From f2f03a358c7372da2f92ad57f2aa1b4714675720 Mon Sep 17 00:00:00 2001
From: Tobias Gesellchen <tobias@gesellix.de>
Date: Sun, 31 May 2026 22:18:20 +0200
Subject: [PATCH] feat(web): show Play URL service URL read-only when
 configured server-side

Mirrors the TTS view's "configured -> locked" behavior. HandlePlayURL
already prefers the server-side --service-url over the client value, so
when it's set the browser field's edits are ignored anyway; reflect that
by rendering it read-only with a note, and editable only as a fallback
when no --service-url is configured. (Play URL has no SSRF: the URL is
handed to the speaker, not fetched by soundtouch-web.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../soundtouchweb/static/js/components/PlayURL.js     | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pkg/service/soundtouchweb/static/js/components/PlayURL.js b/pkg/service/soundtouchweb/static/js/components/PlayURL.js
index e32327f..d04cdc8 100644
--- a/pkg/service/soundtouchweb/static/js/components/PlayURL.js
+++ b/pkg/service/soundtouchweb/static/js/components/PlayURL.js
@@ -41,7 +41,10 @@ export function PlayURL({ devices, serverServiceUrl }) {
         setPendingPlay(null);
         setStatus('Playing…');
         try {
-            const resp = await api.playURL(deviceId, item.url, item.name, '', serviceUrl.trim());
+            // When configured server-side, that value wins; send it so a stale
+            // localStorage override never matters.
+            const effectiveServiceUrl = serverServiceUrl || serviceUrl.trim();
+            const resp = await api.playURL(deviceId, item.url, item.name, '', effectiveServiceUrl);
             setStatus(resp.success ? 'Playing — use ★ on the device page to save as preset' : 'Error: ' + (resp.error || 'Unknown error'));
         } catch (e) {
             setStatus('Error: ' + e.message);
@@ -77,11 +80,15 @@ export function PlayURL({ devices, serverServiceUrl }) {
                     type="url"
                     class="tunein-search-input"
                     placeholder="AfterTouch URL (https://…)"
-                    value=${serviceUrl}
+                    value=${serverServiceUrl || serviceUrl}
                     onInput=${(e) => onServiceUrlChange(e.target.value)}
+                    readonly=${!!serverServiceUrl}
                     title="AfterTouch service base URL — required for LOCAL_INTERNET_RADIO playback and preset save"
                 />
             </div>
+            ${serverServiceUrl
+                ? html`<div class="track-meta" style="margin-top:.2rem; opacity:.85">Configured server-side (soundtouch-web --service-url); edits here would be ignored.</div>`
+                : null}
             ${status && html`<div class="track-meta" style="margin-top:.6rem">${status}</div>`}
 
             ${pendingPlay ? html`