Add linux/arm64 to platforms supported

* Ability to build arm7 docker image using buildx

* Build arm64 and amd64 images

.github/workflows/ci.yml

@@ -21,7 +21,7 @@ jobs:
       - 
         uses: actions/setup-node@v1
         with:
-          node-version: 16.6.x
+          node-version: '16'
       - 
         run: yarn install
       - 
@@ -38,6 +38,12 @@ jobs:
         uses: actions/checkout@v2
         with:
           fetch-depth: 0
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
       -
         name: Docker meta
         id: meta
@@ -56,6 +62,7 @@ jobs:
         uses: docker/build-push-action@v2
         with:
           context: .
+          platforms: linux/amd64,linux/arm/v7,linux/arm64
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:16.6-alpine as build
+FROM node:16-bullseye as build
 
 WORKDIR /bonob
 
@@ -16,22 +16,30 @@ COPY yarn.lock .
 COPY .yarnrc.yml .
 COPY .yarn/releases ./.yarn/releases
 
-RUN apk add --no-cache --update --virtual .gyp \
-        vips-dev \
+ENV JEST_TIMEOUT=30000
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && \
+    apt-get -y upgrade && \
+    apt-get -y install --no-install-recommends \
+        libvips-dev \
         python3 \
         make \
         git \
         g++ && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* && \
     yarn install --immutable && \
     yarn gitinfo && \
     yarn test --no-cache && \
     yarn build
 
 
-
-FROM node:16.6-alpine
+FROM node:16-bullseye
 
 ENV BNB_PORT=4534
+ENV DEBIAN_FRONTEND=noninteractive
+ENV TZ=UTC
 
 EXPOSE $BNB_PORT
 
@@ -46,9 +54,15 @@ COPY --from=build /bonob/.gitinfo ./
 COPY web ./web
 COPY src/Sonoswsdl-1.19.4-20190411.142401-3.wsdl ./src/Sonoswsdl-1.19.4-20190411.142401-3.wsdl
 
-RUN apk add --no-cache --update vips
+RUN apt-get update && \
+    apt-get -y upgrade && \
+    apt-get -y install --no-install-recommends libvips tzdata && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
 
 USER nobody 
 WORKDIR /bonob/src
 
+HEALTHCHECK CMD wget -O- http://localhost:${BNB_PORT}/about || exit 1   
+
 CMD ["node", "app.js"]

README.md

@@ -25,7 +25,7 @@ Support for Subsonic API clones (tested against Navidrome and Gonic).
 
 ## Running
 
-bonob is ditributed via docker and can be run in a number of ways
+bonob is distributed via docker and can be run in a number of ways
 
 ### Full sonos device auto-discovery and auto-registration using docker --network host
 
@@ -134,6 +134,10 @@ services:
       BNB_SUBSONIC_URL: http://navidrome:4533
 ```
 
+### Running bonob on synology
+
+[See this issue](https://github.com/simojenki/bonob/issues/15)
+
 ## Configuration
 
 item | default value | description
@@ -141,6 +145,7 @@ item | default value | description
 BNB_PORT | 4534 | Default http port for bonob to listen on
 BNB_URL | http://$(hostname):4534 | URL (including path) for bonob so that sonos devices can communicate. **This must be either the public IP or DNS entry of the bonob instance so that the sonos devices can communicate with it.**
 BNB_SECRET | bonob | secret used for encrypting credentials
+BNB_AUTH_TIMEOUT | 1h | Timeout for the sonos auth token, described in the format [ms](https://github.com/vercel/ms), ie. '5s' == 5 seconds, '11h' == 11 hours.  In the case of using Navidrome this should be less than the value for ND_SESSIONTIMEOUT
 BNB_SONOS_AUTO_REGISTER | false | Whether or not to try and auto-register on startup
 BNB_SONOS_DEVICE_DISCOVERY | true | Enable/Disable sonos device discovery entirely.  Setting this to 'false' will disable sonos device search, regardless of whether a seed host is specified.
 BNB_SONOS_SEED_HOST | undefined | sonos device seed host for discovery, or ommitted for for auto-discovery
@@ -153,6 +158,7 @@ BNB_SCROBBLE_TRACKS | true | Whether to scrobble the playing of a track if it ha
 BNB_REPORT_NOW_PLAYING | true | Whether to report a track as now playing
 BNB_ICON_FOREGROUND_COLOR | undefined | Icon foreground color in sonos app, must be a valid [svg color](https://www.december.com/html/spec/colorsvg.html)
 BNB_ICON_BACKGROUND_COLOR | undefined | Icon background color in sonos app, must be a valid [svg color](https://www.december.com/html/spec/colorsvg.html)
+TZ | UTC | Your timezone from the [tz database](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) ie. 'Australia/Melbourne'
 
 ## Initialising service within sonos app
 
@@ -168,6 +174,20 @@ BNB_ICON_BACKGROUND_COLOR | undefined | Icon background color in sonos app, must
 - You should now be able to play music on your sonos devices from you subsonic clone
 - Within the subsonic clone a new player will be created, 'bonob (username)', so you can configure transcoding specifically for sonos
 
+## Re-registering your bonob service with sonos App
+
+Generally speaking you will not need to do this very often.  However on occassion bonob will change the implementation of the authentication between sonos and bonob, which will require a re-registration.  Your sonos app will complain about not being able to browse the service, to re-register execute the following steps (taken from the iOS app);
+
+- Open the sonos app
+- Settings -> Services & Voice
+- Your bonob service, will likely have name of either 'bonob' or $BNB_SONOS_SERVICE_NAME
+- Reauthorize Account
+- Authorize
+- Enter credentials, you should see 'Login Successful!'
+- Done
+
+Service should now be registered and everything should work as expected.
+
 ## Implementing a different music source other than a subsonic clone
 
 - Implement the MusicService/MusicLibrary interface
@@ -175,12 +195,10 @@ BNB_ICON_BACKGROUND_COLOR | undefined | Icon background color in sonos app, must
 
 ## A note on transcoding
 
-tldr; Transcoding to mp3/m4a is not supported as sonos devices will not play the track.  Transcoding to flac works however, use BNB_SUBSONIC_CUSTOM_CLIENTS=audio/flac if you want to transcode flac->flac ie. to downsample HD flacs (see below).
+tldr; Transcoding to mp3/m4a is not supported as sonos devices will not play the track.  However transcoding to flac does work, use BNB_SUBSONIC_CUSTOM_CLIENTS=audio/flac if you want to transcode flac->flac ie. to downsample HD flacs (see below).
 
 Sonos devices are very particular about how audio streams are presented to them, see [streaming basics](https://developer.sonos.com/build/content-service-add-features/streaming-basics/).  When using transcoding both Navidrome and Gonic report no 'content-length', nor do they support range queries, this will cause the sonos device to fail to play the track.
 
-## Cusomisation
-
 ### Audio File type specific transcoding options within Subsonic
 
 In some situations you may wish to have different 'Players' within you Subsonic server so that you can configure different transcoding options depending on the file type.  For example if you have flacs with a mixture of frequency formats where not all are supported by sonos [See issue #52](https://github.com/simojenki/bonob/issues/52) & [Sonos supported audio formats](https://developer.sonos.com/build/content-service-add-features/supported-audio-formats/)
@@ -213,7 +231,20 @@ ffmpeg -i %s -af aresample=resampler=soxr:out_sample_fmt=s16:out_sample_rate=480
 
 ![Chartreuse & Fuchsia](https://github.com/simojenki/bonob/blob/master/docs/images/chartreuseFuchsia.png?raw=true)
 
+```bash
+-e BNB_ICON_FOREGROUND_COLOR=lime \
+-e BNB_ICON_BACKGROUND_COLOR=aliceblue
+```
+
+![Lime & Alice Blue](https://github.com/simojenki/bonob/blob/master/docs/images/limeAliceBlue.png?raw=true)
+
+```bash
+-e 'BNB_ICON_FOREGROUND_COLOR=#1db954' \
+-e 'BNB_ICON_BACKGROUND_COLOR=#121212'
+```
+
+![Spotify-ish](https://github.com/simojenki/bonob/blob/master/docs/images/spotify-ish.png?raw=true)
+
 ## Credits
 
 - Icons courtesy of: [Navidrome](https://www.navidrome.org/), [Vectornator](https://www.vectornator.io/icons), and @jicho
-

package.json

@@ -9,8 +9,11 @@
     "@svrooij/sonos": "^2.4.0",
     "@types/express": "^4.17.13",
     "@types/fs-extra": "^9.0.13",
+    "@types/jsonwebtoken": "^8.5.5",
+    "@types/jws": "^3.2.4",
     "@types/morgan": "^1.9.3",
     "@types/node": "^16.7.13",
+    "@types/randomstring": "^1.1.8",
     "@types/sharp": "^0.28.6",
     "@types/underscore": "^1.11.3",
     "@types/uuid": "^8.3.1",
@@ -20,14 +23,18 @@
     "express": "^4.17.1",
     "fp-ts": "^2.11.1",
     "fs-extra": "^10.0.0",
+    "jsonwebtoken": "^8.5.1",
+    "jws": "^4.0.0",
     "libxmljs2": "^0.28.0",
     "morgan": "^1.10.0",
     "node-html-parser": "^4.1.4",
+    "randomstring": "^1.2.1",
     "sharp": "^0.29.1",
     "soap": "^0.42.0",
     "ts-md5": "^1.2.9",
     "typescript": "^4.4.2",
     "underscore": "^1.13.1",
+    "urn-lib": "^2.0.0",
     "uuid": "^8.3.2",
     "winston": "^3.3.3"
   },

src/access_tokens.ts

@@ -1,116 +0,0 @@
-import { Dayjs } from "dayjs";
-import { v4 as uuid } from "uuid";
-import crypto from "crypto";
-
-import { Encryption } from "./encryption";
-import logger from "./logger";
-import { Clock, SystemClock } from "./clock";
-import { b64Encode, b64Decode } from "./b64";
-
-type AccessToken = {
-  value: string;
-  authToken: string;
-  expiry: Dayjs;
-};
-
-export interface AccessTokens {
-  mint(authToken: string): string;
-  authTokenFor(value: string): string | undefined;
-}
-
-export class ExpiringAccessTokens implements AccessTokens {
-  tokens = new Map<string, AccessToken>();
-  clock: Clock;
-
-  constructor(clock: Clock = SystemClock) {
-    this.clock = clock;
-  }
-
-  mint(authToken: string): string {
-    this.clearOutExpired();
-    const accessToken = {
-      value: uuid(),
-      authToken,
-      expiry: this.clock.now().add(12, "hours"),
-    };
-    this.tokens.set(accessToken.value, accessToken);
-    return accessToken.value;
-  }
-
-  authTokenFor(value: string): string | undefined {
-    this.clearOutExpired();
-    return this.tokens.get(value)?.authToken;
-  }
-
-  clearOutExpired() {
-    Array.from(this.tokens.values())
-      .filter((it) => it.expiry.isBefore(this.clock.now()))
-      .forEach((expired) => {
-        this.tokens.delete(expired.value);
-      });
-  }
-
-  count = () => this.tokens.size;
-}
-
-export class EncryptedAccessTokens implements AccessTokens {
-  encryption: Encryption;
-
-  constructor(encryption: Encryption) {
-    this.encryption = encryption;
-  }
-
-  mint = (authToken: string): string =>
-    b64Encode(JSON.stringify(this.encryption.encrypt(authToken)));
-
-  authTokenFor(value: string): string | undefined {
-    try {
-      return this.encryption.decrypt(
-        JSON.parse(b64Decode(value))
-      );
-    } catch {
-      logger.warn("Failed to decrypt access token...");
-      return undefined;
-    }
-  }
-}
-
-export class AccessTokenPerAuthToken implements AccessTokens {
-  authTokenToAccessToken = new Map<string, string>();
-  accessTokenToAuthToken = new Map<string, string>();
-
-  mint = (authToken: string): string => {
-    if (this.authTokenToAccessToken.has(authToken)) {
-      return this.authTokenToAccessToken.get(authToken)!;
-    } else {
-      const accessToken = uuid();
-      this.authTokenToAccessToken.set(authToken, accessToken);
-      this.accessTokenToAuthToken.set(accessToken, authToken);
-      return accessToken;
-    }
-  };
-
-  authTokenFor = (value: string): string | undefined => this.accessTokenToAuthToken.get(value);
-}
-
-export const sha256 = (salt: string) => (authToken: string) => crypto
-  .createHash("sha256")
-  .update(`${authToken}${salt}`)
-  .digest("hex")
-
-export class InMemoryAccessTokens implements AccessTokens {
-  tokens = new Map<string, string>();
-  minter;
-
-  constructor(minter: (authToken: string) => string) {
-    this.minter = minter
-  }
-
-  mint = (authToken: string): string => {
-    const accessToken = this.minter(authToken);
-    this.tokens.set(accessToken, authToken);
-    return accessToken;
-  }
-
-  authTokenFor = (value: string): string | undefined => this.tokens.get(value);
-}

src/api_tokens.ts

@@ -0,0 +1,30 @@
+import crypto from "crypto";
+
+export interface APITokens {
+  mint(authToken: string): string;
+  authTokenFor(apiToken: string): string | undefined;
+}
+
+
+export const sha256 = (salt: string) => (value: string) => crypto
+  .createHash("sha256")
+  .update(`${value}${salt}`)
+  .digest("hex")
+
+
+export class InMemoryAPITokens implements APITokens {
+  tokens = new Map<string, string>();
+  minter;
+
+  constructor(minter: (authToken: string) => string = sha256('bonob')) {
+    this.minter = minter
+  }
+
+  mint = (authToken: string): string => {
+    const accessToken = this.minter(authToken);
+    this.tokens.set(accessToken, authToken);
+    return accessToken;
+  }
+
+  authTokenFor = (apiToken: string): string | undefined => this.tokens.get(apiToken);
+}

src/app.ts

@@ -2,6 +2,7 @@ import path from "path";
 import fs from "fs";
 import server from "./server";
 import logger from "./logger";
+
 import {
   appendMimeTypeToClientFor,
   axiosImageFetcher,
@@ -9,17 +10,18 @@ import {
   DEFAULT,
   Subsonic,
 } from "./subsonic";
-import encryption from "./encryption";
-import { InMemoryAccessTokens, sha256 } from "./access_tokens";
+import { InMemoryAPITokens, sha256 } from "./api_tokens";
 import { InMemoryLinkCodes } from "./link_codes";
 import readConfig from "./config";
 import sonos, { bonobService } from "./sonos";
 import { MusicService } from "./music_service";
 import { SystemClock } from "./clock";
+import { JWTSmapiLoginTokens } from "./smapi_auth";
 
 const config = readConfig();
+const clock = SystemClock;
 
-logger.info(`Starting bonob with config ${JSON.stringify(config)}`);
+logger.info(`Starting bonob with config ${JSON.stringify({ ...config, secret: "*******" })}`);
 
 const bonob = bonobService(
   config.sonos.serviceName,
@@ -40,15 +42,15 @@ const artistImageFetcher = config.subsonic.artistImageCache
 
 const subsonic = new Subsonic(
   config.subsonic.url,
-  encryption(config.secret),
   streamUserAgent,
   artistImageFetcher
 );
 
 const featureFlagAwareMusicService: MusicService = {
   generateToken: subsonic.generateToken,
-  login: (authToken: string) =>
-    subsonic.login(authToken).then((library) => {
+  refreshToken: subsonic.refreshToken,
+  login: (serviceToken: string) =>
+    subsonic.login(serviceToken).then((library) => {
       return {
         ...library,
         scrobble: (id: string) => {
@@ -82,12 +84,14 @@ const app = server(
   featureFlagAwareMusicService,
   {
     linkCodes: () => new InMemoryLinkCodes(),
-    accessTokens: () => new InMemoryAccessTokens(sha256(config.secret)),
-    clock: SystemClock,
+    apiTokens: () => new InMemoryAPITokens(sha256(config.secret)),
+    clock,
     iconColors: config.icons,
     applyContextPath: true,
     logRequests: true,
     version,
+    smapiAuthTokens: new JWTSmapiLoginTokens(clock, config.secret, config.authTimeout),
+    externalImageResolver: artistImageFetcher
   }
 );
 

src/burn.ts

@@ -0,0 +1,90 @@
+import _ from "underscore";
+import { createUrnUtil } from "urn-lib";
+import randomstring from "randomstring";
+
+import jwsEncryption from "./encryption";
+
+const BURN = createUrnUtil("bnb", {
+  components: ["system", "resource"],
+  separator: ":",
+  allowEmpty: false,
+});
+
+export type BUrn = {
+  system: string;
+  resource: string;
+};
+
+const DEFAULT_FORMAT_OPTS = {
+  shorthand: false,
+  encrypt: false,
+}
+
+const SHORTHAND_MAPPINGS: Record<string, string> = {
+  "internal" : "i",
+  "external": "e",
+  "subsonic": "s",
+  "navidrome": "n",
+  "encrypted": "x"
+}
+const REVERSE_SHORTHAND_MAPPINGS: Record<string, string> = Object.keys(SHORTHAND_MAPPINGS).reduce((ret, key) => {
+  ret[SHORTHAND_MAPPINGS[key] as unknown as string] = key;
+  return ret;
+}, {} as Record<string, string>)
+if(SHORTHAND_MAPPINGS.length != REVERSE_SHORTHAND_MAPPINGS.length) {
+  throw `Invalid SHORTHAND_MAPPINGS, must be duplicate!`
+}
+
+export const BURN_SALT = randomstring.generate(5);
+const encryptor = jwsEncryption(BURN_SALT);
+
+export const format = (
+  burn: BUrn,
+  opts: Partial<{ shorthand: boolean; encrypt: boolean }> = {}
+): string => {
+  const o = { ...DEFAULT_FORMAT_OPTS, ...opts }
+  let toBurn = burn;
+  if(o.shorthand) {
+    toBurn = {
+      ...toBurn,
+      system: SHORTHAND_MAPPINGS[toBurn.system] || toBurn.system
+    }
+  }
+  if(o.encrypt) {
+    const encryptedToBurn = {
+      system: "encrypted",
+      resource: encryptor.encrypt(BURN.format(toBurn))
+    }
+    return format(encryptedToBurn, { ...opts, encrypt: false })
+  } else {
+    return BURN.format(toBurn);
+  }
+};
+
+export const formatForURL = (burn: BUrn) => {
+  if(burn.system == "external") return format(burn, { shorthand: true, encrypt: true })
+  else return format(burn, { shorthand: true })
+}
+
+export const parse = (burn: string): BUrn => {
+  const result = BURN.parse(burn)!;
+  const validationErrors = BURN.validate(result) || [];
+  if (validationErrors.length > 0) {
+    throw new Error(`Invalid burn: '${burn}'`);
+  }
+  const system = result.system as string;
+  const x = {
+    system: REVERSE_SHORTHAND_MAPPINGS[system] || system,
+    resource: result.resource as string,
+  };
+  if(x.system == "encrypted") {
+    return parse(encryptor.decrypt(x.resource));
+  } else {
+    return x;
+  }
+}
+
+export function assertSystem(urn: BUrn, system: string): BUrn {
+  if (urn.system != system) throw `Unsupported urn: '${format(urn)}'`;
+  else return urn;
+}

src/clock.ts

@@ -14,3 +14,15 @@ export interface Clock {
 }
 
 export const SystemClock = { now: () => dayjs() };
+
+export class FixedClock implements Clock {
+  time: Dayjs;
+  
+  constructor(time: Dayjs = dayjs()) {
+    this.time = time;
+  }
+
+  add = (t: number, unit: dayjs.UnitTypeShort) => this.time = this.time.add(t, unit)
+
+  now = () => this.time;
+}

src/config.ts

@@ -3,6 +3,7 @@ import logger from "./logger";
 import url from "./url_builder";
 
 export const WORD = /^\w+$/;
+export const COLOR = /^#?\w+$/;
 
 type EnvVarOpts = {
   default: string | undefined;
@@ -62,12 +63,13 @@ export default function () {
     port,
     bonobUrl: url(bonobUrl),
     secret: bnbEnvVar("SECRET", { default: "bonob" })!,
+    authTimeout: bnbEnvVar("AUTH_TIMEOUT", { default: "1h" })!,
     icons: {
       foregroundColor: bnbEnvVar("ICON_FOREGROUND_COLOR", {
-        validationPattern: WORD,
+        validationPattern: COLOR,
       }),
       backgroundColor: bnbEnvVar("ICON_BACKGROUND_COLOR", {
-        validationPattern: WORD,
+        validationPattern: COLOR,
       }),
     },
     sonos: {

src/encryption.ts

@@ -1,33 +1,65 @@
-import { createCipheriv, createDecipheriv, randomBytes, createHash } from "crypto";
+import {
+  createCipheriv,
+  createDecipheriv,
+  randomBytes,
+  createHash,
+} from "crypto";
 
-const ALGORITHM = "aes-256-cbc"
+import jws from "jws";
+
+const ALGORITHM = "aes-256-cbc";
 const IV = randomBytes(16);
 
+
 export type Hash = {
-  iv: string,
-  encryptedData: string
-}
+  iv: string;
+  encryptedData: string;
+};
 
 export type Encryption = {
-  encrypt: (value:string) => Hash
-  decrypt: (hash: Hash) => string
-}
+  encrypt: (value: string) => string;
+  decrypt: (value: string) => string;
+};
 
-const encryption = (secret: string): Encryption => {
-  const key = createHash('sha256').update(String(secret)).digest('base64').substr(0, 32);
+export const jwsEncryption = (secret: string): Encryption => {
   return {
-    encrypt: (value: string) => {
-      const cipher = createCipheriv(ALGORITHM, key, IV);
-      return { 
-        iv: IV.toString("hex"), 
-        encryptedData: Buffer.concat([cipher.update(value), cipher.final()]).toString("hex") 
-      };
-    },
-    decrypt: (hash: Hash) => {
-      const decipher = createDecipheriv(ALGORITHM, key, Buffer.from(hash.iv, 'hex'));
-      return Buffer.concat([decipher.update(Buffer.from(hash.encryptedData, 'hex')), decipher.final()]).toString();
-    }
+    encrypt: (value: string) => jws.sign({
+      header: { alg: 'HS256' },
+      payload: value,
+      secret: secret,
+    }),
+    decrypt: (value: string) => jws.decode(value).payload
   }
 }
 
-export default encryption;
+export const cryptoEncryption = (secret: string): Encryption => {
+  const key = createHash("sha256")
+    .update(String(secret))
+    .digest("base64")
+    .substr(0, 32);
+  return {
+    encrypt: (value: string) => {
+      const cipher = createCipheriv(ALGORITHM, key, IV);
+      return `${IV.toString("hex")}.${Buffer.concat([
+        cipher.update(value),
+        cipher.final(),
+      ]).toString("hex")}`;
+    },
+    decrypt: (value: string) => {
+      const parts = value.split(".");
+      if(parts.length != 2) throw `Invalid value to decrypt`;
+
+      const decipher = createDecipheriv(
+        ALGORITHM,
+        key,
+        Buffer.from(parts[0]!, "hex")
+      );
+      return Buffer.concat([
+        decipher.update(Buffer.from(parts[1]!, "hex")),
+        decipher.final(),
+      ]).toString();
+    },
+  };
+};
+
+export default jwsEncryption;

src/link_codes.ts

@@ -2,7 +2,7 @@ import { v4 as uuid } from 'uuid';
 
 
 export type Association = {
-  authToken: string
+  serviceToken: string
   userId: string
   nickname: string  
 }

src/music_service.ts

@@ -1,48 +1,29 @@
+import { BUrn } from "./burn";
+import { taskEither as TE } from "fp-ts";
+
 export type Credentials = { username: string; password: string };
 
-export function isSuccess(
-  authResult: AuthSuccess | AuthFailure
-): authResult is AuthSuccess {
-  return (authResult as AuthSuccess).authToken !== undefined;
-}
-
-export function isFailure(
-  authResult: any | AuthFailure
-): authResult is AuthFailure {
-  return (authResult as AuthFailure).message !== undefined;
-}
-
 export type AuthSuccess = {
-  authToken: string;
+  serviceToken: string;
   userId: string;
   nickname: string;
 };
 
-export type AuthFailure = {
-  message: string;
+export class AuthFailure extends Error {
+  constructor(message: string) {
+    super(message);
+  }
 };
 
 export type ArtistSummary = {
-  id: string;
+  id: string | undefined;
   name: string;
-};
-
-export type Images = {
-  small: string | undefined;
-  medium: string | undefined;
-  large: string | undefined;
-};
-
-export const NO_IMAGES: Images = {
-  small: undefined,
-  medium: undefined,
-  large: undefined,
+  image: BUrn | undefined;
 };
 
 export type SimilarArtist = ArtistSummary & { inLibrary: boolean };
 
 export type Artist = ArtistSummary & {
-  image: Images
   albums: AlbumSummary[];
   similarArtists: SimilarArtist[]
 };
@@ -52,7 +33,7 @@ export type AlbumSummary = {
   name: string;
   year: string | undefined;
   genre: Genre | undefined;
-  coverArt: string | undefined;
+  coverArt: BUrn | undefined;
 
   artistName: string | undefined;
   artistId: string | undefined;
@@ -77,7 +58,7 @@ export type Track = {
   duration: number;
   number: number | undefined;
   genre: Genre | undefined;
-  coverArt: string | undefined;
+  coverArt: BUrn | undefined;
   album: AlbumSummary;
   artist: ArtistSummary;
   rating: Rating;
@@ -117,6 +98,7 @@ export type AlbumQuery = Paging & {
 export const artistToArtistSummary = (it: Artist): ArtistSummary => ({
   id: it.id,
   name: it.name,
+  image: it.image
 });
 
 export const albumToAlbumSummary = (it: Album): AlbumSummary => ({
@@ -164,8 +146,9 @@ export const asArtistAlbumPairs = (artists: Artist[]): [Artist, Album][] =>
   );
 
 export interface MusicService {
-  generateToken(credentials: Credentials): Promise<AuthSuccess | AuthFailure>;
-  login(authToken: string): Promise<MusicLibrary>;
+  generateToken(credentials: Credentials): TE.TaskEither<AuthFailure, AuthSuccess>;
+  refreshToken(serviceToken: string): TE.TaskEither<AuthFailure, AuthSuccess>;
+  login(serviceToken: string): Promise<MusicLibrary>;
 }
 
 export interface MusicLibrary {
@@ -184,7 +167,7 @@ export interface MusicLibrary {
     range: string | undefined;
   }): Promise<TrackStream>;
   rate(trackId: string, rating: Rating): Promise<boolean>;
-  coverArt(id: string, size?: number): Promise<CoverArt | undefined>;
+  coverArt(coverArtURN: BUrn, size?: number): Promise<CoverArt | undefined>;
   nowPlaying(id: string): Promise<boolean>
   scrobble(id: string): Promise<boolean>
   searchArtists(query: string): Promise<ArtistSummary[]>;

src/random_string.ts

@@ -1,6 +0,0 @@
-import { randomBytes } from "crypto";
-
-const randomString = () => randomBytes(32).toString('hex')
-
-export default randomString
-

src/server.ts

@@ -1,4 +1,4 @@
-import { option as O } from "fp-ts";
+import { either as E, taskEither as TE } from "fp-ts";
 import express, { Express, Request } from "express";
 import * as Eta from "eta";
 import path from "path";
@@ -22,9 +22,9 @@ import {
   ratingAsInt,
 } from "./smapi";
 import { LinkCodes, InMemoryLinkCodes } from "./link_codes";
-import { MusicService, isSuccess } from "./music_service";
+import { MusicService, AuthFailure, AuthSuccess } from "./music_service";
 import bindSmapiSoapServiceToExpress from "./smapi";
-import { AccessTokens, AccessTokenPerAuthToken } from "./access_tokens";
+import { APITokens, InMemoryAPITokens } from "./api_tokens";
 import logger from "./logger";
 import { Clock, SystemClock } from "./clock";
 import { pipe } from "fp-ts/lib/function";
@@ -34,6 +34,12 @@ import { Icon, ICONS, festivals, features } from "./icon";
 import _, { shuffle } from "underscore";
 import morgan from "morgan";
 import { takeWithRepeats } from "./utils";
+import { parse } from "./burn";
+import { axiosImageFetcher, ImageFetcher } from "./subsonic";
+import {
+  JWTSmapiLoginTokens,
+  SmapiAuthTokens,
+} from "./smapi_auth";
 
 export const BONOB_ACCESS_TOKEN_HEADER = "bat";
 
@@ -76,7 +82,7 @@ export class RangeBytesFromFilter extends Transform {
 
 export type ServerOpts = {
   linkCodes: () => LinkCodes;
-  accessTokens: () => AccessTokens;
+  apiTokens: () => APITokens;
   clock: Clock;
   iconColors: {
     foregroundColor: string | undefined;
@@ -85,16 +91,24 @@ export type ServerOpts = {
   applyContextPath: boolean;
   logRequests: boolean;
   version: string;
+  smapiAuthTokens: SmapiAuthTokens;
+  externalImageResolver: ImageFetcher;
 };
 
 const DEFAULT_SERVER_OPTS: ServerOpts = {
   linkCodes: () => new InMemoryLinkCodes(),
-  accessTokens: () => new AccessTokenPerAuthToken(),
+  apiTokens: () => new InMemoryAPITokens(),
   clock: SystemClock,
   iconColors: { foregroundColor: undefined, backgroundColor: undefined },
   applyContextPath: true,
   logRequests: false,
   version: "v?",
+  smapiAuthTokens: new JWTSmapiLoginTokens(
+    SystemClock,
+    `bonob-${uuid()}`,
+    "1m"
+  ),
+  externalImageResolver: axiosImageFetcher,
 };
 
 function server(
@@ -107,7 +121,8 @@ function server(
   const serverOpts = { ...DEFAULT_SERVER_OPTS, ...opts };
 
   const linkCodes = serverOpts.linkCodes();
-  const accessTokens = serverOpts.accessTokens();
+  const smapiAuthTokens = serverOpts.smapiAuthTokens;
+  const apiTokens = serverOpts.apiTokens();
   const clock = serverOpts.clock;
 
   const startUpTime = dayjs();
@@ -154,7 +169,7 @@ function server(
           removeRegistrationRoute: bonobUrl
             .append({ pathname: REMOVE_REGISTRATION_ROUTE })
             .pathname(),
-          version: opts.version,
+          version: serverOpts.version || DEFAULT_SERVER_OPTS.version,
         });
       }
     );
@@ -216,28 +231,41 @@ function server(
     const lang = langFor(req);
     const { username, password, linkCode } = req.body;
     if (!linkCodes.has(linkCode)) {
-      res.status(400).render("failure", {
+      return res.status(400).render("failure", {
         lang,
         message: lang("invalidLinkCode"),
       });
     } else {
-      const authResult = await musicService.generateToken({
-        username,
-        password,
-      });
-      if (isSuccess(authResult)) {
-        linkCodes.associate(linkCode, authResult);
-        res.render("success", {
-          lang,
-          message: lang("loginSuccessful"),
-        });
-      } else {
-        res.status(403).render("failure", {
-          lang,
-          message: lang("loginFailed"),
-          cause: authResult.message,
-        });
-      }
+      return pipe(
+        musicService.generateToken({
+          username,
+          password,
+        }),
+        TE.match(
+          (e: AuthFailure) => ({
+            status: 403,
+            template: "failure",
+            params: {
+              lang,
+              message: lang("loginFailed"),
+              cause: e.message,
+            },
+          }),
+          (success: AuthSuccess) => {
+            linkCodes.associate(linkCode, success);
+            return {
+              status: 200,
+              template: "success",
+              params: {
+                lang,
+                message: lang("loginSuccessful"),
+              },
+            };
+          }
+        )
+      )().then(({ status, template, params }) =>
+        res.status(status).render(template, params)
+      );
     }
   });
 
@@ -262,25 +290,39 @@ function server(
     const nowPlayingRatingsMatch = (value: number) => {
       const rating = ratingFromInt(value);
       const nextLove = { ...rating, love: !rating.love };
-      const nextStar = { ...rating, stars: (rating.stars === 5 ? 0 : rating.stars + 1) }
+      const nextStar = {
+        ...rating,
+        stars: rating.stars === 5 ? 0 : rating.stars + 1,
+      };
 
-      const loveRatingIcon = bonobUrl.append({pathname: rating.love ? '/love-selected.svg' : '/love-unselected.svg'}).href();
-      const starsRatingIcon = bonobUrl.append({pathname: `/star${rating.stars}.svg`}).href();
+      const loveRatingIcon = bonobUrl
+        .append({
+          pathname: rating.love ? "/love-selected.svg" : "/love-unselected.svg",
+        })
+        .href();
+      const starsRatingIcon = bonobUrl
+        .append({ pathname: `/star${rating.stars}.svg` })
+        .href();
 
       return `<Match propname="rating" value="${value}">
         <Ratings>
-          <Rating Id="${ratingAsInt(nextLove)}" AutoSkip="NEVER" OnSuccessStringId="LOVE_SUCCESS" StringId="LOVE">
+          <Rating Id="${ratingAsInt(
+            nextLove
+          )}" AutoSkip="NEVER" OnSuccessStringId="LOVE_SUCCESS" StringId="LOVE">
             <Icon Controller="universal" LastModified="${LastModified}" Uri="${loveRatingIcon}" />
           </Rating>
-          <Rating Id="${-ratingAsInt(nextStar)}" AutoSkip="NEVER" OnSuccessStringId="STAR_SUCCESS" StringId="STAR">
+          <Rating Id="${-ratingAsInt(
+            nextStar
+          )}" AutoSkip="NEVER" OnSuccessStringId="STAR_SUCCESS" StringId="STAR">
             <Icon Controller="universal" LastModified="${LastModified}" Uri="${starsRatingIcon}" />
           </Rating>
         </Ratings>
-      </Match>`
-    }
-    
+      </Match>`;
+    };
+
     res.type("application/xml").send(`<?xml version="1.0" encoding="utf-8" ?>
     <Presentation>
+      <BrowseOptions PageSize="30" />
       <PresentationMap type="ArtWorkSizeMap">
         <Match>
           <imageSizeMap>
@@ -333,21 +375,31 @@ function server(
     const trace = uuid();
 
     logger.info(
-      `${trace} bnb<- ${req.method} ${req.path}?${
-        JSON.stringify(req.query)
-      }, headers=${JSON.stringify(req.headers)}`
+      `${trace} bnb<- ${req.method} ${req.path}?${JSON.stringify(
+        req.query
+      )}, headers=${JSON.stringify({ ...req.headers, "bnbt": "*****", "bnbk": "*****" })}`
     );
-    const authToken = pipe(
-      req.query[BONOB_ACCESS_TOKEN_HEADER] as string,
-      O.fromNullable,
-      O.map((accessToken) => accessTokens.authTokenFor(accessToken)),
-      O.getOrElseW(() => undefined)
-    );
-    if (!authToken) {
+
+    const serviceToken = pipe(
+      E.fromNullable("Missing bnbt header")(req.headers["bnbt"] as string),
+      E.chain(token => pipe(
+        E.fromNullable("Missing bnbk header")(req.headers["bnbk"] as string),
+        E.map(key => ({ token, key }))
+      )),
+      E.chain((auth) =>
+        pipe(
+          smapiAuthTokens.verify(auth),
+          E.mapLeft((_) => "Auth token failed to verify")
+        )
+      ),
+      E.getOrElseW(() => undefined)
+    )
+
+    if (!serviceToken) {
       return res.status(401).send();
     } else {
       return musicService
-        .login(authToken)
+        .login(serviceToken)
         .then((it) =>
           it
             .stream({
@@ -356,7 +408,7 @@ function server(
             })
             .then((stream) => ({ musicLibrary: it, stream }))
         )
-        .then(({ stream }) => {
+        .then(({ musicLibrary, stream }) => {
           logger.info(
             `${trace} bnb<- stream response from music service for ${id}, status=${
               stream.status
@@ -367,7 +419,7 @@ function server(
             contentType
               .split(";")
               .map((it) => it.trim())
-              .map((it) => sonosifyMimeType(it))
+              .map(sonosifyMimeType)
               .join("; ");
 
           const respondWith = ({
@@ -375,25 +427,32 @@ function server(
             filter,
             headers,
             sendStream,
+            nowPlaying,
           }: {
             status: number;
             filter: Transform;
             headers: Record<string, string>;
             sendStream: boolean;
+            nowPlaying: boolean;
           }) => {
             logger.info(
               `${trace} bnb-> ${
                 req.path
               }, status=${status}, headers=${JSON.stringify(headers)}`
             );
-            res.status(status);
-            Object.entries(headers)
-              .filter(([_, v]) => v !== undefined)
-              .forEach(([header, value]) => {
-                res.setHeader(header, value!);
-              });
-            if (sendStream) stream.stream.pipe(filter).pipe(res);
-            else res.send();
+            (nowPlaying
+              ? musicLibrary.nowPlaying(id)
+              : Promise.resolve(true)
+            ).then((_) => {
+              res.status(status);
+              Object.entries(headers)
+                .filter(([_, v]) => v !== undefined)
+                .forEach(([header, value]) => {
+                  res.setHeader(header, value!);
+                });
+              if (sendStream) stream.stream.pipe(filter).pipe(res);
+              else res.send();
+            });
           };
 
           if (stream.status == 200) {
@@ -408,6 +467,7 @@ function server(
                 "accept-ranges": stream.headers["accept-ranges"],
               },
               sendStream: req.method == "GET",
+              nowPlaying: req.method == "GET",
             });
           } else if (stream.status == 206) {
             respondWith({
@@ -422,6 +482,7 @@ function server(
                 "accept-ranges": stream.headers["accept-ranges"],
               },
               sendStream: req.method == "GET",
+              nowPlaying: req.method == "GET",
             });
           } else {
             respondWith({
@@ -429,6 +490,7 @@ function server(
               filter: new PassThrough(),
               headers: {},
               sendStream: req.method == "GET",
+              nowPlaying: false,
             });
           }
         });
@@ -506,22 +568,32 @@ function server(
     "centre",
   ];
 
-  app.get("/art/:ids/size/:size", (req, res) => {
-    const authToken = accessTokens.authTokenFor(
+  app.get("/art/:burns/size/:size", (req, res) => {
+    const serviceToken = apiTokens.authTokenFor(
       req.query[BONOB_ACCESS_TOKEN_HEADER] as string
     );
-    const ids = req.params["ids"]!.split("&");
+    const urns = req.params["burns"]!.split("&").map(parse);
     const size = Number.parseInt(req.params["size"]!);
 
-    if (!authToken) {
+    if (!serviceToken) {
       return res.status(401).send();
     } else if (!(size > 0)) {
       return res.status(400).send();
     }
 
     return musicService
-      .login(authToken)
-      .then((it) => Promise.all(ids.map((id) => it.coverArt(id, size))))
+      .login(serviceToken)
+      .then((musicLibrary) =>
+        Promise.all(
+          urns.map((it) => {
+            if (it.system == "external") {
+              return serverOpts.externalImageResolver(it.resource);
+            } else {
+              return musicLibrary.coverArt(it, size);
+            }
+          })
+        )
+      )
       .then((coverArts) => coverArts.filter((it) => it))
       .then(shuffle)
       .then((coverArts) => {
@@ -559,7 +631,7 @@ function server(
         }
       })
       .catch((e: Error) => {
-        logger.error(`Failed fetching image ${ids.join("&")}/size/${size}`, {
+        logger.error(`Failed fetching image ${urns.join("&")}/size/${size}`, {
           cause: e,
         });
         return res.status(500).send();
@@ -572,9 +644,10 @@ function server(
     bonobUrl,
     linkCodes,
     musicService,
-    accessTokens,
+    apiTokens,
     clock,
-    i8n
+    i8n,
+    serverOpts.smapiAuthTokens
   );
 
   if (serverOpts.applyContextPath) {

src/smapi.ts

@@ -3,6 +3,9 @@ import { Express, Request } from "express";
 import { listen } from "soap";
 import { readFileSync } from "fs";
 import path from "path";
+import { option as O, either as E, taskEither as TE, task as T } from "fp-ts";
+import { pipe } from "fp-ts/lib/function";
+
 import logger from "./logger";
 
 import { LinkCodes } from "./link_codes";
@@ -18,12 +21,20 @@ import {
   slice2,
   Track,
 } from "./music_service";
-import { AccessTokens } from "./access_tokens";
+import { APITokens } from "./api_tokens";
 import { Clock } from "./clock";
 import { URLBuilder } from "./url_builder";
 import { asLANGs, I8N } from "./i8n";
 import { ICON, iconForGenre } from "./icon";
-import { uniq } from "underscore";
+import _, { uniq } from "underscore";
+import { BUrn, formatForURL } from "./burn";
+import {
+  isExpiredTokenError,
+  MissingLoginTokenError,
+  SmapiAuthTokens,
+  SMAPI_FAULT_LOGIN_UNAUTHORIZED,
+  ToSmapiFault,
+} from "./smapi_auth";
 
 export const LOGIN_ROUTE = "/login";
 export const CREATE_REGISTRATION_ROUTE = "/registration/add";
@@ -55,6 +66,7 @@ const WSDL_FILE = path.resolve(
 export type Credentials = {
   loginToken: {
     token: string;
+    key: string;
     householdId: string;
   };
   deviceId: string;
@@ -145,10 +157,19 @@ export function searchResult(
 class SonosSoap {
   linkCodes: LinkCodes;
   bonobUrl: URLBuilder;
+  smapiAuthTokens: SmapiAuthTokens;
+  clock: Clock;
 
-  constructor(bonobUrl: URLBuilder, linkCodes: LinkCodes) {
+  constructor(
+    bonobUrl: URLBuilder,
+    linkCodes: LinkCodes,
+    smapiAuthTokens: SmapiAuthTokens,
+    clock: Clock
+  ) {
     this.bonobUrl = bonobUrl;
     this.linkCodes = linkCodes;
+    this.smapiAuthTokens = smapiAuthTokens;
+    this.clock = clock;
   }
 
   getAppLink(): GetAppLinkResult {
@@ -177,10 +198,13 @@ class SonosSoap {
   }): GetDeviceAuthTokenResult {
     const association = this.linkCodes.associationFor(linkCode);
     if (association) {
+      const smapiAuthToken = this.smapiAuthTokens.issue(
+        association.serviceToken
+      );
       return {
         getDeviceAuthTokenResult: {
-          authToken: association.authToken,
-          privateKey: "",
+          authToken: smapiAuthToken.token,
+          privateKey: smapiAuthToken.key,
           userInfo: {
             nickname: association.nickname,
             userIdHashCode: crypto
@@ -242,25 +266,36 @@ export const playlistAlbumArtURL = (
   bonobUrl: URLBuilder,
   playlist: Playlist
 ) => {
-  const ids = uniq(
-    playlist.entries.map((it) => it.coverArt).filter((it) => it)
-  );
-  if (ids.length == 0) {
+  const burns: BUrn[] = uniq(
+    playlist.entries.filter((it) => it.coverArt != undefined),
+    (it) => it.album.id
+  ).map((it) => it.coverArt!);
+  if (burns.length == 0) {
     return iconArtURI(bonobUrl, "error");
   } else {
     return bonobUrl.append({
-      pathname: `/art/${ids.slice(0, 9).join("&")}/size/180`,
+      pathname: `/art/${burns
+        .slice(0, 9)
+        .map((it) => encodeURIComponent(formatForURL(it)))
+        .join("&")}/size/180`,
     });
   }
 };
 
 export const defaultAlbumArtURI = (
   bonobUrl: URLBuilder,
-  { coverArt }: { coverArt: string | undefined }
+  { coverArt }: { coverArt: BUrn | undefined }
 ) =>
-  coverArt
-    ? bonobUrl.append({ pathname: `/art/${coverArt}/size/180` })
-    : iconArtURI(bonobUrl, "vinyl");
+  pipe(
+    coverArt,
+    O.fromNullable,
+    O.map((it) =>
+      bonobUrl.append({
+        pathname: `/art/${encodeURIComponent(formatForURL(it))}/size/180`,
+      })
+    ),
+    O.getOrElseW(() => iconArtURI(bonobUrl, "vinyl"))
+  );
 
 export const iconArtURI = (bonobUrl: URLBuilder, icon: ICON) =>
   bonobUrl.append({
@@ -270,7 +305,17 @@ export const iconArtURI = (bonobUrl: URLBuilder, icon: ICON) =>
 export const defaultArtistArtURI = (
   bonobUrl: URLBuilder,
   artist: ArtistSummary
-) => bonobUrl.append({ pathname: `/art/artist:${artist.id}/size/180` });
+) =>
+  pipe(
+    artist.image,
+    O.fromNullable,
+    O.map((it) =>
+      bonobUrl.append({
+        pathname: `/art/${encodeURIComponent(formatForURL(it))}/size/180`,
+      })
+    ),
+    O.getOrElseW(() => iconArtURI(bonobUrl, "vinyl"))
+  );
 
 export const sonosifyMimeType = (mimeType: string) =>
   mimeType == "audio/x-flac" ? "audio/flac" : mimeType;
@@ -299,10 +344,10 @@ export const track = (bonobUrl: URLBuilder, track: Track) => ({
     album: track.album.name,
     albumId: `album:${track.album.id}`,
     albumArtist: track.artist.name,
-    albumArtistId: `artist:${track.artist.id}`,
+    albumArtistId: track.artist.id ? `artist:${track.artist.id}` : undefined,
     albumArtURI: defaultAlbumArtURI(bonobUrl, track).href(),
     artist: track.artist.name,
-    artistId: `artist:${track.artist.id}`,
+    artistId: track.artist.id ? `artist:${track.artist.id}` : undefined,
     duration: track.duration,
     genre: track.album.genre?.name,
     genreId: track.album.genre?.id,
@@ -321,39 +366,6 @@ export const artist = (bonobUrl: URLBuilder, artist: ArtistSummary) => ({
   albumArtURI: defaultArtistArtURI(bonobUrl, artist).href(),
 });
 
-const auth = async (
-  musicService: MusicService,
-  accessTokens: AccessTokens,
-  credentials?: Credentials
-) => {
-  if (!credentials) {
-    throw {
-      Fault: {
-        faultcode: "Client.LoginUnsupported",
-        faultstring: "Missing credentials...",
-      },
-    };
-  }
-  const authToken = credentials.loginToken.token;
-  const accessToken = accessTokens.mint(authToken);
-
-  return musicService
-    .login(authToken)
-    .then((musicLibrary) => ({
-      musicLibrary,
-      authToken,
-      accessToken,
-    }))
-    .catch((_) => {
-      throw {
-        Fault: {
-          faultcode: "Client.LoginUnauthorized",
-          faultstring: "Credentials not found...",
-        },
-      };
-    });
-};
-
 function splitId<T>(id: string) {
   const [type, typeId] = id.split(":");
   return (t: T) => ({
@@ -367,17 +379,28 @@ type SoapyHeaders = {
   credentials?: Credentials;
 };
 
+type Auth = {
+  serviceToken: string;
+  credentials: Credentials;
+  apiKey: string;
+};
+
+function isAuth(thing: any): thing is Auth {
+  return thing.serviceToken;
+}
+
 function bindSmapiSoapServiceToExpress(
   app: Express,
   soapPath: string,
   bonobUrl: URLBuilder,
   linkCodes: LinkCodes,
   musicService: MusicService,
-  accessTokens: AccessTokens,
+  apiKeys: APITokens,
   clock: Clock,
-  i8n: I8N
+  i8n: I8N,
+  smapiAuthTokens: SmapiAuthTokens
 ) {
-  const sonosSoap = new SonosSoap(bonobUrl, linkCodes);
+  const sonosSoap = new SonosSoap(bonobUrl, linkCodes, smapiAuthTokens, clock);
 
   const urlWithToken = (accessToken: string) =>
     bonobUrl.append({
@@ -386,6 +409,67 @@ function bindSmapiSoapServiceToExpress(
       },
     });
 
+  const auth = (credentials?: Credentials): E.Either<ToSmapiFault, Auth> => {
+    const credentialsFrom = E.fromNullable(new MissingLoginTokenError());
+    return pipe(
+      credentialsFrom(credentials),
+      E.chain((credentials) =>
+        pipe(
+          smapiAuthTokens.verify({
+            token: credentials.loginToken.token,
+            key: credentials.loginToken.key,
+          }),
+          E.map((serviceToken) => ({
+            serviceToken,
+            credentials,
+          }))
+        )
+      ),
+      E.map(({ serviceToken, credentials }) => ({
+        serviceToken,
+        credentials,
+        apiKey: apiKeys.mint(serviceToken),
+      }))
+    );
+  };
+
+  const login = async (credentials?: Credentials) => {
+    const authOrFail = pipe(
+      auth(credentials),
+      E.getOrElseW((fault) => fault)
+    );
+    if (isAuth(authOrFail)) {
+      return musicService
+        .login(authOrFail.serviceToken)
+        .then((musicLibrary) => ({ ...authOrFail, musicLibrary }))
+        .catch((_) => {
+          throw SMAPI_FAULT_LOGIN_UNAUTHORIZED;
+        });
+    } else if (isExpiredTokenError(authOrFail)) {
+      throw await pipe(
+        musicService.refreshToken(authOrFail.expiredToken),
+        TE.map((it) => smapiAuthTokens.issue(it.serviceToken)),
+        TE.map((newToken) => ({
+          Fault: {
+            faultcode: "Client.TokenRefreshRequired",
+            faultstring: "Token has expired",
+            detail: {
+              refreshAuthTokenResult: {
+                authToken: newToken.token,
+                privateKey: newToken.key,
+              },
+            },
+          },
+        })),
+        TE.getOrElse(() =>
+          T.of(SMAPI_FAULT_LOGIN_UNAUTHORIZED)
+        )
+      )();
+    } else {
+      throw authOrFail.toSmapiFault();
+    }
+  };
+
   const soapyService = listen(
     app,
     soapPath,
@@ -403,31 +487,72 @@ function bindSmapiSoapServiceToExpress(
               pollInterval: 60,
             },
           }),
+          refreshAuthToken: async (_, _2, soapyHeaders: SoapyHeaders) => {
+            const serviceToken = pipe(
+              auth(soapyHeaders?.credentials),
+              E.fold(
+                (fault) =>
+                  isExpiredTokenError(fault)
+                    ? E.right(fault.expiredToken)
+                    : E.left(fault),
+                (creds) => E.right(creds.serviceToken)
+              ),
+              E.getOrElseW((fault) => {
+                throw fault.toSmapiFault();
+              })
+            );
+            return pipe(
+              musicService.refreshToken(serviceToken),
+              TE.map((it) => smapiAuthTokens.issue(it.serviceToken)),
+              TE.map((it) => ({
+                refreshAuthTokenResult: {
+                  authToken: it.token,
+                  privateKey: it.key,
+                },
+              })),
+              TE.getOrElse((_) => {
+                throw SMAPI_FAULT_LOGIN_UNAUTHORIZED;
+              })
+            )();
+          },
           getMediaURI: async (
             { id }: { id: string },
             _,
             soapyHeaders: SoapyHeaders
           ) =>
-            auth(musicService, accessTokens, soapyHeaders?.credentials)
+            login(soapyHeaders?.credentials)
               .then(splitId(id))
-              .then(({ accessToken, type, typeId }) => ({
+              .then(({ credentials, type, typeId }) => ({
                 getMediaURIResult: bonobUrl
                   .append({
                     pathname: `/stream/${type}/${typeId}`,
-                    searchParams: { bat: accessToken },
                   })
                   .href(),
+                httpHeaders: [
+                  {
+                    httpHeader: {
+                      header: "bnbt",
+                      value: credentials.loginToken.token,
+                    },
+                  },
+                  {
+                    httpHeader: {
+                      header: "bnbk",
+                      value: credentials.loginToken.key,
+                    },
+                  },
+                ],
               })),
           getMediaMetadata: async (
             { id }: { id: string },
             _,
             soapyHeaders: SoapyHeaders
           ) =>
-            auth(musicService, accessTokens, soapyHeaders?.credentials)
+            login(soapyHeaders?.credentials)
               .then(splitId(id))
-              .then(async ({ musicLibrary, accessToken, typeId }) =>
+              .then(async ({ musicLibrary, apiKey, typeId }) =>
                 musicLibrary.track(typeId!).then((it) => ({
-                  getMediaMetadataResult: track(urlWithToken(accessToken), it),
+                  getMediaMetadataResult: track(urlWithToken(apiKey), it),
                 }))
               ),
           search: async (
@@ -435,16 +560,16 @@ function bindSmapiSoapServiceToExpress(
             _,
             soapyHeaders: SoapyHeaders
           ) =>
-            auth(musicService, accessTokens, soapyHeaders?.credentials)
+            login(soapyHeaders?.credentials)
               .then(splitId(id))
-              .then(async ({ musicLibrary, accessToken }) => {
+              .then(async ({ musicLibrary, apiKey }) => {
                 switch (id) {
                   case "albums":
                     return musicLibrary.searchAlbums(term).then((it) =>
                       searchResult({
                         count: it.length,
                         mediaCollection: it.map((albumSummary) =>
-                          album(urlWithToken(accessToken), albumSummary)
+                          album(urlWithToken(apiKey), albumSummary)
                         ),
                       })
                     );
@@ -453,7 +578,7 @@ function bindSmapiSoapServiceToExpress(
                       searchResult({
                         count: it.length,
                         mediaCollection: it.map((artistSummary) =>
-                          artist(urlWithToken(accessToken), artistSummary)
+                          artist(urlWithToken(apiKey), artistSummary)
                         ),
                       })
                     );
@@ -462,7 +587,7 @@ function bindSmapiSoapServiceToExpress(
                       searchResult({
                         count: it.length,
                         mediaCollection: it.map((aTrack) =>
-                          album(urlWithToken(accessToken), aTrack.album)
+                          album(urlWithToken(apiKey), aTrack.album)
                         ),
                       })
                     );
@@ -480,9 +605,9 @@ function bindSmapiSoapServiceToExpress(
             _,
             soapyHeaders: SoapyHeaders
           ) =>
-            auth(musicService, accessTokens, soapyHeaders?.credentials)
+            login(soapyHeaders?.credentials)
               .then(splitId(id))
-              .then(async ({ musicLibrary, accessToken, type, typeId }) => {
+              .then(async ({ musicLibrary, apiKey, type, typeId }) => {
                 const paging = { _index: index, _count: count };
                 switch (type) {
                   case "artist":
@@ -496,7 +621,7 @@ function bindSmapiSoapServiceToExpress(
                           index: paging._index,
                           total,
                           mediaCollection: page.map((it) =>
-                            album(urlWithToken(accessToken), it)
+                            album(urlWithToken(apiKey), it)
                           ),
                           relatedBrowse:
                             artist.similarArtists.filter((it) => it.inLibrary)
@@ -514,7 +639,7 @@ function bindSmapiSoapServiceToExpress(
                   case "track":
                     return musicLibrary.track(typeId).then((it) => ({
                       getExtendedMetadataResult: {
-                        mediaMetadata: track(urlWithToken(accessToken), it),
+                        mediaMetadata: track(urlWithToken(apiKey), it),
                       },
                     }));
                   case "album":
@@ -526,7 +651,7 @@ function bindSmapiSoapServiceToExpress(
                             userContent: false,
                             renameable: false,
                           },
-                          ...album(urlWithToken(accessToken), it),
+                          ...album(urlWithToken(apiKey), it),
                         },
                         // <mediaCollection readonly="true">
                         //   </mediaCollection>
@@ -552,9 +677,9 @@ function bindSmapiSoapServiceToExpress(
             soapyHeaders: SoapyHeaders,
             { headers }: Pick<Request, "headers">
           ) =>
-            auth(musicService, accessTokens, soapyHeaders?.credentials)
+            login(soapyHeaders?.credentials)
               .then(splitId(id))
-              .then(({ musicLibrary, accessToken, type, typeId }) => {
+              .then(({ musicLibrary, apiKey, type, typeId }) => {
                 const paging = { _index: index, _count: count };
                 const acceptLanguage = headers["accept-language"];
                 logger.debug(
@@ -566,7 +691,7 @@ function bindSmapiSoapServiceToExpress(
                   musicLibrary.albums(q).then((result) => {
                     return getMetadataResult({
                       mediaCollection: result.results.map((it) =>
-                        album(urlWithToken(accessToken), it)
+                        album(urlWithToken(apiKey), it)
                       ),
                       index: paging._index,
                       total: result.total,
@@ -652,8 +777,6 @@ function bindSmapiSoapServiceToExpress(
                           itemType: "albumList",
                         },
                       ],
-                      index: 0,
-                      total: 9,
                     });
                   case "search":
                     return getMetadataResult({
@@ -674,14 +797,12 @@ function bindSmapiSoapServiceToExpress(
                           title: lang("tracks"),
                         },
                       ],
-                      index: 0,
-                      total: 3,
                     });
                   case "artists":
                     return musicLibrary.artists(paging).then((result) => {
                       return getMetadataResult({
                         mediaCollection: result.results.map((it) =>
-                          artist(urlWithToken(accessToken), it)
+                          artist(urlWithToken(apiKey), it)
                         ),
                         index: paging._index,
                         total: result.total,
@@ -756,7 +877,7 @@ function bindSmapiSoapServiceToExpress(
                       .then(([page, total]) => {
                         return getMetadataResult({
                           mediaCollection: page.map((it) =>
-                            playlist(urlWithToken(accessToken), it)
+                            playlist(urlWithToken(apiKey), it)
                           ),
                           index: paging._index,
                           total,
@@ -770,7 +891,7 @@ function bindSmapiSoapServiceToExpress(
                       .then(([page, total]) => {
                         return getMetadataResult({
                           mediaMetadata: page.map((it) =>
-                            track(urlWithToken(accessToken), it)
+                            track(urlWithToken(apiKey), it)
                           ),
                           index: paging._index,
                           total,
@@ -784,7 +905,7 @@ function bindSmapiSoapServiceToExpress(
                       .then(([page, total]) => {
                         return getMetadataResult({
                           mediaCollection: page.map((it) =>
-                            album(urlWithToken(accessToken), it)
+                            album(urlWithToken(apiKey), it)
                           ),
                           index: paging._index,
                           total,
@@ -801,7 +922,7 @@ function bindSmapiSoapServiceToExpress(
                       .then(([page, total]) => {
                         return getMetadataResult({
                           mediaCollection: page.map((it) =>
-                            artist(urlWithToken(accessToken), it)
+                            artist(urlWithToken(apiKey), it)
                           ),
                           index: paging._index,
                           total,
@@ -814,7 +935,7 @@ function bindSmapiSoapServiceToExpress(
                       .then(([page, total]) => {
                         return getMetadataResult({
                           mediaMetadata: page.map((it) =>
-                            track(urlWithToken(accessToken), it)
+                            track(urlWithToken(apiKey), it)
                           ),
                           index: paging._index,
                           total,
@@ -829,7 +950,7 @@ function bindSmapiSoapServiceToExpress(
             _,
             soapyHeaders: SoapyHeaders
           ) =>
-            auth(musicService, accessTokens, soapyHeaders?.credentials)
+            login(soapyHeaders?.credentials)
               .then(({ musicLibrary }) =>
                 musicLibrary
                   .createPlaylist(title)
@@ -855,7 +976,7 @@ function bindSmapiSoapServiceToExpress(
             _,
             soapyHeaders: SoapyHeaders
           ) =>
-            auth(musicService, accessTokens, soapyHeaders?.credentials)
+            login(soapyHeaders?.credentials)
               .then(({ musicLibrary }) => musicLibrary.deletePlaylist(id))
               .then((_) => ({ deleteContainerResult: {} })),
           addToContainer: async (
@@ -863,7 +984,7 @@ function bindSmapiSoapServiceToExpress(
             _,
             soapyHeaders: SoapyHeaders
           ) =>
-            auth(musicService, accessTokens, soapyHeaders?.credentials)
+            login(soapyHeaders?.credentials)
               .then(splitId(id))
               .then(({ musicLibrary, typeId }) =>
                 musicLibrary.addToPlaylist(parentId.split(":")[1]!, typeId)
@@ -874,7 +995,7 @@ function bindSmapiSoapServiceToExpress(
             _,
             soapyHeaders: SoapyHeaders
           ) =>
-            auth(musicService, accessTokens, soapyHeaders?.credentials)
+            login(soapyHeaders?.credentials)
               .then(splitId(id))
               .then((it) => ({
                 ...it,
@@ -897,7 +1018,7 @@ function bindSmapiSoapServiceToExpress(
             _,
             soapyHeaders: SoapyHeaders
           ) =>
-            auth(musicService, accessTokens, soapyHeaders?.credentials)
+            login(soapyHeaders?.credentials)
               .then(splitId(id))
               .then(({ musicLibrary, typeId }) =>
                 musicLibrary.rate(typeId, ratingFromInt(Math.abs(rating)))
@@ -909,31 +1030,21 @@ function bindSmapiSoapServiceToExpress(
             _,
             soapyHeaders: SoapyHeaders
           ) =>
-            auth(musicService, accessTokens, soapyHeaders?.credentials)
+            login(soapyHeaders?.credentials)
               .then(splitId(id))
               .then(({ musicLibrary, type, typeId }) => {
                 switch (type) {
                   case "track":
-                    return musicLibrary
-                      .track(typeId)
-                      .then(({ duration }) => {
-                        if (
-                          (duration < 30 && +seconds >= 10) ||
-                          (duration >= 30 && +seconds >= 30)
-                        ) {
-                          return musicLibrary.scrobble(typeId);
-                        } else {
-                          return Promise.resolve(true);
-                        }
-                      })
-                      .then(() => {
-                        if (+seconds > 0) {
-                          return musicLibrary.nowPlaying(typeId);
-                        } else {
-                          return Promise.resolve(true);
-                        }
-                      });
-                    break;
+                    return musicLibrary.track(typeId).then(({ duration }) => {
+                      if (
+                        (duration < 30 && +seconds >= 10) ||
+                        (duration >= 30 && +seconds >= 30)
+                      ) {
+                        return musicLibrary.scrobble(typeId);
+                      } else {
+                        return Promise.resolve(true);
+                      }
+                    });
                   default:
                     logger.info("Unsupported scrobble", { id, seconds });
                     return Promise.resolve(true);

src/smapi_auth.ts

@@ -0,0 +1,177 @@
+import { either as E } from "fp-ts";
+import jwt from "jsonwebtoken";
+import { v4 as uuid } from "uuid";
+import { b64Decode, b64Encode } from "./b64";
+import { Clock } from "./clock";
+
+export type SmapiFault = { Fault: { faultcode: string; faultstring: string } };
+export type SmapiRefreshTokenResultFault = SmapiFault & {
+  Fault: {
+    detail: {
+      refreshAuthTokenResult: { authToken: string; privateKey: string };
+    };
+  };
+};
+
+function isError(thing: any): thing is Error {
+  return thing.name && thing.message;
+}
+
+export function isSmapiRefreshTokenResultFault(
+  fault: SmapiFault
+): fault is SmapiRefreshTokenResultFault {
+  return (fault.Fault as any).detail?.refreshAuthTokenResult != undefined;
+}
+
+export type SmapiToken = {
+  token: string;
+  key: string;
+};
+
+export interface ToSmapiFault {
+  _tag: string;
+  toSmapiFault(): SmapiFault
+}
+
+export const SMAPI_FAULT_LOGIN_UNAUTHORIZED = {
+  Fault: {
+    faultcode: "Client.LoginUnauthorized",
+    faultstring:
+      "Failed to authenticate, try Re-Authorising your account in the sonos app",
+  },
+};
+
+export const SMAPI_FAULT_LOGIN_UNSUPPORTED = {
+  Fault: {
+    faultcode: "Client.LoginUnsupported",
+    faultstring: "Missing credentials...",
+  },
+};
+
+export class MissingLoginTokenError extends Error implements ToSmapiFault {
+  _tag = "MissingLoginTokenError";
+
+  constructor() {
+    super("Missing Login Token");
+  }
+
+  toSmapiFault = () => SMAPI_FAULT_LOGIN_UNSUPPORTED;
+}
+
+
+export class InvalidTokenError extends Error implements ToSmapiFault {
+  _tag = "InvalidTokenError";
+
+  constructor(message: string) {
+    super(message);
+  }
+
+  toSmapiFault = () => SMAPI_FAULT_LOGIN_UNAUTHORIZED;
+}
+
+export function isExpiredTokenError(thing: any): thing is ExpiredTokenError {
+  return thing._tag == "ExpiredTokenError";
+}
+
+export class ExpiredTokenError extends Error implements ToSmapiFault {
+  _tag = "ExpiredTokenError";
+  expiredToken: string;
+
+  constructor(expiredToken: string) {
+    super("SMAPI token has expired");
+    this.expiredToken = expiredToken;
+  }
+
+  toSmapiFault = () => ({
+    Fault: {
+      faultcode: "Client.TokenRefreshRequired",
+      faultstring: "Token has expired",
+    },
+  });
+}
+
+export type SmapiAuthTokens = {
+  issue: (serviceToken: string) => SmapiToken;
+  verify: (smapiToken: SmapiToken) => E.Either<ToSmapiFault, string>;
+};
+
+type TokenExpiredError = {
+  name: string;
+  message: string;
+  expiredAt: number;
+};
+
+function isTokenExpiredError(thing: any): thing is TokenExpiredError {
+  return thing.name == "TokenExpiredError";
+}
+
+export const smapiTokenAsString = (smapiToken: SmapiToken) =>
+  b64Encode(
+    JSON.stringify({
+      token: smapiToken.token,
+      key: smapiToken.key,
+    })
+  );
+export const smapiTokenFromString = (smapiTokenString: string): SmapiToken =>
+  JSON.parse(b64Decode(smapiTokenString));
+
+export const SMAPI_TOKEN_VERSION = 2;
+
+export class JWTSmapiLoginTokens implements SmapiAuthTokens {
+  private readonly clock: Clock;
+  private readonly secret: string;
+  private readonly expiresIn: string;
+  private readonly version: number;
+  private readonly keyGenerator: () => string;
+
+  constructor(
+    clock: Clock,
+    secret: string,
+    expiresIn: string,
+    keyGenerator: () => string = uuid,
+    version: number = SMAPI_TOKEN_VERSION
+  ) {
+    this.clock = clock;
+    this.secret = secret;
+    this.expiresIn = expiresIn;
+    this.version = version;
+    this.keyGenerator = keyGenerator;
+  }
+
+  issue = (serviceToken: string) => {
+    const key = this.keyGenerator();
+    return {
+      token: jwt.sign(
+        { serviceToken, iat: this.clock.now().unix() },
+        this.secret + this.version + key,
+        { expiresIn: this.expiresIn }
+      ),
+      key,
+    };
+  };
+
+  verify = (smapiToken: SmapiToken): E.Either<ToSmapiFault, string> => {
+    try {
+      return E.right(
+        (
+          jwt.verify(
+            smapiToken.token,
+            this.secret + this.version + smapiToken.key
+          ) as any
+        ).serviceToken
+      );
+    } catch (e) {
+      if (isTokenExpiredError(e)) {
+        const serviceToken = (
+          jwt.verify(
+            smapiToken.token,
+            this.secret + this.version + smapiToken.key,
+            { ignoreExpiration: true }
+          ) as any
+        ).serviceToken;
+        return E.left(new ExpiredTokenError(serviceToken));
+      } else if (isError(e)) return E.left(new InvalidTokenError(e.message));
+      else return E.left(new InvalidTokenError("Failed to verify token"));
+    }
+  };
+}

src/subsonic.ts

@@ -1,4 +1,4 @@
-import { option as O } from "fp-ts";
+import { option as O, taskEither as TE } from "fp-ts";
 import * as A from "fp-ts/Array";
 import { ordString } from "fp-ts/lib/Ord";
 import { pipe } from "fp-ts/lib/function";
@@ -7,20 +7,19 @@ import {
   Credentials,
   MusicService,
   Album,
-  Artist,
-  ArtistSummary,
   Result,
   slice2,
   AlbumQuery,
   ArtistQuery,
   MusicLibrary,
-  Images,
   AlbumSummary,
   Genre,
   Track,
   CoverArt,
   Rating,
   AlbumQueryType,
+  Artist,
+  AuthFailure,
 } from "./music_service";
 import sharp from "sharp";
 import _ from "underscore";
@@ -28,10 +27,11 @@ import fse from "fs-extra";
 import path from "path";
 
 import axios, { AxiosRequestConfig } from "axios";
-import { Encryption } from "./encryption";
-import randomString from "./random_string";
+import randomstring from "randomstring";
 import { b64Encode, b64Decode } from "./b64";
 import logger from "./logger";
+import { assertSystem, BUrn } from "./burn";
+import { artist } from "./smapi";
 
 export const BROWSER_HEADERS = {
   accept:
@@ -47,7 +47,7 @@ export const t = (password: string, s: string) =>
   Md5.hashStr(`${password}${s}`);
 
 export const t_and_s = (password: string) => {
-  const s = randomString();
+  const s = randomstring.generate();
   return {
     t: t(password, s),
     s,
@@ -56,20 +56,18 @@ export const t_and_s = (password: string) => {
 
 export const DODGY_IMAGE_NAME = "2a96cbd8b46e442fc41c2b86b821562f.png";
 
-export const isDodgyImage = (url: string) => url.endsWith(DODGY_IMAGE_NAME);
+export const isValidImage = (url: string | undefined) =>
+  url != undefined && !url.endsWith(DODGY_IMAGE_NAME);
 
-export const validate = (url: string | undefined) =>
-  url && !isDodgyImage(url) ? url : undefined;
-
-export type SubsonicEnvelope = {
+type SubsonicEnvelope = {
   "subsonic-response": SubsonicResponse;
 };
 
-export type SubsonicResponse = {
+type SubsonicResponse = {
   status: string;
 };
 
-export type album = {
+type album = {
   id: string;
   name: string;
   artist: string | undefined;
@@ -79,68 +77,70 @@ export type album = {
   year: string | undefined;
 };
 
-export type artistSummary = {
+type artist = {
   id: string;
   name: string;
   albumCount: number;
   artistImageUrl: string | undefined;
 };
 
-export type GetArtistsResponse = SubsonicResponse & {
+type GetArtistsResponse = SubsonicResponse & {
   artists: {
     index: {
-      artist: artistSummary[];
+      artist: artist[];
       name: string;
     }[];
   };
 };
 
-export type GetAlbumListResponse = SubsonicResponse & {
+type GetAlbumListResponse = SubsonicResponse & {
   albumList2: {
     album: album[];
   };
 };
 
-export type genre = {
+type genre = {
   songCount: number;
   albumCount: number;
   value: string;
 };
 
-export type GetGenresResponse = SubsonicResponse & {
+type GetGenresResponse = SubsonicResponse & {
   genres: {
     genre: genre[];
   };
 };
 
-export type SubsonicError = SubsonicResponse & {
+type SubsonicError = SubsonicResponse & {
   error: {
     code: string;
     message: string;
   };
 };
 
-export type artistInfo = {
-  biography: string | undefined;
-  musicBrainzId: string | undefined;
-  lastFmUrl: string | undefined;
+export type images = {
   smallImageUrl: string | undefined;
   mediumImageUrl: string | undefined;
   largeImageUrl: string | undefined;
-  similarArtist: artistSummary[];
 };
 
-export type ArtistInfo = {
-  image: Images;
-  similarArtist: (ArtistSummary & { inLibrary: boolean })[];
+type artistInfo = images & {
+  biography: string | undefined;
+  musicBrainzId: string | undefined;
+  lastFmUrl: string | undefined;
+  similarArtist: artist[];
 };
 
-export type GetArtistInfoResponse = SubsonicResponse & {
+type ArtistSummary = IdName & {
+  image: BUrn | undefined;
+};
+
+type GetArtistInfoResponse = SubsonicResponse & {
   artistInfo2: artistInfo;
 };
 
-export type GetArtistResponse = SubsonicResponse & {
-  artist: artistSummary & {
+type GetArtistResponse = SubsonicResponse & {
+  artist: artist & {
     album: album[];
   };
 };
@@ -150,7 +150,9 @@ export type song = {
   parent: string | undefined;
   title: string;
   album: string | undefined;
+  albumId: string | undefined;
   artist: string | undefined;
+  artistId: string | undefined;
   track: number | undefined;
   year: string | undefined;
   genre: string | undefined;
@@ -160,25 +162,23 @@ export type song = {
   bitRate: number | undefined;
   suffix: string | undefined;
   contentType: string | undefined;
-  albumId: string | undefined;
-  artistId: string | undefined;
   type: string | undefined;
   userRating: number | undefined;
   starred: string | undefined;
 };
 
-export type GetAlbumResponse = {
+type GetAlbumResponse = {
   album: album & {
     song: song[];
   };
 };
 
-export type playlist = {
+type playlist = {
   id: string;
   name: string;
 };
 
-export type GetPlaylistResponse = {
+type GetPlaylistResponse = {
   playlist: {
     id: string;
     name: string;
@@ -186,32 +186,39 @@ export type GetPlaylistResponse = {
   };
 };
 
-export type GetPlaylistsResponse = {
+type GetPlaylistsResponse = {
   playlists: { playlist: playlist[] };
 };
 
-export type GetSimilarSongsResponse = {
+type GetSimilarSongsResponse = {
   similarSongs2: { song: song[] };
 };
 
-export type GetTopSongsResponse = {
+type GetTopSongsResponse = {
   topSongs: { song: song[] };
 };
 
-export type GetSongResponse = {
+type GetSongResponse = {
   song: song;
 };
 
-export type GetStarredResponse = {
+type GetStarredResponse = {
   starred2: {
     song: song[];
     album: album[];
   };
 };
 
-export type Search3Response = SubsonicResponse & {
+export type PingResponse = {
+  status: string;
+  version: string;
+  type: string;
+  serverVersion: string;
+};
+
+type Search3Response = SubsonicResponse & {
   searchResult3: {
-    artist: artistSummary[];
+    artist: artist[];
     album: album[];
     song: song[];
   };
@@ -223,31 +230,45 @@ export function isError(
   return (subsonicResponse as SubsonicError).error !== undefined;
 }
 
-export const splitCoverArtId = (coverArt: string): [string, string] => {
-  const parts = coverArt.split(":").filter((it) => it.length > 0);
-  if (parts.length < 2) throw `'${coverArt}' is an invalid coverArt id'`;
-  return [parts[0]!, parts.slice(1).join(":")];
-};
-
-export type IdName = {
+type IdName = {
   id: string;
   name: string;
 };
 
-export type getAlbumListParams = {
-  type: string;
-  size?: number;
-  offet?: number;
-  fromYear?: string;
-  toYear?: string;
-  genre?: string;
+const coverArtURN = (coverArt: string | undefined): BUrn | undefined =>
+  pipe(
+    coverArt,
+    O.fromNullable,
+    O.map((it: string) => ({ system: "subsonic", resource: `art:${it}` })),
+    O.getOrElseW(() => undefined)
+  );
+
+export const artistImageURN = (
+  spec: Partial<{
+    artistId: string | undefined;
+    artistImageURL: string | undefined;
+  }>
+): BUrn | undefined => {
+  const deets = {
+    artistId: undefined,
+    artistImageURL: undefined,
+    ...spec,
+  };
+  if (deets.artistImageURL && isValidImage(deets.artistImageURL)) {
+    return {
+      system: "external",
+      resource: deets.artistImageURL,
+    };
+  } else if (artistIsInLibrary(deets.artistId)) {
+    return {
+      system: "subsonic",
+      resource: `art:${deets.artistId!}`,
+    };
+  } else {
+    return undefined;
+  }
 };
 
-export const MAX_ALBUM_LIST = 500;
-
-const maybeAsCoverArt = (coverArt: string | undefined) =>
-  coverArt ? `coverArt:${coverArt}` : undefined;
-
 export const asTrack = (album: Album, song: song): Track => ({
   id: song.id,
   name: song.title,
@@ -255,11 +276,14 @@ export const asTrack = (album: Album, song: song): Track => ({
   duration: song.duration || 0,
   number: song.track || 0,
   genre: maybeAsGenre(song.genre),
-  coverArt: maybeAsCoverArt(song.coverArt),
+  coverArt: coverArtURN(song.coverArt),
   album,
   artist: {
-    id: `${song.artistId!}`,
-    name: song.artist!,
+    id: song.artistId,
+    name: song.artist ? song.artist : "?",
+    image: song.artistId
+      ? artistImageURN({ artistId: song.artistId })
+      : undefined,
   },
   rating: {
     love: song.starred != undefined,
@@ -277,7 +301,7 @@ const asAlbum = (album: album): Album => ({
   genre: maybeAsGenre(album.genre),
   artistId: album.artistId,
   artistName: album.artist,
-  coverArt: maybeAsCoverArt(album.coverArt),
+  coverArt: coverArtURN(album.coverArt),
 });
 
 export const asGenre = (genreName: string) => ({
@@ -295,8 +319,8 @@ const maybeAsGenre = (genreName: string | undefined): Genre | undefined =>
 
 export type StreamClientApplication = (track: Track) => string;
 
-export const DEFAULT_CLIENT_APPLICATION = "bonob";
-export const USER_AGENT = "bonob";
+const DEFAULT_CLIENT_APPLICATION = "bonob";
+const USER_AGENT = "bonob";
 
 export const DEFAULT: StreamClientApplication = (_: Track) =>
   DEFAULT_CLIENT_APPLICATION;
@@ -367,20 +391,37 @@ const AlbumQueryTypeToSubsonicType: Record<AlbumQueryType, string> = {
   starred: "highest",
 };
 
+const artistIsInLibrary = (artistId: string | undefined) =>
+  artistId != undefined && artistId != "-1";
+
+type SubsonicCredentials = Credentials & {
+  type: string;
+  bearer: string | undefined;
+};
+
+export const asToken = (credentials: SubsonicCredentials) =>
+  b64Encode(JSON.stringify(credentials));
+export const parseToken = (token: string): SubsonicCredentials =>
+  JSON.parse(b64Decode(token));
+
+interface SubsonicMusicLibrary extends MusicLibrary {
+  flavour(): string;
+  bearerToken(
+    credentials: Credentials
+  ): TE.TaskEither<Error, string | undefined>;
+}
+
 export class Subsonic implements MusicService {
   url: string;
-  encryption: Encryption;
   streamClientApplication: StreamClientApplication;
   externalImageFetcher: ImageFetcher;
 
   constructor(
     url: string,
-    encryption: Encryption,
     streamClientApplication: StreamClientApplication = DEFAULT,
     externalImageFetcher: ImageFetcher = axiosImageFetcher
   ) {
     this.url = url;
-    this.encryption = encryption;
     this.streamClientApplication = streamClientApplication;
     this.externalImageFetcher = externalImageFetcher;
   }
@@ -405,6 +446,9 @@ export class Subsonic implements MusicService {
         },
         ...config,
       })
+      .catch((e) => {
+        throw `Subsonic failed with: ${e}`;
+      })
       .then((response) => {
         if (response.status != 200 && response.status != 206) {
           throw `Subsonic failed with a ${response.status || "no!"} status`;
@@ -424,23 +468,44 @@ export class Subsonic implements MusicService {
         else return json as unknown as T;
       });
 
-  generateToken = async (credentials: Credentials) =>
-    this.getJSON(credentials, "/rest/ping.view")
-      .then(() => ({
-        authToken: b64Encode(
-          JSON.stringify(this.encryption.encrypt(JSON.stringify(credentials)))
-        ),
+  generateToken = (credentials: Credentials) =>
+    pipe(
+      TE.tryCatch(
+        () =>
+          this.getJSON<PingResponse>(
+            _.pick(credentials, "username", "password"),
+            "/rest/ping.view"
+          ),
+        (e) => new AuthFailure(e as string)
+      ),
+      TE.chain(({ type }) =>
+        pipe(
+          TE.tryCatch(
+            () => this.libraryFor({ ...credentials, type }),
+            () => new AuthFailure("Failed to get library")
+          ),
+          TE.map((library) => ({ type, library }))
+        )
+      ),
+      TE.chain(({ library, type }) =>
+        pipe(
+          library.bearerToken(credentials),
+          TE.map((bearer) => ({ bearer, type }))
+        )
+      ),
+      TE.map(({ bearer, type }) => ({
+        serviceToken: asToken({ ...credentials, bearer, type }),
         userId: credentials.username,
         nickname: credentials.username,
       }))
-      .catch((e) => ({ message: `${e}` }));
+    );
 
-  parseToken = (token: string): Credentials =>
-    JSON.parse(this.encryption.decrypt(JSON.parse(b64Decode(token))));
+  refreshToken = (serviceToken: string) =>
+    this.generateToken(parseToken(serviceToken));
 
   getArtists = (
     credentials: Credentials
-  ): Promise<(IdName & { albumCount: number })[]> =>
+  ): Promise<(IdName & { albumCount: number; image: BUrn | undefined })[]> =>
     this.getJSON<GetArtistsResponse>(credentials, "/rest/getArtists")
       .then((it) => (it.artists.index || []).flatMap((it) => it.artist || []))
       .then((artists) =>
@@ -448,26 +513,46 @@ export class Subsonic implements MusicService {
           id: `${artist.id}`,
           name: artist.name,
           albumCount: artist.albumCount,
+          image: artistImageURN({
+            artistId: artist.id,
+            artistImageURL: artist.artistImageUrl,
+          }),
         }))
       );
 
-  getArtistInfo = (credentials: Credentials, id: string): Promise<ArtistInfo> =>
+  getArtistInfo = (
+    credentials: Credentials,
+    id: string
+  ): Promise<{
+    similarArtist: (ArtistSummary & { inLibrary: boolean })[];
+    images: {
+      s: string | undefined;
+      m: string | undefined;
+      l: string | undefined;
+    };
+  }> =>
     this.getJSON<GetArtistInfoResponse>(credentials, "/rest/getArtistInfo2", {
       id,
       count: 50,
       includeNotPresent: true,
-    }).then((it) => ({
-      image: {
-        small: validate(it.artistInfo2.smallImageUrl),
-        medium: validate(it.artistInfo2.mediumImageUrl),
-        large: validate(it.artistInfo2.largeImageUrl),
-      },
-      similarArtist: (it.artistInfo2.similarArtist || []).map((artist) => ({
-        id: `${artist.id}`,
-        name: artist.name,
-        inLibrary: artist.id != "-1",
-      })),
-    }));
+    })
+      .then((it) => it.artistInfo2)
+      .then((it) => ({
+        images: {
+          s: it.smallImageUrl,
+          m: it.mediumImageUrl,
+          l: it.largeImageUrl,
+        },
+        similarArtist: (it.similarArtist || []).map((artist) => ({
+          id: `${artist.id}`,
+          name: artist.name,
+          inLibrary: artistIsInLibrary(artist.id),
+          image: artistImageURN({
+            artistId: artist.id,
+            artistImageURL: artist.artistImageUrl,
+          }),
+        })),
+      }));
 
   getAlbum = (credentials: Credentials, id: string): Promise<Album> =>
     this.getJSON<GetAlbumResponse>(credentials, "/rest/getAlbum", { id })
@@ -479,13 +564,15 @@ export class Subsonic implements MusicService {
         genre: maybeAsGenre(album.genre),
         artistId: album.artistId,
         artistName: album.artist,
-        coverArt: maybeAsCoverArt(album.coverArt),
+        coverArt: coverArtURN(album.coverArt),
       }));
 
   getArtist = (
     credentials: Credentials,
     id: string
-  ): Promise<IdName & { albums: AlbumSummary[] }> =>
+  ): Promise<
+    IdName & { artistImageUrl: string | undefined; albums: AlbumSummary[] }
+  > =>
     this.getJSON<GetArtistResponse>(credentials, "/rest/getArtist", {
       id,
     })
@@ -493,6 +580,7 @@ export class Subsonic implements MusicService {
       .then((it) => ({
         id: it.id,
         name: it.name,
+        artistImageUrl: it.artistImageUrl,
         albums: this.toAlbumSummary(it.album || []),
       }));
 
@@ -503,7 +591,15 @@ export class Subsonic implements MusicService {
     ]).then(([artist, artistInfo]) => ({
       id: artist.id,
       name: artist.name,
-      image: artistInfo.image,
+      image: artistImageURN({
+        artistId: artist.id,
+        artistImageURL: [
+          artist.artistImageUrl,
+          artistInfo.images.l,
+          artistInfo.images.m,
+          artistInfo.images.s,
+        ].find(isValidImage),
+      }),
       albums: artist.albums,
       similarArtists: artistInfo.similarArtist,
     }));
@@ -538,7 +634,7 @@ export class Subsonic implements MusicService {
       genre: maybeAsGenre(album.genre),
       artistId: album.artistId,
       artistName: album.artist,
-      coverArt: maybeAsCoverArt(album.coverArt),
+      coverArt: coverArtURN(album.coverArt),
     }));
 
   search3 = (credentials: Credentials, q: any) =>
@@ -578,18 +674,27 @@ export class Subsonic implements MusicService {
   //       albums: it.album.map(asAlbum),
   //     }));
 
-  async login(token: string) {
-    const subsonic = this;
-    const credentials: Credentials = this.parseToken(token);
+  login = async (token: string) => this.libraryFor(parseToken(token));
 
-    const musicLibrary: MusicLibrary = {
+  private libraryFor = (
+    credentials: Credentials & { type: string }
+  ): Promise<SubsonicMusicLibrary> => {
+    const subsonic = this;
+
+    const genericSubsonic: SubsonicMusicLibrary = {
+      flavour: () => "subsonic",
+      bearerToken: (_: Credentials) => TE.right(undefined),
       artists: (q: ArtistQuery): Promise<Result<ArtistSummary>> =>
         subsonic
           .getArtists(credentials)
           .then(slice2(q))
           .then(([page, total]) => ({
             total,
-            results: page.map((it) => ({ id: it.id, name: it.name })),
+            results: page.map((it) => ({
+              id: it.id,
+              name: it.name,
+              image: it.image,
+            })),
           })),
       artist: async (id: string): Promise<Artist> =>
         subsonic.getArtistWithInfo(credentials, id),
@@ -694,63 +799,21 @@ export class Subsonic implements MusicService {
               stream: res.data,
             }))
         ),
-      coverArt: async (coverArt: string, size?: number) => {
-        const [type, id] = splitCoverArtId(coverArt);
-        if (type == "coverArt") {
-          return subsonic
-            .getCoverArt(credentials, id, size)
-            .then((res) => ({
-              contentType: res.headers["content-type"],
-              data: Buffer.from(res.data, "binary"),
-            }))
-            .catch((e) => {
-              logger.error(`Failed getting coverArt ${coverArt}: ${e}`);
-              return undefined;
-            });
-        } else {
-          return subsonic
-            .getArtistWithInfo(credentials, id)
-            .then((artist) => {
-              const albumsWithCoverArt = artist.albums.filter(
-                (it) => it.coverArt
-              );
-              if (artist.image.large) {
-                return this.externalImageFetcher(artist.image.large!).then(
-                  (image) => {
-                    if (image && size) {
-                      return sharp(image.data)
-                        .resize(size)
-                        .toBuffer()
-                        .then((resized) => ({
-                          contentType: image.contentType,
-                          data: resized,
-                        }));
-                    } else {
-                      return image;
-                    }
-                  }
-                );
-              } else if (albumsWithCoverArt.length > 0) {
-                return subsonic
-                  .getCoverArt(
-                    credentials,
-                    splitCoverArtId(albumsWithCoverArt[0]!.coverArt!)[1],
-                    size
-                  )
-                  .then((res) => ({
-                    contentType: res.headers["content-type"],
-                    data: Buffer.from(res.data, "binary"),
-                  }));
-              } else {
-                return undefined;
-              }
-            })
-            .catch((e) => {
-              logger.error(`Failed getting coverArt ${coverArt}: ${e}`);
-              return undefined;
-            });
-        }
-      },
+      coverArt: async (coverArtURN: BUrn, size?: number) =>
+        Promise.resolve(coverArtURN)
+          .then((it) => assertSystem(it, "subsonic"))
+          .then((it) => it.resource.split(":")[1]!)
+          .then((it) => subsonic.getCoverArt(credentials, it, size))
+          .then((res) => ({
+            contentType: res.headers["content-type"],
+            data: Buffer.from(res.data, "binary"),
+          }))
+          .catch((e) => {
+            logger.error(
+              `Failed getting coverArt for urn:'${coverArtURN}': ${e}`
+            );
+            return undefined;
+          }),
       scrobble: async (id: string) =>
         subsonic
           .getJSON(credentials, `/rest/scrobble`, {
@@ -774,6 +837,10 @@ export class Subsonic implements MusicService {
             artists.map((artist) => ({
               id: artist.id,
               name: artist.name,
+              image: artistImageURN({
+                artistId: artist.id,
+                artistImageURL: artist.artistImageUrl,
+              }),
             }))
           ),
       searchAlbums: async (query: string) =>
@@ -815,7 +882,7 @@ export class Subsonic implements MusicService {
                     genre: maybeAsGenre(entry.genre),
                     artistName: entry.artist,
                     artistId: entry.artistId,
-                    coverArt: maybeAsCoverArt(entry.coverArt),
+                    coverArt: coverArtURN(entry.coverArt),
                   },
                   entry
                 ),
@@ -887,6 +954,25 @@ export class Subsonic implements MusicService {
         ),
     };
 
-    return Promise.resolve(musicLibrary);
-  }
+    if (credentials.type == "navidrome") {
+      return Promise.resolve({
+        ...genericSubsonic,
+        flavour: () => "navidrome",
+        bearerToken: (credentials: Credentials) =>
+          pipe(
+            TE.tryCatch(
+              () =>
+                axios.post(
+                  `${this.url}/auth/login`,
+                  _.pick(credentials, "username", "password")
+                ),
+              () => new AuthFailure("Failed to get bearerToken")
+            ),
+            TE.map((it) => it.data.token as string | undefined)
+          ),
+      });
+    } else {
+      return Promise.resolve(genericSubsonic);
+    }
+  };
 }

tests/access_tokens.test.ts

@@ -1,273 +0,0 @@
-import { v4 as uuid } from "uuid";
-import dayjs from "dayjs";
-
-import {
-  AccessTokenPerAuthToken,
-  EncryptedAccessTokens,
-  ExpiringAccessTokens,
-  InMemoryAccessTokens,
-  sha256
-} from "../src/access_tokens";
-import { Encryption } from "../src/encryption";
-
-describe("ExpiringAccessTokens", () => {
-  let now = dayjs();
-
-  const accessTokens = new ExpiringAccessTokens({ now: () => now });
-
-  describe("tokens", () => {
-    it("they should be unique", () => {
-      const authToken = uuid();
-      expect(accessTokens.mint(authToken)).not.toEqual(
-        accessTokens.mint(authToken)
-      );
-    });
-  });
-
-  describe("tokens that dont exist", () => {
-    it("should return undefined", () => {
-      expect(accessTokens.authTokenFor("doesnt exist")).toBeUndefined();
-    });
-  });
-
-  describe("tokens that have not expired", () => {
-    it("should be able to return them", () => {
-      const authToken = uuid();
-
-      const accessToken = accessTokens.mint(authToken);
-
-      expect(accessTokens.authTokenFor(accessToken)).toEqual(authToken);
-    });
-
-    it("should be able to have many per authToken", () => {
-      const authToken = uuid();
-
-      const accessToken1 = accessTokens.mint(authToken);
-      const accessToken2 = accessTokens.mint(authToken);
-
-      expect(accessTokens.authTokenFor(accessToken1)).toEqual(authToken);
-      expect(accessTokens.authTokenFor(accessToken2)).toEqual(authToken);
-    });
-  });
-
-  describe("tokens that have expired", () => {
-    describe("retrieving it", () => {
-      it("should return undefined", () => {
-        const authToken = uuid();
-
-        now = dayjs();
-        const accessToken = accessTokens.mint(authToken);
-
-        now = now.add(12, "hours").add(1, "second");
-
-        expect(accessTokens.authTokenFor(accessToken)).toBeUndefined();
-      });
-    });
-
-    describe("should be cleared out", () => {
-      const authToken1 = uuid();
-      const authToken2 = uuid();
-
-      now = dayjs();
-
-      const accessToken1_1 = accessTokens.mint(authToken1);
-      const accessToken2_1 = accessTokens.mint(authToken2);
-
-      expect(accessTokens.count()).toEqual(2);
-      expect(accessTokens.authTokenFor(accessToken1_1)).toEqual(authToken1);
-      expect(accessTokens.authTokenFor(accessToken2_1)).toEqual(authToken2);
-
-      now = now.add(12, "hours").add(1, "second");
-
-      const accessToken1_2 = accessTokens.mint(authToken1);
-
-      expect(accessTokens.count()).toEqual(1);
-      expect(accessTokens.authTokenFor(accessToken1_1)).toBeUndefined();
-      expect(accessTokens.authTokenFor(accessToken2_1)).toBeUndefined();
-      expect(accessTokens.authTokenFor(accessToken1_2)).toEqual(authToken1);
-
-      now = now.add(6, "hours");
-
-      const accessToken2_2 = accessTokens.mint(authToken2);
-
-      expect(accessTokens.count()).toEqual(2);
-      expect(accessTokens.authTokenFor(accessToken1_1)).toBeUndefined();
-      expect(accessTokens.authTokenFor(accessToken2_1)).toBeUndefined();
-      expect(accessTokens.authTokenFor(accessToken1_2)).toEqual(authToken1);
-      expect(accessTokens.authTokenFor(accessToken2_2)).toEqual(authToken2);
-
-      now = now.add(6, "hours").add(1, "minute");
-
-      expect(accessTokens.authTokenFor(accessToken1_1)).toBeUndefined();
-      expect(accessTokens.authTokenFor(accessToken2_1)).toBeUndefined();
-      expect(accessTokens.authTokenFor(accessToken1_2)).toBeUndefined();
-      expect(accessTokens.authTokenFor(accessToken2_2)).toEqual(authToken2);
-      expect(accessTokens.count()).toEqual(1);
-
-      now = now.add(6, "hours").add(1, "minute");
-
-      expect(accessTokens.authTokenFor(accessToken1_1)).toBeUndefined();
-      expect(accessTokens.authTokenFor(accessToken2_1)).toBeUndefined();
-      expect(accessTokens.authTokenFor(accessToken1_2)).toBeUndefined();
-      expect(accessTokens.authTokenFor(accessToken2_2)).toBeUndefined();
-      expect(accessTokens.count()).toEqual(0);
-    });
-  });
-});
-
-describe("EncryptedAccessTokens", () => {
-  const encryption = {
-    encrypt: jest.fn(),
-    decrypt: jest.fn(),
-  };
-
-  const accessTokens = new EncryptedAccessTokens(
-    (encryption as unknown) as Encryption
-  );
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-    jest.resetAllMocks();
-  });
-
-  describe("encrypt and decrypt", () => {
-    it("should be able to round trip the token", () => {
-      const authToken = `the token - ${uuid()}`;
-      const hash = {
-        encryptedData: "the encrypted token",
-        iv: "vi",
-      };
-
-      encryption.encrypt.mockReturnValue(hash);
-      encryption.decrypt.mockReturnValue(authToken);
-
-      const accessToken = accessTokens.mint(authToken);
-
-      expect(accessToken).not.toContain(authToken);
-      expect(accessToken).toEqual(
-        Buffer.from(JSON.stringify(hash)).toString("base64")
-      );
-
-      expect(accessTokens.authTokenFor(accessToken)).toEqual(authToken);
-
-      expect(encryption.encrypt).toHaveBeenCalledWith(authToken);
-      expect(encryption.decrypt).toHaveBeenCalledWith(hash);
-    });
-  });
-
-  describe("when the token is a valid Hash but doesnt decrypt", () => {
-    it("should return undefined", () => {
-      const hash = {
-        encryptedData: "valid hash",
-        iv: "vi",
-      };
-      encryption.decrypt.mockImplementation(() => {
-        throw "Boooooom decryption failed!!!";
-      });
-      expect(
-        accessTokens.authTokenFor(
-          Buffer.from(JSON.stringify(hash)).toString("base64")
-        )
-      ).toBeUndefined();
-    });
-  });
-
-  describe("when the token is not even a valid hash", () => {
-    it("should return undefined", () => {
-      encryption.decrypt.mockImplementation(() => {
-        throw "Boooooom decryption failed!!!";
-      });
-      expect(accessTokens.authTokenFor("some rubbish")).toBeUndefined();
-    });
-  });
-});
-
-describe("AccessTokenPerAuthToken", () => {
-  const accessTokens = new AccessTokenPerAuthToken();
-
-  it("should return the same access token for the same auth token", () => {
-    const authToken = "token1";
-    
-    const accessToken1 = accessTokens.mint(authToken);
-    const accessToken2 = accessTokens.mint(authToken);
-
-    expect(accessToken1).not.toEqual(authToken);
-    expect(accessToken1).toEqual(accessToken2);
-  });
-
-  describe("when there is an auth token for the access token", () => {
-    it("should be able to retrieve it", () => {
-      const authToken = uuid();
-      const accessToken = accessTokens.mint(authToken);
-
-      expect(accessTokens.authTokenFor(accessToken)).toEqual(authToken);
-    });
-  });
-
-  describe("when there is no auth token for the access token", () => {
-    it("should return undefined", () => {
-      expect(accessTokens.authTokenFor(uuid())).toBeUndefined();
-    });
-  });
-});
-
-describe('sha256 minter', () => {
-  it('should return the same value for the same salt and authToken', () => {
-    const authToken = uuid();
-    const token1 = sha256("salty")(authToken);
-    const token2 = sha256("salty")(authToken);
-
-    expect(token1).not.toEqual(authToken);
-    expect(token1).toEqual(token2);
-  });
-
-  it('should returrn different values for the same salt but different authTokens', () => {
-    const authToken1 = uuid();
-    const authToken2 = uuid();
-
-    const token1 = sha256("salty")(authToken1);
-    const token2= sha256("salty")(authToken2);
-
-    expect(token1).not.toEqual(token2);
-  });
-
-  it('should return different values for the same authToken but different salts', () => {
-    const authToken = uuid();
-
-    const token1 = sha256("salt1")(authToken);
-    const token2= sha256("salt2")(authToken);
-
-    expect(token1).not.toEqual(token2);
-  });
-});
-
-describe("InMemoryAccessTokens", () => {
-  const reverseAuthToken = (authToken: string) => authToken.split("").reverse().join("");
-
-  const accessTokens = new InMemoryAccessTokens(reverseAuthToken);
-
-  it("should return the same access token for the same auth token", () => {
-    const authToken = "token1";
-    
-    const accessToken1 = accessTokens.mint(authToken);
-    const accessToken2 = accessTokens.mint(authToken);
-
-    expect(accessToken1).not.toEqual(authToken);
-    expect(accessToken1).toEqual(accessToken2);
-  });
-
-  describe("when there is an auth token for the access token", () => {
-    it("should be able to retrieve it", () => {
-      const authToken = uuid();
-      const accessToken = accessTokens.mint(authToken);
-
-      expect(accessTokens.authTokenFor(accessToken)).toEqual(authToken);
-    });
-  });
-
-  describe("when there is no auth token for the access token", () => {
-    it("should return undefined", () => {
-      expect(accessTokens.authTokenFor(uuid())).toBeUndefined();
-    });
-  });
-});

tests/api_tokens.test.ts

@@ -0,0 +1,67 @@
+import { v4 as uuid } from "uuid";
+
+import {
+  InMemoryAPITokens,
+  sha256
+} from "../src/api_tokens";
+
+describe('sha256 minter', () => {
+  it('should return the same value for the same salt and authToken', () => {
+    const authToken = uuid();
+    const token1 = sha256("salty")(authToken);
+    const token2 = sha256("salty")(authToken);
+
+    expect(token1).not.toEqual(authToken);
+    expect(token1).toEqual(token2);
+  });
+
+  it('should returrn different values for the same salt but different authTokens', () => {
+    const authToken1 = uuid();
+    const authToken2 = uuid();
+
+    const token1 = sha256("salty")(authToken1);
+    const token2= sha256("salty")(authToken2);
+
+    expect(token1).not.toEqual(token2);
+  });
+
+  it('should return different values for the same authToken but different salts', () => {
+    const authToken = uuid();
+
+    const token1 = sha256("salt1")(authToken);
+    const token2= sha256("salt2")(authToken);
+
+    expect(token1).not.toEqual(token2);
+  });
+});
+
+describe("InMemoryAPITokens", () => {
+  const reverseAuthToken = (authToken: string) => authToken.split("").reverse().join("");
+
+  const accessTokens = new InMemoryAPITokens(reverseAuthToken);
+
+  it("should return the same access token for the same auth token", () => {
+    const authToken = "token1";
+    
+    const accessToken1 = accessTokens.mint(authToken);
+    const accessToken2 = accessTokens.mint(authToken);
+
+    expect(accessToken1).not.toEqual(authToken);
+    expect(accessToken1).toEqual(accessToken2);
+  });
+
+  describe("when there is an auth token for the access token", () => {
+    it("should be able to retrieve it", () => {
+      const authToken = uuid();
+      const accessToken = accessTokens.mint(authToken);
+
+      expect(accessTokens.authTokenFor(accessToken)).toEqual(authToken);
+    });
+  });
+
+  describe("when there is no auth token for the access token", () => {
+    it("should return undefined", () => {
+      expect(accessTokens.authTokenFor(uuid())).toBeUndefined();
+    });
+  });
+});

tests/builders.ts

@@ -1,7 +1,8 @@
 import { SonosDevice } from "@svrooij/sonos/lib";
 import { v4 as uuid } from "uuid";
-import { Credentials } from "../src/smapi";
+import randomstring from "randomstring";
 
+import { Credentials } from "../src/smapi";
 import { Service, Device } from "../src/sonos";
 import {
   Album,
@@ -11,9 +12,12 @@ import {
   artistToArtistSummary,
   PlaylistSummary,
   Playlist,
+  SimilarArtist,
+  AlbumSummary,
 } from "../src/music_service";
-import randomString from "../src/random_string";
+
 import { b64Encode } from "../src/b64";
+import { artistImageURN } from "../src/subsonic";
 
 const randomInt = (max: number) => Math.floor(Math.random() * Math.floor(max));
 const randomIpAddress = () => `127.0.${randomInt(255)}.${randomInt(255)}`;
@@ -42,7 +46,7 @@ export function aPlaylistSummary(
 ): PlaylistSummary {
   return {
     id: `playlist-${uuid()}`,
-    name: `playlistname-${randomString()}`,
+    name: `playlistname-${randomstring.generate()}`,
     ...fields,
   };
 }
@@ -50,7 +54,7 @@ export function aPlaylistSummary(
 export function aPlaylist(fields: Partial<Playlist> = {}): Playlist {
   return {
     id: `playlist-${uuid()}`,
-    name: `playlist-${randomString()}`,
+    name: `playlist-${randomstring.generate()}`,
     entries: [aTrack(), aTrack()],
     ...fields,
   };
@@ -86,10 +90,11 @@ export function getAppLinkMessage() {
   };
 }
 
-export function someCredentials(token: string): Credentials {
+export function someCredentials({ token, key } : { token: string, key: string }): Credentials {
   return {
     loginToken: {
       token,
+      key,
       householdId: "hh1",
     },
     deviceId: "d1",
@@ -97,21 +102,34 @@ export function someCredentials(token: string): Credentials {
   };
 }
 
+export function aSimilarArtist(
+  fields: Partial<SimilarArtist> = {}
+): SimilarArtist {
+  const id = fields.id || uuid();
+  return {
+    id,
+    name: `Similar Artist ${id}`,
+    image: artistImageURN({ artistId: id }),
+    inLibrary: true,
+    ...fields,
+  };
+}
+
 export function anArtist(fields: Partial<Artist> = {}): Artist {
-  const id = uuid();
+  const id = fields.id || uuid();
   const artist = {
     id,
     name: `Artist ${id}`,
     albums: [anAlbum(), anAlbum(), anAlbum()],
-    image: {
-      small: `/artist/art/${id}/small`,
-      medium: `/artist/art/${id}/small`,
-      large: `/artist/art/${id}/large`,
-    },
+    image: { system: "subsonic", resource: `art:${id}` },
     similarArtists: [
-      { id: uuid(), name: "Similar artist1", inLibrary: true },
-      { id: uuid(), name: "Similar artist2", inLibrary: true },
-      { id: "-1", name: "Artist not in library", inLibrary: false },
+      aSimilarArtist({ id: uuid(), name: "Similar artist1", inLibrary: true }),
+      aSimilarArtist({ id: uuid(), name: "Similar artist2", inLibrary: true }),
+      aSimilarArtist({
+        id: "-1",
+        name: "Artist not in library",
+        inLibrary: false,
+      }),
     ],
     ...fields,
   };
@@ -163,11 +181,11 @@ export function aTrack(fields: Partial<Track> = {}): Track {
     album: albumToAlbumSummary(
       anAlbum({ artistId: artist.id, artistName: artist.name, genre })
     ),
-    coverArt: `coverArt:${uuid()}`,
+    coverArt: { system: "subsonic", resource: `art:${uuid()}`},
     rating,
     ...fields,
   };
-};
+}
 
 export function anAlbum(fields: Partial<Album> = {}): Album {
   const id = uuid();
@@ -177,11 +195,25 @@ export function anAlbum(fields: Partial<Album> = {}): Album {
     genre: randomGenre(),
     year: `19${randomInt(99)}`,
     artistId: `Artist ${uuid()}`,
-    artistName: `Artist ${randomString()}`,
-    coverArt: `coverArt:${uuid()}`,
+    artistName: `Artist ${randomstring.generate()}`,
+    coverArt: { system: "subsonic", resource: `art:${uuid()}` },
     ...fields,
   };
-}
+};
+
+export function anAlbumSummary(fields: Partial<AlbumSummary> = {}): AlbumSummary {
+  const id = uuid();
+  return {
+    id,
+    name: `Album ${id}`,
+    year: `19${randomInt(99)}`,
+    genre: randomGenre(),
+    coverArt: { system: "subsonic", resource: `art:${uuid()}` },
+    artistId: `Artist ${uuid()}`,
+    artistName: `Artist ${randomstring.generate()}`,
+    ...fields
+  }
+};
 
 export const BLONDIE_ID = uuid();
 export const BLONDIE_NAME = "Blondie";
@@ -196,7 +228,7 @@ export const BLONDIE: Artist = {
       genre: NEW_WAVE,
       artistId: BLONDIE_ID,
       artistName: BLONDIE_NAME,
-      coverArt: `coverArt:${uuid()}`,
+      coverArt: { system: "subsonic", resource: `art:${uuid()}`},
     },
     {
       id: uuid(),
@@ -205,14 +237,10 @@ export const BLONDIE: Artist = {
       genre: POP_ROCK,
       artistId: BLONDIE_ID,
       artistName: BLONDIE_NAME,
-      coverArt: `coverArt:${uuid()}`,
+      coverArt: { system: "subsonic", resource: `art:${uuid()}`},
     },
   ],
-  image: {
-    small: undefined,
-    medium: undefined,
-    large: undefined,
-  },
+  image: { system: "external", resource: "http://localhost:1234/images/blondie.jpg" },
   similarArtists: [],
 };
 
@@ -229,7 +257,7 @@ export const BOB_MARLEY: Artist = {
       genre: REGGAE,
       artistId: BOB_MARLEY_ID,
       artistName: BOB_MARLEY_NAME,
-      coverArt: `coverArt:${uuid()}`,
+      coverArt: { system: "subsonic", resource: `art:${uuid()}`},
     },
     {
       id: uuid(),
@@ -238,7 +266,7 @@ export const BOB_MARLEY: Artist = {
       genre: REGGAE,
       artistId: BOB_MARLEY_ID,
       artistName: BOB_MARLEY_NAME,
-      coverArt: `coverArt:${uuid()}`,
+      coverArt: { system: "subsonic", resource: `art:${uuid()}`},
     },
     {
       id: uuid(),
@@ -247,14 +275,10 @@ export const BOB_MARLEY: Artist = {
       genre: SKA,
       artistId: BOB_MARLEY_ID,
       artistName: BOB_MARLEY_NAME,
-      coverArt: `coverArt:${uuid()}`,
+      coverArt: { system: "subsonic", resource: `art:${uuid()}`},
     },
   ],
-  image: {
-    small: "http://localhost/BOB_MARLEY/sml",
-    medium: "http://localhost/BOB_MARLEY/med",
-    large: "http://localhost/BOB_MARLEY/lge",
-  },
+  image: { system: "subsonic", resource: BOB_MARLEY_ID },
   similarArtists: [],
 };
 
@@ -265,9 +289,8 @@ export const MADONNA: Artist = {
   name: MADONNA_NAME,
   albums: [],
   image: {
-    small: "http://localhost/MADONNA/sml",
-    medium: undefined,
-    large: "http://localhost/MADONNA/lge",
+    system: "external",
+    resource: "http://localhost:1234/images/madonna.jpg",
   },
   similarArtists: [],
 };
@@ -285,7 +308,7 @@ export const METALLICA: Artist = {
       genre: METAL,
       artistId: METALLICA_ID,
       artistName: METALLICA_NAME,
-      coverArt: `coverArt:${uuid()}`,
+      coverArt: { system: "subsonic", resource: `art:${uuid()}`},
     },
     {
       id: uuid(),
@@ -294,18 +317,13 @@ export const METALLICA: Artist = {
       genre: METAL,
       artistId: METALLICA_ID,
       artistName: METALLICA_NAME,
-      coverArt: `coverArt:${uuid()}`,
+      coverArt: { system: "subsonic", resource: `art:${uuid()}`},
     },
   ],
-  image: {
-    small: "http://localhost/METALLICA/sml",
-    medium: "http://localhost/METALLICA/med",
-    large: "http://localhost/METALLICA/lge",
-  },
+  image: { system: "subsonic", resource: METALLICA_ID },
   similarArtists: [],
 };
 
 export const ALL_ARTISTS = [BOB_MARLEY, BLONDIE, MADONNA, METALLICA];
 
 export const ALL_ALBUMS = ALL_ARTISTS.flatMap((it) => it.albums || []);
-

tests/burn.test.ts

@@ -0,0 +1,114 @@
+import { assertSystem, BUrn, format, formatForURL, parse } from "../src/burn";
+
+type BUrnSpec = {
+  burn: BUrn;
+  asString: string;
+  shorthand: string;
+};
+
+describe("BUrn", () => {
+  describe("format", () => {
+    (
+      [
+        {
+          burn: { system: "internal", resource: "icon:error" },
+          asString: "bnb:internal:icon:error",
+          shorthand: "bnb:i:icon:error",
+        },
+        {
+          burn: {
+            system: "external",
+            resource: "http://example.com/widget.jpg",
+          },
+          asString: "bnb:external:http://example.com/widget.jpg",
+          shorthand: "bnb:e:http://example.com/widget.jpg",
+        },
+        {
+          burn: { system: "subsonic", resource: "art:1234" },
+          asString: "bnb:subsonic:art:1234",
+          shorthand: "bnb:s:art:1234",
+        },
+        {
+          burn: { system: "navidrome", resource: "art:1234" },
+          asString: "bnb:navidrome:art:1234",
+          shorthand: "bnb:n:art:1234",
+        },
+      ] as BUrnSpec[]
+    ).forEach(({ burn, asString, shorthand }) => {
+      describe(asString, () => {
+        it("can be formatted as string and then roundtripped back into BUrn", () => {
+          const stringValue = format(burn);
+          expect(stringValue).toEqual(asString);
+          expect(parse(stringValue)).toEqual(burn);
+        });
+
+        it("can be formatted as shorthand string and then roundtripped back into BUrn", () => {
+          const stringValue = format(burn, { shorthand: true });
+          expect(stringValue).toEqual(shorthand);
+          expect(parse(stringValue)).toEqual(burn);
+        });
+
+        describe(`encrypted ${asString}`, () => {
+          it("can be formatted as an encrypted string and then roundtripped back into BUrn", () => {
+            const stringValue = format(burn, { encrypt: true });
+            expect(stringValue.startsWith("bnb:encrypted:")).toBeTruthy();
+            expect(stringValue).not.toContain(burn.system);
+            expect(stringValue).not.toContain(burn.resource);
+            expect(parse(stringValue)).toEqual(burn);
+          });
+
+          it("can be formatted as an encrypted shorthand string and then roundtripped back into BUrn", () => {
+            const stringValue = format(burn, {
+              shorthand: true,
+              encrypt: true,
+            });
+            expect(stringValue.startsWith("bnb:x:")).toBeTruthy();
+            expect(stringValue).not.toContain(burn.system);
+            expect(stringValue).not.toContain(burn.resource);
+            expect(parse(stringValue)).toEqual(burn);
+          });
+        });
+      });
+    });
+  });
+
+  describe("formatForURL", () => {
+    describe("external", () => {
+      it("should be encrypted", () => {
+        const burn = {
+          system: "external",
+          resource: "http://example.com/foo.jpg",
+        };
+        const formatted = formatForURL(burn);
+        expect(formatted.startsWith("bnb:x:")).toBeTruthy();
+        expect(formatted).not.toContain("http://example.com/foo.jpg");
+
+        expect(parse(formatted)).toEqual(burn);
+      });
+    });
+
+    describe("not external", () => {
+      it("should be shorthand form", () => {
+        expect(formatForURL({ system: "internal", resource: "foo" })).toEqual(
+          "bnb:i:foo"
+        );
+        expect(
+          formatForURL({ system: "subsonic", resource: "foo:bar" })
+        ).toEqual("bnb:s:foo:bar");
+      });
+    });
+  });
+
+  describe("assertSystem", () => {
+    it("should fail if the system is not equal", () => {
+      const burn = { system: "external", resource: "something"};
+      expect(() => assertSystem(burn, "subsonic")).toThrow(`Unsupported urn: '${format(burn)}'`)
+    });
+
+    it("should pass if the system is equal", () => {
+      const burn = { system: "external", resource: "something"};
+      expect(assertSystem(burn, "external")).toEqual(burn);
+    });
+  });
+});
+

tests/config.test.ts

@@ -1,5 +1,5 @@
 import { hostname } from "os";
-import config, { envVar, WORD } from "../src/config";
+import config, { COLOR, envVar } from "../src/config";
 
 describe("envVar", () => {
   const OLD_ENV = process.env;
@@ -180,18 +180,25 @@ describe("config", () => {
             });
           });
 
-          describe(`when ${k} is specified`, () => {
+          describe(`when ${k} is specified as a color`, () => {
             it(`should use it`, () => {
               process.env[k] = "pink";
               expect(config().icons.foregroundColor).toEqual("pink");
             });
           });
 
+          describe(`when ${k} is specified as hex`, () => {
+            it(`should use it`, () => {
+              process.env[k] = "#1db954";
+              expect(config().icons.foregroundColor).toEqual("#1db954");
+            });
+          });
+
           describe(`when ${k} is an invalid string`, () => {
             it(`should blow up`, () => {
-              process.env[k] = "#dfasd";
+              process.env[k] = "!dfasd";
               expect(() => config()).toThrow(
-                `Invalid value specified for 'BNB_ICON_FOREGROUND_COLOR', must match ${WORD}`
+                `Invalid value specified for 'BNB_ICON_FOREGROUND_COLOR', must match ${COLOR}`
               );
             });
           });
@@ -215,18 +222,25 @@ describe("config", () => {
             });
           });
 
-          describe(`when ${k} is specified`, () => {
+          describe(`when ${k} is specified as a color`, () => {
             it(`should use it`, () => {
               process.env[k] = "blue";
               expect(config().icons.backgroundColor).toEqual("blue");
             });
           });
 
+          describe(`when ${k} is specified as hex`, () => {
+            it(`should use it`, () => {
+              process.env[k] = "#1db954";
+              expect(config().icons.backgroundColor).toEqual("#1db954");
+            });
+          });
+
           describe(`when ${k} is an invalid string`, () => {
             it(`should blow up`, () => {
-              process.env[k] = "#red";
+              process.env[k] = "!red";
               expect(() => config()).toThrow(
-                `Invalid value specified for 'BNB_ICON_BACKGROUND_COLOR', must match ${WORD}`
+                `Invalid value specified for 'BNB_ICON_BACKGROUND_COLOR', must match ${COLOR}`
               );
             });
           });
@@ -248,6 +262,17 @@ describe("config", () => {
     });
   });
 
+  describe("authTimeout", () => {
+    it("should default to 1h", () => {
+      expect(config().authTimeout).toEqual("1h");
+    });
+
+    it(`should be overridable using BNB_AUTH_TIMEOUT`, () => {
+      process.env["BNB_AUTH_TIMEOUT"] = "33s";
+      expect(config().authTimeout).toEqual("33s");
+    });
+});
+
   describe("sonos", () => {
     describe("serviceName", () => {
       it("should default to bonob", () => {

tests/encryption.test.ts

@@ -1,12 +1,45 @@
-import encryption from '../src/encryption';
-
-describe("encrypt", () => {
-  const e = encryption("secret squirrel");
+import { cryptoEncryption, jwsEncryption } from '../src/encryption';
 
+describe("jwsEncryption", () => {
   it("can encrypt and decrypt", () => {
+    const e = jwsEncryption("secret squirrel");
+
     const value = "bobs your uncle"
     const hash = e.encrypt(value)
-    expect(hash.encryptedData).not.toEqual(value);
+    expect(hash).not.toContain(value);
     expect(e.decrypt(hash)).toEqual(value);
   });
-})
+
+  it("returns different values for different secrets", () => {
+    const e1 = jwsEncryption("e1");
+    const e2 = jwsEncryption("e2");
+
+    const value = "bobs your uncle"
+    const h1 = e1.encrypt(value)
+    const h2 = e2.encrypt(value)
+
+    expect(h1).not.toEqual(h2);
+  });
+})
+
+describe("cryptoEncryption", () => {
+  it("can encrypt and decrypt", () => {
+    const e = cryptoEncryption("secret squirrel");
+
+    const value = "bobs your uncle"
+    const hash = e.encrypt(value)
+    expect(hash).not.toContain(value);
+    expect(e.decrypt(hash)).toEqual(value);
+  });
+
+  it("returns different values for different secrets", () => {
+    const e1 = cryptoEncryption("e1");
+    const e2 = cryptoEncryption("e2");
+
+    const value = "bobs your uncle"
+    const h1 = e1.encrypt(value)
+    const h2 = e2.encrypt(value)
+
+    expect(h1).not.toEqual(h2);
+  });
+})

tests/icon.test.ts

@@ -1,5 +1,6 @@
 import dayjs from "dayjs";
 import libxmljs from "libxmljs2";
+import { FixedClock } from "../src/clock";
 
 import {
   contains,
@@ -556,12 +557,11 @@ describe("festivals", () => {
     backgroundColor: "black",
     foregroundColor: "black",
   });
-  let now = dayjs();
-  const clock = { now: () => now };
+  const clock = new FixedClock(dayjs());
 
   describe("on a day that isn't festive", () => {
     beforeEach(() => {
-      now = dayjs("2022/10/12");
+      clock.time = dayjs("2022/10/12");
     });
 
     it("should use the given colors", () => {
@@ -587,7 +587,7 @@ describe("festivals", () => {
 
   describe("on christmas day", () => {
     beforeEach(() => {
-      now = dayjs("2022/12/25");
+      clock.time = dayjs("2022/12/25");
     });
 
     it("should use the christmas theme colors", () => {
@@ -613,7 +613,7 @@ describe("festivals", () => {
 
   describe("on halloween", () => {
     beforeEach(() => {
-      now = dayjs("2022/10/31");
+      clock.time = dayjs("2022/10/31");
     });
 
     it("should use the given colors", () => {
@@ -638,7 +638,7 @@ describe("festivals", () => {
 
   describe("on may 4", () => {
     beforeEach(() => {
-      now = dayjs("2022/5/4");
+      clock.time = dayjs("2022/5/4");
     });
 
     it("should use the undefined colors, so no color", () => {
@@ -664,7 +664,7 @@ describe("festivals", () => {
   describe("on cny", () => {
     describe("2022", () => {
       beforeEach(() => {
-        now = dayjs("2022/02/01");
+        clock.time = dayjs("2022/02/01");
       });
 
       it("should use the cny theme", () => {
@@ -689,7 +689,7 @@ describe("festivals", () => {
 
     describe("2023", () => {
       beforeEach(() => {
-        now = dayjs("2023/01/22");
+        clock.time = dayjs("2023/01/22");
       });
 
       it("should use the cny theme", () => {
@@ -714,7 +714,7 @@ describe("festivals", () => {
 
     describe("2024", () => {
       beforeEach(() => {
-        now = dayjs("2024/02/10");
+        clock.time = dayjs("2024/02/10");
       });
 
       it("should use the cny theme", () => {
@@ -740,7 +740,7 @@ describe("festivals", () => {
 
   describe("on holi", () => {
     beforeEach(() => {
-      now = dayjs("2022/03/18");
+      clock.time = dayjs("2022/03/18");
     });
 
     it("should use the given colors", () => {

tests/in_memory_music_service.test.ts

@@ -1,6 +1,8 @@
+import { taskEither as TE } from "fp-ts";
+import { pipe } from "fp-ts/lib/function";
+
 import { InMemoryMusicService } from "./in_memory_music_service";
 import {
-  AuthSuccess,
   MusicLibrary,
   artistToArtistSummary,
   albumToAlbumSummary,
@@ -18,6 +20,7 @@ import {
 } from "./builders";
 import _ from "underscore";
 
+
 describe("InMemoryMusicService", () => {
   const service = new InMemoryMusicService();
 
@@ -27,12 +30,15 @@ describe("InMemoryMusicService", () => {
 
       service.hasUser(credentials);
 
-      const token = (await service.generateToken(credentials)) as AuthSuccess;
+      const token = await pipe(
+        service.generateToken(credentials),
+        TE.getOrElse(e => { throw e })
+      )();
 
       expect(token.userId).toEqual(credentials.username);
       expect(token.nickname).toEqual(credentials.username);
 
-      const musicLibrary = service.login(token.authToken);
+      const musicLibrary = service.login(token.serviceToken);
 
       expect(musicLibrary).toBeDefined();
     });
@@ -42,34 +48,19 @@ describe("InMemoryMusicService", () => {
 
       service.hasUser(credentials);
 
-      const token = (await service.generateToken(credentials)) as AuthSuccess;
+      const token = await pipe(
+        service.generateToken(credentials),
+        TE.getOrElse(e => { throw e })
+      )();
 
       service.clear();
 
-      return expect(service.login(token.authToken)).rejects.toEqual(
+      return expect(service.login(token.serviceToken)).rejects.toEqual(
         "Invalid auth token"
       );
     });
   });
-
-  describe("artistToArtistSummary", () => {
-    it("should map fields correctly", () => {
-      const artist = anArtist({
-        id: uuid(),
-        name: "The Artist",
-        image: {
-          small: "/path/to/small/jpg",
-          medium: "/path/to/medium/jpg",
-          large: "/path/to/large/jpg",
-        },
-      });
-      expect(artistToArtistSummary(artist)).toEqual({
-        id: artist.id,
-        name: artist.name,
-      });
-    });
-  });
-
+  
   describe("Music Library", () => {
     const user = { username: "user100", password: "password100" };
     let musicLibrary: MusicLibrary;
@@ -79,8 +70,12 @@ describe("InMemoryMusicService", () => {
 
       service.hasUser(user);
 
-      const token = (await service.generateToken(user)) as AuthSuccess;
-      musicLibrary = (await service.login(token.authToken)) as MusicLibrary;
+      const token = await pipe(
+        service.generateToken(user),
+        TE.getOrElse(e => { throw e })
+      )();
+
+      musicLibrary = (await service.login(token.serviceToken)) as MusicLibrary;
     });
 
     describe("artists", () => {
@@ -143,8 +138,8 @@ describe("InMemoryMusicService", () => {
 
       describe("when it exists", () => {
         it("should provide an artist", async () => {
-          expect(await musicLibrary.artist(artist1.id)).toEqual(artist1);
-          expect(await musicLibrary.artist(artist2.id)).toEqual(artist2);
+          expect(await musicLibrary.artist(artist1.id!)).toEqual(artist1);
+          expect(await musicLibrary.artist(artist2.id!)).toEqual(artist2);
         });
       });
 

tests/in_memory_music_service.ts

@@ -1,4 +1,4 @@
-import { option as O } from "fp-ts";
+import { option as O, taskEither as TE } from "fp-ts";
 import * as A from "fp-ts/Array";
 import { fromEquals } from "fp-ts/lib/Eq";
 import { pipe } from "fp-ts/lib/function";
@@ -24,6 +24,7 @@ import {
   Genre,
   Rating,
 } from "../src/music_service";
+import { BUrn } from "../src/burn";
 
 export class InMemoryMusicService implements MusicService {
   users: Record<string, string> = {};
@@ -33,24 +34,29 @@ export class InMemoryMusicService implements MusicService {
   generateToken({
     username,
     password,
-  }: Credentials): Promise<AuthSuccess | AuthFailure> {
+  }: Credentials): TE.TaskEither<AuthFailure, AuthSuccess> {
     if (
       username != undefined &&
       password != undefined &&
       this.users[username] == password
     ) {
-      return Promise.resolve({
-        authToken: b64Encode(JSON.stringify({ username, password })),
+      return TE.right({
+        serviceToken: b64Encode(JSON.stringify({ username, password })),
         userId: username,
         nickname: username,
+        type: "in-memory"
       });
     } else {
-      return Promise.resolve({ message: `Invalid user:${username}` });
+      return TE.left(new AuthFailure(`Invalid user:${username}`));
     }
   }
 
-  login(token: string): Promise<MusicLibrary> {
-    const credentials = JSON.parse(b64Decode(token)) as Credentials;
+  refreshToken(serviceToken: string): TE.TaskEither<AuthFailure, AuthSuccess> {
+    return this.generateToken(JSON.parse(b64Decode(serviceToken)))
+  }
+
+  login(serviceToken: string): Promise<MusicLibrary> {
+    const credentials = JSON.parse(b64Decode(serviceToken)) as Credentials;
     if (this.users[credentials.username] != credentials.password)
       return Promise.reject("Invalid auth token");
 
@@ -131,8 +137,8 @@ export class InMemoryMusicService implements MusicService {
         ),
       stream: (_: { trackId: string; range: string | undefined }) =>
         Promise.reject("unsupported operation"),
-      coverArt: (id: string, size?: number) =>
-        Promise.reject(`Cannot retrieve coverArt for ${id}, size ${size}`),
+      coverArt: (coverArtURN: BUrn, size?: number) =>
+        Promise.reject(`Cannot retrieve coverArt for ${coverArtURN}, size ${size}`),
       scrobble: async (_: string) => {
         return Promise.resolve(true);
       },

tests/link_codes.test.ts

@@ -18,7 +18,7 @@ describe("InMemoryLinkCodes", () => {
     describe('when token is valid', () => {
       it('should associate the token', () => {
         const linkCode = linkCodes.mint();
-        const association = { authToken: "token123", nickname: "bob", userId: "1" };
+        const association = { serviceToken: "token123", nickname: "bob", userId: "1" };
 
         linkCodes.associate(linkCode, association);
 
@@ -29,7 +29,7 @@ describe("InMemoryLinkCodes", () => {
     describe('when token is valid', () => {
       it('should throw an error', () => {
         const invalidLinkCode = "invalidLinkCode";
-        const association = { authToken: "token456", nickname: "bob", userId: "1" };
+        const association = { serviceToken: "token456", nickname: "bob", userId: "1" };
 
         expect(() => linkCodes.associate(invalidLinkCode, association)).toThrow(`Invalid linkCode ${invalidLinkCode}`)
       }); 

tests/music_service.test.ts

@@ -0,0 +1,22 @@
+import { v4 as uuid } from "uuid";
+
+import { anArtist } from "./builders";
+import { artistToArtistSummary } from "../src/music_service";
+
+describe("artistToArtistSummary", () => {
+  it("should map fields correctly", () => {
+    const artist = anArtist({
+      id: uuid(),
+      name: "The Artist",
+      image: {
+        system: "external",
+        resource: "http://example.com:1234/image.jpg",
+      },
+    });
+    expect(artistToArtistSummary(artist)).toEqual({
+      id: artist.id,
+      name: artist.name,
+      image: artist.image,
+    });
+  });
+});

tests/random_string.test.ts

@@ -1,16 +0,0 @@
-import randomString from "../src/random_string";
-
-describe('randomString', () => {
-  it('should produce different strings...', () => {
-    const s1 = randomString()
-    const s2 = randomString()
-    const s3 = randomString()
-    const s4 = randomString()
-
-    expect(s1.length).toEqual(64)
-    
-    expect(s1).not.toEqual(s2);
-    expect(s1).not.toEqual(s3);
-    expect(s1).not.toEqual(s4);
-  });
-});

tests/scenarios.test.ts

@@ -33,9 +33,10 @@ class LoggedInSonosDriver {
     this.client = client;
     this.token = token;
     this.client.addSoapHeader({
-      credentials: someCredentials(
-        this.token.getDeviceAuthTokenResult.authToken
-      ),
+      credentials: someCredentials({
+        token: this.token.getDeviceAuthTokenResult.authToken,
+        key: this.token.getDeviceAuthTokenResult.privateKey
+      }),
     });
   }
 
@@ -272,7 +273,7 @@ describe("scenarios", () => {
       bonobUrl,
       musicService,
       {
-        linkCodes: () => linkCodes
+        linkCodes: () => linkCodes,
       }
     );
 

tests/smapi_auth.test.ts

@@ -0,0 +1,188 @@
+import { v4 as uuid } from "uuid";
+import jwt from "jsonwebtoken";
+
+import {
+  ExpiredTokenError,
+  InvalidTokenError,
+  isSmapiRefreshTokenResultFault,
+  JWTSmapiLoginTokens,
+  smapiTokenAsString,
+  smapiTokenFromString,
+  SMAPI_TOKEN_VERSION,
+} from "../src/smapi_auth";
+import { either as E } from "fp-ts";
+import { FixedClock } from "../src/clock";
+import dayjs from "dayjs";
+import { b64Encode } from "../src/b64";
+
+describe("smapiTokenAsString", () => {
+  it("can round trip token to and from string", () => {
+    const smapiToken = { token: uuid(), key: uuid(), someOtherStuff: 'this needs to be explicitly ignored' };
+    const asString = smapiTokenAsString(smapiToken)
+
+    expect(asString).toEqual(b64Encode(JSON.stringify({
+      token: smapiToken.token,
+      key: smapiToken.key,
+    })));
+    expect(smapiTokenFromString(asString)).toEqual({
+      token: smapiToken.token,
+      key: smapiToken.key
+    });
+  });
+});
+
+describe("isSmapiRefreshTokenResultFault", () => {
+  it("should return true for a refreshAuthTokenResult fault", () => {
+    const faultWithRefreshAuthToken = {
+      Fault: {
+        faultcode: "",
+        faultstring: "",
+        detail: {
+          refreshAuthTokenResult: {
+            authToken: "x",
+            privateKey: "x",
+          },
+        },
+      },
+    };
+    expect(isSmapiRefreshTokenResultFault(faultWithRefreshAuthToken)).toEqual(
+      true
+    );
+  });
+
+  it("should return false when is not a refreshAuthTokenResult", () => {
+    expect(isSmapiRefreshTokenResultFault({ Fault: { faultcode: "", faultstring:" " }})).toEqual(
+      false
+    );
+  });
+});
+
+describe("auth", () => {
+  describe("JWTSmapiLoginTokens", () => {
+    const clock = new FixedClock(dayjs());
+
+    const expiresIn = "1h";
+    const secret = `secret-${uuid()}`;
+    const key = uuid();
+    const smapiLoginTokens = new JWTSmapiLoginTokens(clock, secret, expiresIn, () => key);
+
+    describe("issuing a new token", () => {
+      it("should issue a token that can then be verified", () => {
+        const serviceToken = `service-token-${uuid()}`;
+
+        const smapiToken = smapiLoginTokens.issue(serviceToken);
+
+        const expected = jwt.sign(
+          {
+            serviceToken,
+            iat: clock.now().unix(),
+          },
+          secret + SMAPI_TOKEN_VERSION + key,
+          { expiresIn }
+        );
+
+        expect(smapiToken.token).toEqual(expected);
+        expect(smapiToken.token).not.toContain(serviceToken);
+        expect(smapiToken.token).not.toContain(secret);
+        expect(smapiToken.token).not.toContain(":");
+
+        const roundTripped = smapiLoginTokens.verify(smapiToken);
+
+        expect(roundTripped).toEqual(E.right(serviceToken));
+      });
+    });
+
+    describe("when verifying the token fails", () => {
+      describe("due to the version changing", () => {
+        it("should return an error", () => {
+          const authToken = uuid();
+
+          const vXSmapiTokens = new JWTSmapiLoginTokens(
+            clock,
+            secret,
+            expiresIn,
+            uuid,
+            SMAPI_TOKEN_VERSION
+          );
+
+          const vXPlus1SmapiTokens = new JWTSmapiLoginTokens(
+            clock,
+            secret,
+            expiresIn,
+            () => uuid(),
+            SMAPI_TOKEN_VERSION + 1
+          );
+
+          const v1Token = vXSmapiTokens.issue(authToken);
+          expect(vXSmapiTokens.verify(v1Token)).toEqual(E.right(authToken));
+
+          const result = vXPlus1SmapiTokens.verify(v1Token);
+          expect(result).toEqual(
+            E.left(new InvalidTokenError("invalid signature"))
+          );
+        });
+      });
+      
+      describe("due to secret changing", () => {
+        it("should return an error", () => {
+          const authToken = uuid();
+
+          const smapiToken = new JWTSmapiLoginTokens(
+            clock,
+            "A different secret",
+            expiresIn
+          ).issue(authToken);
+
+          const result = smapiLoginTokens.verify(smapiToken);
+          expect(result).toEqual(
+            E.left(new InvalidTokenError("invalid signature"))
+          );
+        });
+      });
+
+      describe("due to key changing", () => {
+        it("should return an error", () => {
+          const authToken = uuid();
+
+          const smapiToken = smapiLoginTokens.issue(authToken);
+
+          const result = smapiLoginTokens.verify({
+            ...smapiToken,
+            key: "some other key",
+          });
+          expect(result).toEqual(
+            E.left(new InvalidTokenError("invalid signature"))
+          );
+        });
+      });
+    });
+
+    describe("when the token has expired", () => {
+      it("should return an ExpiredTokenError, with the authToken", () => {
+        const authToken = uuid();
+        const now = dayjs();
+        const tokenIssuedAt = now.subtract(31, "seconds");
+
+        const tokensWith30SecondExpiry = new JWTSmapiLoginTokens(
+          clock,
+          uuid(),
+          "30s"
+        );
+
+        clock.time = tokenIssuedAt;
+        const expiredToken = tokensWith30SecondExpiry.issue(authToken);
+
+        clock.time = now;
+
+        const result = tokensWith30SecondExpiry.verify(expiredToken);
+        expect(result).toEqual(
+          E.left(
+            new ExpiredTokenError(
+              authToken
+            )
+          )
+        );
+      });
+    });
+  });
+});

tests/tsconfig.json

@@ -1,23 +1,23 @@
 {
-    "extends": "../tsconfig.json",
-    "compilerOptions": {
-      "target": "es2019",
-      "baseUrl": "./",
-      "module": "commonjs",
-      "experimentalDecorators": true,
-      "strictPropertyInitialization": false,
-      "isolatedModules": false,
-      "strict": true,
-      "noImplicitAny": false,
-      "typeRoots" : [
-        "../typings",
-        "../node_modules/@types"
-      ]
-    },
-    "exclude": [
-      "../node_modules"
-    ],
-    "include": [
-      "./**/*.ts"
+  "extends": "../tsconfig.json",
+  "compilerOptions": {
+    "target": "es2019",
+    "baseUrl": "./",
+    "module": "commonjs",
+    "experimentalDecorators": true,
+    "strictPropertyInitialization": false,
+    "isolatedModules": false,
+    "strict": true,
+    "noImplicitAny": false,
+    "typeRoots" : [
+      "../typings",
+      "../node_modules/@types"
     ]
-  }
+  },
+  "exclude": [
+    "../node_modules"
+  ],
+  "include": [
+    "./**/*.ts"
+  ]
+}

yarn.lock

@@ -1184,6 +1184,24 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@types/jsonwebtoken@npm:^8.5.5":
+  version: 8.5.5
+  resolution: "@types/jsonwebtoken@npm:8.5.5"
+  dependencies:
+    "@types/node": "*"
+  checksum: 33c30354641bc7849be7507e9f48685b1f487e944321a932650eac6c247c85184667f5e207ccfcab0da8cb24bde93a8372c09cacf1849e976bbf2cb90b26ce90
+  languageName: node
+  linkType: hard
+
+"@types/jws@npm:^3.2.4":
+  version: 3.2.4
+  resolution: "@types/jws@npm:3.2.4"
+  dependencies:
+    "@types/node": "*"
+  checksum: 43427a5b00ef0c5e60df6bc8e59c4153220c757fdbde2b79a1852e86083bdc76b660b3c0d89ae9e5902dab00bf6ae9f25a551a375ca233b6e02fa1e4e3fff6c4
+  languageName: node
+  linkType: hard
+
 "@types/keyv@npm:^3.1.1":
   version: 3.1.2
   resolution: "@types/keyv@npm:3.1.2"
@@ -1251,6 +1269,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@types/randomstring@npm:^1.1.8":
+  version: 1.1.8
+  resolution: "@types/randomstring@npm:1.1.8"
+  checksum: 22a9e4b09583ad8e7fa7ca214133abc014636d7d6eb49ca9ee671c09b241311107b0a6ea48205bf795ac61fbe5b185ac415aed2dd27c7f5806235bfea0e5532f
+  languageName: node
+  linkType: hard
+
 "@types/range-parser@npm:*":
   version: 1.2.3
   resolution: "@types/range-parser@npm:1.2.3"
@@ -1582,6 +1607,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"array-uniq@npm:1.0.2":
+  version: 1.0.2
+  resolution: "array-uniq@npm:1.0.2"
+  checksum: 8c4beb94aa183791da1e155935aba4df3fe2eeb6f491c69e666ca7351f897b9b260fa04d016e0ce766ae8280129c16f11071e17359c81c01741289009bb5ac6d
+  languageName: node
+  linkType: hard
+
 "assertion-error@npm:^1.1.0":
   version: 1.1.0
   resolution: "assertion-error@npm:1.1.0"
@@ -1782,9 +1814,12 @@ __metadata:
     "@types/express": ^4.17.13
     "@types/fs-extra": ^9.0.13
     "@types/jest": ^27.0.1
+    "@types/jsonwebtoken": ^8.5.5
+    "@types/jws": ^3.2.4
     "@types/mocha": ^9.0.0
     "@types/morgan": ^1.9.3
     "@types/node": ^16.7.13
+    "@types/randomstring": ^1.1.8
     "@types/sharp": ^0.28.6
     "@types/supertest": ^2.0.11
     "@types/tmp": ^0.2.1
@@ -1800,10 +1835,13 @@ __metadata:
     get-port: ^5.1.1
     image-js: ^0.33.0
     jest: ^27.1.0
+    jsonwebtoken: ^8.5.1
+    jws: ^4.0.0
     libxmljs2: ^0.28.0
     morgan: ^1.10.0
     node-html-parser: ^4.1.4
     nodemon: ^2.0.12
+    randomstring: ^1.2.1
     sharp: ^0.29.1
     soap: ^0.42.0
     supertest: ^6.1.6
@@ -1814,6 +1852,7 @@ __metadata:
     ts-node: ^10.2.1
     typescript: ^4.4.2
     underscore: ^1.13.1
+    urn-lib: ^2.0.0
     uuid: ^8.3.2
     winston: ^3.3.3
     xmldom-ts: ^0.3.1
@@ -1903,6 +1942,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"buffer-equal-constant-time@npm:1.0.1":
+  version: 1.0.1
+  resolution: "buffer-equal-constant-time@npm:1.0.1"
+  checksum: 80bb945f5d782a56f374b292770901065bad21420e34936ecbe949e57724b4a13874f735850dd1cc61f078773c4fb5493a41391e7bda40d1fa388d6bd80daaab
+  languageName: node
+  linkType: hard
+
 "buffer-from@npm:^1.0.0":
   version: 1.1.1
   resolution: "buffer-from@npm:1.1.1"
@@ -2717,6 +2763,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"ecdsa-sig-formatter@npm:1.0.11":
+  version: 1.0.11
+  resolution: "ecdsa-sig-formatter@npm:1.0.11"
+  dependencies:
+    safe-buffer: ^5.0.1
+  checksum: 207f9ab1c2669b8e65540bce29506134613dd5f122cccf1e6a560f4d63f2732d427d938f8481df175505aad94583bcb32c688737bb39a6df0625f903d6d93c03
+  languageName: node
+  linkType: hard
+
 "ee-first@npm:1.1.1":
   version: 1.1.1
   resolution: "ee-first@npm:1.1.1"
@@ -4641,6 +4696,66 @@ __metadata:
   languageName: node
   linkType: hard
 
+"jsonwebtoken@npm:^8.5.1":
+  version: 8.5.1
+  resolution: "jsonwebtoken@npm:8.5.1"
+  dependencies:
+    jws: ^3.2.2
+    lodash.includes: ^4.3.0
+    lodash.isboolean: ^3.0.3
+    lodash.isinteger: ^4.0.4
+    lodash.isnumber: ^3.0.3
+    lodash.isplainobject: ^4.0.6
+    lodash.isstring: ^4.0.1
+    lodash.once: ^4.0.0
+    ms: ^2.1.1
+    semver: ^5.6.0
+  checksum: 93c9e3f23c59b758ac88ba15f4e4753b3749dfce7a6f7c40fb86663128a1e282db085eec852d4e0cbca4cefdcd3a8275ee255dbd08fcad0df26ad9f6e4cc853a
+  languageName: node
+  linkType: hard
+
+"jwa@npm:^1.4.1":
+  version: 1.4.1
+  resolution: "jwa@npm:1.4.1"
+  dependencies:
+    buffer-equal-constant-time: 1.0.1
+    ecdsa-sig-formatter: 1.0.11
+    safe-buffer: ^5.0.1
+  checksum: ff30ea7c2dcc61f3ed2098d868bf89d43701605090c5b21b5544b512843ec6fd9e028381a4dda466cbcdb885c2d1150f7c62e7168394ee07941b4098e1035e2f
+  languageName: node
+  linkType: hard
+
+"jwa@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "jwa@npm:2.0.0"
+  dependencies:
+    buffer-equal-constant-time: 1.0.1
+    ecdsa-sig-formatter: 1.0.11
+    safe-buffer: ^5.0.1
+  checksum: 8f00b71ad5fe94cb55006d0d19202f8f56889109caada2f7eeb63ca81755769ce87f4f48101967f398462e3b8ae4faebfbd5a0269cb755dead5d63c77ba4d2f1
+  languageName: node
+  linkType: hard
+
+"jws@npm:^3.2.2":
+  version: 3.2.2
+  resolution: "jws@npm:3.2.2"
+  dependencies:
+    jwa: ^1.4.1
+    safe-buffer: ^5.0.1
+  checksum: f0213fe5b79344c56cd443428d8f65c16bf842dc8cb8f5aed693e1e91d79c20741663ad6eff07a6d2c433d1831acc9814e8d7bada6a0471fbb91d09ceb2bf5c2
+  languageName: node
+  linkType: hard
+
+"jws@npm:^4.0.0":
+  version: 4.0.0
+  resolution: "jws@npm:4.0.0"
+  dependencies:
+    jwa: ^2.0.0
+    safe-buffer: ^5.0.1
+  checksum: d68d07aa6d1b8cb35c363a9bd2b48f15064d342a5d9dc18a250dbbce8dc06bd7e4792516c50baa16b8d14f61167c19e851fd7f66b59ecc68b7f6a013759765f7
+  languageName: node
+  linkType: hard
+
 "keyv@npm:^3.0.0":
   version: 3.1.0
   resolution: "keyv@npm:3.1.0"
@@ -4710,6 +4825,55 @@ __metadata:
   languageName: node
   linkType: hard
 
+"lodash.includes@npm:^4.3.0":
+  version: 4.3.0
+  resolution: "lodash.includes@npm:4.3.0"
+  checksum: 71092c130515a67ab3bd928f57f6018434797c94def7f46aafa417771e455ce3a4834889f4267b17887d7f75297dfabd96231bf704fd2b8c5096dc4a913568b6
+  languageName: node
+  linkType: hard
+
+"lodash.isboolean@npm:^3.0.3":
+  version: 3.0.3
+  resolution: "lodash.isboolean@npm:3.0.3"
+  checksum: b70068b4a8b8837912b54052557b21fc4774174e3512ed3c5b94621e5aff5eb6c68089d0a386b7e801d679cd105d2e35417978a5e99071750aa2ed90bffd0250
+  languageName: node
+  linkType: hard
+
+"lodash.isinteger@npm:^4.0.4":
+  version: 4.0.4
+  resolution: "lodash.isinteger@npm:4.0.4"
+  checksum: 6034821b3fc61a2ffc34e7d5644bb50c5fd8f1c0121c554c21ac271911ee0c0502274852845005f8651d51e199ee2e0cfebfe40aaa49c7fe617f603a8a0b1691
+  languageName: node
+  linkType: hard
+
+"lodash.isnumber@npm:^3.0.3":
+  version: 3.0.3
+  resolution: "lodash.isnumber@npm:3.0.3"
+  checksum: 913784275b565346255e6ae6a6e30b760a0da70abc29f3e1f409081585875105138cda4a429ff02577e1bc0a7ae2a90e0a3079a37f3a04c3d6c5aaa532f4cab2
+  languageName: node
+  linkType: hard
+
+"lodash.isplainobject@npm:^4.0.6":
+  version: 4.0.6
+  resolution: "lodash.isplainobject@npm:4.0.6"
+  checksum: 29c6351f281e0d9a1d58f1a4c8f4400924b4c79f18dfc4613624d7d54784df07efaff97c1ff2659f3e085ecf4fff493300adc4837553104cef2634110b0d5337
+  languageName: node
+  linkType: hard
+
+"lodash.isstring@npm:^4.0.1":
+  version: 4.0.1
+  resolution: "lodash.isstring@npm:4.0.1"
+  checksum: eaac87ae9636848af08021083d796e2eea3d02e80082ab8a9955309569cb3a463ce97fd281d7dc119e402b2e7d8c54a23914b15d2fc7fff56461511dc8937ba0
+  languageName: node
+  linkType: hard
+
+"lodash.once@npm:^4.0.0":
+  version: 4.1.1
+  resolution: "lodash.once@npm:4.1.1"
+  checksum: d768fa9f9b4e1dc6453be99b753906f58990e0c45e7b2ca5a3b40a33111e5d17f6edf2f768786e2716af90a8e78f8f91431ab8435f761fef00f9b0c256f6d245
+  languageName: node
+  linkType: hard
+
 "lodash@npm:4.x, lodash@npm:^4.17.21, lodash@npm:^4.17.5, lodash@npm:^4.7.0":
   version: 4.17.21
   resolution: "lodash@npm:4.17.21"
@@ -5866,6 +6030,25 @@ __metadata:
   languageName: node
   linkType: hard
 
+"randombytes@npm:2.0.3":
+  version: 2.0.3
+  resolution: "randombytes@npm:2.0.3"
+  checksum: 13e1abd143404dd87024bf345fb1a446b2e2ee46d8e1a5a073e8370c9b1e58000d81a97d4327ba7089087213eb6d8c77fa67ab4e91aa00605126d634fcccb9d4
+  languageName: node
+  linkType: hard
+
+"randomstring@npm:^1.2.1":
+  version: 1.2.1
+  resolution: "randomstring@npm:1.2.1"
+  dependencies:
+    array-uniq: 1.0.2
+    randombytes: 2.0.3
+  bin:
+    randomstring: bin/randomstring
+  checksum: 501da2ec59638d502dbb66c237ab80790dbb0b50b493347cbf6abc2dfbf6fe08f195d85e37911689bc406f85d31cf9826757398b5af8c9cae7c0ad4f808f3ac0
+  languageName: node
+  linkType: hard
+
 "range-parser@npm:~1.2.1":
   version: 1.2.1
   resolution: "range-parser@npm:1.2.1"
@@ -6138,7 +6321,7 @@ resolve@^1.20.0:
   languageName: node
   linkType: hard
 
-"semver@npm:^5.4.1, semver@npm:^5.7.1":
+"semver@npm:^5.4.1, semver@npm:^5.6.0, semver@npm:^5.7.1":
   version: 5.7.1
   resolution: "semver@npm:5.7.1"
   bin:
@@ -7088,6 +7271,13 @@ typescript@^4.4.2:
   languageName: node
   linkType: hard
 
+"urn-lib@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "urn-lib@npm:2.0.0"
+  checksum: fde3f4b8c38483d6229fe49e23cbf9cc012e0b4459d6aacb9bb2f3f1a32992b0e1115122401cca3708598ffa279355182158c7f7c248881ff72dc0f9e9f76d82
+  languageName: node
+  linkType: hard
+
 "utf8@npm:^2.1.2":
   version: 2.1.2
   resolution: "utf8@npm:2.1.2"