Fix account swaping

2026-09-18 02:05:48 +02:00
parent 053be20b9c
commit 5ca504c680
10 changed files with 885 additions and 21 deletions
@@ -46,7 +46,12 @@ from http.server import BaseHTTPRequestHandler, HTTPServer

 REDIRECT_PORT = 8899
 REDIRECT_URI = f"http://127.0.0.1:{REDIRECT_PORT}/callback"
-SCOPES = "user-read-playback-state user-modify-playback-state"
+# "streaming" is not for streaming anything here: it is the scope the
+# speakers themselves ask for (getInfo says so) when this panel signs one
+# in to an account over the LAN -- see spotify_zc.py. Without it a token
+# can still see and steer a room the account already holds, but cannot
+# take a room that another account is signed in to.
+SCOPES = "user-read-playback-state user-modify-playback-state streaming"


 def get_code(client_id: str, state: str) -> str: