package qobuz import ( "context" "errors" "fmt" "net" "net/http" "net/url" "sync/atomic" "time" "github.com/bjarneo/cliamp/applog" "github.com/bjarneo/cliamp/internal/browser" ) // authURLObserver is invoked with the OAuth URL when interactive auth begins. // Used by the TUI to display the URL when the launched browser does not reach // the user (containers, headless environments). var authURLObserver atomic.Pointer[func(string)] // SetAuthURLObserver registers a callback invoked once with the OAuth URL at // the start of an interactive sign-in. Pass nil to remove. func SetAuthURLObserver(fn func(string)) { if fn == nil { authURLObserver.Store(nil) return } authURLObserver.Store(&fn) } func notifyAuthURL(u string) { applog.Info("qobuz: sign-in URL: %s", u) if p := authURLObserver.Load(); p != nil { (*p)(u) } } // oauthResult holds the data captured from a Qobuz OAuth redirect. type oauthResult struct { Token string UserID string Code string } // newClientSilent builds an authenticated client from stored credentials only. // It never opens a browser; if no usable credentials exist it returns an error. func newClientSilent(ctx context.Context) (*client, error) { creds, err := loadCreds() if err != nil { return nil, fmt.Errorf("qobuz: no stored credentials: %w", err) } if creds.AppID == "" || creds.UserAuthToken == "" { return nil, fmt.Errorf("qobuz: incomplete stored credentials") } c := newClient(creds.AppID, creds.Secrets) c.secret = creds.Secret c.uat = creds.UserAuthToken c.userID = creds.UserID c.label = creds.Label if err := c.authWithToken(ctx, creds.UserID, creds.UserAuthToken); err != nil { return nil, fmt.Errorf("qobuz: stored token rejected: %w", err) } if c.secret == "" { if err := c.validateSecret(ctx); err != nil { return nil, err } } // Re-persist in case the validated secret or label changed. _ = saveCreds(credsFromClient(c, creds.PrivateKey)) return c, nil } // newClientInteractive scrapes fresh credentials from the Qobuz web player and // runs the interactive OAuth browser flow, persisting the result on success. func newClientInteractive(ctx context.Context) (*client, error) { appID, secrets, privateKey, err := scrapeCredentials(ctx) if err != nil { return nil, fmt.Errorf("qobuz: scrape credentials: %w", err) } c := newClient(appID, secrets) // OAuth first: the secret-validation probe (track/getFileUrl) is an // authenticated endpoint and fails without a user_auth_token, so the // browser sign-in must complete before validateSecret runs. result, err := captureOAuthRedirect(ctx, appID) if err != nil { return nil, err } if err := c.loginWithOAuth(ctx, result, privateKey); err != nil { return nil, fmt.Errorf("qobuz: OAuth login: %w", err) } if err := c.validateSecret(ctx); err != nil { return nil, err } if err := saveCreds(credsFromClient(c, privateKey)); err != nil { applog.UserError("qobuz: failed to save credentials: %v", err) } return c, nil } func credsFromClient(c *client, privateKey string) *storedCreds { return &storedCreds{ AppID: c.appID, Secrets: c.secrets, Secret: c.secret, PrivateKey: privateKey, UserAuthToken: c.uat, UserID: c.userID, Label: c.label, } } // oauthCallbackHTML is shown in the browser once the redirect is captured. const oauthCallbackHTML = ` cliamp

Signed in to Qobuz

You can close this tab now.

` // captureOAuthRedirect starts a local HTTP server on a random port, opens the // Qobuz OAuth URL in the browser, and waits for the redirect carrying the // token or code. Qobuz accepts any localhost redirect_url, so a random port is // fine. func captureOAuthRedirect(ctx context.Context, appID string) (oauthResult, error) { lis, err := net.Listen("tcp", "127.0.0.1:0") if err != nil { return oauthResult{}, fmt.Errorf("qobuz: open local port: %w", err) } defer lis.Close() port := lis.Addr().(*net.TCPAddr).Port // Qobuz validates the redirect_url host server-side and only accepts // "localhost" (not 127.0.0.1). We still bind 127.0.0.1 below; browsers // fall back from localhost ([::1]) to 127.0.0.1, so the capture works. // This matches the proven SofusA/qobine reference flow. // // Note: after authorizing, Qobuz shows a "you are signed in, you can leave // this page" screen with a Back button rather than redirecting back. The // user must click Back to fire the redirect (see docs/qobuz.md). This is // Qobuz's behavior; URL-encoding the redirect_url does not change it. authURL := fmt.Sprintf( "https://www.qobuz.com/signin/oauth?ext_app_id=%s&redirect_url=http://localhost:%d", appID, port, ) notifyAuthURL(authURL) resultCh := make(chan oauthResult, 1) srv := &http.Server{ Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { applog.Debug("qobuz: oauth redirect received: %s", r.URL.RequestURI()) res := parseQueryParams(r.URL.Query()) w.Header().Set("Content-Type", "text/html") _, _ = w.Write([]byte(oauthCallbackHTML)) if res.Token != "" || res.Code != "" { select { case resultCh <- res: default: } } else { applog.Debug("qobuz: oauth redirect had no token/code param") } }), } go func() { _ = srv.Serve(lis) }() defer func() { shutCtx, cancel := context.WithTimeout(context.Background(), 2*time.Second) defer cancel() _ = srv.Shutdown(shutCtx) }() _ = browser.Open(authURL) // best-effort; user can open the URL manually select { case res := <-resultCh: return res, nil case <-ctx.Done(): return oauthResult{}, fmt.Errorf("qobuz: authentication cancelled: %w", ctx.Err()) case <-time.After(5 * time.Minute): return oauthResult{}, errors.New("qobuz: timed out waiting for OAuth redirect") } } // parseQueryParams extracts token/code/user_id from a Qobuz redirect. Qobuz has // used several parameter names across auth flow versions. func parseQueryParams(params url.Values) oauthResult { var res oauthResult if t := params.Get("user_auth_token"); t != "" { res.Token = t } if t := params.Get("token"); t != "" && res.Token == "" { res.Token = t } if uid := params.Get("user_id"); uid != "" { res.UserID = uid } if code := params.Get("code_autorisation"); code != "" { // French spelling, Qobuz's actual param res.Code = code } if code := params.Get("code"); code != "" && res.Code == "" { res.Code = code } return res }