fix(prod): make direct Tigris playback browser-safe

Author: richiemcilroy

apps/site/lib/player-engine.test.mts

@@ -123,3 +123,11 @@ test("explicit MSE playback still allows opener startup when requested", () => {
     url: "https://ash-1.play.rend.so/v/asset/opener.mp4",
   });
 });
+
+test("automatic playback starts with the opener until browser HLS support is known", () => {
+  assert.deepEqual(initialSourceSelection(READY_BOOTSTRAP, "hls", "auto"), {
+    label: "opener",
+    artifactPath: "opener.mp4",
+    url: "https://ash-1.play.rend.so/v/asset/opener.mp4",
+  });
+});

apps/site/lib/player-engine.ts

@@ -152,6 +152,13 @@ export function initialSourceSelection(
     return null;
   }
 
+  // The server cannot know whether the browser supports native HLS. Start the
+  // universally playable opener for auto mode, then let the client upgrade to
+  // native HLS or hls.js without first assigning an unsupported manifest.
+  if (playbackEngine === "auto" && ready.opener_url) {
+    return { label: "opener", artifactPath: "opener.mp4", url: ready.opener_url };
+  }
+
   if (ready.playable_state === "hls_ready" && ready.manifest_url) {
     return { label: "native_hls", artifactPath: "hls/master.m3u8", url: ready.manifest_url };
   }

infra/aws/platform/analytics.tf

@@ -116,7 +116,7 @@ resource "aws_s3_object" "clickhouse_schema" {
   bucket                 = aws_s3_bucket.clickhouse_native_backups.id
   key                    = "bootstrap/clickhouse-schema.sql"
   content                = join("\n", [for schema in sort(fileset("${path.module}/../../../clickhouse", "*.sql")) : file("${path.module}/../../../clickhouse/${schema}")])
-  source_hash            = sha256(join("\n", [for schema in sort(fileset("${path.module}/../../../clickhouse", "*.sql")) : file("${path.module}/../../../clickhouse/${schema}")]))
+  etag                   = md5(join("\n", [for schema in sort(fileset("${path.module}/../../../clickhouse", "*.sql")) : file("${path.module}/../../../clickhouse/${schema}")]))
   server_side_encryption = "aws:kms"
   kms_key_id             = aws_kms_key.clickhouse.arn
 }

infra/aws/platform/locals.tf

@@ -41,7 +41,7 @@ locals {
     { name = "REND_PLAYBACK_MODE", value = "tigris" },
     { name = "REND_PLAYBACK_BASE_URL", value = local.playback_base_url },
     { name = "REND_TIGRIS_PLAYBACK_BASE_URL", value = local.playback_base_url },
-    { name = "REND_PUBLIC_PLAYBACK_ENABLED", value = "false" },
+    { name = "REND_PUBLIC_PLAYBACK_ENABLED", value = "true" },
     { name = "REND_PUBLIC_PLAYBACK_ALIAS_ENABLED", value = "true" },
     { name = "REND_PUBLIC_PLAYBACK_ALIAS_BUCKET", value = var.tigris_media_bucket },
     { name = "REND_PUBLIC_PLAYBACK_ALIAS_PREFIX", value = "v" },

infra/aws/scripts/provision-tigris.sh

@@ -130,6 +130,7 @@ ensure_bucket() {
   local bucket="$1"
   local location="$2"
   local cors_file="$3"
+  local allow_public_policy="${4:-false}"
   local bucket_info
   local expected_location
   local actual_location
@@ -160,7 +161,7 @@ ensure_bucket() {
     --bucket "$bucket" \
     --query 'PolicyStatus.IsPublic' \
     --output text)"
-  if [[ "$public_policy" != "False" && "$public_policy" != "false" ]]; then
+  if [[ "$allow_public_policy" != "true" && "$public_policy" != "False" && "$public_policy" != "false" ]]; then
     echo "Tigris policy is public for bucket $bucket" >&2
     exit 1
   fi
@@ -183,7 +184,35 @@ ensure_bucket() {
 }
 
 ensure_bucket "$TIGRIS_SOURCE_BUCKET" "$TIGRIS_SOURCE_LOCATION" "$work_dir/source-cors.json"
-ensure_bucket "$TIGRIS_MEDIA_BUCKET" "$TIGRIS_MEDIA_LOCATION" "$work_dir/media-cors.json"
+ensure_bucket "$TIGRIS_MEDIA_BUCKET" "$TIGRIS_MEDIA_LOCATION" "$work_dir/media-cors.json" true
+
+# Only immutable playback aliases are anonymously readable. Canonical media,
+# processing attempts, and source objects remain private. Asset identifiers are
+# unguessable UUIDs and the public API already grants playback by asset ID, so
+# signed cookies add no authorization boundary while preventing credentialed
+# browser playback on Tigris's S3-compatible CORS responses.
+jq -n --arg bucket "$TIGRIS_MEDIA_BUCKET" '{
+  Version: "2012-10-17",
+  Statement: [{
+    Sid: "PublicReadPlaybackAliases",
+    Effect: "Allow",
+    Principal: "*",
+    Action: ["s3:GetObject"],
+    Resource: ["arn:aws:s3:::" + $bucket + "/v/*"]
+  }]
+}' >"$work_dir/media-policy.json"
+tigris_s3api put-bucket-policy \
+  --bucket "$TIGRIS_MEDIA_BUCKET" \
+  --policy "file://$work_dir/media-policy.json" >/dev/null
+
+media_public_policy="$(tigris_s3api get-bucket-policy-status \
+  --bucket "$TIGRIS_MEDIA_BUCKET" \
+  --query 'PolicyStatus.IsPublic' \
+  --output text)"
+if [[ "$media_public_policy" != "True" && "$media_public_policy" != "true" ]]; then
+  echo "Tigris playback alias policy is not public for bucket $TIGRIS_MEDIA_BUCKET" >&2
+  exit 1
+fi
 
 playback_public_key_pem="$(printf '%s' "$TIGRIS_PLAYBACK_PUBLIC_KEY_PEM_B64" | base64 --decode)"
 if [[ "$playback_public_key_pem" != "-----BEGIN PUBLIC KEY-----"* ]]; then
@@ -234,4 +263,4 @@ aws ssm put-parameter \
   --overwrite \
   --no-cli-pager >/dev/null
 
-echo "Tigris source and media bucket contracts, private playback key, and custom playback domain are reconciled."
+echo "Tigris private source/canonical media, public playback aliases, and custom playback domain are reconciled."