[pull] develop from ossrs:develop - #17

Replaced Discord badge with Telegram badge in README.

Removed IDE recommendation and sponsorship section. Added AI usage recommendation for SRS maintenance.

Added social media and YouTube links to README.

Improve the Go proxy’s browser tooling, documentation, shared agent
configuration, and issue-maintenance workflows.

- Support authenticated external WHIP and WHEP endpoints in the browser
players.
- Add a catalog of implemented Go proxy capabilities and current
limitations.
- Clarify heartbeat registration and expiration behavior for multi-proxy
deployments.
- Add shared `.agents` workspace configuration and correct stale
workspace paths.
- Add issue scanning and Truth Record workflows for bug maintenance.
- Update the codebase map for the new proxy feature documentation.

---------

Co-authored-by: Claude Fable 5 <[email protected]>

This PR refines how SRS knowledge, documentation, code navigation, and
verification guidance are organized for AI maintainers.

- Introduce internal SRS skills for documentation and code-map routing.
- Move shared code maps and project knowledge out of the legacy
`memory/` structure.
- Bundle trusted C++ and Go proxy documentation with the documentation
skill.
- Route development and support workflows through the smallest relevant
references.
- Centralize Git workflow and AI attribution guidance in the development
skill.
- Remove obsolete memory and documentation symlinks from individual
AI-agent workspaces.
- Update the documentation synchronization script for the new bundled
layout.
- Document SRS 8.0, community support, and the findings for issue #4681.
- Add optional Redis key namespaces for isolating proxy clusters sharing
a Redis database.

The previous structure distributed knowledge across workspace memory,
documentation directories, and individual AI-agent configuration.

The new structure makes SRS knowledge portable and discoverable through
reusable skills. AI agents can first route a task to the correct code
map or documentation reference, then load only the relevant material
instead of broadly searching the repository.

This provides a clearer separation between:

- User support and development workflows.
- Documentation and source-code navigation.
- Server implementation maps and verification guidance.
- Shared project knowledge and agent-specific workspace memory.

---------

Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Prevent the live-source cleanup timer from removing a source while a
publisher owns that stream's publish token but has not activated the
source yet. Fixes #4656.

**Root cause**

A publisher can acquire the stream publish token, fetch live source
**A**, and then yield before `acquire_publish()` marks the source
active. During that interval, cleanup can consider **A** dead and remove
it from the source pool.

The publisher still holds a shared pointer and later publishes into
**A**, but new players fetch or create source **B** for the same stream
URL. Those players create consumers with `active=0` and receive no RTMP
or HTTP-FLV media, while HLS attached to **A** can continue working.

---------

Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Fixes #4647. Add `PROXY_ORIGIN_SERVER_TTL` so operators can tune how
long an origin registration remains healthy instead of relying on the
fixed 300-second lifetime. The default remains `300s`, preserving
existing behavior.

---------

Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Summary:

- Fix the browser player's default HTTP-FLV/HLS URL construction to use
the public page protocol and port while preserving explicit target
overrides.
- Keep direct SRS access on port 8080, omit standard HTTP/HTTPS ports,
and support custom reverse-proxy ports.
- Add an AI-owned Node.js regression script for browser URL generation
and route browser-client work through the internal code map.

The regression script passes all six scenarios:

- Direct SRS HTTP server on port 8080
- Public HTTP origin on port 80
- Public HTTPS origin on port 443
- Custom reverse-proxy port
- Explicit protocol change without a port
- Explicit target overrides

---------

Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

The reported explanation that `session_` is never cleared for the
recorded owner is not correct after PR #4083. However, the TCP handshake
still had a real ownership bug: connection B could replace connection A
as the RTC TCP network owner before the uniqueness check ran.

That left A alive with a raw `session_` pointer while teardown only
interrupted B. A could later dereference stale memory at
`session_->tcp()`, matching the reported crash area.

## Fix

The first TCP handshake now claims an empty owner slot. Later handshakes
for the same RTC session fail with `ERROR_RTC_TCP_UNIQUE` before
changing ownership or storing `session_`.

## Regression coverage

Added:

```text
ReproduceIssue4642.RejectSecondTcpConnForSameRtcSession
```

The test verifies:

- A succeeds and becomes owner.
- B fails with `ERROR_RTC_TCP_UNIQUE`.
- A remains owner.
- B never stores the session pointer.

On the unfixed baseline, this test failed because B succeeded, replaced
A, and stored the session pointer.

---------

Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

## Summary

Fix #4639 by appending the SDP line terminator after
`SrsSSRCGroup::encode()` writes an `a=ssrc-group:` attribute.

Before this fix, an SSRC group followed by another SDP attribute could
be serialized as one concatenated line, for example:

```text
a=ssrc-group:FID 12345 67890a=ssrc:12345 cname:test-cname
```

This was a narrow encoder bug: other SDP encoders already append
`kCRLF`.

## Changes

- Add the missing `kCRLF` after encoded SSRC group lines.
- Tighten the existing SSRC group unit test to require the exact
CRLF-terminated output.
- Add a regression test for an SSRC group followed by an `a=ssrc:` line.
- Record the verified Truth Record for #4639 in the AI issue records.

## Verification

```bash
make utest -j4
ASAN_OPTIONS=detect_leaks=0 ./objs/srs_utest --gtest_filter='ProtocolSdpTest.SrsSSRCGroupEncode*'
ASAN_OPTIONS=detect_leaks=0 ./objs/srs_utest
```

Results:

- Targeted SSRC group tests passed: 2 tests.
- Full C++ utest suite passed: 2240 tests.

---------

Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

…4703)

## Summary

- Fix #4631 by releasing partially acquired RTMP publish state after a
non-busy acquisition error.
- Preserve an existing publisher when a new session is rejected with
`StreamBusy`.
- Add regression coverage for repeated dynamic-forward backend failures.
- Record the verified Truth Records for #4632, #4633, and #4634.

## Behavior

A dynamic-forward backend error still rejects the current publication.
SRS now cleans up the partial publish state so the same stream can retry
after the backend recovers, without restarting SRS.

The external unpublish hook remains limited to sessions that
successfully acquired the stream and entered the publish lifecycle.

## Verification

- Targeted forward-backend rollback test passed.
- Complete C++ unit suite passed: 2,190 tests from 274 suites.
- Runtime verification passed: HTTP 500 rejected the first publication,
and the same stream published successfully after backend recovery
without restarting SRS.

Fixes #4631

---------

Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

## Summary

- Fix MP4 DVR playback timing when consecutive RTMP H.264 messages have
the same DTS.
- Preserve valid zero-duration MP4 `stts` entries instead of treating
them as uninitialized.
- Add regression coverage for a picture and auxiliary H.264 packets
sharing one timestamp.
- Record the verified Truth Records for issues #4625 through #4629.

## Problem

Some publishers, including the drone stream from #4625, send a picture
plus separate SEI/AUD messages with the same DTS. SRS records each RTMP
video message as an MP4 sample.

The MP4 `stts` builder used `sample_delta_ == 0` to detect an empty
entry. However, zero is also the valid delta between samples sharing the
same DTS. When the next positive delta arrived, SRS replaced the
accumulated zero delta and assigned time to the same-DTS auxiliary
samples.

This produced inconsistent MP4 files: the reporter's header duration was
30.259 seconds, while its accumulated `stts` timeline was 140.099
seconds. VLC consequently listed the file as approximately 30 seconds
but played it for approximately 140 seconds.

## Simplified example

There are two decoded video pictures, but the publisher sends four RTMP
video messages:

| RTMP message | H.264 content | DTS | Decoded picture? |
|---|---|---:|---|
| 1 | IDR picture | 0 ms | Yes |
| 2 | SEI metadata | 0 ms | No |
| 3 | AUD delimiter | 0 ms | No |
| 4 | P-picture | 30 ms | Yes |

SEI and AUD are auxiliary H.264 NAL units, not additional pictures. The
IDR, SEI, and AUD share one timestamp, so only one 30 ms interval passes
before the P-picture:

```text
0 ms                              30 ms
|                                   |
IDR + SEI + AUD                     P-picture
```

The correct timing deltas are effectively:

```text
0 ms, 0 ms, 0 ms, 30 ms
```

The old `stts` builder mistook the valid zero-delta entry for an empty
entry. When the 30 ms delta arrived, it effectively changed the group
to:

```text
30 ms, 30 ms, 30 ms, 30 ms
```

The group therefore consumed about 120 ms instead of 30 ms. Repeating
this error throughout the recording inflated its playback timeline.

## Fix

Use `sample_count_ == 0` to determine whether the current `stts` entry
is empty. Entry state is now independent from the valid `sample_delta_`
value, so zero-duration runs are preserved.

For the regression DTS sequence `9, 9, 9, 9, 39` ms:

- Before: `(1,9), (4,30)` = 129 ms
- After: `(1,9), (3,0), (1,30)` = 39 ms

Fixes #4625.

## Verification

- Targeted ASAN regression test passed:
`ReproduceIssue4625.PreserveZeroDtsInMp4Stts`
- Full ASAN C++ unit suite passed: 2,191 tests from 275 suites
- DVR blackbox tests passed:
  - `TestFast_RtmpPublish_DvrFlv_Basic`
  - `TestFast_RtmpPublish_DvrMp4_Basic`
- Controlled FFmpeg → RTMP → SRS DVR MP4 integration passed
  - Before: header 28.920 seconds; `stts` 115.710 seconds
  - After: header 28.920 seconds; `stts` 28.920 seconds
- `git diff --check` passed

---------

Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

## Summary

- Suppress repeated, byte-identical AVC and HEVC sequence headers in the
RTC-to-RTMP bridge.
- Reset sequence-header deduplication state for each publication and
retain state only after successful delivery.
- Prevent unchanged WebRTC parameter sets from marking every open HLS
segment as discontinuous.
- Add H.264 and H.265 regression tests for repeated parameter sets and
update the existing AVC expectation.
- Synchronize the authorized Truth Records for #4623 and #4624.

Fixes #4695.

## Verification

- `make utest -j4`
- `ASAN_OPTIONS=detect_leaks=0 ./objs/srs_utest
--gtest_filter='ReproduceIssue4695.*:RtcFrameBuilderTest.PacketSequenceHeaderAvc_ComprehensiveCoverage'`
— 3 tests passed
- `ASAN_OPTIONS=detect_leaks=0 ./objs/srs_utest` — 2,244 tests passed
- `git diff --check`

The full WHIP-to-HLS workflow was not reproduced locally.

---------

Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

## Summary

- Fix duplicated RTMP query parameters in HTTP callbacks when SRS parses
the request during connect and again after identifying the publish
stream.
- Make RTMP URL reconstruction idempotent when parameters are already
present in `tcUrl` or repeated in the publish stream.
- Refactor RTMP URL parsing into focused helpers for parameter
normalization, URL reconstruction, and legacy URL normalization.
- Add regression coverage for full-stream `tcUrl`, app-level `tcUrl`,
and parameters present in both RTMP fields.

Fixes #4622.

## Root cause

`SrsRtmpServer::connect_app()` first parsed `tcUrl` and stored its query
in `req->param_`. After `identify_client()` supplied the publish stream,
`SrsRtmpConn::stream_service_cycle()` parsed the request again. The
parser appended the previously extracted parameter back to a `tcUrl`
that already contained it, producing callback values such as:

```text
?token=abc?token=abc
```

## Fix

Normalize parameters before reconstructing the complete RTMP URL. When
`tcUrl` already contains the parameter, do not append it again; when the
publish stream repeats the same parameter, remove the duplicate suffix.
Legacy RTMP query placement and FMLE `/_definst_` paths are then
normalized before parsing with `SrsHttpUri`.

---------

Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

#4711)

## Summary

Preserve the original HTTP-FLV viewer address supplied by a reverse
proxy instead of replacing it with the proxy's TCP peer address.

## Problem

SRS already parses `X-Forwarded-For` and `X-Real-IP`, but
`SrsLiveStream::serve_http_impl()` unconditionally replaced the parsed
address with `hc->remote_ip()`. As a result, HTTP-FLV client statistics
and the SRS console displayed the reverse proxy address rather than the
viewer address.

## Changes

- Prefer the original address from `X-Forwarded-For` or `X-Real-IP` for
HTTP-FLV viewers.
- Fall back to the TCP peer address when neither header is present.
- Add regression test
`ReproduceIssue4621.PreserveForwardedIpForHttpFlvClient`.

---------

Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

)

## Summary

- Fix `srs_clients_errs_total` so disconnects already classified by SRS
as graceful are not counted as client errors.
- Add regression coverage for graceful RTMP/TCP, SRT, and HTTP stream
termination while preserving coverage for genuine client errors.
- Refine the `srs-develop` bug workflow so the detailed GitHub Truth
Record is canonical and the local issue record is added only after
successful publication.
- Add maintainer-approved local Truth Records for #4697, #4621, #4620,
#4617, #4616, and #4611.

## Issue #4609

Before this change, `SrsStatistic::on_disconnect()` incremented the
client error counter for every nonzero internal error. Connection
handling later treated several of those errors as graceful termination,
so normal player exits were successful operationally but recorded as
failures statistically.

This PR excludes the existing client- and server-graceful-close
classifications from `srs_clients_errs_total`:

- `ERROR_SOCKET_READ`
- `ERROR_SOCKET_READ_FULLY`
- `ERROR_SOCKET_WRITE`
- `ERROR_SRT_IO`
- `ERROR_HTTP_STREAM_EOF`

Genuine disconnect errors continue to increment the counter.

The separate report that `srs_clients` retained a historical maximum was
not reproduced and is not changed by this PR. See the [approved Truth
Record](#4609 (comment))
for the full reproduction, evidence, and remaining unknowns.

## Verification

- `ReproduceIssue4609.GracefulDisconnectsDoNotIncrementErrors`: passed.
- `StatisticTest.DumpsMetrics`: passed with genuine error codes.
- Full ASAN C++ unit suite: **2,249 tests from 291 suites passed**.
- Runtime verification with one publisher and five normally exiting RTMP
players confirmed that `srs_clients` returned to one,
`srs_clients_total` remained six, and `srs_clients_errs_total` remained
zero.

---------

Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

….16 (#4714)

## Summary

- Refine the issue Truth Record workflow and add a read-only
pull-request scanning workflow.
- Split development tasks into focused references, add supported routes
for the SRS browser player and Dev Docker, and keep proxy verification
with its owning development workflow.
- Expand the trusted code maps for vendored C++ media dependencies and
clarify the in-process FFmpeg Fit versus external FFmpeg CLI integration
paths.
- Add Oryx documentation routing, a dedicated support workflow and
overview, and FAQ-grounded troubleshooting for deployment, HTTPS,
authentication, persistent data, recording to local or S3-compatible
storage, restreaming, virtual live, cameras, transcoding, and AI
features.

This pull request changes AI skills and their documentation only; it
does not change SRS runtime behavior.

---------

Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

## Summary

- Upgrade pinned GitHub, Docker, release, and retry actions.
- Upload release assets with the GitHub CLI and configure releases for
SRS 8.0.
- Remove Aliyun image publishing and the legacy server-update jobs while
preserving test and Docker release gating.
- Add the README AI Agent section and list the v7.0-d0 and v6.0-r1
releases.
- Record the verified resolution and FFmpeg 8 limitation for #4410, and
remove the unsupported documentation entry from the development router.

---------

Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

## Summary

- Update the vendored
[json-parser](https://github.com/json-parser/json-parser) implementation
in `srs_protocol_json.cpp` from the verified upstream revisions for
`json.h` and `json.c`.
- Record the upstream repository, per-file revisions, dates, and
synchronization date so future AI-assisted maintenance can determine
whether another update is needed.
- Scope Clang's deprecated-declaration warning suppression to the
vendored block, preserving the upstream parser code while eliminating
the macOS `sprintf` warnings.
- Improve the local AI setup documentation by clarifying the related
Oryx and Dev Docker repositories and reorganizing the agent guidance.

---------

Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Count primary media-frame observations instead of every RTP packet,
exclude RTX and FEC traffic, and expose stream lifetime for FPS
calculation. Add regression coverage for frame classification and the
stream alive field.
    
---------
    
Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

…#4718)

## Summary

- Preserve end-to-end backend response headers for HTTP-FLV, HTTP-TS,
and HLS responses.
- Remove standard hop-by-hop headers and additional fields nominated by
`Connection`.
- Rewrite HLS segment URLs with a canonical single `&` when the original
URL already has query parameters.
- Repair response metadata after modifying an m3u8 body, and add
wire-level regression coverage.

## Problem

The HTTP proxy called `WriteHeader` before copying headers from the
backend. Go commits the response at that point, so later additions such
as `Content-Type`, `Cache-Control`, `ETag`, `Last-Modified`, `Vary`, and
custom origin metadata never reached the downstream client.

HLS playlist rewriting also generated segment URLs containing an
unnecessary empty query component:

```text
segment.ts?spbhid=xxx&&token=abc
```

Moving header copying before `WriteHeader` is not sufficient by itself.
An m3u8 playlist is modified when the proxy inserts `spbhid`, so the
backend's original `Content-Length`, strong `ETag`, digest, content
encoding, and range metadata no longer describe the downstream
representation. Forwarding the stale length can make Go reject the
enlarged response with `http: wrote more than the declared
Content-Length`.

A proxy must also avoid forwarding connection-specific headers to the
next hop.

## Changes

- Copy backend end-to-end headers before committing HTTP-FLV, HTTP-TS,
and HLS responses.
- Strip `Connection`, its nominated fields, and the standard
proxy/connection-specific header set.
- Keep byte-transparent FLV and TS representation metadata unchanged.
- Read and rewrite m3u8 playlists before sending response headers.
- Recompute `Content-Length` and remove stale validators, digests,
encodings, and range metadata when the playlist body changes.
- Generate existing-query segment URLs as:

  ```text
  segment.ts?spbhid=xxx&token=abc
  ```

- Add real HTTP-boundary tests for header preservation, hop-by-hop
removal, query rewriting, complete playlist delivery, and rewritten-body
metadata.

---------

Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

Inform the assembler that we don't need an executable stack

SRS works normally without this change, so this is not a functional bug fix. It is a Linux security-hardening improvement.

SRS includes hand-written State Threads assembly. Without a .note.GNU-stack declaration, the linker may assume that these assembly objects require an executable process stack. This can produce linker or packaging warnings and may cause the final SRS binary to have an executable stack.

The assembly code does not execute code from the stack, so marking it as non-executable is correct. This restores an important defense-in-depth mitigation: if SRS ever has a memory-corruption vulnerability, an attacker should not be allowed to execute injected code directly from the stack.

Therefore, this PR is worth merging because it:
* improves the security properties of the Linux binary;
* avoids executable-stack warnings from modern toolchains and distributions;
* accurately describes the requirements of the assembly code;
* has no expected effect on normal SRS behavior or performance.

This PR does not fix a known exploitable vulnerability, but it removes an unnecessary security weakness with a small and low-risk change.

---------

Co-authored-by: Winlin <[email protected]>
Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

…ct. v8.0.22 (#4721)

## Summary

Fixes #4719.

For deployments using an external SIP server, `POST /gb/v1/publish/`
reserves a stream ID and SSRC. SRS previously retained that session
after the active RTP/PS-over-TCP publisher disconnected, so publishing
the same ID or SSRC again returned `StreamBusy`. API-created sessions
that never established a media connection could also remain reserved.

This PR:

- ends the GB28181 session when its active media TCP connection closes,
releasing the ID, SSRC, and associated media resources;
- ignores disconnects from stale transports after the session has
switched to another connection;
- expires API-created sessions that do not bind a media connection
within the media-connect timeout;
- adds reusable external-SIP session/publisher helpers and focused
timeout and TCP-disconnect E2E tests;
- sends valid RTP/PS with ADTS AAC from the mock publisher; and
- documents the required C++ media-server maintenance verification
workflow.

The source branch also contains a small cleanup of repository
synchronization helper scripts.

## Verification

- `skills/srs-develop/scripts/gb28181-api-timeout-test.sh`
- `skills/srs-develop/scripts/gb28181-tcp-disconnect-test.sh`
- `./objs/srs_utest` — 2,252 tests passed

---------

Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

…4723)

## Problem

The `SrsSharedPtrMessage` to `SrsMediaPacket` refactor stopped carrying
each RTMP packet's preferred chunk stream ID (CSID). SRS then selected a
CSID only from the RTMP message type.

That fallback is insufficient because all AMF0 commands share message
type 20 even though connection commands and stream commands use
different CSIDs. It also sent protocol-control messages on CSID 3
instead of the protocol-required CSID 2. Strict clients such as Larix
Broadcaster may fail during RTMP connection setup.

| Packet | Expected CSID | Before this fix |
| --- | ---: | ---: |
| `SrsSetChunkSizePacket` | 2 | 3 |
| `SrsSetPeerBandwidthPacket` | 2 | 3 |
| `SrsConnectAppResPacket` | 3 | 5 |
| `SrsOnBWDonePacket` | 3 | 5 |
| `SrsPublishPacket` | 5 | 5 |
| `SrsPlayPacket` | 5 | 5 |

Related report and packet captures: #4683.

## Root cause

The packet-specific preferred CSID was lost between `SrsRtmpCommand`,
`SrsMessageHeader`, and `SrsMediaPacket`. Once lost, the chunk writer
could not distinguish NetConnection commands from NetStream commands.

---------

Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

…0.24 (#4660)

Replace the final deprecated `io/ioutil` use in the WebRTC proxy with
`io.ReadAll` and remove the obsolete import.

---------

Co-authored-by: Winlin <[email protected]>

This PR improves the VS Code development workflow for SRS:

- Prevents GDB from stopping on `SIGPIPE` during C++ debugging.
- Makes VS Code build tasks automatically configure CMake when
`cmake/build/CMakeCache.txt` is missing.
- Keeps the debug/build configuration usable from a fresh checkout
without manually entering `cmake/build` first.

---------

Co-authored-by: haibo.chen(陈海博) <[email protected]>
Co-authored-by: winlin <[email protected]>

## Problem

`ParseBody` in `internal/utils/utils.go` defers `r.Close()` only after
`io.ReadAll(r)` succeeds. If `io.ReadAll` returns an error, the function
returns before registering the deferred close, so the request/body
reader is left open.

```go
func ParseBody(r io.ReadCloser, v interface{}) error {
    b, err := io.ReadAll(r)
    if err != nil {
        return errors.Wrapf(err, "read body") // r is not closed on this path
    }
    defer r.Close()
```

## Solution

Move `defer r.Close()` to the top of `ParseBody`, before reading the
body, so all return paths close the reader.

```go
func ParseBody(r io.ReadCloser, v interface{}) error {
    defer r.Close()

    b, err := io.ReadAll(r)
```

---------

Co-authored-by: Jacob Su <[email protected]>
Co-authored-by: winlin <[email protected]>

…4638)

This PR updates the SRS HTML5 player to support browsers with native HLS
playback, especially iOS Safari.

The previous HLS path treated `Hls.isSupported()` as the only capability
check. That is incorrect for Safari on iOS: hls.js depends on MSE, while
iOS Safari can play HLS directly with the native `<video>` element.

---------

Co-authored-by: winlin <[email protected]>
Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>

…4726)

Fix #4690

- Require `SRS_HTTP_API_AUTH_TYPE` when SRS HTTP API authentication is
enabled.
- Add Bearer token authentication for the SRS HTTP API while preserving
Basic authentication.
- Add Bearer authentication for proxy origin registration with
`PROXY_HTTP_API_AUTH_*`.
- Allow SRS heartbeat requests to authenticate to the proxy with
`SRS_HEARTBEAT_AUTH_*`.
- Add unit tests, an end-to-end Bearer authentication test,
documentation, and separate Basic/Bearer sample configurations.

---------

Co-authored-by: chatgpt-codex-connector[bot] <199175422+chatgpt-codex-connector[bot]@users.noreply.github.com>