kmarrip / gospotify

goSpotify uses Oauth2.0 for signing in users with spotify account and gets interesting input from spotify.

goSpotify

goSpotify uses Oauth2 to authorize the users with their spotify account and returns the song/album currently being played

join goSpotify discord server

QuickStart

1. Install Docker.
2. Go to https://developer.spotify.com/ and login/register
3. In dashboard add a new app, so in edit settings add this redirect url http://localhost:8080/callback
4. Get your client id and client secret and create .env file like this:

      baseUrl=https://accounts.spotify.com/authorize?
      clientId=your-client-id
      clientSecret=your-client-secret
      redirectUrl=http://localhost:8080/callback
      scopes=user-read-playback-state
      tokenUrl=https://accounts.spotify.com/api/token
      getMeSpotify=https://api.spotify.com/v1/me
      currentlyPlaying=https://api.spotify.com/v1/me/player/
   

5. Run the build command

   docker build -t gospotify:latest .
   

6. Run the start command

   docker run -p 8080:8080 gospotify:latest
   

Todo list

these are the pending action items, list will be updated overtime

• Add state in the url parmas when the user is redirected, to protect against csrf attacks
• After successful authentication return a html page instead of text
• Add error page for errors during /authorize step
• Add more test cases
• Add more functionality to the app
• Buy a domain and add it to the cloud run

Deployment

CI/CD pipeline is configured in gcp, google cloud build processes the builds and deploys it to the cloud run as per cloudbuild.yaml file. This app is currently deployed to cloud run app

gospotify's Issues

Add state in redirect url and verify it after the auth code is generated

• Currently users are redirected without the state param in the url
• Before the users are sent to the authorization server , add a state param as per OIDC standards
• After successful authorization the state is also sent back if given , see the docs spotify api docs
• This is to stop request forgery

Add test cases

• Requirement is simple, golang has inbuilt testing library. use that to add test cases

pre commit and pre push git hooks

currently the app doesn't have any git hooks installed.

• would be great to have husky style pre commit and push
• should check for lint issue, go lint
• should run tests

Refresh access token if its about to expire

For every request access token ,refresh token are sent as cookies to the server

• send an expiry time cookie which has unix time stamp of the expiry date, generate this when access token is generated
• for every future request in the base handler, check the current time stamp and the expiry time stamp
• if it is about to expire in about lets say 5 min, send the request to refresh endpoint
• get the refresh token from the cookie and talk to spotify via their api and save the access, refresh token and expiry unix time stamp
• finally send the request to base url

Html page for Failed authentication

• If the user doesn't authorize the app, authorization server sends back and error in reply url
• Notify the user to accept the permissions

Html Page for the app

• Right now after the users are authorized, they are presented with a simple text file.
• It would be great if the users are greeted with a pleasant html page

Move to GIN

Current the built in library for http router is being used

• for testing and reliability it would be great to move to GIN framework