fixes lol

backend/src/controllers/AudioController.cpp

@@ -115,8 +115,8 @@ namespace {
             return "";
         }
 
-        // Compute 200 peaks from samples
-        const int numPeaks = 200;
+        // Compute 500 peaks from samples for finer waveform detail
+        const int numPeaks = 500;
         std::vector<float> peaks(numPeaks, 0.0f);
         size_t samplesPerPeak = samples.size() / numPeaks;
         if (samplesPerPeak == 0) samplesPerPeak = 1;

backend/src/controllers/PyramidController.cpp

@@ -15,6 +15,8 @@ std::mutex PyramidWebSocketController::connectionsMutex_;
 // ==================== Validation Helpers ====================
 
 bool PyramidController::isValidPixelPosition(int faceId, int x, int y) {
+    constexpr int FACE_SIZE = 200;
+
     // Face ID must be 0-4
     if (faceId < 0 || faceId > 4) return false;
 
@@ -673,7 +675,25 @@ void PyramidWebSocketController::handlePlacePixel(const WebSocketConnectionPtr &
     int y = msg["y"].asInt();
     std::string color = msg["color"].asString();
 
+    // Validate pixel position
+    if (!PyramidController::isValidPixelPosition(faceId, x, y)) {
+        Json::Value error;
+        error["type"] = "error";
+        error["message"] = "Invalid pixel position";
+        Json::StreamWriterBuilder builder;
+        wsConnPtr->send(Json::writeString(builder, error));
+        return;
+    }
+
     // Validate and uppercase color
+    if (!PyramidController::isValidColor(color)) {
+        Json::Value error;
+        error["type"] = "error";
+        error["message"] = "Invalid color format (use #RRGGBB)";
+        Json::StreamWriterBuilder builder;
+        wsConnPtr->send(Json::writeString(builder, error));
+        return;
+    }
     std::transform(color.begin(), color.end(), color.begin(), ::toupper);
 
     // Use the REST endpoint logic for actual placement

backend/src/controllers/PyramidController.h

@@ -56,12 +56,13 @@ public:
                          const std::string &x,
                          const std::string &y);
 
+    // Static validation methods (also used by WebSocket controller)
+    static bool isValidPixelPosition(int faceId, int x, int y);
+    static bool isValidColor(const std::string &color);
+
 private:
     static constexpr int DAILY_PIXEL_LIMIT = 1000;
     static constexpr int FACE_SIZE = 200;
-
-    bool isValidPixelPosition(int faceId, int x, int y);
-    bool isValidColor(const std::string &color);
 };
 
 // WebSocket controller for real-time pixel updates

backend/src/services/RestreamService.cpp

@@ -16,6 +16,12 @@ std::string RestreamService::getBaseUrl() {
     return "http://ovenmediaengine:8081";
 }
 
+// Use openresty proxy for push operations to avoid URL encoding issues
+// Drogon encodes ':' as '%3A' but OME expects literal colon in path
+std::string RestreamService::getPushProxyUrl() {
+    return "http://openresty:80";
+}
+
 std::string RestreamService::getApiToken() {
     const char* envToken = std::getenv("OME_API_TOKEN");
     if (!envToken || strlen(envToken) == 0) {
@@ -28,6 +34,10 @@ HttpClientPtr RestreamService::getClient() {
     return HttpClient::newHttpClient(getBaseUrl());
 }
 
+HttpClientPtr RestreamService::getPushProxyClient() {
+    return HttpClient::newHttpClient(getPushProxyUrl());
+}
+
 HttpRequestPtr RestreamService::createRequest(HttpMethod method, const std::string& path) {
     auto request = HttpRequest::newHttpRequest();
     request->setMethod(method);
@@ -106,12 +116,13 @@ void RestreamService::startPush(const std::string& sourceStreamKey, const Restre
     body["protocol"] = "rtmp";
     body["url"] = fullUrl;
 
-    // Use Drogon HttpClient instead of curl for security
-    auto request = createJsonRequest(drogon::Post, "/v1/vhosts/default/apps/app:startPush", body);
+    // Use openresty proxy to avoid URL encoding issues with colon in path
+    // Drogon encodes ':' as '%3A' but OME expects literal colon
+    auto request = createJsonRequest(drogon::Post, "/ome-internal/push/start", body);
 
-    LOG_INFO << "Sending HTTP request for push start";
+    LOG_INFO << "Sending HTTP request for push start via proxy";
 
-    getClient()->sendRequest(request,
+    getPushProxyClient()->sendRequest(request,
         [this, callback, pushId, sourceStreamKey, destId](ReqResult result, const HttpResponsePtr& response) {
             if (result != ReqResult::Ok || !response) {
                 std::string error = "Failed to connect to OME API";
@@ -187,12 +198,12 @@ void RestreamService::stopPush(const std::string& sourceStreamKey, int64_t desti
     Json::Value body;
     body["id"] = pushId;
 
-    // Use Drogon HttpClient instead of curl for security
-    auto request = createJsonRequest(drogon::Post, "/v1/vhosts/default/apps/app:stopPush", body);
+    // Use openresty proxy to avoid URL encoding issues with colon in path
+    auto request = createJsonRequest(drogon::Post, "/ome-internal/push/stop", body);
 
-    LOG_INFO << "Sending HTTP request for push stop";
+    LOG_INFO << "Sending HTTP request for push stop via proxy";
 
-    getClient()->sendRequest(request,
+    getPushProxyClient()->sendRequest(request,
         [this, callback, pushId, sourceStreamKey, destinationId](ReqResult result, const HttpResponsePtr& response) {
             // Remove from tracking regardless of result
             {

backend/src/services/RestreamService.h

@@ -57,8 +57,10 @@ private:
     RestreamService& operator=(const RestreamService&) = delete;
 
     std::string getBaseUrl();
+    std::string getPushProxyUrl();  // Openresty proxy for push API (avoids URL encoding issues)
     std::string getApiToken();
     drogon::HttpClientPtr getClient();
+    drogon::HttpClientPtr getPushProxyClient();  // Client for push proxy
     drogon::HttpRequestPtr createRequest(drogon::HttpMethod method, const std::string& path);
     drogon::HttpRequestPtr createJsonRequest(drogon::HttpMethod method, const std::string& path,
                                               const Json::Value& body);