Changeset f2eacca in Klonkt for src/routes/audio.js

Timestamp:

06/30/2026 01:50:00 AM (2 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

084d1c0

Parents:

80797d7

Message:

feat(music): per-track "share on the fediverse" — federate the file as a native AS2 Audio attachment

A per-track opt-in (default off) so an OPEN track's audio file is federated as a real AS2 Audio
attachment and served ungated → it plays inline in EVERY fediverse client, incl. the official
Mastodon apps (which only play native media, not external player cards). Gated tracks (default)
keep the file hidden + web-player-only. This is the spec-canonical way to federate audio; the
gated path stays the deliberate anti-steal choice.

• src/config/database.js — audio_tracks.fedi_open column (default 0)
• src/routes/audio.js — /audio/stream serves fedi_open tracks ungated so remote servers can fetch them
• src/services/ActivityPubService.js (buildNote) — fedi_open tracks → AS2 Audio attachments (the file URL)
• src/routes/admin-audio.js — POST /:id/fedi-open toggle (god-only) + fedi_open in the track query
• src/views/pages/admin-audio.ejs — per-track share toggle next to the download toggle
• src/services/i18n.js — aaud.fedi_on/off labels (nl/en/de)

Co-Authored-By: Claude <noreply@…>

File:

• src/routes/audio.js (modified) (2 diffs)

src/routes/audio.js

@@ -54 +54 @@
 };
 
-// Access gate: allow only same-origin browser fetches / media loads.
-function isAllowedAudioRequest(req) {
+// Access gate: same-origin browser fetches / media loads — PLUS fediverse-shared tracks.
+function isAllowedAudioRequest(req, filename) {
   if (req.get('X-Audio-Player') === '1') return true;  // our blob fetch
   const site = req.get('Sec-Fetch-Site');              // set by modern browsers
-  return site === 'same-origin' || site === 'same-site';
+  if (site === 'same-origin' || site === 'same-site') return true;
+  // fedi_open tracks are deliberately served ungated so remote servers (Mastodon, …) can
+  // fetch + play the file inline. The operator opted this specific track in (per-track flag).
+  if (filename) {
+    try {
+      const r = db.prepare(`SELECT 1 FROM audio_tracks t JOIN media m ON t.media_id = m.id
+        WHERE t.fedi_open = 1 AND (m.storage_path = ? OR m.storage_path LIKE ?) LIMIT 1`).get(filename, '%' + filename);
+      if (r) return true;
+    } catch { /* ignore */ }
+  }
+  return false;
 }
 
@@ -64 +74 @@
   const { filename } = req.params;
 
-  if (!isAllowedAudioRequest(req)) {
+  if (!isAllowedAudioRequest(req, filename)) {
     return res.status(403).send('Direct access not allowed');
   }