Why does spotcast needs sp_dc/sp_key instead of using oauth based id/secret ?

fondberg / spotcast

Home assistant custom component to start Spotify playback on an idle chromecast device as well as control spotify connect devices

Apache License 2.0

666 stars 95 forks source link

Why does spotcast needs sp_dc/sp_key instead of using oauth based id/secret ? #452

Open maxenced opened 3 weeks ago

maxenced commented 3 weeks ago

Not really a bug, more a question.

Every now and then, my sp dc/key expires and I have to update them. And every time I ask myself why spotcast does not use oauth workflow just as many other things / tools do.

I'm sure there is some reason, but I can't get it, could you explain or point me to explanation ?

rwjack commented 3 weeks ago

https://github.com/librespot-org/librespot/discussions/1311

I came here because I see that I can no longer find sp_key in the cookies when logging in from my desktop. It's fascinating how many stupid decisions they can make in such short notice, just pushing customers away for no reason

OK, re-logged and I see the key now, but still, fuck you Spotify 🖕🏽

maxenced commented 3 weeks ago

Being impolite does not help much , especially on a bugtracker (either here or librespot) of community developed software, with no direct link to spotify itself

rwjack commented 3 weeks ago

I'm simply testing the waters to see if I'm the only one frustrated by this issue, or if the community agrees with my views

fcusson commented 3 weeks ago

@rwjack if you have a solution that gives us the level of Api access we need without the need for these keys go on make a PR.

Also what do you think the oauth process does? It just allows connections without cookies or keys? No they save the keys once you do the login. Which we can't do because we currently have a manual setup using yaml configuration.

Again make a pr for either an alternate credentials process or a setup process to fetch the keys on install.

maxenced commented 3 weeks ago

@fcusson not sure if the 2nd part of your answer is directed to my or rwjack, sorry if my initial question appeared to be rude or irrespective, was definitely not my intention. I'm really interested by what's hiding behind "the level of Api access we need". Every time I need to update my cookies I think about spending some time to understand why we need them, hence my question.

And yes, I plan to spend some time checking if we can improve this :)

rwjack commented 3 weeks ago

I came in being pissed at spotify for breaking something that was functioning.

Meanwhile your reply absolutely reminded me of this guy, coming in like a smart ass and completely missing the point, I didn't even ask the original question lol

https://youtu.be/J7HZeCrtofs

fcusson commented 3 weeks ago

@maxenced @rwjack

forgot to add both in the message, and there were no ill-intent in my message. That's the sad part of messages and forum, gauging tone is sometime hard.

I can be very rhetorical some times when I speak. To make it clearer what I meant was:

Currently we are limited to the usage of Spotipy, more specifically the client credentials workflow. Which requires the cookie keys. Otherwise, we don't have the api access that we want for the whole process.
If there is a way to part ways with the client credentials workflow I'm all for it, but I'm not versed enough on Spotify documentation to check it out.
A better option in my opinion would be to work on a home assistant setup workflow, which would also help remove one of my biggest issue with our current setup flow which is less than ideal to say the least.

So in the end, there is a reason (possibly outdated, that we need the sp_dc and sp_key). I'm unaware of a solution to this. If someone has a solution for either of the 2 solutions, please, make a PR, I would be glad to review it.

maxenced commented 3 weeks ago

@fcusson sorry for the details, do you have in mind which part of " the api access that we want for the whole process" i should check first if I try to switch to auth code flow for ex ?

rwjack commented 3 weeks ago

@fcusson All good bro, thanks for clarifying.

fcusson commented 1 week ago

@maxenced might be purely legacy code.

I've been working on my side on spotcast v4. I currently have a functioning build that uses the Spotify OAuth implementation but with added scope. Might be promissing. This would mean moving everyone to a HomeAssistant GUI config. There's still a lot to do, since I'm basically trying a full rewrite, but I currently have:

ability to load spotify app on chromecast
a generic way to extend the wakeup and play system to any other types of devices as long as someone is able to create the wakeup process for it
ability to fully load spotipy using oauth process

maxenced commented 1 week ago

that's awesome !! I'll wait for it then :) I think we can close this ?

fcusson commented 1 week ago

@maxenced bad news on my build. I see why fondberg used the sp_dc and sp_key. There is a single section where we need to use the internal api spclient.wg.spotify.con. This can only be done with the sp_dc and sp_key has this is not the same as the open api Spotify is providing.

I'll try to figure out something. My build has some improvements on the current state, but we would still be limited to this requirement