✅ Authenticated!
You can close this tab now.
`
// performOAuth2PKCE runs an OAuth2 PKCE flow: opens a browser for user consent,
// waits for the callback, and exchanges the code for a token.
func performOAuth2PKCE(ctx context.Context, clientID string) (*oauth2.Token, error) {
lis, err := net.Listen("tcp", fmt.Sprintf(":%d", CallbackPort))
if err != nil {
return nil, fmt.Errorf("listen on port %d: %w", CallbackPort, err)
}
defer lis.Close() // always release the port
oauthConf := spotifyOAuthConfig(clientID)
verifier := oauth2.GenerateVerifier()
authURL := oauthConf.AuthCodeURL("", oauth2.S256ChallengeOption(verifier))
notifyAuthURL(authURL)
codeCh := make(chan string, 1)
go func() {
if err := http.Serve(lis, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
code := r.URL.Query().Get("code")
if code != "" {
codeCh <- code
}
w.Header().Set("Content-Type", "text/html")
_, _ = w.Write([]byte(oauthCallbackHTML))
})); err != nil && !errors.Is(err, net.ErrClosed) {
applog.UserError("spotify: auth callback server error: %v", err)
}
}()
_ = browser.Open(authURL) // best-effort — user can open the URL manually if this fails
var code string
select {
case code = <-codeCh:
case <-ctx.Done():
return nil, fmt.Errorf("authentication cancelled: %w", ctx.Err())
}
token, err := oauthConf.Exchange(ctx, code, oauth2.VerifierOption(verifier))
if err != nil {
return nil, fmt.Errorf("token exchange: %w", err)
}
return token, nil
}
// doWebAPIAuth performs an OAuth2 PKCE flow to get a fresh Web API access token.
// Opens a browser for user consent, returns the full token (including refresh token).
func doWebAPIAuth(ctx context.Context, clientID string) (*oauth2.Token, error) {
token, err := performOAuth2PKCE(ctx, clientID)
if err != nil {
return nil, err
}
fmt.Println("Spotify: Web API token refreshed.")
return token, nil
}
func newInteractiveSession(ctx context.Context, clientID string) (*Session, error) {
devID := generateDeviceID()
token, err := performOAuth2PKCE(ctx, clientID)
if err != nil {
return nil, fmt.Errorf("spotify: %w", err)
}
username, _ := token.Extra("username").(string)
accessToken := token.AccessToken
// Create go-librespot session using the OAuth2 token.
sess, err := session.NewSessionFromOptions(ctx, &session.Options{
Log: &librespot.NullLogger{},
DeviceType: devicespb.DeviceType_COMPUTER,
DeviceId: devID,
Credentials: session.SpotifyTokenCredentials{
Username: username,
Token: accessToken,
},
})
if err != nil {
return nil, fmt.Errorf("spotify: session from token: %w", err)
}
// Persist stored credentials + refresh token for future sessions.
if err := saveCreds(&storedCreds{
Username: sess.Username(),
Data: sess.StoredCredentials(),
DeviceID: devID,
RefreshToken: token.RefreshToken,
}); err != nil {
applog.UserError("spotify: failed to save credentials: %v", err)
}
// Create an auto-refreshing token source for Web API calls.
conf := spotifyOAuthConfig(clientID)
ts := conf.TokenSource(context.Background(), token)
s := &Session{sess: sess, devID: devID, clientID: clientID, tokenSource: ts}
if err := s.initPlayer(); err != nil {
sess.Close()
return nil, err
}
return s, nil
}
// initPlayer creates the go-librespot player. We only use NewStream() for
// decoded AudioSources — audio output is routed through cliamp's Beep pipeline,
// not go-librespot's output backend.
func (s *Session) initPlayer() error {
// go-librespot uses this for media restriction checks but Premium
// accounts can play all tracks regardless.
countryCode := "US"
p, err := librespotPlayer.NewPlayer(&librespotPlayer.Options{
Spclient: s.sess.Spclient(),
AudioKey: s.sess.AudioKey(),
Events: s.sess.Events(),
Log: &librespot.NullLogger{},
CountryCode: &countryCode,
NormalisationEnabled: true,
AudioBackend: "pipe",
AudioOutputPipe: os.DevNull,
})
if err != nil {
return fmt.Errorf("spotify: player init: %w", err)
}
s.player = p
return nil
}
// NewStream creates a decoded audio stream for the given Spotify track ID.
//
// Holds s.mu.RLock() across the librespot network call. Multiple concurrent
// NewStream / webApi callers can run in parallel (RLock is shared), so rapid
// track skipping does not serialize. reconnect() and Close() take the full
// Lock and will wait for in-flight callers to finish before tearing down the
// player — without this, the swap could call oldPlayer.Close() while we are
// still reading from it.
func (s *Session) NewStream(ctx context.Context, spotID librespot.SpotifyId, bitrate int) (*librespotPlayer.Stream, error) {
s.mu.RLock()
defer s.mu.RUnlock()
if s.player == nil {
return nil, fmt.Errorf("spotify: session closed")
}
return s.player.NewStream(ctx, http.DefaultClient, spotID, bitrate, 0)
}
// webApiWithBody calls the Spotify Web API using the OAuth2 access token.
//
// The spclient/login5 token from librespot is NOT accepted by the Web API
// for endpoints like /v1/search and /v1/me/playlists — Spotify returns
// misleading errors ("Invalid limit", 429) instead of a clear auth failure.
// So if there is no OAuth2 token source, fail loudly with ErrNeedsAuth
// rather than attempting the call with the wrong token.
func (s *Session) webApiWithBody(ctx context.Context, method, path string, query url.Values, body io.Reader, contentType string) (*http.Response, error) {
s.mu.RLock()
ts := s.tokenSource
s.mu.RUnlock()
if ts == nil {
return nil, fmt.Errorf("spotify: web api token unavailable, run 'cliamp spotify reset' and sign in again: %w", playlist.ErrNeedsAuth)
}
tok, err := ts.Token()
if err != nil {
return nil, fmt.Errorf("refresh access token: %w", err)
}
token := tok.AccessToken
u, _ := url.Parse("https://api.spotify.com")
u = u.JoinPath(path)
if query != nil {
u.RawQuery = query.Encode()
}
req, err := http.NewRequestWithContext(ctx, method, u.String(), body)
if err != nil {
return nil, err
}
req.Header.Set("Authorization", "Bearer "+token)
req.Header.Set("Accept", "application/json")
if contentType != "" {
req.Header.Set("Content-Type", contentType)
}
return http.DefaultClient.Do(req)
}
// Close releases all session and player resources.
func (s *Session) Close() {
s.mu.Lock()
defer s.mu.Unlock()
if s.player != nil {
s.player.Close()
}
if s.sess != nil {
s.sess.Close()
}
}
// Reconnect rebuilds the session from stored credentials (no browser).
// Returns an error if stored credentials are missing or the refresh fails.
func (s *Session) Reconnect(ctx context.Context) error {
return s.reconnect(ctx, NewSessionSilent)
}
// ReconnectInteractive forces a fresh browser-based OAuth2 flow.
// Stored credentials are preserved until the new session succeeds —
// newInteractiveSession overwrites them via saveCreds on success.
func (s *Session) ReconnectInteractive(ctx context.Context) error {
return s.reconnect(ctx, newInteractiveSession)
}
// reconnect replaces the live session using the provided builder function.
// The new session is established before tearing down the old one to avoid a
// window where s.sess/s.player are nil (which would crash concurrent callers).
//
// The swap-and-teardown phase is done under s.mu (full Lock), which waits for
// any in-flight NewStream / webApi RLockers to drain. This guarantees that
// oldPlayer.Close() is never called while a NewStream is still using the
// old player pointer.
func (s *Session) reconnect(ctx context.Context, build func(context.Context, string) (*Session, error)) error {
s.mu.RLock()
clientID := s.clientID
s.mu.RUnlock()
newSess, err := build(ctx, clientID)
if err != nil {
return fmt.Errorf("spotify: reconnect: %w", err)
}
// Swap and tear down the old session under a single write lock so
// in-flight NewStream / webApi calls finish before oldPlayer.Close()
// runs. The expensive build() above happened lock-free.
s.mu.Lock()
oldPlayer := s.player
oldSess := s.sess
s.sess = newSess.sess
s.player = newSess.player
s.devID = newSess.devID
s.tokenSource = newSess.tokenSource
if oldPlayer != nil {
oldPlayer.Close()
}
if oldSess != nil {
oldSess.Close()
}
s.mu.Unlock()
// Prevent newSess.Close() from tearing down the resources we just adopted.
newSess.mu.Lock()
newSess.sess = nil
newSess.player = nil
newSess.mu.Unlock()
const reauthMsg = "spotify: re-authenticated successfully"
applog.Info(reauthMsg)
applog.Status(reauthMsg)
return nil
}
func generateDeviceID() string {
b := make([]byte, 20)
_, _ = rand.Read(b)
return hex.EncodeToString(b)
}
func loadCreds() (*storedCreds, error) {
path, err := CredsPath()
if err != nil {
return nil, err
}
data, err := os.ReadFile(path)
if err != nil {
return nil, err
}
var creds storedCreds
if err := json.Unmarshal(data, &creds); err != nil {
return nil, err
}
return &creds, nil
}
func saveCreds(creds *storedCreds) error {
path, err := CredsPath()
if err != nil {
return err
}
if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
return err
}
data, err := json.Marshal(creds)
if err != nil {
return err
}
return os.WriteFile(path, data, 0o600)
}