feat(fm): let each web user link their own NetEase account for personal FM (#164)

With several people sharing one bot, personal FM always followed the one
account the bot was logged in with. Each signed-in (non-guest) web user
can now scan a QR code under Settings → 账户 to link their own NetEase
account; FM they start from the WebUI then comes from their account.

- user_music_cookies table (per user + platform, dropped with the user).
- NeteaseProvider.pollQrLogin returns the cookie without storing it, so
  a personal login can never replace the bot's shared account;
  checkQrCodeStatus is now built on it. withCookie gives a view bound to
  another account.
- /api/me/music/netease: status / qrcode / qrcode/status / unlink, acting
  only on req.user. The cookie never leaves the server.
- POST /api/player/:botId/fm uses the caller's linked account for
  NetEase. Songs still resolve through the shared provider when played.

TeamSpeak chat !fm keeps using the shared account: chat users are not
tied to web accounts.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

src/web/api/personal-music.test.ts

@@ -0,0 +1,125 @@
+import { describe, it, expect, vi } from "vitest";
+import express from "express";
+import request from "supertest";
+import pino from "pino";
+import { createDatabase } from "../../data/database.js";
+import { createPersonalMusicRouter } from "./personal-music.js";
+import { createPlayerRouter } from "./player.js";
+
+function mount() {
+  const db = createDatabase(":memory:");
+  db.db
+    .prepare("INSERT INTO users (id, username, passwordHash, createdAt, updatedAt, role) VALUES (?,?,?,?,?,?)")
+    .run("u1", "alice", "x", 0, 0, "member");
+  const personalView = {
+    getAuthStatus: vi.fn(async () => ({ loggedIn: true, nickname: "Alice163" })),
+  };
+  const provider: any = {
+    platform: "netease",
+    getQrCode: vi.fn(async () => ({ qrUrl: "u", qrImg: "data:img", key: "k1" })),
+    pollQrLogin: vi.fn(async () => ({ status: "waiting" })),
+    withCookie: vi.fn(() => personalView),
+    setCookie: vi.fn(),
+  };
+  const app = express();
+  app.use(express.json());
+  app.use((req, _res, next) => {
+    (req as any).user = { id: "u1", username: "alice", role: "member" };
+    next();
+  });
+  app.use("/api/me/music", createPersonalMusicRouter(db, provider, pino({ level: "silent" })));
+  return { app, db, provider, personalView };
+}
+
+describe("personal music account router (#164)", () => {
+  it("reports not linked until the user logs in", async () => {
+    const { app } = mount();
+    const res = await request(app).get("/api/me/music/netease/status");
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({ linked: false, loggedIn: false });
+  });
+
+  it("creates a QR code", async () => {
+    const { app } = mount();
+    const res = await request(app).post("/api/me/music/netease/qrcode");
+    expect(res.body).toEqual({ qrUrl: "u", qrImg: "data:img", key: "k1" });
+  });
+
+  it("stores the cookie for this user on confirm, never on the shared provider, and never returns it", async () => {
+    const { app, db, provider } = mount();
+    provider.pollQrLogin.mockResolvedValue({ status: "confirmed", cookie: "MUSIC_U=alice" });
+    const res = await request(app).get("/api/me/music/netease/qrcode/status").query({ key: "k1" });
+    expect(res.body).toEqual({ status: "confirmed" });
+    expect(JSON.stringify(res.body)).not.toContain("MUSIC_U");
+    expect(db.getUserMusicCookie("u1", "netease")).toBe("MUSIC_U=alice");
+    expect(provider.setCookie).not.toHaveBeenCalled();
+  });
+
+  it("requires a key to poll", async () => {
+    const { app } = mount();
+    expect((await request(app).get("/api/me/music/netease/qrcode/status")).status).toBe(400);
+  });
+
+  it("reports the linked account's nickname via a view on the user's cookie", async () => {
+    const { app, db, provider } = mount();
+    db.setUserMusicCookie("u1", "netease", "MUSIC_U=alice");
+    const res = await request(app).get("/api/me/music/netease/status");
+    expect(res.body).toEqual({ linked: true, loggedIn: true, nickname: "Alice163" });
+    expect(provider.withCookie).toHaveBeenCalledWith("MUSIC_U=alice");
+  });
+
+  it("unlinks", async () => {
+    const { app, db } = mount();
+    db.setUserMusicCookie("u1", "netease", "MUSIC_U=alice");
+    expect((await request(app).delete("/api/me/music/netease")).status).toBe(200);
+    expect(db.getUserMusicCookie("u1", "netease")).toBeNull();
+  });
+});
+
+describe("web FM uses the caller's linked NetEase account (#164)", () => {
+  async function startFm(opts: { linked: boolean; role?: string; platform?: string }) {
+    const db = createDatabase(":memory:");
+    db.db
+      .prepare("INSERT INTO users (id, username, passwordHash, createdAt, updatedAt, role) VALUES (?,?,?,?,?,?)")
+      .run("u1", "alice", "x", 0, 0, "member");
+    if (opts.linked) db.setUserMusicCookie("u1", "netease", "MUSIC_U=alice");
+    const personal = { platform: "netease", personal: true };
+    const shared: any = { platform: "netease", pollQrLogin: vi.fn(), withCookie: vi.fn(() => personal) };
+    const qq: any = { platform: "qq" };
+    const bot = {
+      id: "b1",
+      getProviderFor: (p: string) => (p === "qq" ? qq : shared),
+      startFm: vi.fn(async (_provider: unknown) => "Personal FM started"),
+    };
+    const botManager: any = { getBot: () => bot };
+    const app = express();
+    app.use(express.json());
+    app.use((req, _res, next) => {
+      (req as any).user = {
+        id: "u1", username: "alice", role: opts.role ?? "member",
+        capabilities: new Set(["player.control"]), bots: "all", guest: { playMode: true },
+      };
+      next();
+    });
+    app.use("/api/player", createPlayerRouter(botManager, pino({ level: "silent" }), db));
+    const res = await request(app).post("/api/player/b1/fm").send({ platform: opts.platform ?? "netease" });
+    return { res, bot, shared, personal, qq };
+  }
+
+  it("starts FM on the user's own account when linked", async () => {
+    const { res, bot, shared, personal } = await startFm({ linked: true });
+    expect(res.status).toBe(200);
+    expect(shared.withCookie).toHaveBeenCalledWith("MUSIC_U=alice");
+    expect(bot.startFm.mock.calls[0][0]).toBe(personal);
+  });
+
+  it("falls back to the shared account when the user has not linked one", async () => {
+    const { bot, shared } = await startFm({ linked: false });
+    expect(bot.startFm.mock.calls[0][0]).toBe(shared);
+  });
+
+  it("leaves other platforms alone", async () => {
+    const { bot, qq } = await startFm({ linked: true, platform: "qq" });
+    expect(bot.startFm.mock.calls[0][0]).toBe(qq);
+  });
+});

src/web/api/personal-music.ts

@@ -0,0 +1,95 @@
+import { Router } from "express";
+import type { BotDatabase } from "../../data/database.js";
+import type { MusicProvider, QrCodeResult } from "../../music/provider.js";
+import type { Logger } from "../../logger.js";
+
+/**
+ * A provider that can log a web user into their OWN account without touching
+ * the bot's shared login, and hand out a view bound to that account (#164).
+ */
+export interface PersonalLoginProvider {
+  getQrCode(): Promise<QrCodeResult>;
+  pollQrLogin(key: string): Promise<{ status: "waiting" | "scanned" | "confirmed" | "expired"; cookie?: string }>;
+  withCookie(cookie: string): MusicProvider;
+}
+
+export function supportsPersonalLogin(
+  provider: MusicProvider | undefined,
+): provider is MusicProvider & PersonalLoginProvider {
+  const p = provider as Partial<PersonalLoginProvider> | undefined;
+  return typeof p?.pollQrLogin === "function" && typeof p.withCookie === "function";
+}
+
+/**
+ * The caller's own NetEase account, used for their personal FM instead of the
+ * bot's shared login (#164). Every route acts on req.user only; the cookie is
+ * stored server-side and never sent back to the browser.
+ */
+export function createPersonalMusicRouter(
+  database: BotDatabase,
+  neteaseProvider: MusicProvider,
+  logger: Logger,
+): Router {
+  const router = Router();
+  const platform = "netease";
+
+  router.use((_req, res, next) => {
+    if (!supportsPersonalLogin(neteaseProvider)) {
+      res.status(501).json({ error: "Personal login not supported" });
+      return;
+    }
+    next();
+  });
+  const provider = neteaseProvider as MusicProvider & PersonalLoginProvider;
+
+  router.get("/netease/status", async (req, res) => {
+    const cookie = database.getUserMusicCookie(req.user!.id, platform);
+    if (!cookie) {
+      res.json({ linked: false, loggedIn: false });
+      return;
+    }
+    try {
+      const status = await provider.withCookie(cookie).getAuthStatus();
+      res.json({ linked: true, ...status });
+    } catch (err) {
+      logger.warn({ err }, "Personal NetEase status check failed");
+      res.json({ linked: true, loggedIn: false });
+    }
+  });
+
+  router.post("/netease/qrcode", async (_req, res) => {
+    try {
+      res.json(await provider.getQrCode());
+    } catch (err) {
+      logger.error({ err }, "Personal NetEase QR generation failed");
+      res.status(500).json({ error: (err as Error).message });
+    }
+  });
+
+  router.get("/netease/qrcode/status", async (req, res) => {
+    const key = req.query.key;
+    if (typeof key !== "string" || !key) {
+      res.status(400).json({ error: "key is required" });
+      return;
+    }
+    try {
+      const { status, cookie } = await provider.pollQrLogin(key);
+      if (status === "confirmed" && cookie) {
+        database.setUserMusicCookie(req.user!.id, platform, cookie);
+        logger.info({ userId: req.user!.id, platform }, "Personal music account linked");
+      }
+      res.json({ status });
+    } catch (err) {
+      logger.error({ err }, "Personal NetEase QR status check failed");
+      res.status(500).json({ error: (err as Error).message });
+    }
+  });
+
+  router.delete("/netease", (req, res) => {
+    database.deleteUserMusicCookie(req.user!.id, platform);
+    logger.info({ userId: req.user!.id, platform }, "Personal music account unlinked");
+    res.json({ ok: true });
+  });
+
+  return router;
+}

src/web/api/player.ts

@@ -6,6 +6,7 @@ import type { Logger } from "../../logger.js";
 import { parseCommand } from "../../bot/commands.js";
 import { requireBotAccess } from "../middleware/requirePermission.js";
 import { authorize } from "../middleware/authorize.js";
+import { supportsPersonalLogin } from "./personal-music.js";
 
 export function createPlayerRouter(
   botManager: BotManager,
@@ -124,11 +125,19 @@ export function createPlayerRouter(
         rejectDisabledLocalAudio(res);
         return;
       }
-      const provider = bot.getProviderFor(
+      let provider = bot.getProviderFor(
         platform === "bilibili" || platform === "qq" || platform === "youtube" || platform === "local" || platform === "kugou" || platform === "jellyfin"
           ? platform
           : "netease"
       );
+      // A signed-in user who linked their own NetEase account gets FM from
+      // THEIR taste, not the bot's shared login (#164). Songs still resolve
+      // through the shared provider when played.
+      const user = (req as any).user;
+      if (provider.platform === "netease" && user && user.role !== "guest" && database) {
+        const cookie = database.getUserMusicCookie(user.id, "netease");
+        if (cookie && supportsPersonalLogin(provider)) provider = provider.withCookie(cookie);
+      }
       const message = await bot.startFm(provider, requesterName(req));
       res.json({
         ok:

src/web/server.ts

@@ -19,6 +19,7 @@ import { createUsersRouter } from "./api/users.js";
 import { createAuditStore } from "../data/audit.js";
 import { createAuditRouter } from "./api/audit.js";
 import { createFavoritesRouter } from "./api/favorites.js";
+import { createPersonalMusicRouter } from "./api/personal-music.js";
 import { createSavedQueuesRouter } from "./api/saved-queues.js";
 import { createSpotifyRouter } from "./api/spotify.js";
 import type { SpotifyOAuth } from "../music/spotify/spotify-oauth.js";
@@ -203,6 +204,13 @@ export function createWebServer(options: WebServerOptions): WebServer {
     );
   }
   app.use("/api/favorites", requireNotGuest, createFavoritesRouter(options.database, logger));
+  // The caller's own NetEase login for their personal FM (#164). Guests share
+  // one anonymous identity, so they cannot link an account.
+  app.use(
+    "/api/me/music",
+    requireNotGuest,
+    createPersonalMusicRouter(options.database, options.neteaseProvider, logger),
+  );
   // Saved queues (Feature 1, #119). Members + admins only (requireNotGuest);
   // the router itself 403s every route unless savedQueuesEnabled is on.
   app.use(