feat(tunein): dynamic TuneIn stream resolution + remove preset overwrite confirmation

.github/workflows/ci.yml

@@ -292,16 +292,16 @@ jobs:
           curl --retry 10 --retry-delay 2 --retry-connrefused http://localhost:4173
 
       - name: Run Cypress E2E tests
+        id: cypress
         working-directory: apps/frontend
         run: npm run test:e2e
-        continue-on-error: true
         env:
           CYPRESS_BASE_URL: http://localhost:4173
           CYPRESS_API_URL: http://localhost:7778/api
 
       - name: Upload Cypress screenshots on failure
         uses: actions/upload-artifact@v7
-        if: failure()
+        if: failure() && steps.cypress.outcome == 'failure'
         with:
           name: cypress-screenshots
           path: apps/frontend/tests/e2e/screenshots
@@ -336,7 +336,7 @@ jobs:
           path: .out/coverage/frontend
 
       - name: SonarCloud Scan
-        uses: SonarSource/sonarqube-scan-action@v5
+        uses: SonarSource/sonarqube-scan-action@v6
         with:
           args: >
             -Dsonar.projectKey=scheilch_opencloudtouch

.github/workflows/license-check.yml

@@ -0,0 +1,82 @@
+# ==============================================================================
+# LICENSE CHECK - Verify OSS dependency licenses are compatible
+#
+# Fails on: GPL, AGPL, LGPL, CPAL, EUPL (copyleft incompatible with MIT)
+# Allowed:  MIT, Apache-2.0, BSD-*, ISC, Python-2.0, CC0-1.0, 0BSD, Unlicense
+# ==============================================================================
+
+name: License Check
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'apps/frontend/package.json'
+      - 'package-lock.json'
+      - 'apps/backend/requirements.txt'
+      - 'apps/backend/requirements-dev.txt'
+  pull_request:
+    paths:
+      - 'apps/frontend/package.json'
+      - 'package-lock.json'
+      - 'apps/backend/requirements.txt'
+      - 'apps/backend/requirements-dev.txt'
+  workflow_dispatch:
+
+jobs:
+  license-check:
+    name: License Check
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      # ── Frontend (npm) ──────────────────────────────────────────────────────
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: package-lock.json
+
+      - name: Install frontend dependencies
+        run: npm ci
+
+      - name: Check frontend licenses
+        run: |
+          npx license-checker-rseidelsohn \
+            --start apps/frontend \
+            --production \
+            --excludePrivatePackages \
+            --onlyAllow "MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD;Unlicense;CC0-1.0;CC-BY-3.0;CC-BY-4.0;Python-2.0;BlueOak-1.0.0;Artistic-2.0" \
+            --summary
+
+      # ── Backend (pip) ───────────────────────────────────────────────────────
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.13'
+
+      - name: Install backend dependencies
+        run: |
+          pip install pip-licenses
+          pip install -r apps/backend/requirements.txt
+
+      - name: Check backend licenses
+        # asyncssh is an approved dependency: EPL-2.0 (Eclipse Public License 2.0)
+        # is weak-copyleft — only applies to modifications of asyncssh itself, not
+        # to embedding projects. Excluded via --ignore-packages because its SPDX
+        # composite expression "EPL-2.0 OR GPL-2.0-or-later" contains "GPL-2.0-or-later"
+        # as a substring, which would otherwise trigger the --fail-on check.
+        #
+        # LGPL is intentionally NOT in the deny-list: LGPL-2.1 only requires open-
+        # sourcing modifications to the LGPL library itself, not embedding code.
+        # zeroconf (mDNS discovery) is LGPL-2.1 and safe to use here.
+        run: |
+          pip-licenses \
+            --format=markdown \
+            --order=license \
+            --ignore-packages asyncssh \
+            --fail-on="GNU General Public License;GNU Affero General Public License;European Union Public Licence;GPL-2.0-only;GPL-2.0-or-later;GPL-3.0-only;GPL-3.0-or-later;AGPL-3.0-only;AGPL-3.0-or-later;EUPL-1.1;EUPL-1.2"

.gitignore

@@ -65,6 +65,11 @@ apps/backend/openapi.yaml
 *_TEMP.md
 CONTEXT_TEMP.md
 *.log
+result.txt
+test-output.txt
+test*.txt
+test_full.txt
+apps/backend/result.txt
 AGENTS.md
 .github/copilot-instructions.md
 .github/prompts/

apps/backend/src/opencloudtouch/bmx/radiobrowser_routes.py

@@ -14,7 +14,7 @@
 from fastapi.responses import JSONResponse
 
 from opencloudtouch.bmx.models import BmxAudio, BmxPlaybackResponse, BmxStream
-from opencloudtouch.bmx.routes import convert_https_to_http
+from opencloudtouch.bmx.stream_utils import convert_https_to_http
 from opencloudtouch.bmx.tunein import get_oct_base_url
 from opencloudtouch.radio.adapter import get_radio_adapter
 from opencloudtouch.radio.providers.radiobrowser import (

apps/backend/src/opencloudtouch/bmx/routes.py

@@ -25,34 +25,14 @@
     BmxServicesResponse,
     BmxStream,
 )
+from opencloudtouch.bmx.stream_utils import convert_https_to_http
 from opencloudtouch.bmx.tunein import get_oct_base_url, resolve_tunein_station
 
 logger = logging.getLogger(__name__)
 
 router = APIRouter(tags=["bmx"])
 
 
-def convert_https_to_http(url: str) -> str:
-    """Convert HTTPS URLs to HTTP for Bose device compatibility.
-
-    Bose SoundTouch devices cannot play HTTPS streams directly.
-    Most radio stations support both HTTP and HTTPS, so we try HTTP first.
-
-    Args:
-        url: Stream URL (may be HTTPS or HTTP)
-
-    Returns:
-        HTTP version of the URL (https:// → http://)
-    """
-    if url.startswith("https://"):
-        http_url = "http://" + url[8:]
-        logger.info(
-            f"[BMX] Converting HTTPS to HTTP: {url[:50]}... → {http_url[:50]}..."
-        )
-        return http_url
-    return url
-
-
 # =============================================================================
 # BMX Registry Endpoint
 # =============================================================================
@@ -244,9 +224,15 @@ async def custom_stream_playback(request: Request) -> JSONResponse:
         json_obj = json.loads(json_str)
 
         stream_url = json_obj.get("streamUrl", "")
+        tunein_id = json_obj.get("tuneinId", "")
         image_url = json_obj.get("imageUrl", "")
         name = json_obj.get("name", "Custom Station")
 
+        # TuneIn stations: resolve stream URL dynamically via TuneIn API
+        if tunein_id and not stream_url:
+            logger.info(f"[BMX ORION] TuneIn station detected: {tunein_id} ({name})")
+            return await _resolve_tunein_for_orion(tunein_id)
+
         # Convert HTTPS to HTTP - Bose devices can't play HTTPS streams
         stream_url = convert_https_to_http(stream_url)
 
@@ -284,3 +270,24 @@ async def custom_stream_playback(request: Request) -> JSONResponse:
             status_code=500,
             headers={"Access-Control-Allow-Origin": "*"},
         )
+
+
+async def _resolve_tunein_for_orion(tunein_id: str) -> JSONResponse:
+    """Resolve TuneIn station dynamically for Orion playback.
+
+    Called when a preset contains a tuneinId but no streamUrl.
+    Fetches fresh stream URL from TuneIn API at playback time.
+    """
+    try:
+        response = await resolve_tunein_station(tunein_id)
+        return JSONResponse(
+            content=response.model_dump(),
+            headers={"Access-Control-Allow-Origin": "*"},
+        )
+    except Exception as e:
+        logger.error(f"[BMX ORION] TuneIn resolution failed for {tunein_id}: {e}")
+        return JSONResponse(
+            content={"error": f"TuneIn resolution failed: {e}"},
+            status_code=500,
+            headers={"Access-Control-Allow-Origin": "*"},
+        )

apps/backend/src/opencloudtouch/bmx/stream_utils.py

@@ -0,0 +1,26 @@
+"""Shared stream URL utilities for BMX modules."""
+
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+def convert_https_to_http(url: str) -> str:
+    """Convert HTTPS URLs to HTTP for Bose device compatibility.
+
+    Bose SoundTouch devices cannot play HTTPS streams directly.
+    Most radio stations support both HTTP and HTTPS, so we try HTTP first.
+
+    Args:
+        url: Stream URL (may be HTTPS or HTTP)
+
+    Returns:
+        HTTP version of the URL (https:// → http://)
+    """
+    if url.startswith("https://"):
+        http_url = "http://" + url[8:]  # NOSONAR - intentional HTTP for Bose SoundTouch
+        logger.info(
+            f"[BMX] Converting HTTPS to HTTP: {url[:50]}... → {http_url[:50]}..."
+        )
+        return http_url
+    return url

apps/backend/src/opencloudtouch/bmx/tunein.py

@@ -12,6 +12,7 @@
 import httpx
 
 from opencloudtouch.bmx.models import BmxAudio, BmxPlaybackResponse, BmxStream
+from opencloudtouch.bmx.stream_utils import convert_https_to_http
 
 logger = logging.getLogger(__name__)
 
@@ -96,7 +97,9 @@ async def resolve_tunein_station(station_id: str) -> BmxPlaybackResponse:
 
             stream_resp = await client.get(TUNEIN_STREAM_URL % station_id)
             stream_urls = [
-                u.strip() for u in stream_resp.text.splitlines() if u.strip()
+                convert_https_to_http(u.strip())
+                for u in stream_resp.text.splitlines()
+                if u.strip()
             ]
 
             if not stream_urls: