From 3903317a59a1fd1d4d80aa2a057c5bf06d011ba9 Mon Sep 17 00:00:00 2001
From: Stan Runge <stan@stanrunge.dev>
Date: Sat, 24 Oct 2026 16:12:10 +0000
Subject: [PATCH] spotify: manual 302 for external redirects in
 /api/spotify/connect (kit refuses redirect() to external origins)

---
 src/routes/api/spotify/connect/+server.ts | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/src/routes/api/spotify/connect/+server.ts b/src/routes/api/spotify/connect/+server.ts
index 9f7365b..5f2d0ae 100644
--- a/src/routes/api/spotify/connect/+server.ts
+++ b/src/routes/api/spotify/connect/+server.ts
@@ -1,5 +1,5 @@
 import { SPOTIFY_CLIENT_ID } from '$app/env/private';
-import { error, redirect } from '@sveltejs/kit';
+import { error } from '@sveltejs/kit';
 import { requireOwner } from '#lib/server/owner.js';
 import {
 	authorizeUrl,
@@ -9,13 +9,18 @@ import {
 } from '#lib/server/music/oauth.js';
 import type { RequestHandler } from './$types';
 
+// SvelteKit refuses redirect() to external origins; build the 302 by hand.
+// Cookies set via event.cookies are still attached to this Response.
+const externalRedirect = (location: string) =>
+	new Response(null, { status: 302, headers: { location, 'cache-control': 'no-store' } });
+
 // Owner only: start the Spotify Authorization Code flow for the listening tracker.
 export const GET: RequestHandler = (event) => {
 	requireOwner(event);
 	const { url, cookies } = event;
 	// The state cookie must be set on the host Spotify redirects back to.
 	if (url.hostname === 'www.stanrunge.dev')
-		redirect(302, 'https://stanrunge.dev/api/spotify/connect');
+		return externalRedirect('https://stanrunge.dev/api/spotify/connect');
 	if (!SPOTIFY_CLIENT_ID) error(503, 'Spotify is not configured on this server.');
 	const state = Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString('base64url');
 	cookies.set(STATE_COOKIE, state, {
@@ -25,5 +30,5 @@ export const GET: RequestHandler = (event) => {
 		sameSite: 'lax',
 		maxAge: 600
 	});
-	redirect(302, authorizeUrl(SPOTIFY_CLIENT_ID, `${publicOrigin(url)}${CALLBACK_PATH}`, state));
+	return externalRedirect(authorizeUrl(SPOTIFY_CLIENT_ID, `${publicOrigin(url)}${CALLBACK_PATH}`, state));
 };