Alert when an Apple Music account's session has gone stale #47
No reviewers
Labels
No labels
Kind/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Reviewed
Confirmed
Reviewed
Duplicate
Reviewed
Invalid
Reviewed
Won't Fix
Status
Abandoned
Status
Blocked
Status
Need More Info
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
WulfScience-FOSS/ha-music-own!47
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "macsome_6"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
fetch_ma_playlists now tracks per-account attempted/failed counts for
every provider-backed (non-native) account touched in a sync, and flags
needs_reauth when every playlist attempted for an account failed (>=2
attempted, to distinguish a genuinely dead session from one persistently
odd playlist).
coordinator.py raises a persistent Home Assistant notification per
flagged account (stable notification_id per account instance, so it
doesn't re-spam every sync) and dismisses it automatically once that
account succeeds again. Exposed as sensor.tracks_owned's new "accounts"
attribute too.
This is a known, documented gap in Apple's own Music-User-Token design
(per Apple's developer relations: the token is meant to be re-derived per
session, not persisted long-term by a backend) rather than a Music
Assistant or music_own bug - confirmed via Apple Developer Forum reports
of the same days-not-months expiry when a token is stored server-side.
No code fix exists for the underlying expiry; this just makes it visible
immediately instead of requiring log-digging.
README updated with this context, plus the manual-token option (doesn't
change expiry, but sidesteps the browser-session-reuse risk when
re-authenticating a specific account since you can visually confirm which
account you're extracting the token from).