From 22060d1d359bcdc7d4b1b730e7d41ee97b2d4c4d Mon Sep 17 00:00:00 2001
From: vicrodh <103399283+vicrodh@users.noreply.github.com>
Date: Mon, 23 Feb 2026 15:18:52 -0600
Subject: [PATCH] fix(oauth): correct parameter names (code_autorisation, not
 code)

Qobuz redirects to play.qobuz.com/discover?code_autorisation=XXX
not ?code=XXX. Both the navigation intercept and the /oauth/callback
API call were using the wrong parameter name, so the code was never
captured and the exchange request was malformed.
---
 crates/qbz-qobuz/src/client.rs | 2 +-
 src-tauri/src/api/client.rs    | 2 +-
 src-tauri/src/commands_v2.rs   | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/crates/qbz-qobuz/src/client.rs b/crates/qbz-qobuz/src/client.rs
index 9369497b3..e14dac2f9 100644
--- a/crates/qbz-qobuz/src/client.rs
+++ b/crates/qbz-qobuz/src/client.rs
@@ -210,7 +210,7 @@ impl QobuzClient {
             .http
             .get(&callback_url)
             .headers(headers)
-            .query(&[("code", code), ("private_key", &private_key)])
+            .query(&[("code_autorisation", code), ("private_key", &private_key)])
             .send()
             .await?;
 
diff --git a/src-tauri/src/api/client.rs b/src-tauri/src/api/client.rs
index 900324aab..6a5a34d7d 100644
--- a/src-tauri/src/api/client.rs
+++ b/src-tauri/src/api/client.rs
@@ -211,7 +211,7 @@ impl QobuzClient {
             .http
             .get(&callback_url)
             .headers(headers)
-            .query(&[("code", code), ("private_key", &private_key)])
+            .query(&[("code_autorisation", code), ("private_key", &private_key)])
             .send()
             .await?;
 
diff --git a/src-tauri/src/commands_v2.rs b/src-tauri/src/commands_v2.rs
index 981371150..1461c30db 100644
--- a/src-tauri/src/commands_v2.rs
+++ b/src-tauri/src/commands_v2.rs
@@ -1078,10 +1078,10 @@ pub async fn v2_start_oauth_login(
     .resizable(true)
     .on_navigation(move |url| {
         log::info!("[OAuth] on_navigation: {}", url);
-        // Intercept redirect to play.qobuz.com/discover?code=...
+        // Intercept redirect to play.qobuz.com/discover?code_autorisation=...
         if url.host_str() == Some("play.qobuz.com") {
             for (key, value) in url.query_pairs() {
-                if key == "code" {
+                if key == "code_autorisation" || key == "code" {
                     let mut holder = code_holder_nav.lock().unwrap();
                     // Only act on the first code (idempotent)
                     if holder.is_none() {