From e1bc18ce1ac7f94a7e575c09d14f83b2dc03489c Mon Sep 17 00:00:00 2001
From: x3 <x3@sysdaemon.xyz>
Date: Sun, 6 Sep 2026 08:25:02 +0000
Subject: [PATCH] fix: redirect uri auf https umstellen mit self-signed cert

---
 README.md           |  2 +-
 spotify_cli/auth.py | 29 ++++++++++++++++++++++++++---
 2 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index 5f9fde4..e957b5b 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,7 @@ Terminal-basierter Spotify Client im Stil von ncmpcpp.
 
 1. Gehe zu https://developer.spotify.com/dashboard
 2. Erstelle eine neue App
-3. Setze den Redirect URI auf `http://localhost:8888/callback`
+3. Setze den Redirect URI auf `https://localhost:8888/callback`
 4. Kopiere die **Client ID**
 
 ### 2. Installation
diff --git a/spotify_cli/auth.py b/spotify_cli/auth.py
index b0e6bae..85f972a 100644
--- a/spotify_cli/auth.py
+++ b/spotify_cli/auth.py
@@ -83,7 +83,7 @@ class SpotifyAuth:
         params = {
             "client_id": self.client_id,
             "response_type": "code",
-            "redirect_uri": "http://localhost:8888/callback",
+            "redirect_uri": "https://localhost:8888/callback",
             "code_challenge_method": "S256",
             "code_challenge": code_challenge,
             "state": state,
@@ -104,7 +104,27 @@ class SpotifyAuth:
 
     def _wait_for_callback(self, timeout=300):
         from http.server import HTTPServer, BaseHTTPRequestHandler
-        import threading
+        import ssl
+        import subprocess
+
+        cert_dir = self.cfg.get("cert_dir", "")
+        if not cert_dir:
+            from pathlib import Path
+            cert_dir = str(Path.home() / ".config" / "spotify-cli" / "certs")
+            self.cfg["cert_dir"] = cert_dir
+
+        cert_file = f"{cert_dir}/cert.pem"
+        key_file = f"{cert_dir}/key.pem"
+
+        import os
+        if not os.path.exists(cert_file) or not os.path.exists(key_file):
+            os.makedirs(cert_dir, exist_ok=True)
+            subprocess.run([
+                "openssl", "req", "-x509", "-newkey", "rsa:2048",
+                "-keyout", key_file, "-out", cert_file,
+                "-days", "365", "-nodes",
+                "-subj", "/CN=localhost"
+            ], check=True, capture_output=True)
 
         received_code = {"code": None, "state": None}
 
@@ -128,6 +148,9 @@ class SpotifyAuth:
                 pass
 
         server = HTTPServer(("localhost", 8888), Handler)
+        ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+        ctx.load_cert_chain(cert_file, key_file)
+        server.socket = ctx.wrap_socket(server.socket, server_side=True)
         server.timeout = timeout
 
         start = time.time()
@@ -143,7 +166,7 @@ class SpotifyAuth:
         resp = requests.post(SPOTIFY_TOKEN_URL, data={
             "grant_type": "authorization_code",
             "code": code,
-            "redirect_uri": "http://localhost:8888/callback",
+            "redirect_uri": "https://localhost:8888/callback",
             "client_id": self.client_id,
             "code_verifier": code_verifier,
         })