From 60c74a60a2b5d1de27665d2abaf4a46499b9202e Mon Sep 17 00:00:00 2001
From: Honey <me_honeyy@proton.me>
Date: Sat, 9 May 2026 20:02:18 +0200
Subject: [PATCH] fix: get Spotify token from embed page instead of blocked
 get_access_token endpoint

---
 backend/novasonic-server.js | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/backend/novasonic-server.js b/backend/novasonic-server.js
index 0464440..bd23e01 100644
--- a/backend/novasonic-server.js
+++ b/backend/novasonic-server.js
@@ -72,18 +72,24 @@ let _spTokenExpiry = 0;
 
 async function fetchSpotifyToken() {
   if (_spTokenCache && Date.now() < _spTokenExpiry) return _spTokenCache;
-  const r = await fetch('https://open.spotify.com/get_access_token?reason=transport&productType=web_player', {
+  // Extract anonymous token from embed page — works from any IP unlike get_access_token
+  const r = await fetch('https://open.spotify.com/embed/track/4uLU6hMCjMI75M1A2tKUQC', {
     headers: {
       'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36',
-      'Accept': 'application/json',
+      'Accept': 'text/html,application/xhtml+xml',
+      'Accept-Language': 'en-US,en;q=0.9',
     },
-    signal: AbortSignal.timeout(10000),
+    signal: AbortSignal.timeout(12000),
   });
-  if (!r.ok) throw new Error(`Spotify-Token nicht abrufbar (${r.status})`);
-  const d = await r.json();
-  if (!d.accessToken) throw new Error('Kein Spotify-Token erhalten');
-  _spTokenCache = d.accessToken;
-  _spTokenExpiry = (d.accessTokenExpirationTimestampMs || (Date.now() + 55 * 60 * 1000)) - 30000;
+  if (!r.ok) throw new Error(`Spotify-Embed nicht erreichbar (${r.status})`);
+  const html = await r.text();
+  const m = html.match(/<script id="__NEXT_DATA__" type="application\/json">(.+?)<\/script>/s);
+  if (!m) throw new Error('Spotify-Seite nicht parsebar');
+  const nd = JSON.parse(m[1]);
+  const token = nd?.props?.pageProps?.accessToken;
+  if (!token) throw new Error('Kein Token in Spotify-Embed gefunden');
+  _spTokenCache = token;
+  _spTokenExpiry = (nd?.props?.pageProps?.accessTokenExpirationTimestampMs || (Date.now() + 55 * 60 * 1000)) - 30000;
   return _spTokenCache;
 }