react-native-audio-browser 0.2.0-next.3 → 0.2.0-next.30

package/src/web/http/followMediaRedirect.test.ts

@@ -0,0 +1,289 @@
+import { describe, it, expect, vi } from 'vitest'
+import { followMediaRedirect } from './followMediaRedirect'
+
+const res = (over: Partial<Response> = {}): Response =>
+  ({ ok: true, url: '', ...over }) as Response
+
+describe('followMediaRedirect', () => {
+  const url = 'https://api.example.com/stream/content/7'
+  const signed = 'https://cdn.example.com/track.mp3?sig=abc'
+  const headers = { Authorization: 'Bearer token' }
+
+  it('returns the url the redirect chain lands on', async () => {
+    const fetchImpl = vi.fn().mockResolvedValue(res({ url: signed }))
+
+    const out = await followMediaRedirect(url, headers, { fetchImpl })
+
+    expect(out.src).toBe(signed)
+    // the credential was for the authenticating host, not the one it sent us to
+    expect(out.headers).toBeUndefined()
+    expect(fetchImpl).toHaveBeenCalledWith(url, {
+      method: 'HEAD',
+      headers,
+      redirect: 'follow',
+      signal: expect.any(AbortSignal)
+    })
+  })
+
+  it('does not fetch when there are no headers to apply', async () => {
+    const fetchImpl = vi.fn()
+
+    expect((await followMediaRedirect(url, undefined, { fetchImpl })).src).toBe(
+      url
+    )
+    expect((await followMediaRedirect(url, {}, { fetchImpl })).src).toBe(url)
+    expect(fetchImpl).not.toHaveBeenCalled()
+  })
+
+  it('does not fetch for shared headers that are not a credential', async () => {
+    const fetchImpl = vi.fn()
+
+    // an X-Client-Version that also rides browse requests: probing here would
+    // cost a preflight on every play, at every stream host, for nothing
+    const out = await followMediaRedirect(
+      url,
+      { 'X-Client-Version': '1.2.3' },
+      { fetchImpl }
+    )
+
+    expect(out.src).toBe(url)
+    expect(fetchImpl).not.toHaveBeenCalled()
+  })
+
+  it('fetches for a non-Authorization header the media layer set', async () => {
+    const fetchImpl = vi.fn().mockResolvedValue(res({ url: signed }))
+
+    const out = await followMediaRedirect(
+      url,
+      { 'X-Api-Key': 'k' },
+      { fetchImpl, mediaLayerHeaders: true }
+    )
+
+    expect(out.src).toBe(signed)
+  })
+
+  it('keeps the signed url when the final hop refuses the HEAD', async () => {
+    // presigned S3/GCS sign the method, so a URL signed for GET 403s a HEAD —
+    // but hop one authenticated, so the signed url it handed back is good
+    const fetchImpl = vi
+      .fn()
+      .mockResolvedValue(res({ ok: false, status: 403, url: signed }))
+
+    const out = await followMediaRedirect(url, headers, { fetchImpl })
+
+    expect(out.src).toBe(signed)
+    expect(out.headers).toBeUndefined()
+  })
+
+  /**
+   * A manifest is played through Shaka's networking engine, where the request
+   * filter carries the headers to the manifest, its segments and its keys.
+   * Probing one is a wasted round trip at best, and at worst clears the headers
+   * on a cross-origin redirect so the segments Android still authenticates go
+   * out bare — which is the divergence this skip closes.
+   */
+  describe('manifests are not probed', () => {
+    it.each([
+      'https://api.example.com/stream/7/playlist.m3u8',
+      'https://api.example.com/stream/7/manifest.mpd',
+      'https://api.example.com/stream/7/Manifest.ISM',
+      'https://api.example.com/stream/7/playlist.m3u8?token=abc'
+    ])('skips %s', async (manifest) => {
+      const fetchImpl = vi.fn()
+
+      const out = await followMediaRedirect(manifest, headers, { fetchImpl })
+
+      expect(out.src).toBe(manifest)
+      expect(out.headers).toEqual(headers)
+      expect(fetchImpl).not.toHaveBeenCalled()
+    })
+
+    it('still probes a progressive file', async () => {
+      const fetchImpl = vi.fn().mockResolvedValue(res({ url: signed }))
+
+      await followMediaRedirect('https://api.example.com/7.mp3', headers, {
+        fetchImpl
+      })
+
+      expect(fetchImpl).toHaveBeenCalled()
+    })
+
+    it('still probes an extensionless url', async () => {
+      // Shaka cannot type these from the extension either, so they stay on the
+      // probe path rather than being guessed either way
+      const fetchImpl = vi.fn().mockResolvedValue(res({ url: signed }))
+
+      await followMediaRedirect(url, headers, { fetchImpl })
+
+      expect(fetchImpl).toHaveBeenCalled()
+    })
+  })
+
+  it('does not fetch local urls', async () => {
+    const fetchImpl = vi.fn()
+    const file = 'file:///var/media/track.mp3'
+
+    expect((await followMediaRedirect(file, headers, { fetchImpl })).src).toBe(
+      file
+    )
+    expect(fetchImpl).not.toHaveBeenCalled()
+  })
+
+  it('resolves a url that does not redirect to itself', async () => {
+    const fetchImpl = vi.fn().mockResolvedValue(res({ url }))
+
+    const out = await followMediaRedirect(url, headers, { fetchImpl })
+    expect(out.src).toBe(url)
+    // same origin, so the headers are still ours to send
+    expect(out.headers).toEqual(headers)
+  })
+
+  it('keeps the headers when the redirect stays on the same origin', async () => {
+    const sameOrigin = 'https://api.example.com/signed/track.mp3'
+    const fetchImpl = vi.fn().mockResolvedValue(res({ url: sameOrigin }))
+
+    const out = await followMediaRedirect(url, headers, { fetchImpl })
+
+    expect(out.src).toBe(sameOrigin)
+    expect(out.headers).toEqual(headers)
+  })
+
+  it('keeps the headers for a relative src served from the page origin', async () => {
+    // `fetch('/api/authed/7')` goes to the page's own origin, so the absolute
+    // url the response reports is the same origin — not a hop. Comparing the
+    // raw relative string instead dropped the credential on every such load.
+    vi.stubGlobal('location', { href: 'https://app.example.com/player' })
+    try {
+      const fetchImpl = vi
+        .fn()
+        .mockResolvedValue(res({ url: 'https://app.example.com/api/authed/7' }))
+
+      const out = await followMediaRedirect('/api/authed/7', headers, {
+        fetchImpl
+      })
+
+      expect(out.headers).toEqual(headers)
+    } finally {
+      vi.unstubAllGlobals()
+    }
+  })
+
+  it('clears the headers when a relative src redirects off the page origin', async () => {
+    vi.stubGlobal('location', { href: 'https://app.example.com/player' })
+    try {
+      const fetchImpl = vi.fn().mockResolvedValue(res({ url: signed }))
+
+      const out = await followMediaRedirect('/api/authed/7', headers, {
+        fetchImpl
+      })
+
+      expect(out.src).toBe(signed)
+      expect(out.headers).toBeUndefined()
+    } finally {
+      vi.unstubAllGlobals()
+    }
+  })
+
+  it('keeps the headers when the origin cannot be determined', async () => {
+    // no document base, so a relative src has no origin — unknown is not
+    // evidence of a hop, and guessing cross-origin loses the credential
+    const fetchImpl = vi
+      .fn()
+      .mockResolvedValue(res({ url: 'https://app.example.com/api/authed/7' }))
+
+    const out = await followMediaRedirect('/api/authed/7', headers, {
+      fetchImpl
+    })
+
+    expect(out.headers).toEqual(headers)
+  })
+
+  it('treats a default port as the same origin', async () => {
+    // Android compares HttpUrl.port, which resolves to the scheme default, so
+    // web must normalize too or it strips headers Android keeps
+    const explicitPort = 'https://api.example.com:443/signed/track.mp3'
+    const fetchImpl = vi.fn().mockResolvedValue(res({ url: explicitPort }))
+
+    const out = await followMediaRedirect(url, headers, { fetchImpl })
+
+    expect(out.src).toBe(explicitPort)
+    expect(out.headers).toEqual(headers)
+  })
+
+  it('ignores userinfo when comparing origins', async () => {
+    const withUser = 'https://user@api.example.com/signed/track.mp3'
+    const fetchImpl = vi.fn().mockResolvedValue(res({ url: withUser }))
+
+    const out = await followMediaRedirect(url, headers, { fetchImpl })
+
+    expect(out.headers).toEqual(headers)
+  })
+
+  it('clears the headers on a real cross-origin hop', async () => {
+    const otherPort = 'https://api.example.com:8443/signed/track.mp3'
+    const fetchImpl = vi.fn().mockResolvedValue(res({ url: otherPort }))
+
+    expect(
+      (await followMediaRedirect(url, headers, { fetchImpl })).headers
+    ).toBeUndefined()
+  })
+
+  it('falls back to the original url when the credential is refused', async () => {
+    // no redirect, so the 401 is the authenticating endpoint's own answer
+    const fetchImpl = vi
+      .fn()
+      .mockResolvedValue(res({ ok: false, status: 401, url }))
+
+    expect((await followMediaRedirect(url, headers, { fetchImpl })).src).toBe(
+      url
+    )
+  })
+
+  it('falls back to the original url when the probe outlives its deadline', async () => {
+    vi.useFakeTimers()
+    try {
+      // a host that accepts the connection and then says nothing: without a
+      // deadline the load waits on this forever, with no audio and no error
+      const fetchImpl = vi.fn(() => new Promise<Response>(() => {}))
+      const pending = followMediaRedirect(url, headers, {
+        fetchImpl,
+        timeoutMs: 1000
+      })
+
+      await vi.advanceTimersByTimeAsync(1000)
+      const out = await pending
+
+      expect(out.src).toBe(url)
+      expect(out.headers).toEqual(headers)
+    } finally {
+      vi.useRealTimers()
+    }
+  })
+
+  it('passes an abort signal so a dead host does not hold the connection', async () => {
+    const fetchImpl = vi.fn().mockResolvedValue(res({ url: signed }))
+
+    await followMediaRedirect(url, headers, { fetchImpl })
+
+    expect(fetchImpl.mock.calls[0]?.[1]?.signal).toBeInstanceOf(AbortSignal)
+  })
+
+  it('falls back to the original url when the fetch throws', async () => {
+    const fetchImpl = vi.fn().mockRejectedValue(new Error('CORS'))
+
+    expect((await followMediaRedirect(url, headers, { fetchImpl })).src).toBe(
+      url
+    )
+  })
+
+  it('falls back to the original url when no fetch is available', async () => {
+    const globalFetch = globalThis.fetch
+    // @ts-expect-error — exercising a runtime without fetch
+    globalThis.fetch = undefined
+    try {
+      expect((await followMediaRedirect(url, headers)).src).toBe(url)
+    } finally {
+      globalThis.fetch = globalFetch
+    }
+  })
+})

package/src/web/http/followMediaRedirect.ts

@@ -0,0 +1,253 @@
+/**
+ * Resolves a media URL that is authenticated by a header.
+ *
+ * Shaka only routes manifest requests through its networking engine, where a
+ * request filter can attach headers. A progressive file is played by assigning
+ * `mediaElement.src`, and a media element cannot send custom headers — so such
+ * a URL is unplayable that way. Following the redirect here yields the signed,
+ * public URL these endpoints hand back, which needs no auth of its own.
+ *
+ * Best effort and bounded: anything that fails — including taking too long, see
+ * {@link PROBE_TIMEOUT_MS} — falls back to the original URL, so the load fails
+ * or succeeds on its own terms rather than ours. It must never be the reason a
+ * load hangs: `load()` awaits this before Shaka sees the URL at all.
+ *
+ * Gated, because the probe is not free: a HEAD at a third-party stream host
+ * costs a CORS preflight, and most will refuse it, so an app that never
+ * authenticates its media would pay a round trip on every play for a result it
+ * always discards. It runs only for headers that look like media credentials
+ * ({@link isMediaAuth}), on media a media element actually has to play
+ * ({@link isManifestUrl}), and never on a URL the browser resolves locally.
+ */
+
+/** URLs the browser resolves locally; there is no redirect to follow. */
+const isLocalUrl = (url: string): boolean =>
+  /^(file|blob|data|mediasource):/i.test(url)
+
+/**
+ * Extensions Shaka types as a manifest, from its own `EXTENSIONS_TO_MIME_TYPES_`
+ * map: HLS, DASH and Smooth Streaming.
+ */
+const MANIFEST_EXTENSIONS = new Set(['m3u8', 'mpd', 'ism'])
+
+/**
+ * Whether Shaka will parse this as a manifest rather than hand it to the media
+ * element — in which case the probe has nothing to offer and something to cost.
+ *
+ * A manifest goes through Shaka's networking engine, where the request filter
+ * attaches the headers to the manifest, its segments and any key requests. The
+ * probe cannot improve on that, and it actively breaks it: on a cross-origin
+ * redirect the probe clears the headers, so the segments that Android still
+ * authenticates would go out bare and 401. So this is a correctness fix as much
+ * as it is one fewer round trip.
+ *
+ * Extension-based, and therefore partial — Shaka guesses the same way
+ * (`NetworkingUtils.getExtension`), but plenty of HLS endpoints have no
+ * extension at all. Those still get probed, which is the status quo rather than
+ * a regression. Nothing on `Track` carries a MIME type to do better with.
+ */
+const isManifestUrl = (url: string): boolean => {
+  const path = url.split(/[?#]/)[0] ?? ''
+  const filename = path.slice(path.lastIndexOf('/') + 1)
+  const pieces = filename.split('.')
+  return (
+    pieces.length > 1 &&
+    MANIFEST_EXTENSIONS.has(pieces[pieces.length - 1]!.toLowerCase())
+  )
+}
+
+export interface FollowMediaRedirectOptions {
+  /** Injected for testing; defaults to the global `fetch`. */
+  fetchImpl?: typeof fetch
+  /**
+   * Whether the `media` layer contributed any of these headers, rather than
+   * their all arriving from the shared `request` layer.
+   */
+  mediaLayerHeaders?: boolean
+  /** Milliseconds before the probe gives up. Defaults to {@link PROBE_TIMEOUT_MS}. */
+  timeoutMs?: number
+}
+
+/**
+ * How long the probe may take before the original URL is played instead.
+ *
+ * The same 8s the Android media client allows a connect or a read
+ * (`MediaFactory.mediaHttpClient`), which is generous for a HEAD but errs the
+ * safe way: a slow-but-working auth endpoint should not be abandoned, since
+ * giving up means playing a URL that will 401.
+ */
+const PROBE_TIMEOUT_MS = 8_000
+
+/**
+ * `AbortSignal.timeout` where it exists (Safari 16+, Chrome 103+, Node 17.3+),
+ * else a hand-rolled equivalent, else nothing — an environment with neither
+ * still gets the deadline below, just without cancelling the request.
+ */
+const timeoutSignal = (ms: number): AbortSignal | undefined => {
+  if (typeof AbortSignal === 'undefined') return undefined
+  if (typeof AbortSignal.timeout === 'function') return AbortSignal.timeout(ms)
+  if (typeof AbortController === 'undefined') return undefined
+  const controller = new AbortController()
+  setTimeout(() => controller.abort(), ms)
+  return controller.signal
+}
+
+/**
+ * The probe, with a deadline. `load()` awaits this before Shaka is asked to
+ * play anything, so an unreachable host would otherwise stall the load
+ * indefinitely — no audio, and no error to show for it.
+ *
+ * Two mechanisms, each with its own job: the signal cancels the request, so a
+ * dead host does not hold a connection open behind us, and the race bounds *us*
+ * even where the fetch implementation ignores the signal. Whichever fires, the
+ * caller treats it as any other probe failure and plays the original URL.
+ */
+const fetchWithDeadline = async (
+  doFetch: typeof fetch,
+  url: string,
+  headers: Record<string, string>,
+  timeoutMs: number
+): Promise<Response> => {
+  let timer: ReturnType<typeof setTimeout> | undefined
+  try {
+    return await Promise.race([
+      doFetch(url, {
+        method: 'HEAD',
+        headers,
+        redirect: 'follow',
+        signal: timeoutSignal(timeoutMs)
+      }),
+      new Promise<never>((_resolve, reject) => {
+        timer = setTimeout(
+          () =>
+            reject(
+              new Error(`Media redirect probe timed out (${timeoutMs}ms)`)
+            ),
+          timeoutMs
+        )
+      })
+    ])
+  } finally {
+    if (timer !== undefined) clearTimeout(timer)
+  }
+}
+
+/**
+ * Whether these headers look like a media credential — the only thing the
+ * probe can fix, and the only thing worth a preflight.
+ *
+ * A header the `media` layer set is media-specific by construction. Otherwise
+ * only `Authorization` counts: an app authenticating one API for browse and
+ * media alike puts it on the shared `request` layer, and that is the common
+ * shape. Shared plumbing that also rides browse requests — an `X-Client-Version`
+ * — is not a credential and must not trigger the probe.
+ *
+ * The residual case is a shared layer carrying a custom auth header, say
+ * `X-Api-Key`, for media that needs it: move it to the `media` layer and the
+ * probe runs.
+ */
+const isMediaAuth = (
+  headers: Record<string, string>,
+  mediaLayerHeaders: boolean
+): boolean =>
+  mediaLayerHeaders ||
+  Object.keys(headers).some((key) => key.toLowerCase() === 'authorization')
+
+export interface ResolvedMedia {
+  /** The URL to play. */
+  src: string
+  /**
+   * The headers still safe to send. Cleared once the redirect leaves the
+   * origin: the credential was addressed to the authenticating host, and
+   * browsers strip `Authorization` on that hop for the same reason.
+   *
+   * Only for what we send *after* the probe. The probe's own hop is the
+   * browser's to make: `redirect: 'follow'` drops `Authorization` across
+   * origins but re-sends every other header, so a custom-named credential can
+   * reach the redirect target if that target's preflight admits it. There is no
+   * way around it from JS — `redirect: 'manual'` yields an opaque response in
+   * CORS mode, with no `Location` to walk by hand — so a custom-named media
+   * credential is only as private as the hosts it may be redirected to.
+   * Android has no such limit: [CrossOriginHeaderStripper] strips the hop
+   * there.
+   */
+  headers?: Record<string, string>
+}
+
+/**
+ * Origin of an http(s) URL, or undefined when it cannot be determined.
+ *
+ * Relative URLs are resolved against the document, because that is what the
+ * probe's own `fetch` does — a `src` of `/api/authed/7` is a request to the
+ * page's origin, so the credential went there. Without this a relative `src`
+ * has no origin, never matches the absolute URL the response reports, and the
+ * headers are dropped from every load that uses one.
+ *
+ * Parsed rather than pattern-matched so the comparison normalizes the way
+ * Android's `CrossOriginHeaderStripper.sameOrigin` does: `URL.host` omits a
+ * default port, so `https://a.com` and `https://a.com:443` are one origin, and
+ * it excludes userinfo, so `https://user@a.com` is not a third.
+ */
+const originOf = (url: string): string | undefined => {
+  try {
+    const base = typeof location === 'undefined' ? undefined : location.href
+    const { protocol, host } = new URL(url, base)
+    if (protocol !== 'http:' && protocol !== 'https:') return undefined
+    return `${protocol}//${host}`
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Whether the redirect left the origin the credential was addressed to.
+ *
+ * Only when both origins are known and differ. An origin we could not work out
+ * — a relative URL with no document base, outside a browser — is not evidence
+ * of a hop, and treating it as one is how the headers went missing before.
+ */
+const leftTheOrigin = (from: string, to: string): boolean => {
+  const origin = originOf(from)
+  return origin !== undefined && originOf(to) !== origin
+}
+
+export async function followMediaRedirect(
+  url: string,
+  headers: Record<string, string> | undefined,
+  {
+    fetchImpl,
+    mediaLayerHeaders = false,
+    timeoutMs = PROBE_TIMEOUT_MS
+  }: FollowMediaRedirectOptions = {}
+): Promise<ResolvedMedia> {
+  if (!headers || Object.keys(headers).length === 0)
+    return { src: url, headers }
+  if (!isMediaAuth(headers, mediaLayerHeaders)) return { src: url, headers }
+  if (isManifestUrl(url)) return { src: url, headers }
+  if (isLocalUrl(url)) return { src: url, headers }
+
+  const doFetch = fetchImpl ?? globalThis.fetch
+  if (typeof doFetch !== 'function') return { src: url, headers }
+
+  try {
+    // HEAD walks the chain without tripping download counting, which keys off
+    // ranged GETs. Deadlined, because the load waits on it.
+    const response = await fetchWithDeadline(doFetch, url, headers, timeoutMs)
+
+    const src = response.url || url
+
+    // The status belongs to the *last* hop, so it only speaks for the
+    // authenticating endpoint when there was no redirect. Once one has
+    // happened, hop one authenticated and handed us its target, and a refusal
+    // past that is routinely about the method rather than the credential:
+    // presigned S3 and GCS URLs sign it — SigV4's canonical request opens with
+    // HTTPMethod, GCS V4's with HTTP_VERB — so a URL signed for GET answers a
+    // HEAD with 403. Keep the signed URL, which is the whole point of the walk,
+    // and let a real error surface through the player.
+    if (!response.ok && src === url) return { src: url, headers }
+
+    return { src, headers: leftTheOrigin(url, src) ? undefined : headers }
+  } catch {
+    return { src: url, headers }
+  }
+}

package/src/web/player/NowPlayingManager.ts

@@ -1,6 +1,7 @@
 import type { NowPlayingUpdate, NowPlayingMetadata } from '../../features'
 import type { Track } from '../../types'
 import { artworkUrl } from '../../utils/artwork'
+import { getTrackIdentity } from '../../utils/getTrackIdentity'
 
 /**
  * Manages now playing metadata overrides.
@@ -37,7 +38,7 @@ export class NowPlayingManager {
           album: update.album ?? currentTrack.album,
           artwork: artworkUrl(currentTrack.artwork),
           description: currentTrack.description,
-          mediaId: currentTrack.src ?? currentTrack.url,
+          mediaId: getTrackIdentity(currentTrack) ?? currentTrack.path,
           genre: currentTrack.genre,
           duration
         }
@@ -47,7 +48,7 @@ export class NowPlayingManager {
           album: currentTrack.album,
           artwork: artworkUrl(currentTrack.artwork),
           description: currentTrack.description,
-          mediaId: currentTrack.src ?? currentTrack.url,
+          mediaId: getTrackIdentity(currentTrack) ?? currentTrack.path,
           genre: currentTrack.genre,
           duration
         }
@@ -74,7 +75,7 @@ export class NowPlayingManager {
       album: this.override?.album ?? currentTrack.album,
       artwork: artworkUrl(currentTrack.artwork),
       description: currentTrack.description,
-      mediaId: currentTrack.src ?? currentTrack.url,
+      mediaId: getTrackIdentity(currentTrack) ?? currentTrack.path,
       genre: currentTrack.genre,
       duration
     }

package/src/web/util/BrowserPathHelper.test.ts

@@ -0,0 +1,68 @@
+import { describe, it, expect } from 'vitest'
+import { BrowserPathHelper } from './BrowserPathHelper'
+
+describe('BrowserPathHelper contextual URL round-trip', () => {
+  it('round-trips a src carrying its own query params', () => {
+    // A src carrying its own query string (signed CDN URL) must survive the
+    // build → extract/strip round-trip: an unescaped `&` would split the src
+    // into stray query params, truncating the trackId and polluting the
+    // parent path.
+    const src = 'https://cdn.example.com/stream.mp3?token=abc&exp=1699999999'
+    const url = BrowserPathHelper.build('/library', src)
+    expect(BrowserPathHelper.extractTrackId(url)).toBe(src)
+    expect(BrowserPathHelper.stripTrackId(url)).toBe('/library')
+  })
+
+  it('round-trips a src with equals and plus', () => {
+    const src = 'https://cdn.example.com/a+b.mp3?sig=x=y'
+    const url = BrowserPathHelper.build('/library', src)
+    expect(BrowserPathHelper.extractTrackId(url)).toBe(src)
+    expect(BrowserPathHelper.stripTrackId(url)).toBe('/library')
+  })
+
+  it('preserves unrelated parent query params when stripping', () => {
+    const src = 'https://cdn.example.com/stream.mp3?token=abc&exp=1'
+    const url = BrowserPathHelper.build('/search?q=jazz', src)
+    expect(BrowserPathHelper.extractTrackId(url)).toBe(src)
+    expect(BrowserPathHelper.stripTrackId(url)).toBe('/search?q=jazz')
+  })
+
+  it('round-trips the stamped index alongside the trackId', () => {
+    const src = 'https://cdn.example.com/stream.mp3?token=abc&exp=1'
+    const url = BrowserPathHelper.build('/library', src, 3)
+    expect(BrowserPathHelper.extractTrackId(url)).toBe(src)
+    expect(BrowserPathHelper.extractIndex(url)).toBe(3)
+    expect(BrowserPathHelper.stripTrackId(url)).toBe('/library')
+  })
+
+  it('extracts no index from an index-less contextual URL', () => {
+    const url = BrowserPathHelper.build('/library', 'song.mp3')
+    expect(BrowserPathHelper.extractIndex(url)).toBeUndefined()
+  })
+
+  it('extracts no index from a non-contextual or malformed-index URL', () => {
+    expect(BrowserPathHelper.extractIndex('/library')).toBeUndefined()
+    expect(
+      BrowserPathHelper.extractIndex('/library?__trackId=song.mp3&__index=x')
+    ).toBeUndefined()
+    expect(
+      BrowserPathHelper.extractIndex('/library?__trackId=song.mp3&__index=-1')
+    ).toBeUndefined()
+  })
+})
+
+describe('BrowserPathHelper.navigationErrorKind', () => {
+  it('is a search for a search path and a browse for anything else', () => {
+    expect(
+      BrowserPathHelper.navigationErrorKind(
+        BrowserPathHelper.createSearchPath('jazz')
+      )
+    ).toBe('search')
+    expect(BrowserPathHelper.navigationErrorKind('/search?q=jazz')).toBe(
+      'browse'
+    )
+    expect(BrowserPathHelper.navigationErrorKind('/__searchable')).toBe(
+      'browse'
+    )
+  })
+})