Unlock everything, add a donation link, credit Last.fm, nudge re-linking

- Every feature is free for everyone (the plan system stays for later);
  remaining limits are abuse guards
- Optional website donation link (NEXT_PUBLIC_DONATION_URL). Not shown in
  the mobile apps, where tips to the developer generally need in-app
  purchase
- Last.fm/ListenBrainz-sourced plays link to the user's profile, as
  Last.fm's API terms require
- Connections track when they last saw activity; a scrobbler silent for
  over a week prompts re-linking Spotify (its link expires every 6 months)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MzFywujuH9TiuXbr9vjoX8

apps/api/test/connections.test.ts

@@ -29,7 +29,7 @@ describe('username connections', () => {
     expect(res.statusCode).toBe(404);
   });
 
-  it('enforces the per-plan connection limit, but reconnecting is free', async () => {
+  it('lets everyone connect several services, and reconnecting never counts twice', async () => {
     vi.stubGlobal(
       'fetch',
       routeFetch([
@@ -44,8 +44,8 @@ describe('username connections', () => {
     expect(ok.statusCode).toBe(200);
     const again = await app().inject({ method: 'POST', url: '/connections/lastfm', headers: bearer(token), payload: { username: 'rj' } });
     expect(again.statusCode).toBe(200);
-    const over = await app().inject({ method: 'POST', url: '/connections/listenbrainz', headers: bearer(token), payload: { username: 'x' } });
-    expect(over.statusCode).toBe(402);
+    const fourth = await app().inject({ method: 'POST', url: '/connections/listenbrainz', headers: bearer(token), payload: { username: 'x' } });
+    expect(fourth.statusCode).toBe(200);
   });
 
   it('disconnect removes the connection and its schedule', async () => {

apps/api/test/history.test.ts

@@ -71,3 +71,14 @@ describe('listening history', () => {
     expect(await db.select().from(schema.listens)).toHaveLength(0);
   });
 });
+
+describe('attribution', () => {
+  it('links Last.fm-sourced plays back to the Last.fm profile (required by Last.fm)', async () => {
+    const { user } = await createUser(app(), 'bob');
+    await db.insert(schema.connections).values({ userId: user.id, provider: 'lastfm', externalUserId: 'RJ', displayName: 'RJ' });
+    await applyPollResult(user.id, 'lastfm', playing('Disorder'), { sourceUrl: 'https://www.last.fm/user/RJ' });
+    const profile = (await app().inject({ url: '/users/bob' })).json();
+    expect(profile.nowPlaying.sourceUrl).toBe('https://www.last.fm/user/RJ');
+    expect(profile.attribution).toEqual({ lastfm: 'https://www.last.fm/user/RJ' });
+  });
+});

apps/api/test/social.test.ts

@@ -1,6 +1,5 @@
-import { eq } from 'drizzle-orm';
 import { describe, expect, it } from 'vitest';
-import { db, schema } from '../src/db';
+import { PLAN_ENTITLEMENTS } from '@musicshare/shared';
 import { applyPollResult } from '../src/services/nowPlaying';
 import { bearer, createUser, follow, useTestApp } from './helpers';
 
@@ -80,15 +79,21 @@ describe('pinned friends', () => {
     expect(await feedOrder(alice.token)).toEqual(['*bob', '*dave', 'erin', 'carol']);
   });
 
-  it('enforces the plan limit with 402, and plus raises it', async () => {
-    const { alice } = await setup();
-    for (const name of ['bob', 'carol', 'dave']) expect((await pin(alice.token, name)).statusCode).toBe(200);
-    const fourth = await pin(alice.token, 'erin');
-    expect(fourth.statusCode).toBe(402);
-    expect(fourth.json().error).toBe('You can pin up to 3 friends on your plan');
+  it('caps pins as an abuse guard (402 past the limit), and unpinning frees a slot', async () => {
+    const max = PLAN_ENTITLEMENTS.free.maxPinnedFriends;
+    const alice = await createUser(app(), 'alice');
+    const names = Array.from({ length: max + 1 }, (_, i) => `friend${i}`);
+    for (const name of names) {
+      await createUser(app(), name);
+      await follow(app(), alice.token, name);
+    }
+    for (const name of names.slice(0, max)) expect((await pin(alice.token, name)).statusCode).toBe(200);
+    const over = await pin(alice.token, names[max]!);
+    expect(over.statusCode).toBe(402);
+    expect(over.json().error).toBe(`You can pin up to ${max} friends on your plan`);
 
-    await db.update(schema.users).set({ plan: 'plus' }).where(eq(schema.users.id, alice.user.id));
-    expect((await pin(alice.token, 'erin')).statusCode).toBe(200);
+    await pin(alice.token, names[0]!, 'DELETE');
+    expect((await pin(alice.token, names[max]!)).statusCode).toBe(200);
   });
 
   it('pinning is idempotent and does not count twice', async () => {
@@ -108,10 +113,4 @@ describe('pinned friends', () => {
     expect((await app().inject({ url: '/users/bob', headers: bearer(alice.token) })).json().isPinned).toBe(false);
   });
 
-  it('unpin frees a slot', async () => {
-    const { alice } = await setup();
-    for (const name of ['bob', 'carol', 'dave']) await pin(alice.token, name);
-    await pin(alice.token, 'bob', 'DELETE');
-    expect((await pin(alice.token, 'erin')).statusCode).toBe(200);
-  });
 });