tmdbId) {
-        console.error('[VidZee] Error: TMDB ID (tmdbId) is required.');
-        return [];
-    }
-
-    if (!mediaType || (mediaType !== 'movie' && mediaType !== 'tv')) {
-        console.error('[VidZee] Error: mediaType is required and must be either "movie" or "tv".');
-        return [];
-    }
-
-    if (mediaType === 'tv') {
-        if (!seasonNum) {
-            console.error('[VidZee] Error: Season (seasonNum) is required for TV shows.');
-            return [];
-        }
-        if (!episodeNum) {
-            console.error('[VidZee] Error: Episode (episodeNum) is required for TV shows.');
-            return [];
-        }
-    }
-
-    // Fetch and derive the decryption key before hitting servers
-    const decKey = await fetchDecryptionKey();
-    if (!decKey) {
-        console.error('[VidZee] Failed to fetch/derive decryption key.');
-        return [];
-    }
-    console.log('[VidZee] Decryption key derived successfully.');
-
-    // Servers 0–13 (matches reference implementation)
-    const servers = Array.from({ length: 14 }, (_, i) => i);
-
-    const streamPromises = servers.map(async (sr) => {
-        let apiUrl = `${PLAYER_URL}/api/server?id=${tmdbId}&sr=${sr}`;
-        if (mediaType === 'tv') {
-            apiUrl += `&ss=${seasonNum}&ep=${episodeNum}`;
-        }
-
-        try {
-            const response = await axios.get(apiUrl, {
-                headers: VIDZEE_HEADERS,
-                timeout: 7000
-            });
-
-            const responseData = response.data;
-            if (!responseData || typeof responseData !== 'object') return [];
-
-            let apiSources = [];
-            if (responseData.url && Array.isArray(responseData.url)) {
-                apiSources = responseData.url;
-            } else if (responseData.link && typeof responseData.link === 'string') {
-                apiSources = [responseData];
-            }
-
-            if (apiSources.length === 0) return [];
-
-            const streams = await Promise.all(apiSources.map(async (sourceItem) => {
-                const label = sourceItem.name || sourceItem.type || 'VidZee';
-                let quality = String(label).match(/^\d+$/) ? `${label}p` : label;
-                if (!/\d{3,4}p/.test(quality)) quality = '720p';
-                const language = sourceItem.language || sourceItem.lang || 'Unknown';
-
-                let rawLink = sourceItem.link;
-                if (rawLink && !/^https?:\/\//i.test(rawLink)) {
-                    const decoded = await decryptLink(rawLink, decKey);
-                    if (decoded && /^https?:\/\//i.test(decoded)) {
-                        rawLink = decoded;
-                    } else {
-                        console.log(`[VidZee S${sr}] Decryption yielded non-URL, skipping.`);
-                        return null;
-                    }
-                }
-
-                if (!rawLink || !/^https?:\/\//i.test(rawLink)) return null;
-
-                return {
-                    name: `VidZee Server${sr} - ${quality} - ${language}`,
-                    title: `VidZee Server${sr} - ${quality} - ${language}`,
-                    url: rawLink,
-                    quality,
-                    provider: 'VidZee',
-                    headers: { 'Referer': `${BASE_URL}/` }
-                };
-            }));
-
-            const valid = streams.filter(Boolean);
-            if (valid.length > 0) {
-                console.log(`[VidZee S${sr}] ${valid.length} stream(s) extracted.`);
-            }
-            return valid;
-        } catch (error) {
-            console.error(`[VidZee S${sr}] Error: ${error.message}`);
-            return [];
-        }
-    });
-
-    const allStreams = (await Promise.all(streamPromises)).flat();
-    console.log(`[VidZee] Total streams: ${allStreams.length}`);
-    return allStreams;
-};
-
-module.exports = { getVidZeeStreams };

providers/lordflix.js

@@ -8,9 +8,9 @@ const LORDFLIX_HEADERS = {
     'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'
 };
 
-const LORDFLIX_API = 'https://network.hasta-la-vista.site';
+const LORDFLIX_API = 'https://snowhouse.lordflix.club';
 const MULTI_DECRYPT_API = 'https://enc-dec.app/api';
-const SERVERS = ['Berlin', 'Tokyo', 'Bogota', 'Oslo', 'Luna', 'LordFlix', 'Sakura', 'Rio', 'Ativa'];
+const SERVERS = ['Berlin', 'Marseille', 'Backrooms', 'Phoenix', 'Oslo', 'Luna', 'Sakura', 'Rio', 'Ativa', 'Moscow'];
 
 // Matches the reference project's encodeQuote: encodeURIComponent with + encoded as %20
 function encodeQuote(str) {

providers/registry.js

@@ -9,8 +9,6 @@ const providerCache = new Map();
 const providerFunctionMap = {
   'Showbox.js': 'getStreamsFromTmdbId',
   '4khdhub.js': 'get4KHDHubStreams',
-  'moviesmod.js': 'getMoviesModStreams',
-  'VidZee.js': 'getVidZeeStreams',
   'vixsrc.js': 'getVixsrcStreams',
   'videasy.js': 'getVideasyStreams',
   'vidlink.js': 'getVidlinkStreams',

public/config.html

@@ -37,7 +37,7 @@
   <main class="main">
   <div id="bootWarn" class="alert warning" style="display:none;">No FEBBOX_COOKIES configured. Showbox / PStream streams may be unavailable.</div>
   <div id="cacheDisabledBanner" class="alert info" style="display:none;">Cache is <strong>DISABLED</strong>; expect slower responses & higher source load.</div>
-  <div id="tmdbMissingBanner" class="alert warning" style="display:none;">No TMDB API Keys configured. Metadata-dependent providers (Showbox, 4khdhub, MoviesMod) may degrade.</div>
+  <div id="tmdbMissingBanner" class="alert warning" style="display:none;">No TMDB API Keys configured. Metadata-dependent providers (Showbox, 4khdhub) may degrade.</div>
     <form id="cfgForm" onsubmit="return false;" class="panels">
       <section id="panel-status" class="panel">
         <h1>Server Status<button style="margin-left: 1rem;" id="refreshStatusBtn" type="button">Refresh Status</button></h1>

public/index.js

@@ -153,15 +153,12 @@ function fillForm(data){
 		const tmdbMissing = !((override.tmdbApiKeys && override.tmdbApiKeys.length) || (merged.tmdbApiKeys && merged.tmdbApiKeys.length) || override.tmdbApiKey || merged.tmdbApiKey);
 		const tmdbProvidersEnabled = [
 			merged.enableShowboxProvider !== false,
-			merged.enable4khdhubProvider !== false,
+			merged.enable4khdhubProvider !== false
-			merged.enableMoviesmodProvider !== false
 		].some(Boolean);
 		tmdbBanner.style.display = (tmdbMissing && tmdbProvidersEnabled)? 'block':'none';
 	}
 	const advBools = [
 		['enable4khdhubProvider','adv_enable4khdhub'],
-		['enableMoviesmodProvider','adv_enableMoviesmod'],
-		['enableVidzeeProvider','adv_enableVidzee'],
 		['enableVixsrcProvider','adv_enableVixsrc'],
 		['enableProxy','adv_enableProxy'],
 		['disableCache','adv_disableCache'],
@@ -243,8 +240,6 @@ async function save(){
 	}
 	const boolMap = {
 		adv_enable4khdhub:'enable4khdhubProvider',
-		adv_enableMoviesmod:'enableMoviesmodProvider',
-		adv_enableVidzee:'enableVidzeeProvider',
 		adv_enableVixsrc:'enableVixsrcProvider',
 		adv_enableProxy:'enableProxy',
 		adv_disableCache:'disableCache',
@@ -335,8 +330,6 @@ async function clearAll(){
 		// Provider enable flags default to true
 		enableShowboxProvider: true,
 		enable4khdhubProvider: true,
-		enableMoviesmodProvider: true,
-		enableVidzeeProvider: true,
 		enableVixsrcProvider: true,
 		enableProxy: false,
 		// Other defaults

utils/user-config.json

@@ -1,17 +1,11 @@
 {
   "defaultProviders": [],
   "configVersion": 1,
-  "tmdbApiKeys": [
+  "tmdbApiKeys": [],
-    "338a47b75eab45d9e64e67088f910f93"
+  "enableShowboxProvider": true,
-  ],
+  "febboxCookies": [],
-  "enableShowboxProvider": false,
+  "enable4khdhubProvider": true,
-  "febboxCookies": [
+  "enableVixsrcProvider": true,
-    "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3Nzg5MjM2NDksIm5iZiI6MTc3ODkyMzY0OSwiZXhwIjoxODEwMDI3NjY5LCJkYXRhIjp7InVpZCI6ODc2NTEwLCJ0b2tlbiI6IjYxNmZlZDdjZDRjMzY1OWJmNWMzNTg5MGUzOTQ4Y2MyIn19.ESauZ9IInk5Iafpt-zLI64u4hMzsby_Spy0tkTJ6KuY"
-  ],
-  "enable4khdhubProvider": false,
-  "enableMoviesmodProvider": false,
-  "enableVidzeeProvider": false,
-  "enableVixsrcProvider": false,
   "enableProxy": false,
   "disableCache": false,
   "enablePStreamApi": true,
@@ -20,9 +14,8 @@
   "excludeCodecsRaw": "{\"excludeDV\":false,\"excludeHDR\":false}",
   "minQualitiesRaw": "all",
   "enableUhdmoviesProvider": false,
-  "enableVidlinkProvider": false,
+  "enableVidlinkProvider": true,
-  "enableVideasyProvider": false,
+  "enableVideasyProvider": true,
-  "enableLordflixProvider": false,
+  "enableLordflixProvider": true,
-  "port": 8787,
+  "enableNotorrentProvider": true
-  "enableNotorrentProvider": false
+}
-}