[Proposal] DRM: add failOnEncryptedAfterClear keySystems option

An application reported to us an issue where they couldn't play a
content of mixed clear and encrypted contents on PlayReady devices.

After a LOT of attempts at work-arounds, some of them described
[here](#1403), we didn't
succeed to actually find a good solution that would both allow smooth
transition between Periods and a mix of encrypted unencrypted content.

So I attempted to play the same content with other players:

  - dash.js didn't had a smooth transition between Periods here, it
    first loaded and played the clear content, then once finished loaded
    and played the encrypted content with a black screen and license
    request in-between.

  - The shaka-player failed to play the content, I tried to debug it but
    I did not succeed to make it play the content.

This is very probably an issue with PlayReady, yet they historically
haven't been quick to fix issues we reported, so we may have to provide
a perhaps-temporary solution here.

That's why I'm introducing the for-now undocumented (and experimental
feature?) `keySystems[].failOnEncryptedAfterClear` `loadVideo` option.

When set to `true`, we'll reload if an encrypted Period is encountered
after a clear Period has been played. The logic for now is not perfect
with very rare risks of false negatives.

src/core/main/worker/worker_main.ts

@@ -473,6 +473,19 @@ interface IBufferingInitializationInformation {
    * optimizations.
    */
   drmSystemId: string | undefined;
+  /**
+   * If `true`, protection data as found in the content can be manipulated so
+   * e.g. only the data linked to the given systemId may be communicated.
+   *
+   * If `false` the full extent of the protection data, in exactly the way it
+   * has been found in the content, should be communicated.
+   */
+  canFilterProtectionData: boolean;
+  /**
+   * If `true`, the current device is known to not be able to begin playback of
+   * encrypted content if there's already clear content playing.
+   */
+  failOnEncryptedAfterClear: boolean;
   /**
    * Enable/Disable fastSwitching: allow to replace lower-quality segments by
    * higher-quality ones to have a faster transition.
@@ -523,7 +536,14 @@ function loadOrReloadPreparedContent(
     segmentSinksStore,
     segmentFetcherCreator,
   } = preparedContent;
-  const { drmSystemId, enableFastSwitching, initialTime, onCodecSwitch } = val;
+  const {
+    canFilterProtectionData,
+    failOnEncryptedAfterClear,
+    drmSystemId,
+    enableFastSwitching,
+    initialTime,
+    onCodecSwitch,
+  } = val;
   playbackObservationRef.onUpdate((observation) => {
     if (preparedContent.decipherabilityFreezeDetector.needToReload(observation)) {
       handleMediaSourceReload({
@@ -602,6 +622,8 @@ function loadOrReloadPreparedContent(
       maxVideoBufferSize,
       maxBufferAhead,
       maxBufferBehind,
+      canFilterProtectionData,
+      failOnEncryptedAfterClear,
       drmSystemId,
       enableFastSwitching,
       onCodecSwitch,
@@ -884,6 +906,8 @@ function loadOrReloadPreparedContent(
           {
             initialTime: newInitialTime,
             drmSystemId: val.drmSystemId,
+            canFilterProtectionData: val.canFilterProtectionData,
+            failOnEncryptedAfterClear: val.failOnEncryptedAfterClear,
             enableFastSwitching: val.enableFastSwitching,
             onCodecSwitch: val.onCodecSwitch,
           },

src/core/stream/adaptation/adaptation_stream.ts

@@ -441,6 +441,7 @@ export default function AdaptationStream(
           bufferGoal,
           maxBufferSize,
           drmSystemId: options.drmSystemId,
+          canFilterProtectionData: options.canFilterProtectionData,
           fastSwitchThreshold,
         },
       },

src/core/stream/adaptation/types.ts

@@ -188,6 +188,14 @@ export interface IAdaptationStreamOptions {
    * those devices.
    */
   enableFastSwitching: boolean;
+  /**
+   * If `true`, protection data as found in the content can be manipulated so
+   * e.g. only the data linked to the given systemId may be communicated.
+   *
+   * If `false` the full extent of the protection data, in exactly the way it
+   * has been found in the content, should be communicated.
+   */
+  canFilterProtectionData: boolean;
 }
 
 /** Object indicating a choice of Adaptation made by the user. */

src/core/stream/orchestrator/stream_orchestrator.ts

@@ -23,6 +23,7 @@ import type {
   IPeriod,
 } from "../../../manifest";
 import type { IReadOnlyPlaybackObserver } from "../../../playback_observer";
+import type { ITrackType } from "../../../public_types";
 import isNullOrUndefined from "../../../utils/is_null_or_undefined";
 import queueMicrotask from "../../../utils/queue_microtask";
 import type { IReadOnlySharedReference } from "../../../utils/reference";
@@ -109,6 +110,22 @@ export default function StreamOrchestrator(
     MAXIMUM_MAX_BUFFER_BEHIND,
   } = config.getCurrent();
 
+  // Some DRM issues force us to check whether we're initially pushing clear
+  // segments.
+  //
+  // NOTE: Theoretically `initialPeriod` may not be the first Period for
+  // which we push segments (e.g. we may have a small seek which lead to
+  // another Period being streamed instead).
+  // This means that we could have an issue if `initialPeriod` leads to encrypted
+  // content, but the actually first-pushed segments do not. Here
+  // `shouldReloadOnEncryptedContent` would be set to `false` despiste the fact
+  // that it should be set to `true`.
+  // Yet, checking the first Period for which we pushed segments seems very hard,
+  // and all that for what is now (2024-07-31) a PlayReady bug, I don't have the
+  // will.
+  const shouldReloadOnEncryptedContent =
+    options.failOnEncryptedAfterClear && !hasEncryptedContentInPeriod(initialPeriod);
+
   // Keep track of a unique BufferGarbageCollector created per
   // SegmentSink.
   const garbageCollectors = new WeakMapMemory((segmentSink: SegmentSink) => {
@@ -449,6 +466,27 @@ export default function StreamOrchestrator(
   ): void {
     log.info("Stream: Creating new Stream for", bufferType, basePeriod.start);
 
+    if (shouldReloadOnEncryptedContent) {
+      const trackType = hasEncryptedContentInPeriod(basePeriod);
+      if (trackType !== null) {
+        playbackObserver.listen((pos) => {
+          if (pos.position.getWanted() > basePeriod.start - 0.01) {
+            callbacks.needsMediaSourceReload({
+              timeOffset: 0,
+              minimumPosition: basePeriod.start,
+              maximumPosition: basePeriod.end,
+            });
+          } else {
+            callbacks.lockedStream({
+              period: basePeriod,
+              bufferType: trackType,
+            });
+          }
+        });
+        return;
+      }
+    }
+
     /**
      * Contains properties linnked to the next chronological `PeriodStream` that
      * may be created here.
@@ -656,6 +694,11 @@ export type IStreamOrchestratorOptions = IPeriodStreamOptions & {
   maxVideoBufferSize: IReadOnlySharedReference<number>;
   maxBufferAhead: IReadOnlySharedReference<number>;
   maxBufferBehind: IReadOnlySharedReference<number>;
+  /**
+   * If `true`, the current device is known to not be able to begin playback of
+   * encrypted content if there's already clear content playing.
+   */
+  failOnEncryptedAfterClear: boolean;
 };
 
 /** Callbacks called by the `StreamOrchestrator` on various events. */
@@ -760,6 +803,26 @@ export interface ILockedStreamPayload {
   bufferType: IBufferType;
 }
 
+/**
+ * If the given Period has at least one Representation which is known to be
+ * encrypted, returns the related track type.
+ *
+ * Else if the Period is fully clear or if the status is unknown, return `null`.
+ *
+ * @param {Object} period
+ * @returns {string|null}
+ */
+function hasEncryptedContentInPeriod(period: IPeriod): ITrackType | null {
+  for (const adaptation of period.getAdaptations()) {
+    for (const representation of adaptation.representations) {
+      if (representation.contentProtections !== undefined) {
+        return adaptation.type;
+      }
+    }
+  }
+  return null;
+}
+
 /**
  * Returns `true` if low-level buffers have to be "flushed" after the given
  * `cleanedRanges` time ranges have been removed from an audio or video

src/core/stream/representation/representation_stream.ts

@@ -94,7 +94,13 @@ export default function RepresentationStream<TSegmentDataType>(
   parentCancelSignal: CancellationSignal,
 ): void {
   const { period, adaptation, representation } = content;
-  const { bufferGoal, maxBufferSize, drmSystemId, fastSwitchThreshold } = options;
+  const {
+    bufferGoal,
+    maxBufferSize,
+    drmSystemId,
+    canFilterProtectionData,
+    fastSwitchThreshold,
+  } = options;
   const bufferType = adaptation.type;
 
   /** `TaskCanceller` stopping ALL operations performed by the `RepresentationStream` */
@@ -148,7 +154,7 @@ export default function RepresentationStream<TSegmentDataType>(
   // If the DRM system id is already known, and if we already have encryption data
   // for it, we may not need to wait until the initialization segment is loaded to
   // signal required protection data, thus performing License negotiations sooner
-  if (drmSystemId !== undefined) {
+  if (canFilterProtectionData && drmSystemId !== undefined) {
     const encryptionData = representation.getEncryptionData(drmSystemId);
 
     // If some key ids are not known yet, it may be safer to wait for this initialization

src/core/stream/representation/types.ts

@@ -323,6 +323,14 @@ export interface IRepresentationStreamOptions {
    * `0` can be emitted to disable any kind of fast-switching.
    */
   fastSwitchThreshold: IReadOnlySharedReference<undefined | number>;
+  /**
+   * If `true`, protection data as found in the content can be manipulated so
+   * e.g. only the data linked to the given systemId may be communicated.
+   *
+   * If `false` the full extent of the protection data, in exactly the way it
+   * has been found in the content, should be communicated.
+   */
+  canFilterProtectionData: boolean;
 }
 
 /** Object indicating a choice of allowed Representations made by the user. */