fix(bot): expand SoundCloud short links before discord-player resolution

packages/bot/src/functions/music/commands/play/handlers/playHandler.ts

@@ -17,6 +17,7 @@ import {
     isUnknownInteractionError,
     resolveSearchEngine,
     normalizeSoundCloudUrl,
+    expandSoundCloudShortUrl,
 } from '../queryUtils'
 import {
     resolveQueryWithFallbacks,
@@ -55,7 +56,10 @@ export async function executePlayHandler({
     }
 
     const rawQuery = interaction.options.getString('query', true)
-    const query = normalizeSoundCloudUrl(rawQuery)
+    // Expand SoundCloud short links first (on.soundcloud.com → full URL)
+    const expandedQuery = await expandSoundCloudShortUrl(rawQuery)
+    // Then normalize (strip ?in= params)
+    const query = normalizeSoundCloudUrl(expandedQuery)
     const provider = interaction.options.getString('provider')
     const collaborativeCheck = collaborativePlaylistService.canAddTracks(
         interaction.guildId,

packages/bot/src/functions/music/commands/play/queryUtils.spec.ts

@@ -54,7 +54,24 @@ jest.mock('@lucky/shared/utils', () => ({
     warnLog: (...args: unknown[]) => warnLogMock(...args),
 }))
 
-import { normalizeSoundCloudUrl, isUrl, executePlayAtTop } from './queryUtils'
+// Global fetch mock before any imports
+const fetchMock = jest.fn() as jest.Mock
+
+// Mock global.fetch before importing modules that use it
+Object.defineProperty(global, 'fetch', {
+    writable: true,
+    value: fetchMock,
+})
+
+// Don't mock withTimeout - let it work with the real implementation
+// which will properly await and resolve promises
+
+import {
+    normalizeSoundCloudUrl,
+    isUrl,
+    executePlayAtTop,
+    expandSoundCloudShortUrl,
+} from './queryUtils'
 
 describe('normalizeSoundCloudUrl', () => {
     it('strips ?in= playlist context from SoundCloud track URLs', () => {
@@ -114,6 +131,84 @@ describe('isUrl', () => {
     })
 })
 
+describe('expandSoundCloudShortUrl', () => {
+    beforeEach(() => {
+        fetchMock.mockReset()
+        debugLogMock.mockReset()
+    })
+
+    it('expands on.soundcloud.com short links to full soundcloud.com URLs', async () => {
+        const shortUrl = 'https://on.soundcloud.com/abc123'
+        const fullUrl = 'https://soundcloud.com/artist/track'
+
+        fetchMock.mockResolvedValueOnce({
+            url: fullUrl,
+        })
+
+        const result = await expandSoundCloudShortUrl(shortUrl)
+
+        expect(result).toBe(fullUrl)
+        expect(fetchMock).toHaveBeenCalledWith(shortUrl, {
+            method: 'HEAD',
+            redirect: 'follow',
+        })
+    })
+
+    it('returns original URL if not a short link', async () => {
+        const fullUrl = 'https://soundcloud.com/artist/track'
+        const result = await expandSoundCloudShortUrl(fullUrl)
+        expect(result).toBe(fullUrl)
+        expect(fetchMock).not.toHaveBeenCalled()
+    })
+
+    it('returns original URL if redirect goes to non-soundcloud domain', async () => {
+        const shortUrl = 'https://on.soundcloud.com/abc123'
+        const suspiciousUrl = 'https://attacker.com/malware'
+
+        fetchMock.mockResolvedValueOnce({
+            url: suspiciousUrl,
+        })
+
+        const result = await expandSoundCloudShortUrl(shortUrl)
+
+        expect(result).toBe(shortUrl)
+        expect(debugLogMock).toHaveBeenCalledWith(
+            expect.objectContaining({
+                message:
+                    'SoundCloud short URL expansion failed, using original URL',
+            }),
+        )
+    })
+
+    it('handles malformed on.soundcloud.com URLs gracefully', async () => {
+        const malformed = 'on.soundcloud.com/abc123' // No protocol
+
+        const result = await expandSoundCloudShortUrl(malformed)
+
+        expect(result).toBe(malformed)
+        expect(fetchMock).not.toHaveBeenCalled()
+    })
+
+    it('rejects domain-suffix bypass attempts (soundcloud.com.attacker.com)', async () => {
+        const shortUrl = 'https://on.soundcloud.com/abc123'
+        const bypassUrl = 'https://soundcloud.com.attacker.com/x'
+
+        fetchMock.mockResolvedValueOnce({
+            url: bypassUrl,
+        })
+
+        const result = await expandSoundCloudShortUrl(shortUrl)
+
+        expect(result).toBe(shortUrl)
+        expect(debugLogMock).toHaveBeenCalledWith(
+            expect.objectContaining({
+                message:
+                    'SoundCloud short URL expansion failed, using original URL',
+            }),
+        )
+    })
+})
+
 describe('executePlayAtTop — fallback chain', () => {
     const fakeTrack = { id: 'track-1', title: 'Test Song', author: 'Artist' }
     const fakeQueue = {

packages/bot/src/functions/music/commands/play/queryUtils.ts

@@ -15,6 +15,7 @@
 import { interactionReply } from '../../../../utils/general/interactionReply'
 import { createUserFriendlyError } from '@lucky/shared/utils/general/errorSanitizer'
 import { errorLog, debugLog, warnLog } from '@lucky/shared/utils'
+import { withTimeout } from '@lucky/shared/utils/async'
 
 export const DISCORD_UNKNOWN_INTERACTION_CODE = 10062
 
@@ -31,6 +32,82 @@
     return query.startsWith('http://') || query.startsWith('https://')
 }
 
+/**
+ * Expands SoundCloud short links (on.soundcloud.com) by following the HTTP redirect.
+ * Returns the expanded URL if successful, or the original URL if expansion fails.
+ * Uses a 5-second timeout to prevent hanging requests.
+ *
+ * Security: only expands on.soundcloud.com hosts and validates the resolved URL
+ * is a soundcloud.com domain before returning it.
+ */
+export async function expandSoundCloudShortUrl(url: string): Promise<string> {
+    // Fast path: not a short link
+    if (!url.includes('on.soundcloud.com')) {
+        return url
+    }
+
+    try {
+        const parsed = new URL(url)
+        if (parsed.hostname !== 'on.soundcloud.com') {
+            return url
+        }
+
+        // Follow redirects with a 5-second timeout, using HEAD first (no body download)
+        const expanded = await withTimeout(
+            (async () => {
+                try {
+                    const response = await (global.fetch as typeof fetch)(url, {
+                        method: 'HEAD',
+                        redirect: 'follow',
+                    })
+                    const finalUrl = response.url
+
+                    // Security check: ensure resolved URL is a soundcloud domain
+                    const finalParsed = new URL(finalUrl)
+                    if (
+                        finalParsed.hostname !== 'soundcloud.com' &&
+                        !finalParsed.hostname?.endsWith('.soundcloud.com')
+                    ) {
+                        // Redirect went somewhere unexpected — reject and fall back
+                        throw new Error(
+                            `Redirect destination is not a soundcloud.com domain: ${finalUrl}`,
+                        )
+                    }
+
+                    debugLog({
+                        message: 'SoundCloud short URL expanded',
+                        data: { originalUrl: url, expandedUrl: finalUrl },
+                    })
+
+                    return finalUrl
+                } catch (innerError) {
+                    debugLog({
+                        message:
+                            'Failed to expand SoundCloud short URL in fetch block',
+                        data: { url, error: String(innerError) },
+                    })
+                    throw innerError
+                }
+            })(),
+            5000,
+            'soundcloud-short-url-expansion',
+        )
+
+        return expanded
+    } catch (error) {
+        // Network error, timeout, or security validation failed — gracefully fall back
+        debugLog({
+            message:
+                'SoundCloud short URL expansion failed, using original URL',
+            data: {
+                originalUrl: url,
+                error: String(error),
+            },
+        })
+        return url
+    }
+}
+
 /**
  * Strips SoundCloud playlist-context query params (`?in=...`) that the
  * SoundCloud extractor cannot resolve. The bare track URL resolves correctly.