react-native-audio-browser 0.2.0-next.18 → 0.2.0-next.19

package/android/build.gradle

@@ -199,6 +199,7 @@ dependencies {
   implementation("androidx.media3:media3-exoplayer-dash:${media3Version}")
   implementation("androidx.media3:media3-exoplayer-smoothstreaming:${media3Version}")
   implementation("androidx.media3:media3-common:${media3Version}")
+  implementation("androidx.media3:media3-datasource-okhttp:${media3Version}")
 
   implementation "com.google.guava:guava:33.0.0-android"
   implementation "org.jetbrains.kotlinx:kotlinx-coroutines-guava:1.8.0"
@@ -243,4 +244,4 @@ if (isNewArchitectureEnabled()) {
     libraryName = "AudioBrowser"
     codegenJavaPackageName = "com.audiobrowser"
   }
-}
+}

package/android/src/main/java/com/audiobrowser/player/CrossOriginHeaderStripper.kt

@@ -0,0 +1,77 @@
+package com.audiobrowser.player
+
+import okhttp3.HttpUrl
+import okhttp3.Interceptor
+import okhttp3.Request
+import okhttp3.Response
+
+/**
+ * Drops the caller's headers once a redirect leaves the origin.
+ *
+ * OkHttp does this for `Authorization` alone — RetryAndFollowUpInterceptor.buildRedirectRequest is
+ * a single `removeHeader("Authorization")` — so every other configured header, an `X-Api-Key` say,
+ * still reaches whatever host the first one named. iOS forwards none across a hop and web clears
+ * them too; this brings Android in line.
+ *
+ * Installed as a **network** interceptor, which runs once per hop. `chain.call().request()` is the
+ * call's original request, so the comparison is always against the URL the credential was addressed
+ * to rather than the hop before.
+ *
+ * Scoped to the redirect hop, and only that. An HLS segment or key fetch is its own Call, already
+ * addressed to the absolute CDN URL, and [TransformingDataSource] deliberately re-applies the
+ * config's headers to it — authenticated segments are a supported shape, and web does the same
+ * through Shaka's request filter. So this closes the leak of handing a credential to a host the
+ * caller never named; it is not a rule that the credential stays on one origin.
+ */
+internal object CrossOriginHeaderStripper : Interceptor {
+
+  /**
+   * Headers that describe the transport rather than the caller. OkHttp and media3 set these per hop
+   * — `Range` carries the seek, `Host` and `Connection` are the connection's own — so the request
+   * breaks without them. Everything else on a media request came from the media config, and is the
+   * caller's to send only to the host it addressed.
+   *
+   * `Icy-MetaData` is media3's, not the caller's: `ProgressiveMediaPeriod` asks for Shoutcast
+   * metadata through `ICY_METADATA_HEADERS` on the DataSpec — the same channel
+   * [TransformingDataSource] puts the config's headers on, so nothing downstream can tell them
+   * apart. Dropping it on a hop costs the station's `icy-metaint`, so `IcyDataSource` is never
+   * installed and `onMetadata` stops firing: live "now playing" disappears on exactly the
+   * redirecting streams this interceptor exists for, and the interleaved metadata bytes stay in the
+   * audio as audible chirping. It is a request for a response format, never a credential.
+   */
+  private val TRANSPORT_HEADERS =
+    setOf(
+      "accept",
+      "accept-encoding",
+      "connection",
+      "content-length",
+      "host",
+      "icy-metadata",
+      "range",
+      "transfer-encoding",
+      "user-agent",
+    )
+
+  override fun intercept(chain: Interceptor.Chain): Response {
+    val request = chain.request()
+    val addressed = chain.call().request().url
+    return chain.proceed(
+      if (sameOrigin(addressed, request.url)) request else stripCallerHeaders(request)
+    )
+  }
+
+  /** Scheme, host and port — the same origin test `followMediaRedirect` applies on web. */
+  internal fun sameOrigin(a: HttpUrl, b: HttpUrl): Boolean =
+    a.scheme == b.scheme && a.host == b.host && a.port == b.port
+
+  /** The request with every caller-supplied header removed. */
+  internal fun stripCallerHeaders(request: Request): Request =
+    request
+      .newBuilder()
+      .apply {
+        request.headers.names().forEach { name ->
+          if (name.lowercase() !in TRANSPORT_HEADERS) removeHeader(name)
+        }
+      }
+      .build()
+}

package/android/src/main/java/com/audiobrowser/player/MediaFactory.kt

@@ -4,10 +4,10 @@ import android.content.Context
 import androidx.media3.common.MediaItem
 import androidx.media3.datasource.DataSource
 import androidx.media3.datasource.DefaultDataSource
-import androidx.media3.datasource.DefaultHttpDataSource
 import androidx.media3.datasource.TransferListener
 import androidx.media3.datasource.cache.CacheDataSource
 import androidx.media3.datasource.cache.SimpleCache
+import androidx.media3.datasource.okhttp.OkHttpDataSource
 import androidx.media3.exoplayer.drm.DrmSessionManagerProvider
 import androidx.media3.exoplayer.source.DefaultMediaSourceFactory
 import androidx.media3.exoplayer.source.MediaSource
@@ -16,6 +16,8 @@ import androidx.media3.extractor.DefaultExtractorsFactory
 import com.audiobrowser.model.RetryPolicy
 import com.margelo.nitro.audiobrowser.MediaRequestConfig
 import java.io.IOException
+import java.util.concurrent.TimeUnit
+import okhttp3.OkHttpClient
 
 class MediaFactory(
   private val context: Context,
@@ -31,6 +33,20 @@ class MediaFactory(
 
   companion object {
     private const val DEFAULT_USER_AGENT = "react-native-audio-browser"
+
+    /**
+     * The client media requests go out on. One per process so connections are reused; not
+     * `HttpClient`'s browse client, whose read timeout is sized for JSON and would cut a long media
+     * read short. The timeouts are media3's own defaults, so stall detection and
+     * [RetryLoadErrorHandlingPolicy] behave as they did before.
+     */
+    private val mediaHttpClient: OkHttpClient by lazy {
+      OkHttpClient.Builder()
+        .connectTimeout(8, TimeUnit.SECONDS)
+        .readTimeout(8, TimeUnit.SECONDS)
+        .addNetworkInterceptor(CrossOriginHeaderStripper)
+        .build()
+    }
   }
 
   private val extractorsFactory =
@@ -95,17 +111,19 @@ class MediaFactory(
     // ExoPlayer's IO thread. This prevents deadlocks when the JS thread is blocked by
     // synchronous Nitro calls (e.g., seekTo) while a media transform callback needs the
     // JS thread to resolve.
+
+    // OkHttp rather than DefaultHttpDataSource, for how each treats a redirect.
+    // DefaultHttpDataSource re-applies the request headers on every hop, handing
+    // an Authorization header to whatever host the first one named. OkHttp drops
+    // that one header itself, and [CrossOriginHeaderStripper] drops the rest.
     val httpFactory =
-      DefaultHttpDataSource.Factory().apply {
-        // Deliberately NOT setUserAgent(): DefaultHttpDataSource applies the factory
-        // user-agent as a FINAL setRequestProperty("User-Agent", …) that runs after —
-        // and overrides — the per-request DataSpec headers. That would clobber the
-        // User-Agent TransformingDataSource sets per request (the whole point of the
-        // per-request userAgent override). Supplying the same value as a default
-        // request property keeps the default for un-overridden requests while letting
-        // the per-request DataSpec header win.
+      OkHttpDataSource.Factory(mediaHttpClient).apply {
+        // Deliberately NOT setUserAgent(): it is applied last via addHeader(),
+        // which appends, so a request already carrying one would send two. As a
+        // default request property it is merged under dataSpec.httpRequestHeaders
+        // and applied with header(), letting TransformingDataSource's per-request
+        // override win.
         setDefaultRequestProperties(mapOf("User-Agent" to DEFAULT_USER_AGENT))
-        setAllowCrossProtocolRedirects(true)
         // Connect transfer listener for bandwidth measurement
         transferListener?.let { setTransferListener(it) }
       }

package/android/src/test/java/com/audiobrowser/player/CrossOriginHeaderStripperTest.kt

@@ -0,0 +1,94 @@
+package com.audiobrowser.player
+
+import okhttp3.HttpUrl.Companion.toHttpUrl
+import okhttp3.Request
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * OkHttp drops `Authorization` across a cross-origin redirect by itself; these cover the rest,
+ * which it forwards and [CrossOriginHeaderStripper.stripCallerHeaders] removes.
+ */
+class CrossOriginHeaderStripperTest {
+
+  private val api = "https://api.example.com/stream/7".toHttpUrl()
+
+  @Test
+  fun `same origin ignores the path`() {
+    assertTrue(
+      CrossOriginHeaderStripper.sameOrigin(
+        api,
+        "https://api.example.com/signed/track.mp3".toHttpUrl(),
+      )
+    )
+  }
+
+  @Test
+  fun `a different host, port or scheme is a different origin`() {
+    assertFalse(
+      CrossOriginHeaderStripper.sameOrigin(api, "https://cdn.example.com/track.mp3".toHttpUrl())
+    )
+    assertFalse(
+      CrossOriginHeaderStripper.sameOrigin(
+        api,
+        "https://api.example.com:8443/track.mp3".toHttpUrl(),
+      )
+    )
+    assertFalse(
+      CrossOriginHeaderStripper.sameOrigin(api, "http://api.example.com/track.mp3".toHttpUrl())
+    )
+  }
+
+  @Test
+  fun `strips every caller header, whatever its name`() {
+    val request =
+      Request.Builder()
+        .url(api)
+        .header("Authorization", "Bearer token")
+        .header("X-Api-Key", "k")
+        .header("Cookie", "session=abc")
+        .build()
+
+    val stripped = CrossOriginHeaderStripper.stripCallerHeaders(request)
+
+    assertNull(stripped.header("Authorization"))
+    assertNull(stripped.header("X-Api-Key"))
+    assertNull(stripped.header("Cookie"))
+  }
+
+  @Test
+  fun `keeps the transport headers the hop needs`() {
+    val request =
+      Request.Builder()
+        .url(api)
+        .header("Range", "bytes=1024-")
+        .header("accept-encoding", "identity")
+        .header("User-Agent", "react-native-audio-browser")
+        .header("X-Api-Key", "k")
+        .build()
+
+    val stripped = CrossOriginHeaderStripper.stripCallerHeaders(request)
+
+    // a dropped Range would restart the read from zero on every seek past a redirect
+    assertEquals("bytes=1024-", stripped.header("Range"))
+    assertEquals("identity", stripped.header("Accept-Encoding"))
+    assertEquals("react-native-audio-browser", stripped.header("User-Agent"))
+    assertNull(stripped.header("X-Api-Key"))
+  }
+
+  @Test
+  fun `keeps media3's ICY metadata request across a hop`() {
+    // ProgressiveMediaPeriod asks for Shoutcast metadata on the DataSpec, the same channel the
+    // config's headers arrive on. Dropping it costs icy-metaint, so onMetadata never fires again.
+    val request =
+      Request.Builder().url(api).header("Icy-MetaData", "1").header("X-Api-Key", "k").build()
+
+    val stripped = CrossOriginHeaderStripper.stripCallerHeaders(request)
+
+    assertEquals("1", stripped.header("Icy-MetaData"))
+    assertNull(stripped.header("X-Api-Key"))
+  }
+}

package/lib/commonjs/web/NativeAudioBrowser.js

@@ -10,6 +10,7 @@ var _classifyTrackNavigation = require("./browser/classifyTrackNavigation");
 var _FavoriteManager = require("./browser/FavoriteManager");
 var _NavigationErrorManager = require("./browser/NavigationErrorManager");
 var _SearchManager = require("./browser/SearchManager");
+var _followMediaRedirect = require("./http/followMediaRedirect");
 var _HttpClient = require("./http/HttpClient");
 var _RequestConfigBuilder = require("./http/RequestConfigBuilder");
 var _NowPlayingManager = require("./player/NowPlayingManager");
@@ -44,7 +45,6 @@ class NativeAudioBrowser extends _TrackPlayer.QueuePlayer {
   // Managers
 
   // Player state
-  currentLoadId = 0;
   progressTimer = new _PlaybackTimer.PlaybackTimer();
   intervalTimer = new _PlaybackTimer.PlaybackTimer();
   _online = typeof navigator !== 'undefined' ? navigator.onLine : true;
@@ -211,6 +211,13 @@ class NativeAudioBrowser extends _TrackPlayer.QueuePlayer {
       this.onPlaybackError({
         error: newState.error
       });
+    } else if (oldState.state === 'error') {
+      // Leaving the error state clears it, as it does natively. The getter
+      // already reads undefined — consumers subscribe to the event, so without
+      // this a stale error outlives the next successful load.
+      this.onPlaybackError({
+        error: undefined
+      });
     }
   }
   /**
@@ -455,68 +462,98 @@ class NativeAudioBrowser extends _TrackPlayer.QueuePlayer {
    * Supports the transform callback for URL manipulation.
    * Mirrors Android's MediaFactory.getMediaRequestConfig behavior.
    */
-  async resolveMediaUrl(src) {
+  async resolveMediaRequest(src, track) {
+    // The *resolved* request layer, not `configuration.request`: a
+    // resolver-only config would otherwise reach media with no baseUrl and no
+    // headers. Browse, search and browse artwork all read it this way too.
+    //
+    // Caught, because unlike those three this one cannot fail the load: a
+    // resolver hiccup — a token refresh timing out — would otherwise take down
+    // a track whose `src` is already absolute and public and needed no layer at
+    // all. Native degrades the same way, `getMediaRequestConfig` returning null
+    // and the original URL playing on.
+    let request;
+    try {
+      request = await this.browserManager.resolvedRequestConfig();
+    } catch (e) {
+      console.error('Failed to resolve the request layer for media', e);
+    }
     const {
-      request,
       media
     } = this.browserManager.configuration;
-    return _RequestConfigBuilder.RequestConfigBuilder.resolveMediaUrl(src, request, media);
+    return _RequestConfigBuilder.RequestConfigBuilder.resolveMediaRequest(src, request, media, track);
   }
 
   /**
-   * Reload from the queue's own entry, whose `src` is still unresolved —
-   * `current` holds the resolved track, and re-feeding it into `load()` would
-   * re-resolve the resolved URL (double-applying a `transform`) and replace
-   * the queue entry with it.
+   * The queue's own entry, so the queue stays the source of truth for what is
+   * playing. `current` preserves the track as queued — the resolved URL is
+   * passed to `load()` separately — so either is safe to re-feed.
    */
-  reloadCurrent() {
+  trackToReload() {
     const index = this.queue.currentIndex;
-    const sourceTrack = index !== undefined ? this.queue.getTrack(index) : undefined;
-    if (sourceTrack) {
-      this.load(sourceTrack);
-    } else {
-      super.reloadCurrent();
-    }
+    const queued = index !== undefined ? this.queue.getTrack(index) : undefined;
+    // The queue entry wins, so it stays the source of truth for what is
+    // playing; `current` is the fallback for a player loaded without one.
+    return queued ?? super.trackToReload();
   }
-  load(track, callback) {
-    const element = this.requireElement();
-
-    // Clear now playing override when track changes (matches Android's PlayerListener.onMediaItemTransition)
-    this.nowPlayingManager.clearNowPlayingOverride();
 
-    // Match Android: load() modifies the queue.
-    // If queue is empty, add the track. If queue has items, replace at currentIndex.
+  /**
+   * Makes `track` the queue's current entry, emitting the change.
+   *
+   * Matches Android, where `load()` modifies the queue: an empty queue takes
+   * the track as its only entry, a populated one has its current entry
+   * replaced.
+   */
+  syncQueueTo(track) {
     if (this.queue.length === 0) {
       this.queue.setTracks([track]);
       this.queue.currentIndex = 0;
       this.emitQueueChanged();
-    } else if (this.queue.currentIndex !== undefined && this.queue.getTrack(this.queue.currentIndex) !== track) {
+      return;
+    }
+    if (this.queue.currentIndex !== undefined && this.queue.getTrack(this.queue.currentIndex) !== track) {
       this.queue.replaceTrack(this.queue.currentIndex, track);
       this.emitQueueChanged();
     }
+  }
+
+  /**
+   * Everything native does in its media-item transition, all of it before any
+   * network work: announce the new track, publish its now-playing metadata,
+   * cut the outgoing one, and report `loading`.
+   *
+   * Android's `onMediaItemTransition` fires at `prepare()` and does exactly
+   * this, with its LOADING following from `onEvents`; resolution happens later
+   * still, inside `TransformingDataSource.open()`. Doing it here rather than
+   * after the URL resolves is what gives the resolution window a state, and
+   * keeps `activeTrack` ahead of `loading` — the order a consumer that reads
+   * `getActiveTrack()` on the loading edge depends on.
+   */
+  transitionTo(track) {
+    const element = this.requireElement();
     const lastTrack = this.current;
     const lastPosition = element.currentTime;
     const lastIndex = this.queue.lastIndex;
     const currentIndex = this.queue.currentIndex;
 
-    // Set loading flag early so seekTo() calls during async URL resolution
-    // are captured as pending seeks rather than silently dropped
-    this._loadInProgress = true;
-    this._pendingSeek = undefined;
+    // A re-prepare of the item already current is not a transition, and must
+    // not be announced as one: ExoPlayer's `prepare()` does not re-fire
+    // `onMediaItemTransition` for an unchanged media item, so a consumer that
+    // resets on a track change would have its UI wiped by every retry. The
+    // `lastTrack === track` payload was the tell.
+    const isTransition = this.current !== track;
 
-    // Resolve the media URL before loading (async but we don't await)
-    const loadId = ++this.currentLoadId;
-    const doLoad = async () => {
-      const resolvedTrack = track.src ? {
-        ...track,
-        src: await this.resolveMediaUrl(track.src)
-      } : track;
-
-      // A newer load() was called while resolving — discard this stale result
-      if (loadId !== this.currentLoadId) {
-        return;
-      }
-      super.load(resolvedTrack, loadedTrack => {
+    // `current` first, so `getActiveTrack()` already reads the new track inside
+    // a handler and so `getNowPlaying()` publishes the new track's metadata. It
+    // also stops `getActiveTrackIndex()` — which moved with the queue already,
+    // synchronously — from disagreeing with it for the length of the
+    // resolution.
+    this.current = track;
+
+    // Separately guarded: a throwing consumer handler must not skip the
+    // publish, and neither may fail the load.
+    if (isTransition) {
+      try {
         this.onPlaybackActiveTrackChanged({
           lastTrack,
           lastPosition,
@@ -524,24 +561,100 @@ class NativeAudioBrowser extends _TrackPlayer.QueuePlayer {
           index: currentIndex,
           track
         });
-
-        // Update now playing metadata
+      } catch (error) {
+        console.error('Failed to announce the active track change:', error);
+      }
+      try {
+        // Once, here: duration reaches the media session through
+        // `updateProgress()` on each tick, so only metadata needs publishing.
+        // Android publishes from the same transition handler that announces.
         const nowPlaying = this.getNowPlaying();
         if (nowPlaying) {
           this.publishNowPlaying(nowPlaying);
         }
+      } catch (error) {
+        console.error('Failed to publish now-playing metadata:', error);
+      }
+    }
+
+    // Stop the outgoing track now rather than when Shaka eventually gets a URL.
+    // Announcing the new track while the old one is still audible is worse than
+    // the silence, and native has no such window — prepare() cuts the old item
+    // at the moment it announces. This adds no teardown: `player.load()`
+    // already unloads first (shaka player.js:1757-1762). It only moves when.
+    // Verified in a real browser to emit no `pause`, so no state comes of it.
+    this.requirePlayer().unload().catch(error => console.error('Failed to unload the previous track:', error));
+
+    // Loading covers the resolution too. Shaka dispatches its own `loading`
+    // once `player.load()` is called — after resolution — and the state setter
+    // drops that as a no-op. The `buffering` that follows is Shaka's to report.
+    this.dispatch({
+      type: 'trackLoading'
+    });
+  }
+  load(track, callback) {
+    // Before the queue is touched, so a load before `setupPlayer()` throws
+    // rather than half-applying.
+    this.requireElement();
 
+    // Clear now playing override when track changes (matches Android's PlayerListener.onMediaItemTransition)
+    this.nowPlayingManager.clearNowPlayingOverride();
+    this.syncQueueTo(track);
+
+    // Begun here, at the call, so a newer load supersedes this one immediately
+    // rather than once its own URL has resolved. Both continuations below carry
+    // it, as does `super.load()`.
+    const attempt = this.beginLoadAttempt();
+
+    // Loading ends being stopped. `dispatch()` drops every event while
+    // `_isStopped`, to keep Shaka's teardown noise off the stopped state, so
+    // the `trackLoading` in `transitionTo` would be swallowed on the stop → play
+    // path and the resolution window would report nothing. `super.load()` clears
+    // this too, but only after the URL resolves.
+    this._isStopped = false;
+
+    // Set loading flag early so seekTo() calls during async URL resolution
+    // are captured as pending seeks rather than silently dropped
+    this._loadInProgress = true;
+    this._pendingSeek = undefined;
+    this.transitionTo(track);
+
+    // Resolve the media URL before loading (async but we don't await)
+    const doLoad = async () => {
+      const resolvedRequest = track.src ? await this.resolveMediaRequest(track.src, track) : undefined;
+      // Web-only, and forced: a progressive file plays via `mediaElement.src`,
+      // which cannot carry headers. Native sends them with the media request
+      // and follows the redirect inline, so it needs none of this.
+      const resolvedMedia = resolvedRequest ? await (0, _followMediaRedirect.followMediaRedirect)(resolvedRequest.path ?? track.src, resolvedRequest.headers, {
+        mediaLayerHeaders: resolvedRequest.mediaLayerHeaders
+      }) : undefined;
+
+      // Something took over while the URL was resolving — discard this result
+      if (!attempt.isCurrent) return;
+      super.load(track, loadedTrack => {
         // Call the provided callback if any
         if (callback) {
           callback(loadedTrack);
         }
+      }, {
+        headers: resolvedMedia?.headers,
+        src: resolvedMedia?.src,
+        attempt
       });
     };
 
     // Execute async load without blocking, with error handling
     doLoad().catch(error => {
-      // Only the active load may surface a resolution failure.
-      if (loadId !== this.currentLoadId) return;
+      // A backstop with no reachable trigger today, kept because an unhandled
+      // rejection would be worse than a dead branch. Every await inside
+      // `doLoad` catches internally; `shaka.Player.load` is `async`, so it
+      // rejects rather than throwing and its rejection is handled against the
+      // attempt inside `Player.load`; and `this.player` is only ever assigned,
+      // so `requirePlayer()` cannot start succeeding and then fail mid-load.
+      //
+      // No attempt check either, for the same reason it would be dead: nothing
+      // awaits between the guard above and `super.load()`, so the attempt
+      // cannot have changed. Add an await there and this needs the check back.
       this._loadInProgress = false;
       this._pendingSeek = undefined;
       console.error('Error loading track:', error);
@@ -704,10 +817,8 @@ class NativeAudioBrowser extends _TrackPlayer.QueuePlayer {
     this.clearSleepTimerIfFading();
   }
   stop() {
-    // Invalidate any in-flight load: its post-await continuation would call
-    // super.load(), whose first line re-arms the player (_isStopped = false)
-    // and revives the state out of Stopped.
-    this.currentLoadId++;
+    // `Player.stop()` cancels the load attempt, so an in-flight load's
+    // continuation cannot re-arm the player and revive it out of Stopped.
     super.stop();
     this.clearSleepTimerIfFading();
   }
@@ -733,11 +844,13 @@ class NativeAudioBrowser extends _TrackPlayer.QueuePlayer {
       this.sleepTimer.clear();
       this.pause();
       this.onSleepTimerChanged(null);
-      return;
+      // Nothing is loading, so the caller must still report the end — the
+      // element has stopped and its own `pause` is swallowed as end-of-track.
+      return false;
     }
 
     // Otherwise proceed with normal track end behavior
-    super.onTrackEnded();
+    return super.onTrackEnded();
   }
 
   // MARK: Queue management