Fix Apple Music library sync and ATProto write scopes

[mmattbtw]

Summary

• request both catalog songs and library songs from Apple Music's recently played tracks endpoint
• align the client-side limit guard with Apple's documented maximum
• include structured Apple Music API error details in tracker logs
• request explicit AT Protocol create/update actions for play and status records
• add regression coverage for the Apple Music query, API errors, and OAuth scopes

Root cause

Piper queried the recently played tracks endpoint without the types parameter. Apple consequently returned only catalog songs for affected users, leaving newer library or uploaded tracks invisible to the tracker. Separately, PDS writes were rejected with ScopeMissingError because the OAuth request did not explicitly advertise the record actions now enforced by the PDS.

Impact

Library and uploaded Apple Music tracks can now become the latest tracked item. Apple authorization failures will contain actionable API details instead of only an HTTP status. New AT Protocol sessions request the exact write actions Piper uses.

Existing users must authenticate with Piper again before their AT Protocol session receives the new action-specific scopes.

Apple Music still exposes recently played history rather than live playback progress, so updates remain subject to Apple's history latency.

Validation

• go test ./service/applemusic
• go test ./oauth/atproto
• go test ./...
• git diff --check

Summary by CodeRabbit

• Improvements
  • Refined AT Protocol authorization to request only the permissions needed for posting feeds and managing actor status.
  • Improved Apple Music recent-track requests by limiting results to 30 and including song and library-song data.
  • Enhanced Apple Music error messages with detailed titles, descriptions, and error codes when available.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b981bdb0-deda-4b24-a4e2-d62815a8de61

📥 Commits

Reviewing files that changed from the base of the PR and between 41bc823 and 2d2b885.

📒 Files selected for processing (4)

• oauth/atproto/atproto.go
• oauth/atproto/atproto_test.go
• service/applemusic/applemusic.go
• service/applemusic/applemusic_test.go

---

📝 Walkthrough

Walkthrough

The PR narrows AT Protocol OAuth scopes to required write actions. It also limits Apple Music recent-track requests, requests song types explicitly, and includes structured details in API errors.

Changes

AT Protocol OAuth permissions

Layer / File(s)	Summary
Scope wiring and validation oauth/atproto/atproto.go, oauth/atproto/atproto_test.go	The constructor uses atprotoOAuthScopes(). The helper requests feed creation and actor-status creation/update permissions. Tests verify the returned scopes.

Apple Music request handling

Layer / File(s)	Summary
Recent-track requests and structured errors service/applemusic/applemusic.go, service/applemusic/applemusic_test.go	Recent-track requests cap the limit at 30 and include songs,library-songs. Non-200 responses expose HTTP and structured Apple Music error details. Tests verify both behaviors.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• teal-fm/piper#68: Both PRs modify AT Protocol OAuth scopes, but this PR changes requested permissions while that PR renames alpha namespace resources.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/fix-apple-music-sync

---

_{Comment @coderabbitai help to get the list of available commands.}