LucasSantana-Dev · Mar 10, 2026 · Mar 10, 2026 · Mar 10, 2026 · coderabbitai · Mar 10, 2026
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
@@ -36,13 +36,17 @@ jobs:
               run: npm run build:shared
 
             - name: Run backend tests with coverage
-              run: npm run test:ci
+              run: npm run test --workspace=packages/backend -- --ci --coverage
               continue-on-error: true
 
             - name: Run bot tests with coverage
               run: npm run test --workspace=packages/bot -- --ci --coverage
               continue-on-error: true
 
+            - name: Run frontend tests with coverage (lcov)
+              run: npm run test --workspace=packages/frontend -- --coverage --coverage.reporter=lcov --coverage.reporter=text
+              continue-on-error: true
+
             - name: SonarCloud Scan
               uses: SonarSource/sonarqube-scan-action@v6
               env:

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -38,6 +38,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Frontend theming now maps legacy `lucky-*` classes to the Lucky purple/gold palette
 - Frontend typography now uses Lucky type tokens (`Sora`, `Manrope`, `JetBrains Mono`) instead of the old default stack
 - Vercel build now generates Prisma client before shared/frontend builds to prevent missing generated client errors
+- Autoplay no longer keeps cycling the same recommendations; queue top-up now uses anti-repeat filtering and keeps a 4-track buffer
+- Shuffle now works reliably while autoplay is enabled because autoplay maintains enough upcoming tracks
+- Web music repeat mode now supports `autoplay` end-to-end (bot mapper, backend validation, shared/frontend types)
+- OAuth callback now reuses the same redirect URI across auth start/callback token exchange, with forwarded-host fallback for proxied HTTPS deployments
+- E2E stability improvements: dashboard/servers/track-history tests now use deterministic locators and route-delay handling
 
 ### Changed
 

diff --git a/README.md b/README.md
@@ -52,6 +52,7 @@ packages/
 ### Bot
 - Multi-platform music (YouTube, Spotify) with queue, shuffle, repeat, lyrics, autoplay
 - Dynamic Discord presence rotation with live guild/member/session stats and command CTA
+- Autoplay recommendations use anti-repeat filtering with queue buffering so shuffle stays useful during autoplay
 - Now-playing card updates in place to avoid channel spam on track changes
 - Video/audio downloads with format selection and progress tracking
 - Moderation: warn, mute, kick, ban with case tracking
@@ -135,6 +136,8 @@ Without `VITE_API_BASE_URL`, frontend now auto-targets `lucky-api.lucassantana.t
 When `WEBAPP_FRONTEND_URL` includes multiple origins, use comma-separated values
 (example: `https://lucky.lucassantana.tech,https://lukbot.vercel.app`); backend CORS
 accepts all configured entries while OAuth/Last.fm redirects use the first origin.
+Set `WEBAPP_REDIRECT_URI` to the exact Discord OAuth callback URL registered in the
+Discord Developer Portal (example: `https://lucky.lucassantana.tech/api/auth/callback`).
 
 ## Environment Variables
 
@@ -148,6 +151,7 @@ See `.env.example` for all available options. Key variables:
 | `REDIS_HOST` | No | Redis host (default: localhost) |
 | `WEBAPP_ENABLED` | No | Enable web dashboard (default: false) |
 | `WEBAPP_SESSION_SECRET` | No | Session encryption key |
+| `WEBAPP_REDIRECT_URI` | No | Explicit Discord OAuth callback URL (must match Discord app settings) |
 | `CLIENT_SECRET` | No | Discord OAuth secret (for dashboard) |
 | `SENTRY_DSN` | No | Error tracking |
 

diff --git a/package-lock.json b/package-lock.json
diff --git a/packages/backend/src/routes/auth.ts b/packages/backend/src/routes/auth.ts
@@ -7,6 +7,7 @@ import { AppError } from '../errors/AppError'
 import { authLimiter } from '../middleware/rateLimit'
 import { handleOAuthCallback } from './authCallback'
 import { getPrimaryFrontendUrl } from '../utils/frontendOrigin'
+import { getOAuthRedirectUri } from '../utils/oauthRedirectUri'
 
 const getFrontendUrl = (): string => {
     return getPrimaryFrontendUrl()
@@ -19,6 +20,7 @@ export function setupAuthRoutes(app: Express): void {
         async (req: Request, res: Response) => {
             try {
                 req.session.oauthInitiated = true
+                req.session.oauthRedirectUri = getOAuthRedirectUri(req)
 
                 await new Promise<void>((resolve) => {
                     req.session.save((err) => {
@@ -38,9 +40,7 @@ export function setupAuthRoutes(app: Express): void {
                 })
 
                 const clientId = process.env.CLIENT_ID
-                const redirectUri =
-                    process.env.WEBAPP_REDIRECT_URI ??
-                    `http://localhost:${process.env.WEBAPP_PORT ?? '3000'}/api/auth/callback`
+                const redirectUri = req.session.oauthRedirectUri
                 const scope = 'identify guilds'
 
                 if (!clientId) {

diff --git a/packages/backend/src/routes/authCallback.ts b/packages/backend/src/routes/authCallback.ts
@@ -3,6 +3,7 @@ import { debugLog, errorLog } from '@lucky/shared/utils'
 import { discordOAuthService } from '../services/DiscordOAuthService'
 import { sessionService } from '../services/SessionService'
 import { getPrimaryFrontendUrl } from '../utils/frontendOrigin'
+import { getOAuthRedirectUri } from '../utils/oauthRedirectUri'
 
 export async function handleOAuthCallback(
     req: Request,
@@ -30,7 +31,14 @@ export async function handleOAuthCallback(
             data: { code: code.substring(0, 10) },
         })
 
-        const tokenData = await discordOAuthService.exchangeCodeForToken(code)
+        const redirectUri = getOAuthRedirectUri(
+            req,
+            req.session.oauthRedirectUri,
+        )
+        const tokenData = await discordOAuthService.exchangeCodeForToken(
+            code,
+            redirectUri,
+        )
         const userInfo = await discordOAuthService.getUserInfo(
             tokenData.access_token,
         )

diff --git a/packages/backend/src/routes/music/playbackRoutes.ts b/packages/backend/src/routes/music/playbackRoutes.ts
@@ -112,8 +112,10 @@ export function setupPlaybackRoutes(app: Express): void {
         asyncHandler(async (req: AuthenticatedRequest, res: Response) => {
             const guildId = param(req.params.guildId)
             const { mode } = req.body
-            if (!['off', 'track', 'queue'].includes(mode)) {
-                throw AppError.badRequest('Mode must be off, track, or queue')
+            if (!['off', 'track', 'queue', 'autoplay'].includes(mode)) {
+                throw AppError.badRequest(
+                    'Mode must be off, track, queue, or autoplay',
+                )
             }
             res.json(
                 await musicControlService.sendCommand(

diff --git a/packages/backend/src/services/DiscordOAuthService.ts b/packages/backend/src/services/DiscordOAuthService.ts
@@ -52,7 +52,10 @@ class DiscordOAuthService {
         )
     }
 
-    async exchangeCodeForToken(code: string): Promise<TokenResponse> {
+    async exchangeCodeForToken(
+        code: string,
+        redirectUri?: string,
+    ): Promise<TokenResponse> {
         try {
             const response = await fetch(`${this.apiBaseUrl}/oauth2/token`, {
                 method: 'POST',
@@ -64,7 +67,7 @@ class DiscordOAuthService {
                     client_secret: this.getClientSecret(),
                     grant_type: 'authorization_code',
                     code,
-                    redirect_uri: this.getRedirectUri(),
+                    redirect_uri: redirectUri ?? this.getRedirectUri(),
                 }),
             })
 

diff --git a/packages/backend/src/types/session.d.ts b/packages/backend/src/types/session.d.ts
@@ -5,5 +5,6 @@ declare module 'express-session' {
         authenticated?: boolean
         userId?: string
         oauthInitiated?: boolean
+        oauthRedirectUri?: string
     }
 }
diff --git a/packages/backend/src/utils/oauthRedirectUri.ts b/packages/backend/src/utils/oauthRedirectUri.ts
@@ -0,0 +1,34 @@
+import type { Request } from 'express'
+
+const getForwardedHeader = (
+    req: Request,
+    headerName: string,
+): string | undefined => {
+    const value = req.headers[headerName]
+    if (!value) return undefined
+    const raw = Array.isArray(value) ? value[0] : value
+    return raw.split(',')[0].trim() || undefined
+}
+
+const buildRequestRedirectUri = (req: Request): string => {
+    const forwardedProto = getForwardedHeader(req, 'x-forwarded-proto')
+    const forwardedHost = getForwardedHeader(req, 'x-forwarded-host')
+    const protocol = forwardedProto ?? req.protocol ?? 'http'
+    const host =
+        forwardedHost ??
+        req.get('host') ??
+        `localhost:${process.env.WEBAPP_PORT ?? '3000'}`
+
+    return `${protocol}://${host}/api/auth/callback`
+}
+
+export function getOAuthRedirectUri(
+    req: Request,
+    sessionRedirectUri?: string,
+): string {
+    return (
+        sessionRedirectUri ??
+        process.env.WEBAPP_REDIRECT_URI ??
+        buildRequestRedirectUri(req)
+    )
+}
diff --git a/packages/backend/tests/integration/api.test.ts b/packages/backend/tests/integration/api.test.ts
@@ -88,6 +88,7 @@ describe('API Integration Flows', () => {
             )
             expect(mockDiscordOAuth.exchangeCodeForToken).toHaveBeenCalledWith(
                 MOCK_AUTH_CODE,
+                expect.stringContaining('/api/auth/callback'),
             )
             expect(mockDiscordOAuth.getUserInfo).toHaveBeenCalledWith(
                 MOCK_TOKEN_RESPONSE.access_token,