Laravel and Node.js integrations

The three places you customize#

1. Configureconfig/drmx.php and server environment

   Set credentials, a stable instance ID and default policy.

2. Authorizeapp/Services/DrmxAccess.php

   Implement ContentAuthorizer using current permissions.

3. Registerapp/Providers/AppServiceProvider.php

   Bind your authorizer; the default denies access.

1. Install the bundled Composer packages#

Use your existing Laravel application (Laravel 12 is the tested path), PHP 8.2+ with cURL and ZIP. Add this artifact repository and dependency to its composer.json, preserving existing entries:

{
  "repositories": [{"type": "artifact", "url": "/absolute/path/to/kit/packages/composer"}],
  "require": {"haihaisoft/drmx-laravel": "1.3.0-RC13"},
  "minimum-stability": "RC",
  "prefer-stable": true
}

composer update haihaisoft/drmx-laravel --with-dependencies
php artisan vendor:publish --tag=drmx-config

Both the PHP core and Laravel ZIPs are included in the platform kit. Configure DRMX_SITE_ID, DRMX_SITE_KEY and DRMX_ACCESS_KEY. Refresh Laravel’s config cache after changing deployment settings. This package loads no migrations.

2. Implement your permission check#

Create the service below in your application. Replace customerFindAuthorizedVideo with your own query; it must check this user’s current permission.

namespace App\Services;
use Haihaisoft\Drmx\Contracts\ContentAuthorizer;
use Illuminate\Contracts\Auth\Authenticatable;

final class DrmxAccess implements ContentAuthorizer {
    public function authorize(Authenticatable $user, string $videoId): ?array {
        $video = customerFindAuthorizedVideo($user->getAuthIdentifier(), $videoId);
        if ($video === null) return null;
        return ['content_id' => $video->drmx_content_id,
                'content_type' => 'vod', 'title' => $video->title];
    }
}

Register it in AppServiceProvider::register():

$this->app->bind(
    \Haihaisoft\Drmx\Contracts\ContentAuthorizer::class,
    \App\Services\DrmxAccess::class
);

Return null for missing or denied access. A first local test can restrict access to one test account and one video before returning a fixed Content ID. Replace that rule with your business query before deployment.

3. Use your normal Laravel login#

Sign in and open /drmx/videos/lesson-123. The adapter supplies the authenticated routes and player page, rechecks your authorizer on session requests and retains Laravel CSRF protection. Keep the endpoint query string out of access logs. An older database-backed installation must preserve its historical migrations; see legacy/README.md.

Using Node.js instead?#

Follow the Express SDK tutorial. Its equivalent extension point is authorize(userId, videoId).

React, Next.js and Vue#

Download frontend components

Choose an authenticated backend first. Copy DrmxPlayer.tsx for React/Next.js or DrmxPlayer.vue for Vue, together with runtime.mjs and runtime.d.mts. Pass the authorized contentId, contentType and same-origin sessionEndpoint. Preserve the video selector and CSRF token in that URL.

The components load the pinned player scripts. Your server still verifies the selected content and user; browser props do not grant access.

Check before going live#

• Sign in as an allowed user and play a published video in a supported browser.
• Try signed-out and unpaid users, then revoke or expire access. New session requests must be denied.
• Change the browser Content ID or website video ID. The server must check the new selection.
• Set the exact public HTTPS origin, keep your framework’s session/CSRF protection, and disable demo identity code.

Existing sessions and DRM licenses have their own lifetimes. Permission changes are checked on new requests; they do not erase a license already issued.