Commit Graph
14 Commits
Author SHA1 Message Date
Tobias GesellchenandClaude Sonnet 4.6 2722e2383c fix(lint): sec6/sec7 post-pass — static.go Close + remove unused sanitizeErr
- stockholm/static.go: wrap deferred root.Close() in func(){}() to
  silence errcheck; change 'rel = rel + ...' to 'rel += ...' (gocritic).

- Remove sanitizeErr from four logutil files where no call site exists
  (cmd/soundtouch-cli, cmd/websocket-demo, pkg/discovery, pkg/service/setup).
  The log-injection fixes in those packages used sanitizeLog on string
  arguments rather than sanitizeErr on error values.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-25 11:28:26 +02:00
Tobias GesellchenandClaude Sonnet 4.6 0e9445af47 fix(security): sec7 — log-injection sweep, sanitizeErr helper
~30 remaining go/log-injection alerts share a common pattern: other
positional args in a log call are wrapped in sanitizeLog() but the
trailing 'err' value (via "%v") is not. CodeQL traces taint through
error chains back to the log.Printf call site itself.

Add sanitizeErr(err error) string to every affected package's
logutil.go (strips newlines from err.Error(), returns "<nil>" when
nil). Three packages had no logutil.go yet; new files added for
cmd/soundtouch-cli, cmd/websocket-demo, and examples.

Call-site changes (replace "%v, err" with "%s, sanitizeErr(err)" and
wrap any other unsanitised args in sanitizeLog):

pkg/client:
  - websocket.go:42   DefaultLogger.Printf now pre-formats and sanitises
                       the entire message (all variadic args sanitised)
  - websocket.go:445  err → sanitizeErr(err)

pkg/service/handlers:
  - handlers_account_mgmt.go:44   err
  - handlers_bmx_tunein.go:324,336 err (stationID already sanitised)
  - handlers_marge.go:288,510      err (deviceID/account already done)
  - handlers_mgmt.go:409,436,720  err
  - handlers_setup.go:1345        session + err
  - server.go:500                  bind
  - server.go:504,863,944,1029,   err (deviceIP/accountID already done)
    1164,1174

pkg/service/marge:
  - marge.go:1469,1923  saveErr / err

pkg/service/setup:
  - setup.go:1417,2316,2462  fmt.Printf — deviceIP / hostsContent / ip

pkg/service/stockholm:
  - proxy.go:117  effectiveTarget.String() + err

pkg/service/zeroconf:
  - zeroconf.go:312  err

pkg/service/proxy:
  - recorder.go:403  err (task.path already sanitised)

pkg/service/datastore:
  - datastore.go:940  werr (device already sanitised)

pkg/discovery:
  - dns.go:72   strings.Join(derived)
  - dns.go:503  d.upstreamDNS (fmt.Sprint of []string)

cmd/soundtouch-cli:
  - cmd_events.go:571  VerboseLogger.Printf — pre-format + sanitise
  - common.go:335      PrintError message

cmd/websocket-demo:
  - main.go:576   VerboseLogger.Printf — pre-format + sanitise

examples:
  - recording-filename-demo.go:79  err

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-25 11:28:26 +02:00
Tobias GesellchenandClaude Opus 4.7 702092d772 chore: sweep example LAN IPs to RFC-5737 in source and config files
Completes the docs-tier RFC-5737 rollout by sweeping the remaining
192.168.1.x references that lived outside .md / .txt / test files:

  - .env.example                                — active PREFERRED_DEVICES default + examples
  - .github/ISSUE_TEMPLATE/*.yml + workflows    — issue template + CI examples
  - cmd/websocket-demo/main.go, doc.go          — top-level docs
  - examples/*/main.go (7 files)                — example program comments
  - pkg/client/client.go                        — godoc examples
  - pkg/models/doc.go                           — package godoc
  - pkg/service/{amazon,spotify,zeroconf}/zeroconf.go — godoc comments
  - pkg/service/handlers/web/index.html         — placeholder text in the UI
  - scripts/prepare-release.sh                  — example invocations
  - scripts/spotify/spotify-prime-speaker.sh    — usage comment
  - tests/integration/http-client/http-client.env.json — fixture IPs

Same mapping as the docs commit (136d24a): 192.168.1.X → 192.0.2.X
preserving the last octet.

One semantic carve-out: the three zeroconf `zcBaseURL` godoc comments
in pkg/service/{amazon,spotify,zeroconf}/zeroconf.go switched to
192.168.10.10 instead of the doc range, because validateZcBaseURL
only accepts RFC-1918 / loopback / link-local. The comment must show
a value the validator actually accepts — see the matching test fix
in 92f66a2 for the same reason.

go build ./... clean. go test ./... clean except the pre-existing
TestDocsConsistency (untracked DEVICE-LOCAL-INSTALL.md, unrelated).
golangci-lint run ./... — 0 issues after a gofmt fix on
examples/zone-slave-operations/main.go.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-17 22:05:13 +02:00
Tobias GesellchenandClaude Opus 4.7 c668c732df fix(#308): handle placeholder presets without panicking
The ST10's /presets response after a factory reset emits self-closing
<preset/> entries with no ContentItem child. cmd/soundtouch-cli's
getPresets() handled the missing ContentItem in GetDisplayName() but
then dereferenced preset.ContentItem.Source on the next line, panicking
with "invalid memory address or nil pointer dereference" the moment the
loop reached the first empty entry.

A second placeholder shape was observed on healthy devices that were
never reset: <preset id="0"><ContentItem source="INVALID_SOURCE"
isPresetable="true"/></preset>. ContentItem is non-nil here, so the
previous "ContentItem != nil" guard at other call sites still let
these placeholders through into listings and into the AfterTouch
datastore.

Fix shape:

  pkg/models/presets.go - extend Preset.IsEmpty() to recognise both
  shapes (ContentItem == nil, OR Source == "" / "INVALID_SOURCE").
  HasPresets, GetEmptyPresetSlots and GetUsedPresetSlots become honest
  about which slots actually carry playable content.

  cmd/soundtouch-cli/cmd_info.go (the crash site) - filter the slice
  via IsEmpty before the print loop, and switch the still-printed
  fields to the existing nil-safe Get* helpers.

  pkg/service/setup/setup.go - upgrade syncPresets's "ContentItem ==
  nil" continue-guard to IsEmpty so Shape B placeholders don't get
  persisted in the AfterTouch datastore and then surface as junk
  rows in the admin web UI.

  cmd/soundtouch-cli/cmd_events.go, cmd/websocket-demo/main.go - same
  nil-guard upgrade. These already nil-checked so were crash-safe;
  the change is for consistency and to stop printing
  "Preset 0:  (INVALID_SOURCE)" demo lines.

  examples/preset-management/main.go - had the same latent crash as
  cmd_info.go; same fix shape.

Regression tests in pkg/models/presets_test.go cover both shapes using
the exact XML observed in the wild: the reporter's three <preset/>
placeholders plus the three INVALID_SOURCE entries from a live device.
The reporter XML test walks every preset through the same accessor
path the CLI used and asserts no panic.

The soundtouch-web Go code does not deref preset.ContentItem.X
anywhere - presets flow through as JSON - so no separate crash trap
exists there. The web frontend will pick up the cleaner data once
syncPresets stops persisting placeholders.

Closes #308

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-17 11:36:55 +02:00
Tobias Gesellchen a74dc96e50 style: fix whitespace and wsl_v5 linting issues
- Remove unnecessary trailing/leading whitespace
- Add missing whitespace above return statements, if statements, and loops
- Fix whitespace around variable declarations and assignments
- Improve code readability by following Go whitespace conventions
- Maintain functionality while improving code style consistency

Addresses majority of wsl_v5 and whitespace linting rules.
2026-02-01 21:56:13 +01:00
Tobias Gesellchen 90f5a53ef4 feat: implement complete /storePreset and /removePreset functionality
- Add StorePreset, StoreCurrentAsPreset, and RemovePreset methods to client
- Create comprehensive preset management CLI with subcommands:
  * preset store-current --slot N (store currently playing content)
  * preset store --slot N --source X --location Y (store specific content)
  * preset remove --slot N (remove preset)
  * preset select --slot N (select/play preset)
  * preset list (list all presets)
- Fix WebSocket event handling for preset updates:
  * Correct event type from 'presetUpdated' to 'presetsUpdated'
  * Update event structure to handle complete preset list
  * Improve WebSocket demo display for preset events
- Add comprehensive test coverage for all new client methods
- Fix mock server URL mismatch in tests (/now_playing vs /nowPlaying)
- Add proper input validation and error handling
- Support all content sources: SPOTIFY, TUNEIN, LOCAL_INTERNET_RADIO, etc.

Successfully tested with real SoundTouch device:
- Storing Spotify content as presets 
- Removing presets 
- Real-time WebSocket events 
- CLI usability and error handling 

Resolves #14 - Complete /storePreset implementation
2026-01-30 23:12:45 +01:00
Tobias Gesellchen e5673103e0 Fix WebSocket connection issues and add special message parsing
- Fix WebSocket URL construction by properly extracting hostname from base URL
- Add 'gabbo' protocol requirement as specified in SoundTouch API docs
- Add parsing for SoundTouchSdkInfo and UserActivityUpdate messages
- Add proper filtering support for special message types (sdkInfo, userActivity)
- Fix nil pointer dereference by ensuring WebSocket client always has a logger
- Add SilentLogger for non-verbose mode to prevent crashes
- Update README and help text to include new special message types
- Clean up logging to only show unknown message types, not known special messages

Fixes the original WebSocket connection error:
'parse "ws://http:%2F%2F192.168.178.28:8090:8080/": invalid URL escape "%2F"'
2026-01-10 23:49:54 +01:00
Tobias Gesellchen 56566a2b27 apply/fix golangci-lint findings 2026-01-10 11:43:48 +01:00
Tobias Gesellchen ccd19d97a5 docs: add attribution to official Bose SoundTouch Web API documentation
- Reference original API documentation source from Bose Corporation
- Link to official Bose SoundTouch End-of-Life page
- Clarify this is an independent implementation
- Add disclaimer about non-affiliation with Bose Corporation
- Provide both online and local documentation references
2026-01-10 00:34:54 +01:00
Tobias Gesellchen 6f27a559e4 fix: auto-resolve whitespace and formatting issues using golangci-lint --fix
- Used 'golangci-lint run --fix' to automatically resolve formatting issues
- Fixed all 52 remaining wsl_v5 (whitespace) issues automatically
- Applied go fmt to ensure consistent formatting across codebase
- Touched 49 files with automatic formatting improvements

MAJOR PROGRESS: Reduced total issues from 79 to 27 (66% reduction!)
Remaining issues:
- gocyclo: 14 (complexity - requires manual refactoring)
- revive: 5 (style/naming)
- staticcheck: 5 (static analysis)
- unparam: 3 (unused parameters)
2026-01-09 23:12:08 +01:00
Tobias Gesellchen 8d047bec78 fix: resolve whitespace (wsl_v5) issues - part 1
- Fix whitespace issues in cmd files (example-mdns, example-upnp, soundtouch-cli, websocket-demo)
- Fix whitespace issues in client.go and websocket.go
- Fix whitespace issues in test files
- Restore accidentally removed deviceHost variable
- Add proper spacing around loops, conditionals, and function calls

Progress: Continuing to resolve remaining wsl_v5 linting issues
2026-01-09 23:07:32 +01:00
Tobias Gesellchen 9ed8182278 fix: resolve golangci-lint issues
- Fix all errcheck issues by properly checking error return values
- Fix gocritic exitAfterDefer issues by replacing log.Fatalf with return statements
- Fix rangeValCopy issues by using index-based iteration for large structs
- Add missing package comments for all packages
- Fix unused parameter issues by renaming to underscore
- Fix empty block issues by adding explicit error handling
- Add documentation for exported methods and constants
- Fix shadow variable issues
- Replace deprecated strings.Title with manual implementation
- Fix defer function error handling

Reduced lint issues from 108 to 84 (22% improvement)
All critical error handling and code quality issues resolved
2026-01-09 22:59:21 +01:00
Tobias Gesellchen a8d9ab99c4 Fix linting issues and test failures
- Fix bodyclose issues by properly closing WebSocket response body
- Fix errcheck issues by checking errors on resp.Body.Close(), conn.Close(), etc.
- Fix errorlint issue by using errors.As() instead of type assertion
- Fix nilerr issue by adding proper logging for UPnP discovery failures
- Fix gocritic issues:
  - Convert if-else chains to switch statements
  - Fix parameter type combining (paramTypeCombine)
  - Fix range value copying (rangeValCopy)
  - Fix exitAfterDefer by calling cancel() before log.Fatalf()
- Add package comments to fix revive package-comments issues
- Rename ClientConfig to Config to avoid type name stuttering
- Add missing exported constant comments
- Fix unused parameter issues by renaming to _
- Fix empty block issues
- Add t.Helper() to test helper functions
- Update User-Agent and fix GetNetworkSummary behavior to match test expectations

Reduces linting issues from 151 to 108 (28% improvement).
All tests now pass.
2026-01-09 13:52:57 +01:00
Tobias Gesellchen cc39efc882 feat: Add comprehensive WebSocket events support
- Implement real-time WebSocket client for device monitoring
- Add 12 event types: NowPlaying, Volume, Connection, Preset, Zone, Bass, Clock, Name, Error, Recents, Language
- Create WebSocket demo CLI with event filtering and auto-discovery
- Add comprehensive WebSocket documentation and examples
- Implement automatic reconnection and robust error handling
- Add 50+ WebSocket-specific tests with mock server
- Update project completion to 85% (16/19 endpoints)
- Clarify that POST /presets is officially not supported by SoundTouch API
- Add production-ready WebSocket client with configurable options

Breaking: WebSocket events require gorilla/websocket dependency
Docs: Complete WebSocket integration examples and API reference
2026-01-09 11:30:35 +01:00