react-native-audio-browser 0.2.0-next.17 → 0.2.0-next.19

package/src/web/http/RequestConfigBuilder.ts

@@ -56,6 +56,29 @@ function applyImageQueryParams(
   return { ...config, query }
 }
 
+/** Whether `after` carries a header `before` had not already set identically. */
+function addsHeaders(
+  before: Record<string, string> | undefined,
+  after: Record<string, string> | undefined
+): boolean {
+  if (!after) return false
+  return Object.entries(after).some(([key, value]) => before?.[key] !== value)
+}
+
+export interface ResolvedMediaRequest extends RequestConfig {
+  /**
+   * Whether the `media` layer set a header the shared `request` layer had not
+   * already set identically. A media-specific header is the signal that media
+   * is separately authenticated, which is what the web redirect probe gates
+   * on.
+   *
+   * By value, not by declaration: a media layer re-declaring a shared header
+   * with the same value reads as no contribution, which is what keeps an
+   * identity transform from tripping the probe.
+   */
+  mediaLayerHeaders: boolean
+}
+
 /**
  * Builds and merges request configurations.
  * Mirrors Android's RequestConfigBuilder.kt
@@ -98,7 +121,9 @@ export const RequestConfigBuilder = {
    * A layer with a transform wins completely — it receives the base (plus route
    * params) and its result replaces the base; the layer's own static fields are
    * ignored. A layer without a transform merges its static fields over the base.
-   * `path` is carried from the base — only a transform may change it.
+   * `path` is carried from the base — only a transform may change it. A
+   * throwing transform falls back to the base, so the layer is skipped and the
+   * ladder continues.
    *
    * Mirrors native's BrowserManager.applyLayer so web resolves the shared
    * `request` → `<kind>` → route chain identically across platforms.
@@ -113,10 +138,24 @@ export const RequestConfigBuilder = {
     // its result replaces it. When both are set they run as a pipeline — async
     // first, then sync (mirrors native applyLayer).
     if (layer.transform || layer.transformSync) {
-      let cfg = base
-      if (layer.transform) cfg = await layer.transform(cfg, params)
-      if (layer.transformSync) cfg = layer.transformSync(cfg, params)
-      return cfg
+      try {
+        let cfg = base
+        if (layer.transform) cfg = await layer.transform(cfg, params)
+        if (layer.transformSync) cfg = layer.transformSync(cfg, params)
+        return cfg
+      } catch (e) {
+        // A throwing transform costs its own layer, not the ladder: the layers
+        // under it stand, so a relative path still gets the shared `baseUrl`
+        // and a media request keeps the shared credential. One catch around
+        // the pair, as native has it, so a sync stage that throws after a
+        // successful async one also falls back to the layer's input rather
+        // than to a half-applied config.
+        console.error(
+          'Failed to apply transform function, using base config',
+          e
+        )
+        return base
+      }
     }
     return {
       method: layer.method ?? base.method,
@@ -171,38 +210,115 @@ export const RequestConfigBuilder = {
   },
 
   /**
-   * Resolves a media URL using the media configuration.
-   * Creates a RequestConfig with the track's src as the path, then builds the URL.
-   * Supports the transform callback for URL manipulation.
+   * Resolves a media request from the layered configuration, returning the
+   * whole request rather than just its URL.
+   *
+   * The layers resolve headers (and a user agent) alongside the URL, and the
+   * media request needs all of them: native applies them to the AVURLAsset /
+   * ExoPlayer DataSpec, so web has to apply them to Shaka's requests or the
+   * same configuration authenticates on iOS and Android but 401s here.
    *
-   * The shared `request` layer is applied first (its transform runs for media
-   * too, per the documented contract — e.g. a dynamic baseUrl), then the media
-   * transform / static fields on top. Mirrors native's resolveMediaUrl,
-   * including its best-effort behaviour: if a transform throws, fall back to the
-   * original `src` rather than failing the load.
+   * The resolved URL is returned in `path`, with `baseUrl` already folded into
+   * it. Best-effort throughout, but at two levels: a throwing transform or
+   * resolver costs only its own layer (see {@link applyLayer}), and the catch
+   * here is the backstop for anything left — a malformed `baseUrl` reaching
+   * `buildUrl`, say — which falls back to the bare `src`.
+   *
+   * The chain is `request` → `media` → `media.resolve(track)`, matching
+   * native's. See {@link applyMediaResolve} for why the per-track resolver goes
+   * last.
    *
    * @param src The track's src value (may be relative or absolute)
    * @param requestConfig The shared request configuration (applied first)
    * @param mediaConfig The media request configuration
-   * @returns The resolved absolute URL
+   * @param track The track being loaded, for `media.resolve`; without it the
+   *   per-track layer is skipped and the static layers stand
+   * @returns The resolved request, its URL in `path`
    */
-  async resolveMediaUrl(
+  async resolveMediaRequest(
     src: string,
     requestConfig: TransformableRequestConfig | undefined,
-    mediaConfig: MediaRequestConfig | undefined
-  ): Promise<string> {
+    mediaConfig: MediaRequestConfig | undefined,
+    track?: Track
+  ): Promise<ResolvedMediaRequest> {
     try {
-      const config = await this.applyLayers({ path: src }, [
-        requestConfig,
-        mediaConfig
-      ])
-      return BrowserPathHelper.buildUrl(config.baseUrl, config.path ?? src)
+      // The layers are applied one at a time rather than through `applyLayers`
+      // so the media layer's own header contribution stays visible; each
+      // transform still runs exactly once.
+      const shared = await this.applyLayer({ path: src }, requestConfig)
+      const layered = await this.applyLayer(shared, mediaConfig)
+      const config = await this.applyMediaResolve(layered, mediaConfig, track)
+      // buildUrl folds in baseUrl *and* appends `query`; both are cleared on
+      // the way out so the resolved url can't be rebuilt and double-applied.
+      return {
+        ...config,
+        baseUrl: undefined,
+        query: undefined,
+        path: this.buildUrl({ ...config, path: config.path ?? src }),
+        mediaLayerHeaders: addsHeaders(shared.headers, config.headers)
+      }
     } catch (e) {
       console.error('Failed to resolve media URL, using original src', e)
-      return BrowserPathHelper.buildUrl(undefined, src)
+      return {
+        path: BrowserPathHelper.buildUrl(undefined, src),
+        mediaLayerHeaders: false
+      }
     }
   },
 
+  /**
+   * Applies `media.resolve(track)` / `media.resolveSync(track)` as the final,
+   * most-specific layer over an already request+media-layered config. A no-op
+   * without a track or a resolver, so the layers stand on their own.
+   *
+   * Last, not first: native runs the media layer's transform and then lets the
+   * per-track resolver win over the result (Android `applyMediaResolve`, iOS
+   * `applyMediaResolveLayer`), so a resolver minting a signed URL is not
+   * overwritten by the static layer that shaped the unsigned one. Override-wins
+   * on every field, `path` included — replacing the URL outright is the point.
+   *
+   * A throwing resolver falls back to the layered config, as native does: the
+   * per-track shaping is lost, the layers under it are not.
+   */
+  async applyMediaResolve(
+    layered: RequestConfig,
+    mediaConfig: MediaRequestConfig | undefined,
+    track: Track | undefined
+  ): Promise<RequestConfig> {
+    if (!track || !mediaConfig) return layered
+    if (!mediaConfig.resolve && !mediaConfig.resolveSync) return layered
+
+    try {
+      const resolved = await this.composeResolved(mediaConfig, track)
+      return resolved ? this.mergeConfig(layered, resolved) : layered
+    } catch (e) {
+      console.error('Failed to apply media.resolve, using layered config', e)
+      return layered
+    }
+  },
+
+  /**
+   * Runs a config's per-track resolvers and composes their output: async
+   * `resolve` first, then `resolveSync` merged over it, sync winning.
+   * `undefined` when neither is set or neither produced a config.
+   *
+   * Media and artwork share the pairing, so it lives here rather than in both
+   * — the same reason native has `composeResolved`. Errors are the callers' to
+   * handle: the two paths differ on what a throwing resolver costs.
+   */
+  async composeResolved(
+    config: Pick<MediaRequestConfig, 'resolve' | 'resolveSync'>,
+    track: Track
+  ): Promise<RequestConfig | undefined> {
+    let resolved: RequestConfig | undefined
+    if (config.resolve) resolved = await config.resolve(track)
+    if (config.resolveSync) {
+      const sync = config.resolveSync(track)
+      resolved = resolved ? this.mergeConfig(resolved, sync) : sync
+    }
+    return resolved
+  },
+
   /**
    * Resolves an artwork URL and creates an ImageSource.
    * Matches Android's artwork URL transformation behavior.
@@ -297,16 +413,7 @@ export const RequestConfigBuilder = {
 
       // Step 1: Per-track resolution — async `resolve` first, then `resolveSync`
       // merged over it (mirrors native).
-      let resolvedConfig: RequestConfig | undefined
-      if (artworkConfig.resolve) {
-        resolvedConfig = await artworkConfig.resolve(track)
-      }
-      if (artworkConfig.resolveSync) {
-        const r = artworkConfig.resolveSync(track)
-        resolvedConfig = resolvedConfig
-          ? this.mergeConfig(resolvedConfig, r)
-          : r
-      }
+      const resolvedConfig = await this.composeResolved(artworkConfig, track)
       // If a resolver ran but produced nothing and there's no artwork URL, no artwork
       if (
         (artworkConfig.resolve || artworkConfig.resolveSync) &&

package/src/web/http/followMediaRedirect.test.ts

@@ -0,0 +1,289 @@
+import { describe, it, expect, vi } from 'vitest'
+import { followMediaRedirect } from './followMediaRedirect'
+
+const res = (over: Partial<Response> = {}): Response =>
+  ({ ok: true, url: '', ...over }) as Response
+
+describe('followMediaRedirect', () => {
+  const url = 'https://api.example.com/stream/content/7'
+  const signed = 'https://cdn.example.com/track.mp3?sig=abc'
+  const headers = { Authorization: 'Bearer token' }
+
+  it('returns the url the redirect chain lands on', async () => {
+    const fetchImpl = vi.fn().mockResolvedValue(res({ url: signed }))
+
+    const out = await followMediaRedirect(url, headers, { fetchImpl })
+
+    expect(out.src).toBe(signed)
+    // the credential was for the authenticating host, not the one it sent us to
+    expect(out.headers).toBeUndefined()
+    expect(fetchImpl).toHaveBeenCalledWith(url, {
+      method: 'HEAD',
+      headers,
+      redirect: 'follow',
+      signal: expect.any(AbortSignal)
+    })
+  })
+
+  it('does not fetch when there are no headers to apply', async () => {
+    const fetchImpl = vi.fn()
+
+    expect((await followMediaRedirect(url, undefined, { fetchImpl })).src).toBe(
+      url
+    )
+    expect((await followMediaRedirect(url, {}, { fetchImpl })).src).toBe(url)
+    expect(fetchImpl).not.toHaveBeenCalled()
+  })
+
+  it('does not fetch for shared headers that are not a credential', async () => {
+    const fetchImpl = vi.fn()
+
+    // an X-Client-Version that also rides browse requests: probing here would
+    // cost a preflight on every play, at every stream host, for nothing
+    const out = await followMediaRedirect(
+      url,
+      { 'X-Client-Version': '1.2.3' },
+      { fetchImpl }
+    )
+
+    expect(out.src).toBe(url)
+    expect(fetchImpl).not.toHaveBeenCalled()
+  })
+
+  it('fetches for a non-Authorization header the media layer set', async () => {
+    const fetchImpl = vi.fn().mockResolvedValue(res({ url: signed }))
+
+    const out = await followMediaRedirect(
+      url,
+      { 'X-Api-Key': 'k' },
+      { fetchImpl, mediaLayerHeaders: true }
+    )
+
+    expect(out.src).toBe(signed)
+  })
+
+  it('keeps the signed url when the final hop refuses the HEAD', async () => {
+    // presigned S3/GCS sign the method, so a URL signed for GET 403s a HEAD —
+    // but hop one authenticated, so the signed url it handed back is good
+    const fetchImpl = vi
+      .fn()
+      .mockResolvedValue(res({ ok: false, status: 403, url: signed }))
+
+    const out = await followMediaRedirect(url, headers, { fetchImpl })
+
+    expect(out.src).toBe(signed)
+    expect(out.headers).toBeUndefined()
+  })
+
+  /**
+   * A manifest is played through Shaka's networking engine, where the request
+   * filter carries the headers to the manifest, its segments and its keys.
+   * Probing one is a wasted round trip at best, and at worst clears the headers
+   * on a cross-origin redirect so the segments Android still authenticates go
+   * out bare — which is the divergence this skip closes.
+   */
+  describe('manifests are not probed', () => {
+    it.each([
+      'https://api.example.com/stream/7/playlist.m3u8',
+      'https://api.example.com/stream/7/manifest.mpd',
+      'https://api.example.com/stream/7/Manifest.ISM',
+      'https://api.example.com/stream/7/playlist.m3u8?token=abc'
+    ])('skips %s', async (manifest) => {
+      const fetchImpl = vi.fn()
+
+      const out = await followMediaRedirect(manifest, headers, { fetchImpl })
+
+      expect(out.src).toBe(manifest)
+      expect(out.headers).toEqual(headers)
+      expect(fetchImpl).not.toHaveBeenCalled()
+    })
+
+    it('still probes a progressive file', async () => {
+      const fetchImpl = vi.fn().mockResolvedValue(res({ url: signed }))
+
+      await followMediaRedirect('https://api.example.com/7.mp3', headers, {
+        fetchImpl
+      })
+
+      expect(fetchImpl).toHaveBeenCalled()
+    })
+
+    it('still probes an extensionless url', async () => {
+      // Shaka cannot type these from the extension either, so they stay on the
+      // probe path rather than being guessed either way
+      const fetchImpl = vi.fn().mockResolvedValue(res({ url: signed }))
+
+      await followMediaRedirect(url, headers, { fetchImpl })
+
+      expect(fetchImpl).toHaveBeenCalled()
+    })
+  })
+
+  it('does not fetch local urls', async () => {
+    const fetchImpl = vi.fn()
+    const file = 'file:///var/media/track.mp3'
+
+    expect((await followMediaRedirect(file, headers, { fetchImpl })).src).toBe(
+      file
+    )
+    expect(fetchImpl).not.toHaveBeenCalled()
+  })
+
+  it('resolves a url that does not redirect to itself', async () => {
+    const fetchImpl = vi.fn().mockResolvedValue(res({ url }))
+
+    const out = await followMediaRedirect(url, headers, { fetchImpl })
+    expect(out.src).toBe(url)
+    // same origin, so the headers are still ours to send
+    expect(out.headers).toEqual(headers)
+  })
+
+  it('keeps the headers when the redirect stays on the same origin', async () => {
+    const sameOrigin = 'https://api.example.com/signed/track.mp3'
+    const fetchImpl = vi.fn().mockResolvedValue(res({ url: sameOrigin }))
+
+    const out = await followMediaRedirect(url, headers, { fetchImpl })
+
+    expect(out.src).toBe(sameOrigin)
+    expect(out.headers).toEqual(headers)
+  })
+
+  it('keeps the headers for a relative src served from the page origin', async () => {
+    // `fetch('/api/authed/7')` goes to the page's own origin, so the absolute
+    // url the response reports is the same origin — not a hop. Comparing the
+    // raw relative string instead dropped the credential on every such load.
+    vi.stubGlobal('location', { href: 'https://app.example.com/player' })
+    try {
+      const fetchImpl = vi
+        .fn()
+        .mockResolvedValue(res({ url: 'https://app.example.com/api/authed/7' }))
+
+      const out = await followMediaRedirect('/api/authed/7', headers, {
+        fetchImpl
+      })
+
+      expect(out.headers).toEqual(headers)
+    } finally {
+      vi.unstubAllGlobals()
+    }
+  })
+
+  it('clears the headers when a relative src redirects off the page origin', async () => {
+    vi.stubGlobal('location', { href: 'https://app.example.com/player' })
+    try {
+      const fetchImpl = vi.fn().mockResolvedValue(res({ url: signed }))
+
+      const out = await followMediaRedirect('/api/authed/7', headers, {
+        fetchImpl
+      })
+
+      expect(out.src).toBe(signed)
+      expect(out.headers).toBeUndefined()
+    } finally {
+      vi.unstubAllGlobals()
+    }
+  })
+
+  it('keeps the headers when the origin cannot be determined', async () => {
+    // no document base, so a relative src has no origin — unknown is not
+    // evidence of a hop, and guessing cross-origin loses the credential
+    const fetchImpl = vi
+      .fn()
+      .mockResolvedValue(res({ url: 'https://app.example.com/api/authed/7' }))
+
+    const out = await followMediaRedirect('/api/authed/7', headers, {
+      fetchImpl
+    })
+
+    expect(out.headers).toEqual(headers)
+  })
+
+  it('treats a default port as the same origin', async () => {
+    // Android compares HttpUrl.port, which resolves to the scheme default, so
+    // web must normalize too or it strips headers Android keeps
+    const explicitPort = 'https://api.example.com:443/signed/track.mp3'
+    const fetchImpl = vi.fn().mockResolvedValue(res({ url: explicitPort }))
+
+    const out = await followMediaRedirect(url, headers, { fetchImpl })
+
+    expect(out.src).toBe(explicitPort)
+    expect(out.headers).toEqual(headers)
+  })
+
+  it('ignores userinfo when comparing origins', async () => {
+    const withUser = 'https://user@api.example.com/signed/track.mp3'
+    const fetchImpl = vi.fn().mockResolvedValue(res({ url: withUser }))
+
+    const out = await followMediaRedirect(url, headers, { fetchImpl })
+
+    expect(out.headers).toEqual(headers)
+  })
+
+  it('clears the headers on a real cross-origin hop', async () => {
+    const otherPort = 'https://api.example.com:8443/signed/track.mp3'
+    const fetchImpl = vi.fn().mockResolvedValue(res({ url: otherPort }))
+
+    expect(
+      (await followMediaRedirect(url, headers, { fetchImpl })).headers
+    ).toBeUndefined()
+  })
+
+  it('falls back to the original url when the credential is refused', async () => {
+    // no redirect, so the 401 is the authenticating endpoint's own answer
+    const fetchImpl = vi
+      .fn()
+      .mockResolvedValue(res({ ok: false, status: 401, url }))
+
+    expect((await followMediaRedirect(url, headers, { fetchImpl })).src).toBe(
+      url
+    )
+  })
+
+  it('falls back to the original url when the probe outlives its deadline', async () => {
+    vi.useFakeTimers()
+    try {
+      // a host that accepts the connection and then says nothing: without a
+      // deadline the load waits on this forever, with no audio and no error
+      const fetchImpl = vi.fn(() => new Promise<Response>(() => {}))
+      const pending = followMediaRedirect(url, headers, {
+        fetchImpl,
+        timeoutMs: 1000
+      })
+
+      await vi.advanceTimersByTimeAsync(1000)
+      const out = await pending
+
+      expect(out.src).toBe(url)
+      expect(out.headers).toEqual(headers)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('passes an abort signal so a dead host does not hold the connection', async () => {
+    const fetchImpl = vi.fn().mockResolvedValue(res({ url: signed }))
+
+    await followMediaRedirect(url, headers, { fetchImpl })
+
+    expect(fetchImpl.mock.calls[0]?.[1]?.signal).toBeInstanceOf(AbortSignal)
+  })
+
+  it('falls back to the original url when the fetch throws', async () => {
+    const fetchImpl = vi.fn().mockRejectedValue(new Error('CORS'))
+
+    expect((await followMediaRedirect(url, headers, { fetchImpl })).src).toBe(
+      url
+    )
+  })
+
+  it('falls back to the original url when no fetch is available', async () => {
+    const globalFetch = globalThis.fetch
+    // @ts-expect-error — exercising a runtime without fetch
+    globalThis.fetch = undefined
+    try {
+      expect((await followMediaRedirect(url, headers)).src).toBe(url)
+    } finally {
+      globalThis.fetch = globalFetch
+    }
+  })
+})