Index: src/routes/admin-audio.js
===================================================================
--- src/routes/admin-audio.js	(revision 0d7acdfd541ca8374f3adc7a5f67f2ca00f4f4ef)
+++ src/routes/admin-audio.js	(revision 183875b46fb28dbb72cffa7bc53cedaad373f8cd)
@@ -72,4 +72,21 @@
 
 const router = express.Router();
+
+// "Open in"-platformlinks per track: alleen https + de juiste host accepteren
+// (href komt ongeescaped in de view → scheme/host-guard tegen misbruik).
+const LINK_DOMAINS = {
+  spotify: ['spotify.com'],
+  youtube: ['youtube.com', 'youtu.be', 'music.youtube.com'],
+  soundcloud: ['soundcloud.com'],
+};
+function platformLink(url, domains) {
+  const u = String(url || '').trim();
+  if (!u || !/^https:\/\//i.test(u)) return null;
+  try {
+    const h = new URL(u).hostname.toLowerCase();
+    if (domains.some((d) => h === d || h.endsWith('.' + d))) return u;
+  } catch (e) { /* ongeldige URL */ }
+  return null;
+}
 
 router.get('/', requireGod, (req, res) => {
@@ -172,4 +189,7 @@
     const finalCredit  = (req.body.credit  || '').trim() || finalArtist || null;
     const finalLicense = (req.body.license || '').trim() || null;
+    const finalLinkSpotify    = platformLink(req.body.link_spotify, LINK_DOMAINS.spotify);
+    const finalLinkYoutube    = platformLink(req.body.link_youtube, LINK_DOMAINS.youtube);
+    const finalLinkSoundcloud = platformLink(req.body.link_soundcloud, LINK_DOMAINS.soundcloud);
 
     console.log('[admin-audio] upload received:', {
@@ -222,6 +242,6 @@
       console.log('[admin-audio] inserting audio_tracks row (duration=' + finalDuration + ')');
       db.prepare(`
-        INSERT INTO audio_tracks (id, site_id, title, artist, album, duration, cover_url, credit, license, media_id, position)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, COALESCE(
+        INSERT INTO audio_tracks (id, site_id, title, artist, album, duration, cover_url, credit, license, link_spotify, link_youtube, link_soundcloud, media_id, position)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, COALESCE(
           (SELECT MAX(position) + 1 FROM audio_tracks WHERE site_id = ?),
           0
@@ -233,4 +253,5 @@
         coverUrl,
         finalCredit, finalLicense,
+        finalLinkSpotify, finalLinkYoutube, finalLinkSoundcloud,
         mediaId, site.id
       );
@@ -378,5 +399,6 @@
   const t = db.prepare(`
     SELECT t.id, t.title, t.artist, t.album, t.duration, t.cover_url,
-           t.credit, t.license, t.position, t.created_at, m.filename
+           t.credit, t.license, t.link_spotify, t.link_youtube, t.link_soundcloud,
+           t.position, t.created_at, m.filename
     FROM audio_tracks t LEFT JOIN media m ON m.id = t.media_id
     WHERE t.id = ? AND t.site_id = ?
@@ -445,4 +467,13 @@
   if (Object.prototype.hasOwnProperty.call(body, 'license')) {
     fields.push('license = ?'); values.push(String(body.license || '').trim() || null);
+  }
+  if (Object.prototype.hasOwnProperty.call(body, 'link_spotify')) {
+    fields.push('link_spotify = ?'); values.push(platformLink(body.link_spotify, LINK_DOMAINS.spotify));
+  }
+  if (Object.prototype.hasOwnProperty.call(body, 'link_youtube')) {
+    fields.push('link_youtube = ?'); values.push(platformLink(body.link_youtube, LINK_DOMAINS.youtube));
+  }
+  if (Object.prototype.hasOwnProperty.call(body, 'link_soundcloud')) {
+    fields.push('link_soundcloud = ?'); values.push(platformLink(body.link_soundcloud, LINK_DOMAINS.soundcloud));
   }