@wwdrew/expo-spotify-sdk 2.2.2 → 2.2.3

package/README.md

@@ -406,6 +406,7 @@ Need the deprecated shims temporarily? Pin **`1.x`**: `npm install @wwdrew/expo-
 | --- | --- |
 | [API reference](./docs/api-reference.md) | All namespaces, methods, hooks |
 | [Error codes](./docs/error-codes.md) | Per-namespace codes with when/what-to-do |
+| [Auth error mapping](./docs/auth-error-mapping.md) | iOS/Android auth → JS mapping matrix and parity checklist |
 | [App Remote error mapping](./docs/app-remote-error-mapping.md) | iOS/Android native → JS mapping matrix |
 | [Platform differences](./docs/guides/platform-differences.md) | iOS vs Android parity |
 | [Native SDK distribution](./docs/guides/native-sdk-distribution.md) | How iOS/Android binaries are fetched, packaged, and bumped |

package/android/src/main/java/expo/modules/spotifysdk/ExpoSpotifySDKModule.kt

@@ -8,7 +8,7 @@ import expo.modules.kotlin.functions.Coroutine
 import expo.modules.kotlin.modules.Module
 import expo.modules.kotlin.modules.ModuleDefinition
 
-private const val SDK_VERSION = "2.2.2" // x-release-please-version
+private const val SDK_VERSION = "2.2.3" // x-release-please-version
 private const val EVENT_SESSION_CHANGE = "onSessionChange"
 private const val EVENT_CONNECTION_STATE_CHANGE = "onConnectionStateChange"
 private const val EVENT_CONNECTION_ERROR = "onConnectionError"
@@ -165,6 +165,13 @@ class ExpoSpotifySDKModule : Module() {
       } catch (e: expo.modules.kotlin.exception.CodedException) {
         emitSessionError(e.code ?: "UNKNOWN", e.localizedMessage ?: e.code ?: "Unknown error")
         throw e
+      } catch (e: Exception) {
+        val wrapped = UnknownSpotifyException(
+          "Unexpected authentication error: ${e.message ?: e::class.java.simpleName}",
+          e,
+        )
+        emitSessionError(wrapped.code ?: "UNKNOWN", wrapped.localizedMessage ?: "Unknown error")
+        throw wrapped
       }
     }
 
@@ -187,6 +194,13 @@ class ExpoSpotifySDKModule : Module() {
       } catch (e: expo.modules.kotlin.exception.CodedException) {
         emitSessionError(e.code ?: "UNKNOWN", e.localizedMessage ?: e.code ?: "Unknown error")
         throw e
+      } catch (e: Exception) {
+        val wrapped = UnknownSpotifyException(
+          "Unexpected token refresh error: ${e.message ?: e::class.java.simpleName}",
+          e,
+        )
+        emitSessionError(wrapped.code ?: "UNKNOWN", wrapped.localizedMessage ?: "Unknown error")
+        throw wrapped
       }
     }
 

package/android/src/main/java/expo/modules/spotifysdk/SpotifyTokenSwapClient.kt

@@ -4,6 +4,7 @@ import kotlinx.coroutines.suspendCancellableCoroutine
 import okhttp3.Call
 import okhttp3.Callback
 import okhttp3.FormBody
+import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
 import okhttp3.OkHttpClient
 import okhttp3.Request
 import okhttp3.Response
@@ -43,11 +44,13 @@ class SpotifyTokenSwapClient(
     tokenSwapURL: String,
     requestedScopes: List<String>,
   ): SpotifySessionPayload {
+    val url = tokenSwapURL.toHttpUrlOrNull()
+      ?: throw InvalidConfigException("Invalid token swap URL: $tokenSwapURL")
     val body = FormBody.Builder()
       .add("code", code)
       .build()
     val request = Request.Builder()
-      .url(tokenSwapURL)
+      .url(url)
       .header("User-Agent", userAgent)
       .post(body)
       .build()
@@ -60,11 +63,13 @@ class SpotifyTokenSwapClient(
     tokenRefreshURL: String,
     previousScopes: List<String>,
   ): SpotifySessionPayload {
+    val url = tokenRefreshURL.toHttpUrlOrNull()
+      ?: throw InvalidConfigException("Invalid token refresh URL: $tokenRefreshURL")
     val body = FormBody.Builder()
       .add("refresh_token", refreshToken)
       .build()
     val request = Request.Builder()
-      .url(tokenRefreshURL)
+      .url(url)
       .header("User-Agent", userAgent)
       .post(body)
       .build()

package/ios/ExpoSpotifySDKModule.swift

@@ -1,7 +1,7 @@
 import ExpoModulesCore
 import SpotifyiOS
 
-private let SDK_VERSION = "2.2.2" // x-release-please-version
+private let SDK_VERSION = "2.2.3" // x-release-please-version
 private let EVENT_SESSION_CHANGE = "onSessionChange"
 private let EVENT_CONNECTION_STATE_CHANGE = "onConnectionStateChange"
 private let EVENT_CONNECTION_ERROR = "onConnectionError"

package/ios/SpotifyAuthCoordinator.swift

@@ -1,4 +1,5 @@
 import ExpoModulesCore
+import AuthenticationServices
 import Foundation
 import SpotifyiOS
 import UIKit
@@ -11,6 +12,10 @@ enum SpotifyError: Error {
   case authInProgress
   case userCancelled
   case spotifyNotInstalled
+  case networkError(message: String, cause: Error)
+  case tokenSwapFailed(status: Int?, message: String, cause: Error)
+  case tokenSwapParseError(message: String, cause: Error)
+  case authError(message: String, cause: Error)
   case underlying(message: String, cause: Error)
 
   var code: String {
@@ -19,6 +24,10 @@ enum SpotifyError: Error {
     case .authInProgress:       return "AUTH_IN_PROGRESS"
     case .userCancelled:        return "USER_CANCELLED"
     case .spotifyNotInstalled:  return "SPOTIFY_NOT_INSTALLED"
+    case .networkError:         return "NETWORK_ERROR"
+    case .tokenSwapFailed:      return "TOKEN_SWAP_FAILED"
+    case .tokenSwapParseError:  return "TOKEN_SWAP_PARSE_ERROR"
+    case .authError:            return "AUTH_ERROR"
     case .underlying:           return "UNKNOWN"
     }
   }
@@ -29,6 +38,10 @@ enum SpotifyError: Error {
     case .authInProgress:                  return "Another authentication request is already in progress"
     case .userCancelled:                   return "Authentication was cancelled by the user"
     case .spotifyNotInstalled:             return "The Spotify app is not installed on this device"
+    case .networkError(let message, _):    return message
+    case .tokenSwapFailed(_, let message, _): return message
+    case .tokenSwapParseError(let message, _): return message
+    case .authError(let message, _):       return message
     case .underlying(let message, _):      return message
     }
   }
@@ -38,6 +51,10 @@ enum SpotifyError: Error {
   /// full chain rather than collapsing into "undefined reason".
   var underlyingCause: Error? {
     switch self {
+    case .networkError(_, let cause): return cause
+    case .tokenSwapFailed(_, _, let cause): return cause
+    case .tokenSwapParseError(_, let cause): return cause
+    case .authError(_, let cause): return cause
     case .underlying(_, let cause): return cause
     default:                        return nil
     }
@@ -123,6 +140,10 @@ actor SpotifyAuthCoordinator {
     // mutating it here takes effect for the upcoming initiateSession call.
     sptConfiguration.tokenSwapURL = tokenSwapURL
     sptConfiguration.tokenRefreshURL = tokenRefreshURL
+    bridge.updateAuthContext(
+      tokenSwapURL: tokenSwapURL,
+      tokenRefreshURL: tokenRefreshURL
+    )
     // alwaysShowAuthorizationDialog is a property on SPTSessionManager, not an
     // SPTAuthorizationOptions flag (the options enum has no such case).
     sessionManager.alwaysShowAuthorizationDialog = showDialog
@@ -146,6 +167,7 @@ actor SpotifyAuthCoordinator {
   func deliver(_ result: Result<SPTSession, Error>) {
     let cont = pending
     pending = nil
+    bridge.clearAuthContext()
     cont?.resume(with: result)
   }
 
@@ -168,7 +190,21 @@ actor SpotifyAuthCoordinator {
 /// can't satisfy directly. The bridge is a tiny NSObject that hops the call
 /// onto the actor's executor.
 final class SpotifySessionDelegateBridge: NSObject, SPTSessionManagerDelegate {
+  private struct AuthContext {
+    let tokenSwapURL: URL?
+    let tokenRefreshURL: URL?
+  }
+
   weak var coordinator: SpotifyAuthCoordinator?
+  private var authContext: AuthContext?
+
+  func updateAuthContext(tokenSwapURL: URL?, tokenRefreshURL: URL?) {
+    authContext = AuthContext(tokenSwapURL: tokenSwapURL, tokenRefreshURL: tokenRefreshURL)
+  }
+
+  func clearAuthContext() {
+    authContext = nil
+  }
 
   func sessionManager(manager _: SPTSessionManager, didInitiate session: SPTSession) {
     NSLog(
@@ -199,14 +235,194 @@ final class SpotifySessionDelegateBridge: NSObject, SPTSessionManagerDelegate {
   /// Translate a few well-known SDK error shapes into our taxonomy.
   private func mapSDKError(_ error: Error) -> Error {
     let nsError = error as NSError
-    let description = nsError.localizedDescription.lowercased()
-    if description.contains("cancel") {
+    if isUserCancelled(error: nsError) {
+      NSLog(
+        "[ExpoSpotifySDK] mapSDKError classified=USER_CANCELLED domain=%@ code=%d detail=%@",
+        nsError.domain,
+        nsError.code,
+        describeError(nsError)
+      )
       return SpotifyError.userCancelled
     }
+
+    if let classified = classifyNonCancellationAuthError(nsError) {
+      return classified
+    }
+
     // Keep the original NSError as `cause` so the structured underlying-chain
     // is preserved (Sentry, debug breadcrumbs); the rendered string goes to
     // `message` so JS callers get a single human-readable line.
-    return SpotifyError.underlying(message: describeError(nsError), cause: nsError)
+    let detail = describeError(nsError)
+    NSLog(
+      "[ExpoSpotifySDK] mapSDKError classified=UNKNOWN domain=%@ code=%d detail=%@",
+      nsError.domain,
+      nsError.code,
+      detail
+    )
+    return SpotifyError.underlying(message: detail, cause: nsError)
+  }
+
+  private func classifyNonCancellationAuthError(_ error: NSError) -> SpotifyError? {
+    let detail = describeError(error)
+    let lower = detail.lowercased()
+    let tokenSwapConfigured = authContext?.tokenSwapURL != nil
+
+    if isNetworkFailure(error) {
+      return SpotifyError.networkError(message: "Network error during Spotify authentication: \(detail)", cause: error)
+    }
+
+    // OAuth-style rejection from Spotify auth endpoints — evaluated before the
+    // tokenSwapConfigured gate so these are never misclassified as token-swap errors.
+    if lower.contains("access_denied") || lower.contains("invalid_scope") || lower.contains("invalid_client") ||
+      lower.contains("authorization") || lower.contains("oauth") || lower.contains("spotify account")
+    {
+      return SpotifyError.authError(
+        message: "Spotify authorization failed: \(detail)",
+        cause: error
+      )
+    }
+
+    if let status = extractHTTPStatusCode(from: detail), status == 401 || status == 403 {
+      return SpotifyError.authError(
+        message: "Spotify authorization failed (HTTP \(status)): \(detail)",
+        cause: error
+      )
+    }
+
+    if tokenSwapConfigured || lower.contains("token swap") || lower.contains("token endpoint") || lower.contains("token exchange") {
+      if let status = extractHTTPStatusCode(from: detail) {
+        return SpotifyError.tokenSwapFailed(
+          status: status,
+          message: "Token swap server returned HTTP \(status): \(detail)",
+          cause: error
+        )
+      }
+      if lower.contains("parse") || lower.contains("json") || lower.contains("decode") || lower.contains("malformed") {
+        return SpotifyError.tokenSwapParseError(
+          message: "Token swap response was invalid: \(detail)",
+          cause: error
+        )
+      }
+      return SpotifyError.tokenSwapFailed(
+        status: nil,
+        message: "Token swap failed: \(detail)",
+        cause: error
+      )
+    }
+
+    return nil
+  }
+
+  /// Detect user cancellation from the full NSError chain rather than relying
+  /// on a single wrapper domain/code pair.
+  private func isUserCancelled(error: NSError) -> Bool {
+    var visited = Set<ObjectIdentifier>()
+    var stack: [NSError] = [error]
+
+    while let current = stack.popLast() {
+      let id = ObjectIdentifier(current)
+      guard visited.insert(id).inserted else { continue }
+
+      if isKnownCancellationCode(current) || messageLooksCancelled(current) {
+        return true
+      }
+
+      if let underlying = current.userInfo[NSUnderlyingErrorKey] as? NSError {
+        stack.append(underlying)
+      }
+    }
+
+    return false
+  }
+
+  private func isKnownCancellationCode(_ error: NSError) -> Bool {
+    if error.domain == NSURLErrorDomain && error.code == NSURLErrorCancelled {
+      return true
+    }
+
+    if #available(iOS 12.0, *),
+       error.domain == ASWebAuthenticationSessionErrorDomain,
+       error.code == ASWebAuthenticationSessionError.canceledLogin.rawValue
+    {
+      return true
+    }
+
+    if error.domain == "SFAuthenticationErrorDomain" && error.code == 1 {
+      return true
+    }
+
+    return false
+  }
+
+  private func isNetworkFailure(_ error: NSError) -> Bool {
+    var visited = Set<ObjectIdentifier>()
+    var stack: [NSError] = [error]
+
+    while let current = stack.popLast() {
+      let id = ObjectIdentifier(current)
+      guard visited.insert(id).inserted else { continue }
+
+      if current.domain == NSURLErrorDomain,
+         current.code != NSURLErrorCancelled
+      {
+        return true
+      }
+
+      if let underlying = current.userInfo[NSUnderlyingErrorKey] as? NSError {
+        stack.append(underlying)
+      }
+    }
+
+    return false
+  }
+
+  private func messageLooksCancelled(_ error: NSError) -> Bool {
+    // Only apply fuzzy text matching in auth/browser domains to avoid mapping
+    // unrelated transport or backend failures into USER_CANCELLED.
+    guard isLikelyAuthCancellationDomain(error.domain) else {
+      return false
+    }
+
+    let cancelKeywords = ["cancel", "canceled", "cancelled"]
+    let negativeKeywords = [
+      "timed out",
+      "timeout",
+      "network",
+      "offline",
+      "unreachable",
+      "server",
+      "unauthorized",
+      "forbidden",
+      "invalid"
+    ]
+    let messageParts = [
+      error.localizedDescription,
+      error.localizedFailureReason ?? "",
+      error.userInfo[NSLocalizedDescriptionKey] as? String ?? "",
+      error.userInfo[NSLocalizedFailureReasonErrorKey] as? String ?? ""
+    ]
+    let combined = messageParts
+      .joined(separator: " ")
+      .lowercased()
+
+    if negativeKeywords.contains(where: { combined.contains($0) }) {
+      return false
+    }
+
+    return cancelKeywords.contains(where: { combined.contains($0) })
+  }
+
+  private func isLikelyAuthCancellationDomain(_ domain: String) -> Bool {
+    if domain == ASWebAuthenticationSessionErrorDomain || domain == "SFAuthenticationErrorDomain" {
+      return true
+    }
+
+    // SPT wrappers commonly bubble auth-web errors under their own namespace.
+    if domain.lowercased().contains("spotify") && domain.lowercased().contains("auth") {
+      return true
+    }
+
+    return false
   }
 
   /// Build a diagnostic string from an NSError that includes the domain,
@@ -232,4 +448,29 @@ final class SpotifySessionDelegateBridge: NSObject, SPTSessionManagerDelegate {
     }
     return parts.joined(separator: " ")
   }
+
+  private func extractHTTPStatusCode(from message: String) -> Int? {
+    let patterns = [
+      #"http\s+([1-5][0-9]{2})"#,
+      #"status(?:\s+code)?[:=\s]+([1-5][0-9]{2})"#
+    ]
+
+    for pattern in patterns {
+      guard let regex = try? NSRegularExpression(pattern: pattern, options: [.caseInsensitive]) else {
+        continue
+      }
+      let range = NSRange(message.startIndex..<message.endIndex, in: message)
+      guard let match = regex.firstMatch(in: message, options: [], range: range),
+            match.numberOfRanges > 1,
+            let codeRange = Range(match.range(at: 1), in: message)
+      else {
+        continue
+      }
+      if let code = Int(message[codeRange]) {
+        return code
+      }
+    }
+
+    return nil
+  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wwdrew/expo-spotify-sdk",
-  "version": "2.2.2",
+  "version": "2.2.3",
   "description": "Expo module wrapping the native Spotify iOS (v5) and Android (v4) SDKs for OAuth authentication and App Remote playback control",
   "main": "build/index.js",
   "types": "build/index.d.ts",