react-native-audio-browser 0.2.0-next.1 → 0.2.0-next.11

package/android/src/test/java/com/audiobrowser/tls/CachingCertificateFetcherCallSiteTest.kt

@@ -0,0 +1,322 @@
+package com.audiobrowser.tls
+
+import java.net.InetAddress
+import java.net.ServerSocket
+import java.security.cert.X509Certificate
+import java.util.concurrent.CountDownLatch
+import java.util.concurrent.TimeUnit
+import java.util.concurrent.atomic.AtomicInteger
+import java.util.concurrent.atomic.AtomicReference
+import javax.security.auth.x500.X500Principal
+import kotlin.concurrent.thread
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.mockito.Mockito.mock
+import org.mockito.Mockito.`when`
+
+/**
+ * Exercises [CachingCertificateFetcher.fetch] against a real loopback server.
+ *
+ * The safety helpers have their own unit tests, but a predicate that is never consulted protects
+ * nothing: these cover the *wiring*, so that removing the `isSafeUrl` guard or swapping
+ * `readCapped` back for a plain read-to-EOF fails a test rather than passing silently.
+ */
+class CachingCertificateFetcherCallSiteTest {
+
+  private var server: ServerSocket? = null
+
+  @After
+  fun tearDown() {
+    server?.close()
+  }
+
+  /**
+   * Serves [response] to every connection, recording the request line of the first. [handled]
+   * counts accepted connections.
+   */
+  private fun startServer(
+    response: ByteArray = "HTTP/1.0 404 Not Found\r\n\r\n".toByteArray(),
+    handled: AtomicInteger = AtomicInteger(),
+    firstRequest: AtomicReference<String> = AtomicReference(),
+  ): Int {
+    val socket = ServerSocket(0, 50, InetAddress.getByName("127.0.0.1"))
+    server = socket
+    thread(isDaemon = true) {
+      while (!socket.isClosed) {
+        try {
+          socket.accept().use { client ->
+            handled.incrementAndGet()
+            val request = ByteArray(1024)
+            val read = client.getInputStream().read(request)
+            firstRequest.compareAndSet(null, String(request, 0, maxOf(read, 0)))
+            client.getOutputStream().apply {
+              write(response)
+              flush()
+            }
+          }
+        } catch (e: Exception) {
+          return@thread // socket closed, or the client hung up
+        }
+      }
+    }
+    return socket.localPort
+  }
+
+  @Test
+  fun `a URL carrying CRLF never reaches the network`() {
+    val handled = AtomicInteger()
+    val port = startServer(handled = handled)
+
+    // Without the isSafeUrl guard this connects and emits "SET foo bar" as its own request line.
+    val certs = CachingCertificateFetcher().fetch("http://127.0.0.1:$port/\r\nSET foo bar\r\n")
+
+    assertTrue(certs.isEmpty())
+    assertEquals("the request must not be sent at all", 0, handled.get())
+  }
+
+  @Test
+  fun `a well-formed URL does reach the network, so the guard is not just refusing everything`() {
+    val handled = AtomicInteger()
+    val request = AtomicReference<String>()
+    val port = startServer(handled = handled, firstRequest = request)
+
+    CachingCertificateFetcher().fetch("http://127.0.0.1:$port/issuer.crt")
+
+    assertEquals(1, handled.get())
+    assertTrue("request line was: ${request.get()}", request.get().startsWith("GET /issuer.crt "))
+  }
+
+  @Test
+  fun `a non-default port is carried in the Host header`() {
+    val request = AtomicReference<String>()
+    val port = startServer(firstRequest = request)
+
+    CachingCertificateFetcher().fetch("http://127.0.0.1:$port/issuer.crt")
+
+    assertTrue(
+      "headers were: ${request.get()}",
+      request.get().contains("Host: 127.0.0.1:$port\r\n"),
+    )
+  }
+
+  @Test(timeout = 30_000)
+  fun `an oversized response is abandoned rather than read to EOF`() {
+    // Asserting only that the fetch fails would prove nothing — 4 MiB crosses loopback in
+    // milliseconds and would fail to parse either way. What has to be true is that the client
+    // stopped reading, which shows up as the server's write not draining.
+    val socket = ServerSocket(0, 50, InetAddress.getByName("127.0.0.1"))
+    server = socket
+    val written = AtomicInteger()
+    val finished = CountDownLatch(1)
+    thread(isDaemon = true) {
+      runCatching {
+        socket.accept().use { client ->
+          client.getInputStream().read(ByteArray(1024))
+          val out = client.getOutputStream()
+          out.write("HTTP/1.0 200 OK\r\n\r\n".toByteArray())
+          val chunk = ByteArray(64 * 1024)
+          // 64 MiB — far past the 1 MiB cap. Once the client stops reading and closes, this
+          // throws a broken pipe, which is the signal we want.
+          repeat(1024) {
+            out.write(chunk)
+            written.addAndGet(chunk.size)
+          }
+        }
+      }
+      finished.countDown()
+    }
+
+    val certs = CachingCertificateFetcher().fetch("http://127.0.0.1:${socket.localPort}/big.crt")
+
+    assertTrue(certs.isEmpty())
+    assertTrue(finished.await(20, TimeUnit.SECONDS))
+    // Socket buffers mean the server gets somewhat past the cap before the write fails, but it
+    // must be nowhere near the 64 MiB it wanted to send.
+    assertTrue(
+      "server wrote ${written.get()} bytes; the read was not cut off",
+      written.get() < 16 shl 20,
+    )
+  }
+
+  @Test(timeout = 30_000)
+  fun `a real certificate is fetched, parsed and then served from cache`() {
+    // The success path, end to end over a socket: every other wire test serves a failure, so a
+    // broken body offset or a broken cache write would not show up anywhere.
+    val der = CertFixtures.bytes("letsencrypt-r13.der")
+    val handled = AtomicInteger()
+    val port =
+      startServer(
+        response =
+          ("HTTP/1.0 200 OK\r\nContent-Type: application/pkix-cert\r\n\r\n").toByteArray() + der,
+        handled = handled,
+      )
+    val fetcher = CachingCertificateFetcher()
+    val url = "http://127.0.0.1:$port/r13.der"
+
+    val certs = fetcher.fetch(url)
+
+    assertEquals(1, certs.size)
+    assertEquals("CN=R13,O=Let's Encrypt,C=US", certs.first().subjectX500Principal.name)
+
+    // Second call must be served from the cache, not the network.
+    assertEquals(certs, fetcher.fetch(url))
+    assertEquals("a successful fetch must be cached", 1, handled.get())
+  }
+
+  /**
+   * A mock certificate whose AIA extension lists [url] as its one CA-Issuers location, so
+   * [AiaCertChaser.completeChain] chases it with this fetcher — the real wiring, end to end.
+   */
+  private fun certPointingAt(url: String): X509Certificate {
+    // Short-form DER lengths only; a loopback URL is far under 128 bytes.
+    fun der(tag: Int, content: ByteArray) =
+      byteArrayOf(tag.toByte(), content.size.toByte()) + content
+    val caIssuersOid = byteArrayOf(0x2B, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x02)
+    val aia =
+      der(
+        0x04,
+        der(
+          0x30,
+          der(0x30, der(0x06, caIssuersOid) + der(0x86, url.toByteArray(Charsets.US_ASCII))),
+        ),
+      )
+    return mock(X509Certificate::class.java).also {
+      `when`(it.getExtensionValue("1.3.6.1.5.5.7.1.1")).thenReturn(aia)
+      // Distinct principals, or the chaser reads the mock as a self-signed root and never fetches.
+      `when`(it.subjectX500Principal).thenReturn(X500Principal("CN=leaf"))
+      `when`(it.issuerX500Principal).thenReturn(X500Principal("CN=issuer"))
+    }
+  }
+
+  @Test(timeout = 30_000)
+  fun `a drip-feeding server is cut off by the chase deadline, not only the per-fetch caps`() {
+    // One byte every 100 ms: each read lands well inside the socket timeout, so per-read limits
+    // never fire, and the per-fetch read budget alone would let this run for its full 10 s. The
+    // walk's 1 s budget must cut the fetch *itself* — not merely decline to start the next one.
+    val socket = ServerSocket(0, 50, InetAddress.getByName("127.0.0.1"))
+    server = socket
+    thread(isDaemon = true) {
+      runCatching {
+        socket.accept().use { client ->
+          client.getInputStream().read(ByteArray(1024))
+          val out = client.getOutputStream()
+          out.write("HTTP/1.0 200 OK\r\n\r\n".toByteArray())
+          out.flush()
+          repeat(300) { // 30 s of drip on offer; the client must not stay for it
+            out.write(0)
+            out.flush()
+            Thread.sleep(100)
+          }
+        }
+      }
+    }
+    val fetcher = CachingCertificateFetcher()
+    val cert = certPointingAt("http://127.0.0.1:${socket.localPort}/drip.crt")
+
+    val started = System.nanoTime()
+    val completed =
+      AiaCertChaser.completeChain(listOf(cert), budgetMs = 1_000) { url, deadline ->
+        fetcher.fetch(url, deadline)
+      }
+    val elapsedMs = (System.nanoTime() - started) / 1_000_000
+
+    assertEquals(listOf(cert), completed)
+    // Well past the 1 s budget to absorb scheduling noise, but far short of the 10 s the
+    // per-fetch read budget alone would have allowed.
+    assertTrue("chase ran for $elapsedMs ms", elapsedMs < 8_000)
+  }
+
+  @Test(timeout = 30_000)
+  fun `the chase deadline spans redirect hops, not just fetch starts`() {
+    // Every hop stalls 1 s and then redirects back to itself. Each hop sits comfortably inside
+    // the per-operation timeouts, so only a deadline threaded through the redirect recursion
+    // can end the fetch — without one it walks all 5 redirects, ~6 s here.
+    val socket = ServerSocket(0, 50, InetAddress.getByName("127.0.0.1"))
+    server = socket
+    thread(isDaemon = true) {
+      while (!socket.isClosed) {
+        try {
+          socket.accept().use { client ->
+            client.getInputStream().read(ByteArray(1024))
+            Thread.sleep(1_000)
+            client.getOutputStream().apply {
+              write("HTTP/1.0 302 Found\r\nLocation: /again.crt\r\n\r\n".toByteArray())
+              flush()
+            }
+          }
+        } catch (e: Exception) {
+          return@thread
+        }
+      }
+    }
+    val fetcher = CachingCertificateFetcher()
+
+    val started = System.nanoTime()
+    val certs =
+      fetcher.fetch(
+        "http://127.0.0.1:${socket.localPort}/loop.crt",
+        deadlineNanos = System.nanoTime() + 1_500 * 1_000_000L,
+      )
+    val elapsedMs = (System.nanoTime() - started) / 1_000_000
+
+    assertTrue(certs.isEmpty())
+    assertTrue("fetch ran for $elapsedMs ms across redirect hops", elapsedMs < 4_000)
+  }
+
+  @Test(timeout = 30_000)
+  fun `a server that accepts and never answers is bounded by the read timeout`() {
+    val socket = ServerSocket(0, 50, InetAddress.getByName("127.0.0.1"))
+    server = socket
+    val accepted = CountDownLatch(1)
+    // Accept, then hold the connection open saying nothing at all.
+    thread(isDaemon = true) {
+      runCatching {
+        val client = socket.accept()
+        accepted.countDown()
+        Thread.sleep(60_000)
+        client.close()
+      }
+    }
+
+    val certs =
+      CachingCertificateFetcher(connectTimeoutMs = 2_000, readTimeoutMs = 1_000)
+        .fetch("http://127.0.0.1:${socket.localPort}/hangs.crt")
+
+    assertTrue(accepted.await(10, TimeUnit.SECONDS))
+    assertTrue(certs.isEmpty())
+  }
+
+  @Test
+  fun `a non-http scheme is never fetched`() {
+    val handled = AtomicInteger()
+    val port = startServer(handled = handled)
+
+    assertTrue(CachingCertificateFetcher().fetch("ftp://127.0.0.1:$port/issuer.crt").isEmpty())
+    assertTrue(CachingCertificateFetcher().fetch("file:///etc/hosts").isEmpty())
+    assertEquals(0, handled.get())
+  }
+
+  @Test
+  fun `a failed fetch is not cached, so it stays retryable`() {
+    val handled = AtomicInteger()
+    val port = startServer(handled = handled)
+    val fetcher = CachingCertificateFetcher()
+    val url = "http://127.0.0.1:$port/issuer.crt"
+
+    fetcher.fetch(url)
+    fetcher.fetch(url)
+
+    assertEquals("both attempts must hit the network", 2, handled.get())
+  }
+
+  @Test
+  fun `the cache is bounded`() {
+    // Far more distinct URLs than MAX_CACHE_ENTRIES; nothing is cached here (every fetch fails),
+    // but the bound is what stops an attacker-chosen URL space from growing without limit.
+    assertFalse(CachingCertificateFetcher.MAX_CACHE_ENTRIES <= 0)
+    assertTrue(CachingCertificateFetcher.MAX_CACHE_ENTRIES <= 128)
+  }
+}

package/android/src/test/java/com/audiobrowser/tls/CachingCertificateFetcherTest.kt

@@ -1,5 +1,7 @@
 package com.audiobrowser.tls
 
+import java.io.ByteArrayInputStream
+import java.io.InputStream
 import org.junit.Assert.assertArrayEquals
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertNull
@@ -72,4 +74,85 @@ class CachingCertificateFetcherTest {
       CachingCertificateFetcher.parseHttpResponse("garbage without a header break".toByteArray())
     )
   }
+
+  // -- response cap (the AIA URL, so the host serving it, comes from the presented cert) --
+
+  // -- URL validation (the AIA URL is attacker-supplied text from the presented cert) --
+
+  @Test
+  fun `accepts the URL form CAs actually serve`() {
+    assertTrue(CachingCertificateFetcher.isSafeUrl("http://r13.i.lencr.org/"))
+    assertTrue(CachingCertificateFetcher.isSafeUrl("http://ca.example:8080/issuer.crt?v=2"))
+  }
+
+  @Test
+  fun `rejects a URL carrying CRLF, which would inject request lines`() {
+    // java.net.URL keeps the CRLF in `file`, and the cleartext fetch writes `file` straight
+    // into "GET $path HTTP/1.0\r\n" on a raw socket.
+    assertTrue(!CachingCertificateFetcher.isSafeUrl("http://127.0.0.1:6379/\r\nSET foo bar\r\n"))
+    assertTrue(!CachingCertificateFetcher.isSafeUrl("http://ca.example/a\nX-Injected: 1"))
+  }
+
+  @Test
+  fun `rejects a URL carrying a space, which would split the request line`() {
+    assertTrue(!CachingCertificateFetcher.isSafeUrl("http://ca.example/a b"))
+  }
+
+  @Test
+  fun `reads a response that fits within the cap`() {
+    val body = ByteArray(64) { it.toByte() }
+
+    assertArrayEquals(
+      body,
+      CachingCertificateFetcher.readCapped(ByteArrayInputStream(body), limit = 128),
+    )
+  }
+
+  @Test
+  fun `returns null for a response that exceeds the cap`() {
+    val body = ByteArray(129)
+
+    assertNull(CachingCertificateFetcher.readCapped(ByteArrayInputStream(body), limit = 128))
+  }
+
+  @Test
+  fun `a stream that never ends does not read without bound`() {
+    // Endless: read() always fills the buffer and never signals EOF, the shape a slow-drip
+    // server takes — the per-read timeout never fires because every read succeeds.
+    val endless =
+      object : InputStream() {
+        override fun read() = 0
+
+        override fun read(b: ByteArray, off: Int, len: Int): Int = len
+      }
+
+    assertNull(CachingCertificateFetcher.readCapped(endless, limit = 1 shl 16))
+  }
+
+  @Test
+  fun `a slow drip is cut off by the deadline, not left to exhaust the byte cap`() {
+    // One byte per read, each one landing just inside the socket's read timeout: the byte cap
+    // alone would let this run for a million reads. The clock advances 1s per read, so the
+    // 10s budget must end it after ~10 — far short of the 1 MiB cap.
+    var reads = 0
+    val drip =
+      object : InputStream() {
+        override fun read() = 0
+
+        override fun read(b: ByteArray, off: Int, len: Int): Int {
+          reads++
+          return 1
+        }
+      }
+    var nanos = 0L
+
+    val result =
+      CachingCertificateFetcher.readCapped(drip, budgetMs = 10_000) {
+        nanos += 1_000_000_000
+        nanos
+      }
+
+    assertNull(result)
+    assertTrue("gave up after $reads reads", reads < 20)
+  }
 }

package/ios/Browser/BrowserManager.swift

@@ -64,9 +64,6 @@ final class BrowserManager {
   private let router = SimpleRouter()
   private let httpClient = HttpClient()
 
-  // LRU cache for individual tracks - keyed by both url and src for O(1) lookup
-  private let trackCache = LRUCache<String, Track>(maxSize: 3000)
-
   // LRU cache for resolved content - keyed by path
   private let contentCache = LRUCache<String, ResolvedTrack>(maxSize: 20)
 
@@ -223,22 +220,6 @@ final class BrowserManager {
     return resolvedTrack.copying(children: hydratedChildren)
   }
 
-  // MARK: - Track Cache
-
-  /// Cache a track by both url and src for O(1) lookup from either key.
-  private func cacheTrack(_ track: Track) {
-    if let url = track.url {
-      trackCache.set(url, value: track)
-    }
-    if let src = track.src {
-      trackCache.set(src, value: track)
-    }
-  }
-
-  private func cacheChildren(_ resolvedTrack: ResolvedTrack) {
-    resolvedTrack.children?.forEach { cacheTrack($0) }
-  }
-
   // MARK: - Navigation
 
   /// Main navigation method - updates path and resolves content.
@@ -276,9 +257,6 @@ final class BrowserManager {
     // Cache the resolved content for future navigation
     contentCache.set(normalizedPath, value: resolvedTrack)
 
-    // Cache children for track lookups
-    cacheChildren(resolvedTrack)
-
     return hydrateChildren(resolvedTrack)
   }
 
@@ -682,9 +660,6 @@ final class BrowserManager {
     lastSearchQuery = query
     lastSearchResults = hydratedResults
 
-    // Cache individual tracks
-    hydratedResults.forEach { cacheTrack($0) }
-
     return makeSearchResult(query: query, results: hydratedResults)
   }
 
@@ -770,9 +745,9 @@ final class BrowserManager {
     // silently queueing the changed list would resume the wrong station.
     let sectionTracks: [Track]
     switch SectionScope.section(of: children, containing: trackId) {
-    case .imageRow(let items):
+    case let .imageRow(items):
       sectionTracks = items.map { $0.toTrack() }
-    case .run(let tracks):
+    case let .run(tracks):
       sectionTracks = tracks
     case nil:
       return nil

package/ios/Browser/SearchDrillIn.swift

@@ -20,7 +20,7 @@ enum SearchDrillIn {
   /// yields nothing. Returns nil when nothing is playable.
   static func playable<Item: PlayableSearchItem>(
     from children: [Item],
-    resolveChildren: sending (String) async throws -> [Item]
+    resolveChildren: sending (String) async throws -> [Item],
   ) async throws -> [Item]? {
     guard !children.isEmpty else { return nil }
 

package/ios/CarPlay/RNABMediaAddHandler.swift

@@ -22,8 +22,8 @@ class RNABMediaAddHandler: NSObject, INAddMediaIntentHandling {
   private static let logger = Logger(subsystem: "com.audiobrowser", category: "MediaAddHandler")
 
   func handle(
-    intent: INAddMediaIntent,
-    completion: @escaping @Sendable (INAddMediaIntentResponse) -> Void
+    intent _: INAddMediaIntent,
+    completion: @escaping @Sendable (INAddMediaIntentResponse) -> Void,
   ) {
     Self.logger.info("Add media — favorite current track")
 
@@ -57,7 +57,7 @@ class RNABMediaAddHandler: NSObject, INAddMediaIntentHandling {
   @objc(resolveMediaItemsForAddMedia:withCompletion:)
   func resolveMediaItems(
     for intent: INAddMediaIntent,
-    with completion: @escaping ([INAddMediaMediaItemResolutionResult]) -> Void
+    with completion: @escaping ([INAddMediaMediaItemResolutionResult]) -> Void,
   ) {
     let name = intent.mediaSearch?.mediaName ?? ""
     let item = INMediaItem(identifier: name, title: name, type: .unknown, artwork: nil)
@@ -66,10 +66,10 @@ class RNABMediaAddHandler: NSObject, INAddMediaIntentHandling {
 
   @objc(resolveMediaDestinationForAddMedia:withCompletion:)
   func resolveMediaDestination(
-    for intent: INAddMediaIntent,
-    with completion: @escaping (INAddMediaMediaDestinationResolutionResult) -> Void
+    for _: INAddMediaIntent,
+    with completion: @escaping (INAddMediaMediaDestinationResolutionResult) -> Void,
   ) {
     // One flat favorites collection — always the user's library, no playlists.
-      completion(.success(with: INMediaDestination.library))
+    completion(.success(with: INMediaDestination.library))
   }
 }

package/ios/CarPlay/RNABMediaAffinityHandler.swift

@@ -21,7 +21,7 @@ class RNABMediaAffinityHandler: NSObject, INUpdateMediaAffinityIntentHandling {
 
   func handle(
     intent: INUpdateMediaAffinityIntent,
-    completion: @escaping @Sendable (INUpdateMediaAffinityIntentResponse) -> Void
+    completion: @escaping @Sendable (INUpdateMediaAffinityIntentResponse) -> Void,
   ) {
     let affinity = intent.affinityType
     Self.logger.info("Update media affinity — type=\(affinity.rawValue)")
@@ -60,7 +60,7 @@ class RNABMediaAffinityHandler: NSObject, INUpdateMediaAffinityIntentHandling {
   @objc(resolveMediaItemsForUpdateMediaAffinity:withCompletion:)
   func resolveMediaItems(
     for intent: INUpdateMediaAffinityIntent,
-    with completion: @escaping ([INUpdateMediaAffinityMediaItemResolutionResult]) -> Void
+    with completion: @escaping ([INUpdateMediaAffinityMediaItemResolutionResult]) -> Void,
   ) {
     let name = intent.mediaSearch?.mediaName ?? ""
     let item = INMediaItem(identifier: name, title: name, type: .unknown, artwork: nil)

package/ios/CarPlay/RNABMediaIntentHandler.swift

@@ -21,7 +21,7 @@ class RNABMediaIntentHandler: NSObject, INPlayMediaIntentHandling {
       mediaTypeMode: Self.mediaTypeMode(s?.mediaType ?? .unknown),
       reference: Self.reference(s?.reference ?? .unknown),
       hasMediaType: (s?.mediaType ?? .unknown) != .unknown,
-      appName: Self.hostAppName()
+      appName: Self.hostAppName(),
     )
     Self.logger.info("Play media intent — query=\(criteria.query) matchesApp=\(criteria.matchesAppName) resume=\(criteria.isResume)")
 
@@ -37,18 +37,18 @@ class RNABMediaIntentHandler: NSObject, INPlayMediaIntentHandling {
   /// `album` are filters, not verticals — they yield no mode.
   private static func mediaTypeMode(_ type: INMediaItemType) -> String? {
     switch type {
-    case .station, .radioStation, .algorithmicRadioStation, .musicStation: return "station"
-    case .podcastShow, .podcastEpisode, .podcastPlaylist, .podcastStation:  return "podcast"
-    case .audioBook:       return "audiobook"
-    case .news:            return "news"
-    case .music:           return "music"
-    case .song:            return "song"
-    case .playlist:        return "playlist"
-    case .musicVideo:      return "music-video"
-    case .movie:           return "movie"
-    case .tvShow:          return "tv-show"
-    case .tvShowEpisode:   return "tv-show-episode"
-    default:               return nil   // album/artist/genre/unknown
+    case .station, .radioStation, .algorithmicRadioStation, .musicStation: "station"
+    case .podcastShow, .podcastEpisode, .podcastPlaylist, .podcastStation: "podcast"
+    case .audioBook: "audiobook"
+    case .news: "news"
+    case .music: "music"
+    case .song: "song"
+    case .playlist: "playlist"
+    case .musicVideo: "music-video"
+    case .movie: "movie"
+    case .tvShow: "tv-show"
+    case .tvShowEpisode: "tv-show-episode"
+    default: nil // album/artist/genre/unknown
     }
   }
 
@@ -56,9 +56,9 @@ class RNABMediaIntentHandler: NSObject, INPlayMediaIntentHandling {
   /// routes to native resume; `.my` to the consumer; everything else is unknown.
   private static func reference(_ ref: INMediaReference) -> MediaIntentCriteria.Reference {
     switch ref {
-    case .currentlyPlaying: return .currentlyPlaying
-    case .my:               return .my
-    default:                return .unknown
+    case .currentlyPlaying: .currentlyPlaying
+    case .my: .my
+    default: .unknown
     }
   }