fix(bot): expand SoundCloud short links before discord-player resolution

[LucasSantana-Dev]

Closes #1162 · Resolves Sentry LUCKY-3R

on.soundcloud.com short links were passed straight to discord-player, which can't resolve them → NoResultError. Now expanded via HEAD redirect-follow before resolution.

Security: only on.soundcloud.com inputs are expanded; the resolved host must be soundcloud.com or *.soundcloud.com (exact/suffix match — rejects soundcloud.com.attacker.com). 5s timeout; graceful fallback to original URL on any failure.

• 2500 bot tests green (incl. happy path, malicious-redirect, domain-suffix bypass, timeout)
• tsc clean

---

Summary by cubic

Fixes failures when users paste SoundCloud short links by expanding on.soundcloud.com URLs before resolution. Prevents NoResultError in discord-player and blocks unsafe redirects.

• Bug Fixes
  • Expand only on.soundcloud.com via HEAD + redirect follow with withTimeout (5s), then normalize.
  • Validate resolved host equals soundcloud.com or ends with .soundcloud.com; reject suffix lookalikes.
  • Fall back to the original URL on timeout, network errors, or invalid/malicious redirects.
  • Tests cover happy path, non-short-link, malformed URL, malicious redirect, and domain-suffix bypass.

^{Written for commit cc74a7d. Summary will update on new commits.}

Summary by CodeRabbit

New Features

• Added support for SoundCloud short links in the music player, automatically expanding them to full URLs for improved usability.

Tests

• Added comprehensive test coverage for SoundCloud short link expansion and URL normalization, including edge cases and security validation.

[LucasSantana-Dev]

@cubic-dev-ai review

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
lucky	Ready	Preview, Comment	Jun 5, 2026 11:08am

[cubic-dev-ai]

@cubic-dev-ai review

@LucasSantana-Dev I have started the AI code review. It will take a few minutes to complete.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR adds SoundCloud short-link expansion to the /play command. A new utility function detects on.soundcloud.com short URLs, follows HTTP redirects with a 5-second timeout, validates the target is a SoundCloud domain, and returns either the expanded URL or the original as a safe fallback. The handler integrates this expansion into query preprocessing before URL normalization and search resolution.

Changes

SoundCloud Short-URL Expansion in Play Command

Layer / File(s)	Summary
SoundCloud short-URL expansion utility packages/bot/src/functions/music/commands/play/queryUtils.ts	expandSoundCloudShortUrl detects short links on on.soundcloud.com, follows redirects via HEAD request under 5-second timeout, validates the resolved hostname belongs to SoundCloud or its subdomains, logs debug events for success and failure paths, and falls back to returning the original URL on network errors, timeouts, or validation failures.
Short-URL expansion test suite packages/bot/src/functions/music/commands/play/queryUtils.spec.ts	Global fetch mock is configured before importing queryUtils, and a new describe block adds mock reset in beforeEach plus async test cases for: short-link expansion via HEAD request, passthrough of non-short links, safe rejection of non-SoundCloud redirects (including domain-suffix bypass attempts), and graceful handling of malformed URLs.
Play handler integration packages/bot/src/functions/music/commands/play/handlers/playHandler.ts	Play handler query preprocessing now calls expandSoundCloudShortUrl asynchronously before URL normalization, passing the expanded URL into downstream search resolution and error logging.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• LucasSantana-Dev/Lucky#540: Adds SoundCloud URL normalization (?in= parameter stripping) to query preprocessing, complementary to this PR's short-link expansion step.
• LucasSantana-Dev/Lucky#522: Integrates provider-aware search engine resolution into the /play query flow, part of the same query preprocessing pipeline that now includes short-link expansion.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix(bot): expand SoundCloud short links before discord-player resolution' clearly and specifically describes the main change—expanding SoundCloud short links before discord-player resolution, matching the primary objective of the pull request.
Linked Issues check	✅ Passed	The implementation expands SoundCloud short links (on.soundcloud.com) via HEAD request with 5s timeout, validates the resolved domain is soundcloud.com or subdomain, and integrates this before discord-player resolution, addressing all coding requirements from issue #1162.
Out of Scope Changes check	✅ Passed	All changes focus on expanding SoundCloud short links and integrating this into the play handler, with comprehensive tests for the new function covering happy path, malicious redirects, and malformed inputs—all directly aligned with issue #1162 objectives.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/soundcloud-shortlink-expansion

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[greptile-apps]

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

[github-actions]

Failed to generate code suggestions for PR

[cubic-dev-ai]

3 issues found across 3 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

No issues found across 3 files

<sub>Auto-approved: The PR adds a focused, well-tested expansion of SoundCloud short links with proper security validation and graceful fallback, and any failure simply returns the original URL without impacting other functionality.

Re-trigger cubic</sub>

[LucasSantana-Dev]

@cubic-dev-ai review

[cubic-dev-ai]

@cubic-dev-ai review

@LucasSantana-Dev I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 3 files

<sub>Auto-approved: This change adds a sound, well-tested expansion of SoundCloud short links with a 5-second timeout and domain validation, and gracefully falls back to the original URL on any failure, so even a bug would not break existing functionality.

Re-trigger cubic</sub>

[greptile-apps]

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

[greptile-apps]

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

[greptile-apps]

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

packages/bot/src/functions/music/commands/play/handlers/playHandler.ts (1)

58-68: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Run the contribution-limit gate before expanding short links.

Lines 58-68 now do external I/O before collaborativePlaylistService.canAddTracks(...) can reject the request. That turns an otherwise fast failure into up to 5 seconds of avoidable latency and extra outbound traffic for already-blocked users. Move the collaborative limit check ahead of expandSoundCloudShortUrl().

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/bot/src/functions/music/commands/play/handlers/playHandler.ts`
around lines 58 - 68, Move the collaborative playlist gate so it runs before any
external I/O: call and await
collaborativePlaylistService.canAddTracks(interaction.guildId,
interaction.user.id, 1) immediately after getting rawQuery (and after any
non-blocking local setup), and if it rejects/returns a blocking response, return
early; only after the check complete should you call
expandSoundCloudShortUrl(rawQuery) and then
normalizeSoundCloudUrl(expandedQuery). Keep the same call signatures
(expandSoundCloudShortUrl, normalizeSoundCloudUrl,
collaborativePlaylistService.canAddTracks) and preserve provider =
interaction.options.getString('provider') placement as needed.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/bot/src/functions/music/commands/play/queryUtils.ts`:
- Around line 59-76: The current fetch uses redirect: 'follow' and only
validates response.url after following hops and doesn’t cancel timed-out
requests; change the logic in the code that calls global.fetch (the block that
fetches url and reads response.url/finalUrl and uses withTimeout) to: perform
manual redirect handling by issuing fetch requests with redirect: 'manual' and
for each 3xx response read the Location header, parse its hostname (validate
hostname === 'soundcloud.com' || hostname.endsWith('.soundcloud.com')) before
following to the next URL, and only follow when valid; also create an
AbortController for each fetch and wire its signal into fetch and into your
timeout so that when the 5s withTimeout expires it calls controller.abort() to
actually cancel the in-flight request. Ensure you update references to response,
finalUrl and finalParsed accordingly and throw the same error when a redirect
target is not an allowed SoundCloud domain.
- Around line 56-63: The HEAD fetch in expandSoundCloudShortUrl is only raced by
withTimeout and can continue running after timeout; modify
expandSoundCloudShortUrl to create/obtain an AbortSignal (e.g., use
AbortSignal.timeout(5000) or create an AbortController and call
controller.signal) and pass that signal into the fetch call (the fetch(...)
inside withTimeout). Ensure the same signal is used for the HEAD request and
that you abort/cancel it on timeout so the underlying fetch is actually
terminated rather than left running.

---

Outside diff comments:
In `@packages/bot/src/functions/music/commands/play/handlers/playHandler.ts`:
- Around line 58-68: Move the collaborative playlist gate so it runs before any
external I/O: call and await
collaborativePlaylistService.canAddTracks(interaction.guildId,
interaction.user.id, 1) immediately after getting rawQuery (and after any
non-blocking local setup), and if it rejects/returns a blocking response, return
early; only after the check complete should you call
expandSoundCloudShortUrl(rawQuery) and then
normalizeSoundCloudUrl(expandedQuery). Keep the same call signatures
(expandSoundCloudShortUrl, normalizeSoundCloudUrl,
collaborativePlaylistService.canAddTracks) and preserve provider =
interaction.options.getString('provider') placement as needed.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c8208306-4acb-4e3e-88a8-a687fd5278bb

📥 Commits

Reviewing files that changed from the base of the PR and between 1c46b55 and cc74a7d.

📒 Files selected for processing (3)

• packages/bot/src/functions/music/commands/play/handlers/playHandler.ts
• packages/bot/src/functions/music/commands/play/queryUtils.spec.ts
• packages/bot/src/functions/music/commands/play/queryUtils.ts

📜 Review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (11)

• GitHub Check: Test — backend
• GitHub Check: Checks
• GitHub Check: Test — bot
• GitHub Check: Test — frontend
• GitHub Check: quality / Lint (lint)
• GitHub Check: quality / Dead code (knip)
• GitHub Check: quality / SAST (CodeQL) (javascript-typescript)
• GitHub Check: Build — frontend
• GitHub Check: Build — backend
• GitHub Check: Build — bot
• GitHub Check: Security

🔇 Additional comments (1)

packages/bot/src/functions/music/commands/play/queryUtils.spec.ts (1)

57-74: LGTM!

Also applies to: 134-210