Laravel Media Viewer Laravel Package

Product Decisions This Supports

• Build vs. buy for private media/file delivery: This package covers the unglamorous plumbing — HTTP Range requests, HLS playlist responses, security headers, and disk-agnostic delivery — that would otherwise be hand-rolled per project. That is a "buy" (adopt) decision unless requirements include edge-level CDN auth or DRM.
• Feature viability for media use cases: Range support plus HLS handling makes authenticated video/audio streaming, course platforms, podcast hosting, and private media libraries feasible without a separate media service. The v0.1.1 fix — HLS playlist responses now carry the same Content-Security-Policy: sandbox and Cross-Origin-Resource-Policy headers as all other files — removes a real inconsistency that could have caused security review friction or inconsistent browser behavior between playlist and segment requests.
• Storage architecture decisions: The README clarifications matter for roadmap. URLs are scoped to the user only when signed in; Range savings apply between browser and app; non-seekable remote streams are read up to the offset; and redirect mode works with any disk exposing temporary URLs. This directly informs whether S3-backed media is served as a redirect (cheaper, offloads egress from the app) or proxied (needed for non-seekable sources or where temporary URLs are unavailable).
• Bandwidth/cost planning: The documented redirect mode for S3 is a cost lever — it avoids piping bytes through PHP for remote disks. That is a decision input for infrastructure budgeting, not just implementation detail.
• Release maturity tracking: This is a 0.x package at v0.1.1. A patch release that fixes a header-parity bug and tightens docs signals active maintenance but also pre-1.0 API instability. Roadmap should treat adoption as a time-boxed evaluation or isolate usage behind an abstraction rather than betting a flagship feature on a frozen API.

When to Consider This Package

Consider adoption when:

• A Laravel app must serve private files to authenticated users and you need correct Range/partial-content behavior rather than a naive response()->download().
• You are shipping HLS or progressive media and want consistent security headers across playlists and segments.
• You use multiple disks (local and S3-compatible) and want one delivery path, with redirect mode available where temporary URLs exist.
• You want the browser↔app Range behavior documented up front, especially where upstream sources are non-seekable.
• You can tolerate pre-1.0 versioning and are willing to pin versions and re-review on minor releases.

Look elsewhere when:

• You need DRM, transcoding, or adaptive-bitrate packaging — this is a delivery layer, not a media pipeline.
• You need CDN-edge authorization (signed cookies/tokens at the edge) rather than app-mediated auth.
• You require a stable 1.0+ API contract for a long-lived, high-traffic core path, or you operate outside Laravel/PHP.
• Your throughput needs exceed what a PHP request path can reasonably serve — redirect mode helps, but full proxy mode remains app-bound.
• You need guaranteed seekability for remote streams; the README explicitly notes non-seekable remote streams are read up to the offset, so those cases need a different source or redirect strategy.

How to Pitch It (Stakeholders)

For executives: This is a small, low-cost dependency that lets us deliver private video, audio, and files correctly — including range requests and HLS — without building and maintaining that plumbing ourselves. It has a cost angle: redirect mode lets S3-compatible storage serve bytes directly, reducing app bandwidth. The v0.1.1 patch closes a header-consistency gap for HLS playlists and clarifies auth and redirect behavior in the docs. Risk is modest but real: it is a 0.x package on a security-relevant path, so we should pin the version and gate adoption behind a limited rollout.

For engineering: Adopt it to avoid bespoke Range/HLS handling and to get uniform Content-Security-Policy: sandbox and Cross-Origin-Resource-Policy headers across all file responses, now including playlists. Use redirect mode for S3 or any disk with temporary URLs to keep bytes off the app; use proxied delivery where sources are non-seekable, accepting that reads go up to the requested offset. Validate the signed-in-only URL binding assumption against our auth model, pin to a specific 0.x version, and re-review on minor releases since the API is not yet frozen.