librespot-org / librespot-org/librespot
`get_token` fails using credentials obtained through FB auth flow
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 7.2k
- Forks
- 888
- Avg merge
- 6h 41m
- Merged PRs (30d)
- 3
Description
I have credentials through a modified version of https://github.com/hrkfdn/ncspot/pull/537 that uses a newly created client id and client secret (CLIENT_ID from here on out). These credentials authenticate:
[2021-05-24][14:45:53] [librespot_core::session] [INFO] Authenticated as "##########" !
[2021-05-24][14:45:53] [librespot_playback::audio_backend::pulseaudio] [INFO] Using PulseAudio sink with format: S16
[2021-05-24][14:45:53] [librespot_core::session] [INFO] Country: "DE"
However librespot is unable to get a token using these credentials:
[2021-05-24][14:45:53] [librespot_core::mercury] [WARN] error 403 for uri hm://keymaster/token/authenticated?client_id=CLIENT_ID&scope=user-read-private,playlist-read-private,playlist-read-collaborative,playlist-modify-public,playlist-modify-private,user-follow-modify,user-follow-read,user-library-read,user-library-modify,user-top-read,user-read-recently-played
I have a hacked up version of examples/get_token.rs that works off of these credentials instead of whats passed on the command line (see https://github.com/medwards/librespot/commit/fed29f4ceca9d4fedf49f251b1b7d9a0cdc74ed2).
This works for the streaming scope:
~/forks/librespot$ cargo run --package librespot --example get_token -- /home/medwards/.cache/ncspot/librespot CLIENT_ID streaming
Finished dev [unoptimized + debuginfo] target(s) in 0.06s
Running `target/debug/examples/get_token /home/medwards/.cache/ncspot/librespot CLIENT_ID streaming`
Connecting..
Token: Token {
access_token: "AN_ACCESS_TOKEN",
expires_in: 3600,
token_type: "Bearer",
scope: [
"streaming",
],
}
For any other scope or combination of scopes I get MecuryError.
~/forks/librespot$ cargo run --package librespot --example get_token -- /home/medwards/.cache/ncspot/librespot CLIENT_ID playlist-modify
Finished dev [unoptimized + debuginfo] target(s) in 0.06s
Running `target/debug/examples/get_token /home/medwards/.cache/ncspot/librespot CLIENT_ID playlist-modify`
Connecting..
Got error: MercuryError
~/forks/librespot$ cargo run --package librespot --example get_token -- /home/medwards/.cache/ncspot/librespot CLIENT_ID playlist-read
Finished dev [unoptimized + debuginfo] target(s) in 0.06s
Running `target/debug/examples/get_token /home/medwards/.cache/ncspot/librespot CLIENT_ID playlist-read`
Connecting..
Got error: MercuryError
I originally requested the following scopes when going through the oauth2 flow so I expect these to work (and mysteriously streaming does):
"app-remote-control",
"playlist-modify",
"playlist-modify-private",
"playlist-modify-public",
"playlist-read",
"playlist-read-collaborative",
"playlist-read-private",
"streaming",
"user-follow-modify",
"user-follow-read",
"user-library-modify",
"user-library-read",
"user-modify",
"user-read-private",
"user-read-recently-played",
"user-top-read",
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with examples/get_token.rs and reproduce the successful streaming request alongside the failing playlist scopes using the commands in the report. Trace the authentication request to the hm://keymaster/token/authenticated endpoint and compare the requested scopes with the 403 response. Done means the reported scopes either return a token or their unsupported behavior is clearly surfaced and covered by a regression test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- api, authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100