From 6a499e4ed9b0c25f64975ede15b44900a27107dc Mon Sep 17 00:00:00 2001 From: dragged9698 Date: Thu, 20 Aug 2026 10:13:28 -0400 Subject: [PATCH] fix(cider): do not send apptoken to Apple artwork CDN Reuse of the tokened Session leaked local Cider headers to *.mzstatic.com; fetch artwork with a bare requests.get like LRCLIB. Co-authored-by: Cursor --- cider/plugin.toml | 2 +- cider/scripts/cider_bridge.py | 4 +++- cider/scripts/test_lyrics_display.py | 14 +++++++++++--- cider/scripts/test_write_position.py | 7 +++++++ 4 files changed, 22 insertions(+), 5 deletions(-) diff --git a/cider/plugin.toml b/cider/plugin.toml index f38d166a..a33318c5 100644 --- a/cider/plugin.toml +++ b/cider/plugin.toml @@ -2,7 +2,7 @@ id = "dragged/cider" name = "Cider" -version = "1.8.3" +version = "1.8.4" plugin_api = 23 author = "dragged" license = "MIT" diff --git a/cider/scripts/cider_bridge.py b/cider/scripts/cider_bridge.py index a33cec2e..e39307c7 100644 --- a/cider/scripts/cider_bridge.py +++ b/cider/scripts/cider_bridge.py @@ -995,7 +995,9 @@ def _cache_artwork(self, url: str, cache_key: str = "") -> str: if dest.exists() and dest.stat().st_size > 0: return str(dest) try: - resp = self._session.get(url, timeout=10) + # Tokened Session is only for Cider's local API. Artwork URLs are + # Apple Music CDN (*.mzstatic.com) — same bare get as LRCLIB. + resp = requests.get(url, timeout=10) resp.raise_for_status() if not resp.content: return "" diff --git a/cider/scripts/test_lyrics_display.py b/cider/scripts/test_lyrics_display.py index 59283c8d..b1529128 100644 --- a/cider/scripts/test_lyrics_display.py +++ b/cider/scripts/test_lyrics_display.py @@ -88,10 +88,18 @@ def test_unsung_paint_is_next_grey_not_dim_white(self) -> None: far = {"text": "thing", "start": 2_000, "end": 2_200} unsung_line = cfg.token_rgba_for_paint(far, 2_000, 2_200, 0, paint) self.assertAlmostEqual(unsung_line[0], cfg.NEXT_RGBA[0], places=2) + # Fixed palette so active vs sung stay distinct even when Noctalia + # theme tokens land on similar greens. + contrast = { + "sung": (1.0, 1.0, 1.0, 1.0), + "active": (1.0, 0.0, 0.0, 1.0), + "upcoming": cfg.NEXT_RGBA, + "next": cfg.NEXT_RGBA, + } later = {"text": "thing", "start": 200, "end": 400} - live_future = cfg.token_rgba_for_paint(later, 0, 400, 80, paint) - self.assertAlmostEqual(live_future[1], paint["active"][1], places=2) - self.assertNotAlmostEqual(live_future[1], paint["sung"][1], places=1) + live_future = cfg.token_rgba_for_paint(later, 0, 400, 80, contrast) + self.assertAlmostEqual(live_future[1], contrast["active"][1], places=2) + self.assertNotAlmostEqual(live_future[1], contrast["sung"][1], places=1) overlay = (ROOT / "scripts" / "lyrics_overlay.py").read_text(encoding="utf-8") self.assertNotIn('self._mul_a(self._paint["sung"], alpha)', overlay) self.assertIn("line_only_current_rgba", overlay) diff --git a/cider/scripts/test_write_position.py b/cider/scripts/test_write_position.py index 4fdf9d44..bdcba31f 100644 --- a/cider/scripts/test_write_position.py +++ b/cider/scripts/test_write_position.py @@ -101,6 +101,13 @@ def test_bridge_sends_apptoken_and_apitoken(self) -> None: self.assertIn('self._session.headers["apptoken"]', text) self.assertIn('self._session.headers["apitoken"]', text) + def test_artwork_cdn_fetch_is_tokenless(self) -> None: + source = Path(__file__).resolve().parent / "cider_bridge.py" + text = source.read_text(encoding="utf-8") + # Remote CDN must not reuse the Cider-token Session (ItsLemmy review). + self.assertIn("resp = requests.get(url, timeout=10)", text) + self.assertNotIn("self._session.get(url, timeout=10)", text) + if __name__ == "__main__": unittest.main()