This module is available to use in your EdgeWorkers code bundles to perform operations related to forensic watermarking for Over-The-Top (OTT) content delivered in an Adaptive Bitrate (ABR) format. The watermarking module adheres to the DASH-IF watermarking specification. jwt and cwt modules are supported for token verification.

📘 Currently there is a known compatibility issue between partial object caching and the watermarking module. Reach out to your account team for more information.

You can use the watermarking module in both direct and indirect mode. For indirect mode, you need to obtain vendor specific wmid generator code and plug it into the module. Refer to the wm-indirect example in the EdgeWorkers GitHub repo for more details.

👍 To use the watermarking library you need to use EdgeWorkers Dynamic Compute resource tier.

Watermarking

Constructor for a new Watermarking Object. It performs type checks on the wmOptions Object parameters.

Watermarking(wmOptions: WMOptions,  vendorAlgorithms: Map<string,VendorAlgorithm> )

Throws an error if the type checks fail for the following wmOptions parameters.

WMOptions Object

vendorAlgorithms

A map with key as the vendor identifier. This should be the same as the wmvnd field from the watermarking token. The value should be an implementation of the vendor-algorithm interface shown below. Refer to the Indirect Watermarking example for more details.

/**
 * Abstract class to implement vendor specific algorithm to generate tmid.
 */
interface VendorAlgorithm {
    /**
     * Returns the generated WMID after executing vendor specific algorithm.
     * @param payload @instance of WMPaylaod.
     * @param secretKey key (if any) required to generate WMID. 
     * @returns WMID as hex string
     */
    generateTmid(payload: WMPayload, secretKey: string): Promise<string>;
}

validateToken

Validates the watermarking token as per the validation rules, performs signature verification for each key from the array. The token signature needs to be successfully verified by at least one key to consider the token as valid.

Returns a promise<WMJSON> upon successful verification of the token, otherwise throws an error.

validateToken( authToken: Uint8Array | string, keys: string[], keyAlg: string )

Throws a DOMException or a TypeError when trying to use invalid key data, when the key is not a supported key for the algorithm, or when trying to use an algorithm that is either unknown or isn’t suitable for a verify operation.

WMJSON

JSON object containing the header and payload.

WMPayload

Contains watermarking fields in addition to fields from the CWT and JWT payload. Refer to CWT or JWT payload for details about other fields.

getWMPathWithVariant

Executes the relevant vendor algorithm (indirect) or performs decryption (direct) to generate the watermarking variant. Once the wmid is obtained from the token (either directly, decrypted or calculated), the CDN edge enforces big-endian convention to address a single bit in it when using the value of position obtained from side car file.

The following is an example with a WM pattern equal to 0x0A0B0C0D.

For a value of position equal to 3, the bit to consider is highlighted in green (equal to 0). This is not any other bit,
especially, those highlighted in red.

Returns a promise<number> representing the computed watermarking variant.

getWMPathWithVariant(
    path: string,
    payload: WMPayload,
    secretKey: string,
    rangeHeader?: string
  ): Promise<number>

Throws an error if the type checks fails for the following parameters or if any validation check fails.

Throws a DOMException or a TypeError when trying to use invalid key data, when the key is not a supported key for the algorithm, or when trying to use an algorithm that is either unknown or isn’t suitable for a verify operation.