🚀 XC_VM v2.5.3

This release brings a significant round of improvements across the reseller and admin experience, licensing and activation, streaming security, fanout operations, internationalization, and continued modernization of the codebase.

📊 Reseller Dashboard & UI

• Expanded the Reseller Dashboard with richer media panels for recently added streams, movies, and episodes.
• Added live connections, recent media activity, expiring lines, and a geographic connection map.
• Added live media counts, added dates, category chips, artwork fallbacks, and active viewer indicators.
• Improved dashboard card headers with contextual Tabler icons across both Admin and Reseller dashboards.
• Added trial deep-links and a voucher balance dashboard card.
• Reworked the reseller sidebar into logical sections with improved active-item highlighting.
• Moved destructive connection controls onto their relevant badges and removed redundant Actions columns where no action is available.
• Improved responsive tables and multiple admin data-picker interfaces.
• Added RTL layout support with Arabic translation and language-driven text direction.
• Improved playlist download modal with quick stream links and Xtream API credentials.
• Improved clipboard copy behavior inside modals with clearer visual toast feedback.
• Added/updated date-picker behavior across line, MAG, Enigma2, and other admin forms.

🎟️ Licensing & Activation

• Added a complete license status indicator to the settings/info area.
• Added an activation banner with self-service license key entry.
• Activation UI is now shown only when the supplied key has been accepted.
• Added licensing documentation describing the activation model and data sent to the licensing server.
• Removed the legacy Attribution row from the license indicator.
• Added a license gate preventing load-balancer installation on unlicensed panels.
• Added a soft license gate seam for fanout, allowing the daemon path to fail open where appropriate.
• Added per-build watermarking through RELEASE_ID / XC_VM_BUILD_ID.
• Centralized branding/login attribution handling and added an integrity seam around xcvm_core.
• Added panel UI protection when the required AGPL attribution is removed.

🔐 Security

• Added Encrypt Playlists support across both Live and VOD playlists.
• Hardened player API authentication and activation-code login flows.
• Added stronger protection around player API credential/token handling.
• Hardened image resizing against SSRF and DNS rebinding, including safer TLS trusted-server handling.
• Hardened credentialed reflected-Origin CORS behavior in the player API.
• Added HOST/GeoIP safeguards to prevent live white-screen failures.
• Added additional reseller Host-header validation.
• Improved handling of missing bouquets, stream icons, and nullable player data without bringing down entire API responses.

📡 Fanout & Streaming Operations

• Added a panel-controlled fanout debug mode with support for all or selected daemon debug categories.
• Debug settings are applied live without restarting the daemon, avoiding unnecessary viewer disruption.
• Added fanout daemon memory visibility to the panel, exposing stream/ring/heap information for operational diagnostics.
• Added a bulk drain/unregister-all operation for fanout nodes.
• Added fanout debug-log selection directly from the panel.
• Fixed fanout settings taking up to a minute to reflect saved values.
• Added safeguards around Redis batch reads for reseller live connections.
• Fixed Redis connection parsing errors in StreamsCronJob.
• Preserved Redis self-healing behavior during boot.
• Improved playback/session reporting so player APIs return the line's real active connection count.
• Fixed channels without icons causing complete player API listings to fail.
• Improved VOD paging, rating, EPG limits, and content scoping in the player API.

🧩 Category Templates

• Expanded Category Templates to apply to Lines, MAG, Enigma2 devices, and reseller vouchers.
• Resellers can now see templates shared by any eligible ancestor reseller.
• Added template lifecycle integration with voucher custom data.
• Fixed template visibility and apply-to-all behavior.

🛠️ Admin Architecture & Refactoring

• Reworked the admin bootstrap into a cleaner consolidated architecture.
• Removed legacy session.php and functions.php bootstrap dependencies.
• Migrated module administration onto dedicated ./table and ./api paths.
• Added proper standalone autoloader bootstrapping for post.php.
• Continued removal of procedural compatibility layers and legacy code paths.
• Removed the final goto statements.
• Continued the Rector modernization pass and expanded the automated Rector ruleset.
• Fixed Rector cache behavior and formatting convergence issues.
• Added explicit visibility declarations to remaining class constants.
• Replaced duplicated inline country pickers with the shared GeoReference implementation.
• Continued replacing global database access with typed/service-based access.
• Improved nullable type handling, process PID handling, and controller robustness.
• Cleaned up PHPDoc and coding-style inconsistencies.

🎫 Tickets & Management

• Overhauled the ticket lifecycle, visibility rules, and admin interactions.
• Improved mass-delete and selection controls across Lines, Users, MAG, Enigma2, Streams, Movies, Episodes, Radio, and provider-related interfaces.
• Reworked several client-side picker components to consume raw JSON directly instead of relying on redundant server-side rendering.
• Improved DataTables behavior by removing unnecessary processing overlays.

🧪 Testing & Quality

• Expanded end-to-end coverage for:

  • Admin panel workflows
  • Player API authentication and JSON responses
  • Real channel/category playback
  • Bouquet and admin playback
  • Date/calendar controls
  • Category polling and cache-heavy scenarios

• Added/expanded unit coverage for DB layers, FileCache, Translator, Authorization, BruteforceGuard, SettingsManager, DomainResolver, RequestManager, HTTP requests, module registries, ChannelService, and related helpers.

• Added dual-backend testing for SQLite and MariaDB.

• Improved test harness behavior and bootstrap skip-path coverage.

• Continued CRAP, PHPStan, PHPCS, and Rector cleanup work.

📦 Modules, Build & Tooling

• Fixed module disabling and reinstall lifecycle behavior.
• Disabled modules now remain disabled after reinstall.
• Improved lifecycle failure containment and ensured one directory is maintained per module.
• Enhanced sync-dev.sh to deploy directly into Docker containers.
• Fixed ownership of parent directories created by sync-dev.sh.
• Improved CLI handling so the xcvm_core version is read from PHP and the corresponding current build is fetched.
• Updated Composer dependencies and modernized build tooling.
• Improved PHPCS muted-rule handling and reduced fixer oscillation.

🐛 Stability & Bug Fixes

• Fixed activation banner state handling.
• Fixed admin controller crashes discovered through panel logs.
• Fixed null server/database permission edge cases.
• Fixed nullable bouquet handling in streaming user information.
• Fixed standalone admin endpoints that could execute without the expected bootstrap context.
• Fixed player API failures caused by missing stream icons or null bouquet data.
• Fixed Redis and fanout operational edge cases.
• Improved handling of stream resources, status rendering, and various admin form behaviors.

📚 Documentation & Maintenance

• Updated authentication/session documentation for the consolidated bootstrap.
• Updated licensing documentation with activation and data-transfer details.
• Refreshed translation strings for download and copy actions.
• Continued codebase-wide cleanup, typing, formatting, and modernization work.

🔥 Highlights

This release substantially expands the Reseller Dashboard, introduces a much more complete licensing and activation system, adds encrypted playlists, strengthens player/API security, exposes more fanout operational controls, and continues the migration away from legacy procedural XC_VM architecture.