implement native Deezer download/decrypt pipeline

Replace Deezer yt-dlp usage with native ARL session + media.get_url resolution, add BF_CBC_STRIPE decryption in downloader, and wire cipher-aware Deezer downloads through the main rip pipeline. Includes validation hardening and metadata/source-id improvements used by tagging flows.
2026-06-17 15:05:39 +02:00 · 2026-04-21 00:48:07 +02:00
parent 0ba8faa943
commit 26c9d50fac
10 changed files with 569 additions and 260 deletions
--- a/go.mod
+++ b/go.mod
@@ -24,6 +24,7 @@ require (
 	github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b // indirect
 	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	golang.org/x/crypto v0.50.0 // indirect
 	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
 	golang.org/x/sys v0.43.0 // indirect
 	golang.org/x/text v0.36.0 // indirect
--- a/go.sum
+++ b/go.sum
@@ -49,6 +49,8 @@ github.com/vbauerster/mpb/v8 v8.12.0/go.mod h1:V02YIuMVo301Y1VE9VtZlD8s84OMsk+EK
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
+golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
 golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o=
 golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
 golang.org/x/image v0.39.0 h1:skVYidAEVKgn8lZ602XO75asgXBgLj9G/FE3RbuPFww=
--- a/internal/app/app.go
+++ b/internal/app/app.go
@@ -818,9 +818,19 @@ func (m *Main) ripTrack(ctx context.Context, p provider.Client, source, id, fall
 	if opts.total > 0 && (!m.Config.Session.CLI.ProgressBars || !m.Config.Session.CLI.TextOutput || !m.DL.ProgressEnabled()) {
 		m.logf("[%d/%d] %s\n", opts.index, opts.total, filepath.Base(outPath))
 	}
-	if err = m.DL.File(ctx, d.URL, outPath); err != nil {
+	downloadOnce := func() error {
+		if d.Source == "deezer" && strings.EqualFold(strings.TrimSpace(d.Cipher), "BF_CBC_STRIPE") {
+			trackID := d.TrackID
+			if strings.TrimSpace(trackID) == "" {
+				trackID = id
+			}
+			return m.DL.FileDeezerEncrypted(ctx, d.URL, outPath, trackID)
+		}
+		return m.DL.File(ctx, d.URL, outPath)
+	}
+	if err = downloadOnce(); err != nil {
 		m.logf("retry: %s (%v)\n", filepath.Base(outPath), err)
-		if err = m.DL.File(ctx, d.URL, outPath); err != nil {
+		if err = downloadOnce(); err != nil {
 			_ = m.Store.MarkFailed(ctx, source, "track", id)
 			return fmt.Errorf("id=%s title=%q download: %w", id, title, err)
 		}
@@ -1225,10 +1235,20 @@ func buildTagMetadata(trackMeta map[string]any, title, source, trackID string, o
 	}

 	sourceAlbumID := nestedString(trackMeta, "album", "id")
+	if sourceAlbumID == "" {
+		sourceAlbumID = stringFromAny(trackMeta["source_album_id"])
+	}
 	sourceArtistID := nestedString(trackMeta, "artist", "id")
 	if sourceArtistID == "" {
 		sourceArtistID = nestedString(trackMeta, "performer", "id")
 	}
+	if sourceArtistID == "" {
+		sourceArtistID = stringFromAny(trackMeta["source_artist_id"])
+	}
+	sourceTrackID := trackID
+	if v := stringFromAny(trackMeta["source_track_id"]); v != "" {
+		sourceTrackID = v
+	}

 	return tag.Metadata{
 		Title:               title,
@@ -1251,7 +1271,7 @@ func buildTagMetadata(trackMeta map[string]any, title, source, trackID string, o
 		ReplaygainTrackPeak: trackPeak,
 		ReplaygainAlbumPeak: albumPeak,
 		SourcePlatform:      source,
-		SourceTrackID:       trackID,
+		SourceTrackID:       sourceTrackID,
 		SourceAlbumID:       sourceAlbumID,
 		SourceArtistID:      sourceArtistID,
 	}
--- a/internal/download/downloader.go
+++ b/internal/download/downloader.go
@@ -3,12 +3,15 @@ package download
 import (
 	"bufio"
 	"context"
+	"crypto/cipher"
+	"crypto/md5"
 	"fmt"
 	"io"
 	"net/http"
 	"os"
 	"os/exec"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"sync/atomic"

@@ -17,6 +20,8 @@ import (
 	"golang.org/x/term"

 	"streamrip-go/internal/netutil"
+
+	"golang.org/x/crypto/blowfish"
 )

 type Downloader struct {
@@ -56,6 +61,33 @@ func (d *Downloader) FileVideo(ctx context.Context, sourceURL, outputPath string
 	return d.file(ctx, sourceURL, outputPath, true, true)
 }

+func (d *Downloader) FileDeezerEncrypted(ctx context.Context, sourceURL, outputPath, trackID string) error {
+	if err := os.MkdirAll(filepath.Dir(outputPath), 0o755); err != nil {
+		return err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, sourceURL, nil)
+	if err != nil {
+		return err
+	}
+	resp, err := d.http.Do(req)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("download failed: status=%d", resp.StatusCode)
+	}
+	encrypted, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return err
+	}
+	plain, err := decryptDeezerBFCBCStripe(encrypted, trackID)
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(outputPath, plain, 0o644)
+}
+
 func (d *Downloader) file(ctx context.Context, sourceURL, outputPath string, allowProgress bool, includeVideo bool) error {
 	if err := os.MkdirAll(filepath.Dir(outputPath), 0o755); err != nil {
 		return err
@@ -204,3 +236,60 @@ func isManifestResponse(contentType string, peek []byte) bool {
 	}
 	return false
 }
+
+const deezerBFChunkSize = 2048
+
+var deezerBFIV = []byte{0, 1, 2, 3, 4, 5, 6, 7}
+
+func decryptDeezerBFCBCStripe(in []byte, trackID string) ([]byte, error) {
+	block, err := blowfish.NewCipher(deriveDeezerBlowfishKey(trackID))
+	if err != nil {
+		return nil, err
+	}
+	out := make([]byte, len(in))
+	for i := 0; i*deezerBFChunkSize < len(in); i++ {
+		start := i * deezerBFChunkSize
+		end := start + deezerBFChunkSize
+		if end > len(in) {
+			end = len(in)
+		}
+		chunk := in[start:end]
+		if i%3 == 0 && len(chunk) == deezerBFChunkSize {
+			dec := make([]byte, len(chunk))
+			mode := cipher.NewCBCDecrypter(block, deezerBFIV)
+			mode.CryptBlocks(dec, chunk)
+			copy(out[start:end], dec)
+		} else {
+			copy(out[start:end], chunk)
+		}
+	}
+	return out, nil
+}
+
+func deriveDeezerBlowfishKey(trackID string) []byte {
+	sum := md5.Sum([]byte(trackID))
+	md5Hex := fmt.Sprintf("%x", sum)
+	secret := "g4el58wc0zvf9na1"
+	key := make([]byte, 16)
+	for i := 0; i < 16; i++ {
+		key[i] = md5Hex[i] ^ md5Hex[i+16] ^ secret[i]
+	}
+	return key
+}
+
+func normalizeDeezerTrackID(raw string) string {
+	trimmed := strings.TrimSpace(raw)
+	if trimmed == "" {
+		return ""
+	}
+	if _, err := strconv.Atoi(trimmed); err == nil {
+		return trimmed
+	}
+	parts := strings.Split(strings.Trim(trimmed, "/"), "/")
+	for i := len(parts) - 1; i >= 0; i-- {
+		if _, err := strconv.Atoi(parts[i]); err == nil {
+			return parts[i]
+		}
+	}
+	return trimmed
+}
--- a/internal/download/downloader_test.go
+++ b/internal/download/downloader_test.go
@@ -2,11 +2,14 @@ package download

 import (
 	"context"
+	"crypto/cipher"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"testing"
+
+	"golang.org/x/crypto/blowfish"
 )

 func TestDownloaderHasNoClientTimeout(t *testing.T) {
@@ -51,3 +54,33 @@ func TestManifestDetection(t *testing.T) {
 		t.Fatalf("did not expect flac to be manifest")
 	}
 }
+
+func TestNormalizeDeezerTrackID(t *testing.T) {
+	if got := normalizeDeezerTrackID("https://www.deezer.com/track/3135556"); got != "3135556" {
+		t.Fatalf("normalize track id = %q, want 3135556", got)
+	}
+}
+
+func TestDecryptDeezerBFCBCStripe(t *testing.T) {
+	trackID := "3135556"
+	plain := make([]byte, deezerBFChunkSize*2)
+	for i := range plain {
+		plain[i] = byte(i % 251)
+	}
+	enc := make([]byte, len(plain))
+	copy(enc, plain)
+	block, err := blowfish.NewCipher(deriveDeezerBlowfishKey(trackID))
+	if err != nil {
+		t.Fatalf("cipher error: %v", err)
+	}
+	cbc := cipher.NewCBCEncrypter(block, deezerBFIV)
+	cbc.CryptBlocks(enc[:deezerBFChunkSize], enc[:deezerBFChunkSize])
+
+	dec, err := decryptDeezerBFCBCStripe(enc, trackID)
+	if err != nil {
+		t.Fatalf("decrypt error: %v", err)
+	}
+	if len(dec) != len(plain) || string(dec) != string(plain) {
+		t.Fatalf("decrypted data mismatch")
+	}
+}
--- a/internal/provider/deezer/client.go
+++ b/internal/provider/deezer/client.go
@@ -8,7 +8,6 @@ import (
 	"io"
 	"net/http"
 	"net/url"
-	"os/exec"
 	"strconv"
 	"strings"
 	"time"
@@ -19,17 +18,24 @@ import (
 	"streamrip-go/internal/ratelimit"
 )

-var baseURL = "https://api.deezer.com"
-
-type commandRunner func(ctx context.Context, name string, args ...string) ([]byte, error)
+var (
+	baseURL    = "https://api.deezer.com"
+	webGWLight = "https://www.deezer.com/ajax/gw-light.php"
+	mediaURL   = "https://media.deezer.com/v1/get_url"
+	deezerUA   = "Deezer/9.0.11.4 (Android; 14; Mobile; us) Xiaomi Redmi Note 7"
+)

 type Client struct {
 	cfg      *config.Config
 	http     *http.Client
 	limiter  *ratelimit.Limiter
 	loggedIn bool
-	bin      string
-	run      commandRunner
+	sid      string
+	arl      string
+	jwt      string
+	refresh  string
+	license  string
+	userID   string
 }

 func New(cfg *config.Config) *Client {
@@ -37,8 +43,7 @@ func New(cfg *config.Config) *Client {
 		cfg:     cfg,
 		http:    netutil.NewHTTPClient(30*time.Second, cfg.Session.Downloads.VerifySSL),
 		limiter: ratelimit.New(cfg.Session.Downloads.RequestsPerMinute),
-		bin:     "yt-dlp",
-		run:     runCommand,
+		arl:     strings.TrimSpace(cfg.Session.Deezer.ARL),
 	}
 }

@@ -46,7 +51,13 @@ func (c *Client) Source() string {
 	return "deezer"
 }

-func (c *Client) Login(context.Context) error {
+func (c *Client) Login(ctx context.Context) error {
+	c.arl = strings.TrimSpace(c.cfg.Session.Deezer.ARL)
+	if c.arl != "" {
+		if err := c.refreshSessionFromARL(ctx); err != nil {
+			return err
+		}
+	}
 	c.loggedIn = true
 	return nil
 }
@@ -165,158 +176,38 @@ func (c *Client) GetMetadata(ctx context.Context, item, mediaType string) (map[s
 }

 func (c *Client) GetDownloadable(ctx context.Context, item string, _ int) (*provider.Downloadable, error) {
+	if strings.TrimSpace(c.arl) == "" {
+		return nil, errors.New("deezer native download requires deezer.arl in config")
+	}
+	if strings.TrimSpace(c.license) == "" {
+		if err := c.refreshSessionFromARL(ctx); err != nil {
+			return nil, err
+		}
+	}
 	meta, err := c.GetMetadata(ctx, item, "track")
 	if err != nil {
 		return nil, err
 	}
-	if c.shouldTryYtDlp() {
-		d, dlErr := c.getDownloadableViaYtDlp(ctx, item, meta)
-		if dlErr == nil {
-			return d, nil
-		}
-		if !c.cfg.Session.Deezer.LowerQualityIfNotAvailable {
-			return nil, fmt.Errorf("deezer full-quality mode failed and fallback is disabled: %w", dlErr)
-		}
-	}
-	preview := strings.TrimSpace(stringFromAny(meta["preview"]))
-	if preview == "" {
-		return nil, errors.New("deezer track missing preview url")
-	}
-	return &provider.Downloadable{URL: preview, Extension: "mp3", Source: "deezer"}, nil
-}
-
-func (c *Client) shouldTryYtDlp() bool {
-	if c.cfg == nil {
-		return false
-	}
-	if c.cfg.Session.Deezer.UseDeezloader {
-		return true
-	}
-	return strings.TrimSpace(c.cfg.Session.Deezer.ARL) != ""
-}
-
-func (c *Client) getDownloadableViaYtDlp(ctx context.Context, trackID string, meta map[string]any) (*provider.Downloadable, error) {
-	if _, err := exec.LookPath(c.bin); err != nil {
-		return nil, fmt.Errorf("yt-dlp not found for deezer full-quality mode: %w", err)
-	}
-
-	target := strings.TrimSpace(stringFromAny(meta["link"]))
-	if target == "" {
-		target = "https://www.deezer.com/track/" + trackID
-	}
-	args := []string{"-J", "--no-playlist", "--skip-download", "--no-warnings"}
-	if arl := strings.TrimSpace(c.cfg.Session.Deezer.ARL); arl != "" {
-		args = append(args, "--add-header", "Cookie: arl="+arl)
-	}
-	args = append(args, target)
-	b, err := c.run(ctx, c.bin, args...)
+	trackToken := strings.TrimSpace(stringFromAny(meta["track_token"]))
+	if trackToken == "" {
+		trackToken, err = c.getTrackToken(ctx, item)
 		if err != nil {
 			return nil, err
 		}
-	info := map[string]any{}
-	if err = json.Unmarshal(b, &info); err != nil {
+	}
+	media, err := c.getMediaURL(ctx, trackToken, c.cfg.Session.Deezer.Quality, c.cfg.Session.Deezer.LowerQualityIfNotAvailable)
+	if err != nil {
 		return nil, err
 	}
-	f := selectDeezerFormat(info, c.cfg.Session.Deezer.Quality)
-	if f.url == "" {
-		return nil, errors.New("yt-dlp output missing downloadable format url")
-	}
-	ext := f.ext
+	ext := extensionForFormat(media.Format)
 	if ext == "" {
 		ext = "mp3"
 	}
-	return &provider.Downloadable{URL: f.url, Extension: ext, Source: "deezer"}, nil
-}
-
-type deezerFormat struct {
-	url string
-	ext string
-	abr int
-}
-
-func selectDeezerFormat(info map[string]any, quality int) deezerFormat {
-	formats, _ := info["formats"].([]any)
-	selected := deezerFormat{}
-
-	pick := func(candidate deezerFormat, better func(cur, next deezerFormat) bool) {
-		if candidate.url == "" {
-			return
+	trackID := strings.TrimSpace(stringFromAny(meta["id"]))
+	if trackID == "" {
+		trackID = strings.TrimSpace(item)
 	}
-		if selected.url == "" || better(selected, candidate) {
-			selected = candidate
-		}
-	}
-
-	for _, raw := range formats {
-		m, ok := raw.(map[string]any)
-		if !ok {
-			continue
-		}
-		if strings.TrimSpace(stringFromAny(m["vcodec"])) != "none" {
-			continue
-		}
-		cand := deezerFormat{
-			url: strings.TrimSpace(stringFromAny(m["url"])),
-			ext: strings.TrimSpace(stringFromAny(m["ext"])),
-			abr: intFromAny(m["abr"]),
-		}
-		if quality >= 2 {
-			pick(cand, func(cur, next deezerFormat) bool {
-				curFlac := strings.EqualFold(cur.ext, "flac")
-				nextFlac := strings.EqualFold(next.ext, "flac")
-				if curFlac != nextFlac {
-					return nextFlac
-				}
-				return next.abr > cur.abr
-			})
-			continue
-		}
-		if quality == 1 {
-			pick(cand, func(cur, next deezerFormat) bool {
-				curScore := abrScore(cur.abr, 320)
-				nextScore := abrScore(next.abr, 320)
-				if curScore == nextScore {
-					return next.abr > cur.abr
-				}
-				return nextScore > curScore
-			})
-			continue
-		}
-		pick(cand, func(cur, next deezerFormat) bool {
-			curScore := abrScore(cur.abr, 128)
-			nextScore := abrScore(next.abr, 128)
-			if curScore == nextScore {
-				if cur.abr == 0 {
-					return next.abr > 0
-				}
-				if next.abr == 0 {
-					return false
-				}
-				return next.abr < cur.abr
-			}
-			return nextScore > curScore
-		})
-	}
-
-	if selected.url != "" {
-		return selected
-	}
-
-	rootURL := strings.TrimSpace(stringFromAny(info["url"]))
-	if rootURL == "" {
-		return deezerFormat{}
-	}
-	return deezerFormat{url: rootURL, ext: strings.TrimSpace(stringFromAny(info["ext"])), abr: intFromAny(info["abr"])}
-}
-
-func abrScore(abr int, target int) int {
-	if abr <= 0 {
-		return -1
-	}
-	if abr > target {
-		return target - (abr-target)*2
-	}
-	return abr
+	return &provider.Downloadable{URL: media.URL, Extension: ext, Source: "deezer", Cipher: media.Cipher, TrackID: trackID}, nil
 }

 func (c *Client) apiGet(ctx context.Context, path string, params url.Values) (map[string]any, error) {
@@ -365,6 +256,227 @@ func (c *Client) apiGet(ctx context.Context, path string, params url.Values) (ma
 	return out, nil
 }

+func (c *Client) refreshSessionFromARL(ctx context.Context) error {
+	if strings.TrimSpace(c.arl) == "" {
+		return errors.New("missing deezer arl")
+	}
+	if err := c.limiter.Wait(ctx); err != nil {
+		return err
+	}
+	params := url.Values{}
+	params.Set("method", "deezer.getUserData")
+	params.Set("input", "3")
+	params.Set("api_version", "1.0")
+	params.Set("api_token", "")
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, webGWLight+"?"+params.Encode(), nil)
+	if err != nil {
+		return err
+	}
+	req.Header.Set("User-Agent", deezerUA)
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("Cookie", "arl="+strings.TrimSpace(c.arl))
+
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = resp.Body.Close() }()
+	raw, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return err
+	}
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("deezer getUserData failed: status=%d body=%s", resp.StatusCode, string(raw))
+	}
+	out := map[string]any{}
+	if err = json.Unmarshal(raw, &out); err != nil {
+		return err
+	}
+	if errObj, ok := out["error"].(map[string]any); ok && len(errObj) > 0 {
+		return fmt.Errorf("deezer getUserData error: %s", stringFromAny(errObj["message"]))
+	}
+	results, _ := out["results"].(map[string]any)
+	if len(results) == 0 {
+		return errors.New("deezer getUserData returned empty results")
+	}
+	c.license = findStringByKey(results, "license_token")
+	c.userID = findStringByKey(results, "USER_ID")
+	if c.license == "" {
+		return errors.New("deezer getUserData missing license_token")
+	}
+	return nil
+}
+
+func (c *Client) getTrackToken(ctx context.Context, trackID string) (string, error) {
+	resp, err := c.apiGet(ctx, "/track/"+url.PathEscape(strings.TrimSpace(trackID)), nil)
+	if err != nil {
+		return "", err
+	}
+	token := strings.TrimSpace(stringFromAny(resp["track_token"]))
+	if token == "" {
+		return "", errors.New("deezer track metadata missing track_token")
+	}
+	return token, nil
+}
+
+type mediaResult struct {
+	URL    string
+	Format string
+	Cipher string
+}
+
+func (c *Client) getMediaURL(ctx context.Context, trackToken string, quality int, allowFallback bool) (*mediaResult, error) {
+	requestedFormats := buildFormatPriority(quality, allowFallback)
+	var lastErr error
+	for _, format := range requestedFormats {
+		result, err := c.getMediaURLForFormat(ctx, trackToken, format)
+		if err == nil {
+			return result, nil
+		}
+		lastErr = err
+		if !allowFallback {
+			break
+		}
+	}
+	if lastErr != nil {
+		return nil, lastErr
+	}
+	return nil, errors.New("deezer media response contains no playable variants")
+}
+
+func (c *Client) getMediaURLForFormat(ctx context.Context, trackToken, format string) (*mediaResult, error) {
+	if strings.TrimSpace(c.license) == "" {
+		return nil, errors.New("missing deezer license token")
+	}
+	if err := c.limiter.Wait(ctx); err != nil {
+		return nil, err
+	}
+
+	reqBody := map[string]any{
+		"license_token": c.license,
+		"track_tokens":  []string{trackToken},
+		"media": []map[string]any{{
+			"type":    "FULL",
+			"formats": []map[string]string{{"cipher": "BF_CBC_STRIPE", "format": format}, {"cipher": "NONE", "format": format}},
+		}},
+	}
+	b, err := json.Marshal(reqBody)
+	if err != nil {
+		return nil, err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, mediaURL, strings.NewReader(string(b)))
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("User-Agent", deezerUA)
+	req.Header.Set("Accept", "*/*")
+	req.Header.Set("Content-Type", "text/plain; charset=UTF-8")
+
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = resp.Body.Close() }()
+	raw, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return nil, fmt.Errorf("deezer media get_url failed: status=%d body=%s", resp.StatusCode, string(raw))
+	}
+	var parsed struct {
+		Data []struct {
+			Errors []struct {
+				Code    int    `json:"code"`
+				Message string `json:"message"`
+			} `json:"errors"`
+			Media []struct {
+				Cipher struct {
+					Type string `json:"type"`
+				} `json:"cipher"`
+				Format  string `json:"format"`
+				Sources []struct {
+					URL string `json:"url"`
+				} `json:"sources"`
+			} `json:"media"`
+		} `json:"data"`
+	}
+	if err = json.Unmarshal(raw, &parsed); err != nil {
+		return nil, err
+	}
+	if len(parsed.Data) == 0 {
+		return nil, errors.New("deezer media response contains no data")
+	}
+	if len(parsed.Data[0].Errors) > 0 {
+		e := parsed.Data[0].Errors[0]
+		if strings.Contains(strings.ToLower(e.Message), "drm") {
+			return nil, errors.New("deezer media is DRM protected for this format/account")
+		}
+		return nil, fmt.Errorf("deezer media error %d: %s", e.Code, e.Message)
+	}
+	for _, m := range parsed.Data[0].Media {
+		if len(m.Sources) == 0 || strings.TrimSpace(m.Sources[0].URL) == "" {
+			continue
+		}
+		return &mediaResult{URL: m.Sources[0].URL, Format: m.Format, Cipher: m.Cipher.Type}, nil
+	}
+	return nil, errors.New("deezer media response contains no sources")
+}
+
+func buildFormatPriority(quality int, allowFallback bool) []string {
+	want := "FLAC"
+	if quality <= 0 {
+		want = "MP3_128"
+	} else if quality == 1 {
+		want = "MP3_320"
+	}
+	priority := []string{want}
+	if allowFallback {
+		for _, f := range []string{"FLAC", "MP3_320", "MP3_128"} {
+			if f != want {
+				priority = append(priority, f)
+			}
+		}
+	}
+	return priority
+}
+
+func extensionForFormat(format string) string {
+	switch strings.ToUpper(strings.TrimSpace(format)) {
+	case "FLAC":
+		return "flac"
+	case "MP3_320", "MP3_128", "MP3_64", "MP3_MISC":
+		return "mp3"
+	default:
+		return "mp3"
+	}
+}
+
+func findStringByKey(v any, wantedKey string) string {
+	w := strings.ToLower(strings.TrimSpace(wantedKey))
+	switch x := v.(type) {
+	case map[string]any:
+		for k, value := range x {
+			if strings.ToLower(k) == w {
+				if s := stringFromAny(value); strings.TrimSpace(s) != "" {
+					return s
+				}
+			}
+			if nested := findStringByKey(value, wantedKey); nested != "" {
+				return nested
+			}
+		}
+	case []any:
+		for _, item := range x {
+			if nested := findStringByKey(item, wantedKey); nested != "" {
+				return nested
+			}
+		}
+	}
+	return ""
+}
+
 func enrichTrack(track map[string]any) {
 	if artist, ok := track["artist"].(map[string]any); ok {
 		track["performer"] = map[string]any{"name": stringFromAny(artist["name"]), "id": stringFromAny(artist["id"])}
@@ -452,12 +564,3 @@ func boolFromAny(v any) bool {
 	b, ok := v.(bool)
 	return ok && b
 }
-
-func runCommand(ctx context.Context, name string, args ...string) ([]byte, error) {
-	cmd := exec.CommandContext(ctx, name, args...)
-	b, err := cmd.CombinedOutput()
-	if err != nil {
-		return nil, fmt.Errorf("command %s failed: %w: %s", name, err, string(b))
-	}
-	return b, nil
-}
--- a/internal/provider/deezer/client_test.go
+++ b/internal/provider/deezer/client_test.go
@@ -3,7 +3,6 @@ package deezer
 import (
 	"context"
 	"encoding/json"
-	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -14,12 +13,11 @@ import (

 func TestSearchTrack(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch r.URL.Path {
-		case "/search/track":
+		if r.URL.Path == "/search/track" {
 			_ = json.NewEncoder(w).Encode(map[string]any{"data": []any{map[string]any{"id": 1, "title": "Dreams", "artist": map[string]any{"name": "Fleetwood Mac"}}}})
-		default:
-			w.WriteHeader(http.StatusNotFound)
+			return
 		}
+		w.WriteHeader(http.StatusNotFound)
 	}))
 	defer ts.Close()

@@ -27,9 +25,9 @@ func TestSearchTrack(t *testing.T) {
 	c := New(&config.Config{File: cfgData, Session: cfgData})
 	c.loggedIn = true

-	orig := baseURL
+	origBase := baseURL
 	baseURL = ts.URL
-	defer func() { baseURL = orig }()
+	defer func() { baseURL = origBase }()

 	pages, err := c.Search(context.Background(), "track", "dreams", 5)
 	if err != nil {
@@ -40,11 +38,13 @@ func TestSearchTrack(t *testing.T) {
 	}
 }

-func TestGetDownloadableUsesPreview(t *testing.T) {
+func TestGetDownloadableNativeCipher(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.URL.Path {
 		case "/track/42":
-			_ = json.NewEncoder(w).Encode(map[string]any{"id": 42, "title": "X", "preview": "https://cdn.example/p.mp3"})
+			_ = json.NewEncoder(w).Encode(map[string]any{"id": 42, "title": "X", "track_token": "tt"})
+		case "/media":
+			_ = json.NewEncoder(w).Encode(map[string]any{"data": []any{map[string]any{"errors": []any{}, "media": []any{map[string]any{"cipher": map[string]any{"type": "BF_CBC_STRIPE"}, "format": "FLAC", "sources": []any{map[string]any{"url": "https://cdn.example/file"}}}}}}})
 		default:
 			w.WriteHeader(http.StatusNotFound)
 		}
@@ -52,31 +52,48 @@ func TestGetDownloadableUsesPreview(t *testing.T) {
 	defer ts.Close()

 	cfgData := config.DefaultConfigData()
+	cfgData.Deezer.ARL = "arl"
 	c := New(&config.Config{File: cfgData, Session: cfgData})
 	c.loggedIn = true
-	orig := baseURL
-	baseURL = ts.URL
-	defer func() { baseURL = orig }()
+	c.arl = "arl"
+	c.license = "license"

-	d, err := c.GetDownloadable(context.Background(), "42", 0)
+	origBase := baseURL
+	origMedia := mediaURL
+	baseURL = ts.URL
+	mediaURL = ts.URL + "/media"
+	defer func() {
+		baseURL = origBase
+		mediaURL = origMedia
+	}()
+
+	d, err := c.GetDownloadable(context.Background(), "42", 2)
 	if err != nil {
 		t.Fatalf("GetDownloadable() error = %v", err)
 	}
-	if d.URL != "https://cdn.example/p.mp3" || d.Extension != "mp3" {
+	if d.Cipher != "BF_CBC_STRIPE" || d.Extension != "flac" || d.TrackID != "42" {
 		t.Fatalf("unexpected downloadable: %+v", d)
 	}
 }

-func TestGetMetadataSetsExplicitFromBool(t *testing.T) {
+func TestGetDownloadableRequiresARL(t *testing.T) {
+	cfgData := config.DefaultConfigData()
+	cfgData.Deezer.ARL = ""
+	c := New(&config.Config{File: cfgData, Session: cfgData})
+	c.loggedIn = true
+	_, err := c.GetDownloadable(context.Background(), "42", 2)
+	if err == nil || !strings.Contains(strings.ToLower(err.Error()), "arl") {
+		t.Fatalf("expected arl requirement error, got %v", err)
+	}
+}
+
+func TestGetDownloadableDRMError(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.URL.Path {
-		case "/track/9":
-			_ = json.NewEncoder(w).Encode(map[string]any{
-				"id":              9,
-				"title":           "X",
-				"explicit_lyrics": true,
-				"artist":          map[string]any{"name": "Artist"},
-			})
+		case "/track/42":
+			_ = json.NewEncoder(w).Encode(map[string]any{"id": 42, "title": "X", "track_token": "tt"})
+		case "/media":
+			_ = json.NewEncoder(w).Encode(map[string]any{"data": []any{map[string]any{"errors": []any{map[string]any{"code": 403, "message": "DRM required"}}, "media": []any{}}}})
 		default:
 			w.WriteHeader(http.StatusNotFound)
 		}
@@ -84,69 +101,23 @@ func TestGetMetadataSetsExplicitFromBool(t *testing.T) {
 	defer ts.Close()

 	cfgData := config.DefaultConfigData()
+	cfgData.Deezer.ARL = "arl"
 	c := New(&config.Config{File: cfgData, Session: cfgData})
 	c.loggedIn = true
-	orig := baseURL
+	c.arl = "arl"
+	c.license = "license"
+
+	origBase := baseURL
+	origMedia := mediaURL
 	baseURL = ts.URL
-	defer func() { baseURL = orig }()
-
-	meta, err := c.GetMetadata(context.Background(), "9", "track")
-	if err != nil {
-		t.Fatalf("GetMetadata() error = %v", err)
-	}
-	if explicit, _ := meta["explicit"].(bool); !explicit {
-		t.Fatalf("expected explicit=true, got %#v", meta["explicit"])
-	}
-}
-
-func TestSearchReturnsStructuredAPIError(t *testing.T) {
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == "/search/track" {
-			_ = json.NewEncoder(w).Encode(map[string]any{"error": map[string]any{"message": "invalid query"}})
-			return
-		}
-		w.WriteHeader(http.StatusNotFound)
-	}))
-	defer ts.Close()
-
-	cfgData := config.DefaultConfigData()
-	c := New(&config.Config{File: cfgData, Session: cfgData})
-	c.loggedIn = true
-	orig := baseURL
-	baseURL = ts.URL
-	defer func() { baseURL = orig }()
-
-	_, err := c.Search(context.Background(), "track", "", 5)
-	if err == nil || !strings.Contains(err.Error(), "invalid query") {
-		t.Fatalf("expected structured deezer error, got %v", err)
-	}
-}
-
-func TestGetDownloadableErrorsWhenFullQualityFailsAndFallbackDisabled(t *testing.T) {
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path == "/track/42" {
-			_ = json.NewEncoder(w).Encode(map[string]any{"id": 42, "title": "X", "preview": "https://cdn.example/p.mp3"})
-			return
-		}
-		w.WriteHeader(http.StatusNotFound)
-	}))
-	defer ts.Close()
-
-	cfgData := config.DefaultConfigData()
-	cfgData.Deezer.UseDeezloader = true
-	cfgData.Deezer.LowerQualityIfNotAvailable = false
-	c := New(&config.Config{File: cfgData, Session: cfgData})
-	c.loggedIn = true
-	c.bin = "definitely-not-a-real-yt-dlp-bin"
-	c.run = func(context.Context, string, ...string) ([]byte, error) {
-		return nil, fmt.Errorf("unexpected run call")
-	}
-	orig := baseURL
-	baseURL = ts.URL
-	defer func() { baseURL = orig }()
+	mediaURL = ts.URL + "/media"
+	defer func() {
+		baseURL = origBase
+		mediaURL = origMedia
+	}()

 	_, err := c.GetDownloadable(context.Background(), "42", 2)
-	if err == nil || !strings.Contains(err.Error(), "full-quality mode failed") {
-		t.Fatalf("expected full-quality failure error, got %v", err)
+	if err == nil || !strings.Contains(strings.ToLower(err.Error()), "drm") {
+		t.Fatalf("expected drm error, got %v", err)
 	}
 }
--- a/internal/provider/provider.go
+++ b/internal/provider/provider.go
@@ -6,6 +6,8 @@ type Downloadable struct {
 	URL       string
 	Extension string
 	Source    string
+	Cipher    string
+	TrackID   string
 }

 type Client interface {
--- a/internal/provider/soundcloud/client.go
+++ b/internal/provider/soundcloud/client.go
@@ -106,6 +106,7 @@ func (c *Client) searchTracks(ctx context.Context, query string, limit int) ([]m
 		if artist == "" {
 			artist = strings.TrimSpace(stringFromAny(m["channel"]))
 		}
+		artistID := strings.TrimSpace(firstNonEmpty(stringFromAny(m["uploader_id"]), stringFromAny(m["channel_id"])))
 		item := map[string]any{
 			"id":    id,
 			"title": stringFromAny(m["title"]),
@@ -113,6 +114,9 @@ func (c *Client) searchTracks(ctx context.Context, query string, limit int) ([]m
 				"name": artist,
 			},
 		}
+		if artistID != "" {
+			item["artist"] = map[string]any{"name": artist, "id": artistID}
+		}
 		if trackID := strings.TrimSpace(stringFromAny(m["id"])); trackID != "" {
 			item["source_track_id"] = trackID
 		}
@@ -164,6 +168,7 @@ func (c *Client) searchPlaylists(ctx context.Context, query string, limit int) (
 			title = strings.Trim(strings.ReplaceAll(path, "/", " "), " ")
 		}
 		artist := strings.TrimSpace(firstNonEmpty(stringFromAny(info["uploader"]), stringFromAny(info["channel"])))
+		artistID := strings.TrimSpace(firstNonEmpty(stringFromAny(info["uploader_id"]), stringFromAny(info["channel_id"])))
 		trackCount := 0
 		if entries := asAnySlice(info["entries"]); len(entries) > 0 {
 			trackCount = len(entries)
@@ -175,11 +180,14 @@ func (c *Client) searchPlaylists(ctx context.Context, query string, limit int) (
 			"tracks_count": trackCount,
 			"artist":       map[string]any{"name": artist},
 		}
+		if artistID != "" {
+			item["artist"] = map[string]any{"name": artist, "id": artistID}
+		}
 		if pid := strings.TrimSpace(stringFromAny(info["id"])); pid != "" {
 			item["source_playlist_id"] = pid
 		}
 		if thumb := strings.TrimSpace(stringFromAny(info["thumbnail"])); thumb != "" {
-			item["image"] = map[string]any{"small": thumb, "large": thumb, "extralarge": thumb, "original": thumb}
+			item["image"] = soundcloudImageMap(thumb)
 		}
 		items = append(items, item)
 		if len(items) >= limit {
@@ -227,7 +235,11 @@ func (c *Client) GetMetadata(ctx context.Context, item, mediaType string) (map[s
 				track["title"] = title
 			}
 			if artist := strings.TrimSpace(firstNonEmpty(stringFromAny(entry["uploader"]), stringFromAny(entry["channel"]))); artist != "" {
-				track["artist"] = map[string]any{"name": artist}
+				artistMap := map[string]any{"name": artist}
+				if artistID := strings.TrimSpace(firstNonEmpty(stringFromAny(entry["uploader_id"]), stringFromAny(entry["channel_id"]))); artistID != "" {
+					artistMap["id"] = artistID
+				}
+				track["artist"] = artistMap
 			}
 			track["track_number"] = i + 1
 			tracks = append(tracks, track)
@@ -249,7 +261,7 @@ func (c *Client) GetMetadata(ctx context.Context, item, mediaType string) (map[s
 			meta["artist"] = map[string]any{"name": artist}
 		}
 		if thumb := strings.TrimSpace(stringFromAny(root["thumbnail"])); thumb != "" {
-			meta["image"] = map[string]any{"small": thumb, "large": thumb, "extralarge": thumb, "original": thumb}
+			meta["image"] = soundcloudImageMap(thumb)
 		}
 		if entries := asAnySlice(root["entries"]); len(entries) > 0 {
 			meta["tracks_count"] = len(entries)
@@ -326,17 +338,33 @@ func (c *Client) playlistInfo(ctx context.Context, item string) (map[string]any,

 func trackMetadataFromInfo(id string, info map[string]any) map[string]any {
 	canonicalID := firstNonEmpty(canonicalSoundcloudURL(info), id)
+	publisher := nestedMap(info, "publisher_metadata")
 	title := strings.TrimSpace(stringFromAny(info["title"]))
 	if title == "" {
 		title = canonicalID
 	}
+	albumTitle := strings.TrimSpace(stringFromAny(publisher["album_title"]))
+	if albumTitle == "" {
+		albumTitle = strings.TrimSpace(stringFromAny(info["album"]))
+	}
+	if albumTitle == "" {
+		albumTitle = title
+	}
 	artistName := strings.TrimSpace(stringFromAny(info["artist"]))
+	if artistName == "" {
+		artistName = strings.TrimSpace(stringFromAny(publisher["artist"]))
+	}
 	if artistName == "" {
 		artistName = strings.TrimSpace(stringFromAny(info["uploader"]))
 	}
 	if artistName == "" {
 		artistName = strings.TrimSpace(stringFromAny(info["channel"]))
 	}
+	artistID := strings.TrimSpace(firstNonEmpty(
+		stringFromAny(info["uploader_id"]),
+		stringFromAny(info["channel_id"]),
+		stringFromAny(nestedMap(info, "user")["id"]),
+	))

 	trackNum := intFromAny(info["track_number"])
 	if trackNum <= 0 {
@@ -347,18 +375,20 @@ func trackMetadataFromInfo(id string, info map[string]any) map[string]any {
 		"id":           canonicalID,
 		"title":        title,
 		"track_number": trackNum,
-		"artist":       map[string]any{"name": artistName},
-		"performer":    map[string]any{"name": artistName},
+		"artist":       map[string]any{"name": artistName, "id": artistID},
+		"performer":    map[string]any{"name": artistName, "id": artistID},
 		"album": map[string]any{
-			"id":     strings.TrimSpace(stringFromAny(info["album"])),
-			"title":  strings.TrimSpace(stringFromAny(info["album"])),
-			"artist": map[string]any{"name": artistName},
+			"id":     firstNonEmpty(strings.TrimSpace(stringFromAny(info["album"])), canonicalID),
+			"title":  albumTitle,
+			"artist": map[string]any{"name": artistName, "id": artistID},
 		},
 		"description": strings.TrimSpace(stringFromAny(info["description"])),
 		"genre":       strings.TrimSpace(stringFromAny(info["genre"])),
 		"isrc":        strings.TrimSpace(stringFromAny(info["isrc"])),
-		"label":       strings.TrimSpace(stringFromAny(info["label"])),
+		"label":       strings.TrimSpace(firstNonEmpty(stringFromAny(info["label"]), stringFromAny(info["label_name"]))),
+		"copyright":   strings.TrimSpace(stringFromAny(publisher["p_line"])),
 		"release_date": strings.TrimSpace(firstNonEmpty(
+			stringFromAny(info["created_at"]),
 			stringFromAny(info["release_date"]),
 			stringFromAny(info["upload_date"]),
 		)),
@@ -367,7 +397,7 @@ func trackMetadataFromInfo(id string, info map[string]any) map[string]any {
 		meta["source_track_id"] = trackID
 	}

-	if age := intFromAny(info["age_limit"]); age >= 18 {
+	if boolFromAny(publisher["explicit"]) || intFromAny(info["age_limit"]) >= 18 {
 		meta["explicit"] = true
 	}

@@ -376,19 +406,14 @@ func trackMetadataFromInfo(id string, info map[string]any) map[string]any {
 	}

 	if thumb := strings.TrimSpace(stringFromAny(info["thumbnail"])); thumb != "" {
-		meta["image"] = map[string]any{
-			"small":      thumb,
-			"large":      thumb,
-			"extralarge": thumb,
-			"original":   thumb,
-		}
+		meta["image"] = soundcloudImageMap(thumb)
 	}

-	if album := strings.TrimSpace(stringFromAny(info["album"])); album == "" {
+	if strings.TrimSpace(stringFromAny(info["album"])) == "" && strings.TrimSpace(stringFromAny(publisher["album_title"])) == "" {
 		meta["album"] = map[string]any{
-			"id":     id,
+			"id":     canonicalID,
 			"title":  title,
-			"artist": map[string]any{"name": artistName},
+			"artist": map[string]any{"name": artistName, "id": artistID},
 		}
 	}

@@ -492,6 +517,49 @@ func firstNonEmpty(items ...string) string {
 	return ""
 }

+func nestedMap(m map[string]any, key string) map[string]any {
+	v, ok := m[key].(map[string]any)
+	if !ok {
+		return map[string]any{}
+	}
+	return v
+}
+
+func boolFromAny(v any) bool {
+	switch t := v.(type) {
+	case bool:
+		return t
+	case string:
+		l := strings.ToLower(strings.TrimSpace(t))
+		return l == "1" || l == "true" || l == "yes"
+	case int:
+		return t != 0
+	case int64:
+		return t != 0
+	case float64:
+		return t != 0
+	default:
+		return false
+	}
+}
+
+func soundcloudImageMap(raw string) map[string]any {
+	base := strings.TrimSpace(raw)
+	if base == "" {
+		return map[string]any{}
+	}
+	large := strings.Replace(base, "-large.", "-t500x500.", 1)
+	if large == base {
+		large = strings.Replace(base, "large", "t500x500", 1)
+	}
+	return map[string]any{
+		"small":      base,
+		"large":      large,
+		"extralarge": large,
+		"original":   large,
+	}
+}
+
 func runCommand(ctx context.Context, name string, args ...string) ([]byte, error) {
 	cmd := exec.CommandContext(ctx, name, args...)
 	b, err := cmd.CombinedOutput()
--- a/internal/provider/soundcloud/client_test.go
+++ b/internal/provider/soundcloud/client_test.go
@@ -70,6 +70,9 @@ func TestGetPlaylistMetadata(t *testing.T) {
 	if len(items) != 2 {
 		t.Fatalf("playlist items len = %d, want 2", len(items))
 	}
+	if stringFromAny(meta["id"]) != "https://soundcloud.com/a/sets/road-trip" {
+		t.Fatalf("playlist id not canonical: %q", stringFromAny(meta["id"]))
+	}
 }

 func TestSearchTrack(t *testing.T) {
@@ -95,6 +98,13 @@ func TestSearchTrack(t *testing.T) {
 	if len(items) != 1 {
 		t.Fatalf("items len = %d, want 1", len(items))
 	}
+	item0, ok := items[0].(map[string]any)
+	if !ok {
+		t.Fatalf("expected first item map")
+	}
+	if stringFromAny(item0["id"]) != "https://soundcloud.com/a/b" {
+		t.Fatalf("track search id not canonical: %q", stringFromAny(item0["id"]))
+	}
 }

 func TestSearchPlaylist(t *testing.T) {
@@ -133,6 +143,13 @@ func TestSearchPlaylist(t *testing.T) {
 	if len(items) != 1 {
 		t.Fatalf("items len = %d, want 1", len(items))
 	}
+	item0, ok := items[0].(map[string]any)
+	if !ok {
+		t.Fatalf("expected first item map")
+	}
+	if stringFromAny(item0["id"]) != "https://soundcloud.com/a/sets/road-trip" {
+		t.Fatalf("playlist search id not canonical: %q", stringFromAny(item0["id"]))
+	}
 }

 func TestLoginShowsYtDlpHint(t *testing.T) {
@@ -169,6 +186,9 @@ func TestTrackMetadataIncludesExplicitAndISRC(t *testing.T) {
 	if stringFromAny(meta["source_track_id"]) != "9876" {
 		t.Fatalf("source_track_id = %q, want 9876", stringFromAny(meta["source_track_id"]))
 	}
+	if stringFromAny(nestedMap(meta, "album")["title"]) != "T" {
+		t.Fatalf("album title mismatch: %#v", nestedMap(meta, "album"))
+	}
 }

 func TestCanonicalSoundcloudURL(t *testing.T) {