fix(embed): honor is_streamable so inactive artists' tracks don't render - #14571
Merged
Conversation
apps#14570 gated the web and mobile track pages on `is_streamable`, but the embed player is its own app and was left rendering the full card - title, artist, artwork, play button - for a track whose owner deactivated their own account or was delisted by the trusted notifier. api#1023 made the stream endpoint 404, so the player was already unable to play these; it just showed the metadata and then failed silently on press. Route non-streamable tracks into the existing not-available treatment. The copy is its own message rather than reusing the deleted-by-creator string: the same flag covers a self deactivation and a delisted account, and we shouldn't tell listeners the creator removed a track when moderation suppressed it. Wording matches the web tombstone from #14570. The check is an explicit `=== false` because an absent field must not read as unavailable. Verified against audius.co/rehoxx/just-for-tonight-wmellark-hoonds in all three flavors (card, compact, tiny) and both routes (hash id and permalink), with a streamable track confirmed unaffected. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
dylanjeffers
added a commit
that referenced
this pull request
Sep 9, 2026
The embed player has had **no deploy path since 2026-06-23**. CircleCI shipped it via `embed-deploy-production-cloudflare`; #14504 deleted `.circleci` without porting that job, and nothing in `.github/` has referenced `packages/embed` since. The package README still says "Deployed via CI". Caught because #14571 sat merged for four days with the old bundle still serving on `audius.co/embed`. ## The port Adds an `embed-deploy` job to `web.yml`. Three deliberate differences from the CircleCI original: | | CircleCI | here | |---|---|---| | trigger | `release*` branches | `main` | | gate | none | none (see below) | | deploy cmd | `npm run deploy:prod` | `npx wrangler@4.54.0 deploy`, matching the web deploy | Not behind the `production` gate that web and desktop share. The embed is a self-contained player with no desktop/S3 half to coordinate with, and gating it would mean the deploy that just rotted for two months needs a human every time. Easy to add `needs: [production-gate]` if you'd rather it wait. Also adds `packages/embed/**` to the workflow path filters — without it an embed-only change doesn't trigger this workflow at all, which is why #14571 ran no CI beyond the security scanners. ## Two fixes it depends on - **`wrangler.toml` was wrangler-1.x era.** `type = "webpack"` is silently ignored and `[site] entry-point` is deprecated; both replaced with a top-level `main`. Verified with `--dry-run` on the pinned 3.30.1 *and* 4.54.0 — clean on both, warnings on neither. - **`deploy:prod` called `wrangler publish`**, which no longer exists in wrangler 4. So the manual deploy documented in the README was already broken on any current wrangler. Now `wrangler deploy --env production`. The odd-looking build/deploy split is preserved, not fixed: `build:prod` renames `build/` → `build-production/` and the deploy job renames it back, because `[site] bucket` points at `./build`. That split across repo and CI is why `build:prod && deploy:prod` deploys nothing on its own. Worth collapsing someday; left alone here to keep this a port. ## Verification Ran the job's exact step sequence locally: `npm run build:prod` → `workers-site npm i` → `mv build-production build` → `npx wrangler@4.54.0 deploy --env production --dry-run`. Uploads 57.95 KiB, zero warnings. Confirmed the built bundle contains #14571's strings, so this would ship the fix that's currently stuck. Only thing not verifiable without merging: that `secrets.CLOUDFLARE_API_TOKEN` (already used by the web deploy in this same workflow) has access to the `embed` worker. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #14570, which gated the web and mobile track pages on
is_streamable. The embed player is its own app and was missed — it still rendered the full card (title, artist, artwork, play button) for a track whose owner deactivated their own account or was delisted by the trusted notifier.AudiusProject/api#1023 already made
/v1/tracks/{id}/stream404, so the player couldn't actually play these. It just showed the metadata and then failed silently on press.Change
Route non-streamable tracks into the existing not-available treatment (the same path a 404 takes), with its own copy rather than reusing the deleted-by-creator string — the same flag covers a self deactivation and a delisted account, and we shouldn't tell listeners the creator removed a track when moderation suppressed it. Wording matches the web tombstone from #14570.
The check is an explicit
=== false, matchingisTrackUnavailablein common: an absent field must not read as unavailable. (The embed depends on@audius/sdkrather than@audius/common, so the helper isn't importable here.)Verification
Ran against prod data using
audius.co/rehoxx/just-for-tonight-wmellark-hoonds(ENxw4), the track from the original report:cardcompacttinyBoth routes covered — hash id (
getTrack) and permalink (getBulkTracks). A streamable trending track still renders normally with artwork and play button.vite build,eslint, andjestall pass.Note
The remaining gap is server-side:
/v1/tracks/{id}still returns a signed content-node URL for these tracks, which AudiusProject/api#1024 fixes.🤖 Generated with Claude Code