gerdur 2.16.0 → 2.17.0

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## 2.17.0 - 2026-08-31
+
+### Fixed
+
+- **`DEEZER_EMAIL` / `DEEZER_PASSWORD` are now read** as aliases for
+  `GERDUR_EMAIL` / `GERDUR_PASSWORD`. Those spellings are what people tend to put
+  in a `.env` alongside their other Deezer settings, and until now they were
+  silently ignored — the login just looked unconfigured.
+
+### Changed
+
+- **A refused login no longer blames your password.** It used to report
+  `wrong-credentials` with "check your email and password". That is not something
+  this code can know: Deezer's `user_auth.php` returns an identical error
+  (code 160) for a real account, a wrong password, **and** an address that does
+  not exist. The reason is now `rejected`, and the message says so.
+
+  Probed against the live endpoints while making this change, and every
+  documented password-to-`arl` path is currently refused:
+
+  | path | result |
+  | :--- | :--- |
+  | `connect.deezer.com/oauth/user_auth.php` | `authenticate user failed`, code 160 |
+  | `www.deezer.com/ajax/action.php` | `error` |
+  | `auth.deezer.com/login/arl` | 400 — needs a session the first two can't provide |
+
+  A deliberately malformed request returns a *different* error (code 150, "wrong
+  hash !"), which is how we know the request itself is still well formed and the
+  refusal is about authentication. **Paste an `arl` instead.** The code is kept
+  in case the flow returns, and `reason: 'rejected'` now carries an explanation
+  rather than a misdiagnosis.
+
+### Breaking (programmatic API, minor)
+
+- `LoginResult`'s `wrong-credentials` reason is renamed **`rejected`**. Anything
+  switching exhaustively on `reason` needs updating; `LoginError.reason` carries
+  the new value.
+
 ## 2.16.0 - 2026-08-31
 
 ### Changed

package/README.md

@@ -89,11 +89,20 @@ gerdur --set-arl <your_arl>
 To copy it manually: open <https://www.deezer.com> logged in → DevTools (`F12`) →
 Application → Cookies → `deezer.com` → copy the `arl` value (192 hex chars).
 
-**Log in with email &amp; password** — the guided setup can fetch the `arl` for you
-via Deezer's mobile OAuth flow, so you never open DevTools. Only the resulting
-`arl` is stored; your password is never written to disk unless you explicitly opt
-in when prompted. Deezer bot-protects scripted logins, so this is best-effort and
-falls back to pasting an `arl`.
+**Log in with email &amp; password** — the guided setup can try to fetch the `arl`
+from your credentials, so you never open DevTools. Only the resulting `arl` is
+stored; your password is never written to disk unless you explicitly opt in when
+prompted. Credentials are also read from `GERDUR_EMAIL` / `GERDUR_PASSWORD`, or
+`DEEZER_EMAIL` / `DEEZER_PASSWORD`.
+
+> **This currently does not work.** Every documented password-to-`arl` path is
+> refused: `connect.deezer.com/oauth/user_auth.php` answers `authenticate user
+> failed` (code 160), the web `action.php` login answers `error`, and
+> `auth.deezer.com/login/arl` needs a session you cannot get without the first
+> two. Deezer returns *the same* code 160 for a real account, a wrong password
+> and an address that does not exist, so a failure here says nothing about your
+> credentials. **Paste an `arl` instead** — `gerdur --set-arl <arl>` or
+> `GERDUR_ARL=<arl>`. The code is kept because the flow may come back.
 
 **Zero-config / CI** — set `GERDUR_ARL` (or `GERDUR_EMAIL` + `GERDUR_PASSWORD`)
 and skip the config file entirely. `GERDUR_ARL` takes precedence over the config
@@ -434,7 +443,7 @@ import {loginWithEmail, LoginError, Config, globalConfigPath} from 'gerdur';
 
 const result = await loginWithEmail('you@example.com', 'password');
 if (result.ok) console.log(result.arl);
-else console.error(result.reason, result.message); // 'wrong-credentials' | 'no-arl' | 'network' | 'unknown'
+else console.error(result.reason, result.message); // 'rejected' | 'no-arl' | 'network' | 'unknown'
 
 const conf = new Config();          // the same config the CLI uses
 conf.set('cookies.arl', 'xxx…');

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "gerdur",
-    "version": "2.16.0",
+    "version": "2.17.0",
     "description": "Command-line music downloader for Deezer (Spotify/Tidal links resolved via ISRC matching) with automatic MP3/FLAC tagging, synced lyrics and a side-effect-free programmatic API.",
     "keywords": [
         "deezer",

package/dist/src/lib/arl-setup.d.ts

@@ -17,8 +17,13 @@ export declare const printArlInstructions: () => void;
 export declare const promptForArl: (conf: Config) => Promise<string | null>;
 /**
  * Resolve email/password credentials from (in order): explicit config, then the
- * `GERDUR_EMAIL` / `GERDUR_PASSWORD` environment variables. Used for non-interactive
- * login attempts. Returns `null` if either half is missing.
+ * `GERDUR_EMAIL` / `GERDUR_PASSWORD` environment variables, then `DEEZER_EMAIL` /
+ * `DEEZER_PASSWORD`. Used for non-interactive login attempts. Returns `null` if
+ * either half is missing.
+ *
+ * The `DEEZER_*` spellings are accepted because that is what people tend to put
+ * in a `.env` next to their other Deezer settings; before, those were silently
+ * ignored and the login simply looked unconfigured.
  */
 export declare const resolveCredentials: (conf: Config) => {
     email: string;

package/dist/src/lib/arl-setup.js

@@ -68,12 +68,23 @@ const promptForArl = async (conf) => {
 exports.promptForArl = promptForArl;
 /**
  * Resolve email/password credentials from (in order): explicit config, then the
- * `GERDUR_EMAIL` / `GERDUR_PASSWORD` environment variables. Used for non-interactive
- * login attempts. Returns `null` if either half is missing.
+ * `GERDUR_EMAIL` / `GERDUR_PASSWORD` environment variables, then `DEEZER_EMAIL` /
+ * `DEEZER_PASSWORD`. Used for non-interactive login attempts. Returns `null` if
+ * either half is missing.
+ *
+ * The `DEEZER_*` spellings are accepted because that is what people tend to put
+ * in a `.env` next to their other Deezer settings; before, those were silently
+ * ignored and the login simply looked unconfigured.
  */
 const resolveCredentials = (conf) => {
-    const email = (conf.get('cookies.email') || process.env.GERDUR_EMAIL || '').trim();
-    const password = (conf.get('cookies.password') || process.env.GERDUR_PASSWORD || '').trim();
+    const email = (conf.get('cookies.email') ||
+        process.env.GERDUR_EMAIL ||
+        process.env.DEEZER_EMAIL ||
+        '').trim();
+    const password = (conf.get('cookies.password') ||
+        process.env.GERDUR_PASSWORD ||
+        process.env.DEEZER_PASSWORD ||
+        '').trim();
     if (email && password) {
         return { email, password };
     }

package/dist/src/lib/email-login.d.ts

@@ -2,9 +2,16 @@
 export type LoginResult = {
     ok: true;
     arl: string;
-} | {
+}
+/**
+ * `rejected` means Deezer refused the login. It deliberately does **not** say
+ * "wrong password": the endpoint returns an identical error (code 160) for a
+ * real account, a wrong password and an address that does not exist, so the
+ * cause genuinely cannot be told apart from here.
+ */
+ | {
     ok: false;
-    reason: 'wrong-credentials' | 'no-arl' | 'network' | 'unknown';
+    reason: 'rejected' | 'no-arl' | 'network' | 'unknown';
     message: string;
 };
 /**

package/dist/src/lib/email-login.js

@@ -23,6 +23,13 @@ const got = () => require('got');
 const CLIENT_ID = '447462';
 const CLIENT_SECRET = 'a83bf7f38ad2f137e444727cfc3775cf';
 const UA = 'Mozilla/5.0 (X11; Linux x86_64; rv:123.0) Gecko/20100101 Firefox/123.0';
+/**
+ * Deezer's `user_auth.php` error codes, as far as they can be told apart.
+ * `150` proves the request itself was well formed, which is how we know a `160`
+ * is about the account rather than the app hash.
+ */
+const AUTH_WRONG_HASH = 150;
+const AUTH_FAILED = 160;
 const md5 = (data) => (0, crypto_1.createHash)('md5').update(Buffer.from(data, 'utf8')).digest('hex');
 /**
  * Merge `set-cookie` response headers into a cookie map (last value wins),
@@ -80,7 +87,23 @@ const loginWithEmail = async (email, password) => {
             accessToken = authBody.access_token;
         }
         if (!accessToken && !jar.has('arl') && (authBody.error || auth.statusCode >= 400)) {
-            return { ok: false, reason: 'wrong-credentials', message: 'Login failed — check your email and password.' };
+            const code = authBody?.error?.code;
+            if (code === AUTH_WRONG_HASH) {
+                return {
+                    ok: false,
+                    reason: 'unknown',
+                    message: 'Deezer rejected the request signature — the login flow has changed. Please paste an arl instead.',
+                };
+            }
+            return {
+                ok: false,
+                reason: 'rejected',
+                message: code === AUTH_FAILED
+                    ? 'Deezer refused the login. It returns this same response for a wrong password and for an address ' +
+                        'that does not exist, and it currently refuses valid credentials too, so this is most likely the ' +
+                        'flow being closed rather than anything wrong with your details. Paste an arl instead.'
+                    : 'Deezer refused the login. Paste an arl instead.',
+            };
         }
         // 3. Read the arl for the now-authenticated session.
         const arlResp = await got()('https://www.deezer.com/ajax/gw-light.php', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gerdur",
-  "version": "2.16.0",
+  "version": "2.17.0",
   "description": "Command-line music downloader for Deezer (Spotify/Tidal links resolved via ISRC matching) with automatic MP3/FLAC tagging, synced lyrics and a side-effect-free programmatic API.",
   "keywords": [
     "deezer",