From 5d933f7ebc5c41c33bac952b4a6681eae2b80bc6 Mon Sep 17 00:00:00 2001
From: Tobias Gesellchen <tobias@gesellix.de>
Date: Mon, 6 Apr 2026 21:08:40 +0200
Subject: [PATCH] Use a constant prefix for our internal token

---
 pkg/service/handlers/bridge_test.go | 4 ++--
 pkg/service/spotify/service.go      | 6 ++++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkg/service/handlers/bridge_test.go b/pkg/service/handlers/bridge_test.go
index b8a98b8..9cf4847 100644
--- a/pkg/service/handlers/bridge_test.go
+++ b/pkg/service/handlers/bridge_test.go
@@ -139,8 +139,8 @@ func TestSpotifyBridge(t *testing.T) {
 		t.Fatal("Could not find surrogate token in Marge sources")
 	}
 
-	if len(surrogate) != 32 {
-		t.Errorf("Expected surrogate to be 32 hex chars, got %s", surrogate)
+	if !strings.HasPrefix(surrogate, "bs-") || len(surrogate) != 35 {
+		t.Errorf("Expected surrogate to have 'bs-' prefix and be 35 chars, got %s", surrogate)
 	}
 
 	// Request refresh
diff --git a/pkg/service/spotify/service.go b/pkg/service/spotify/service.go
index d4caff3..d33809c 100644
--- a/pkg/service/spotify/service.go
+++ b/pkg/service/spotify/service.go
@@ -350,13 +350,15 @@ func (s *Service) GetAccountBySecret(secret string) (*Account, bool) {
 }
 
 func (s *Service) generateBoseSecret() string {
+	prefix := "bs-"
+
 	b := make([]byte, 16)
 	if _, err := rand.Read(b); err != nil {
 		// Fallback to timestamp-based if RNG fails
-		return fmt.Sprintf("bs-%d", time.Now().UnixNano())
+		return fmt.Sprintf("%s%d", prefix, time.Now().UnixNano())
 	}
 
-	return hex.EncodeToString(b)
+	return prefix + hex.EncodeToString(b)
 }
 
 // ResolveEntity resolves a Spotify URI to a name and image URL.