ai generated solutions to our ai generated problems

server.cjs

@@ -129,7 +129,7 @@ const CSP_DIRECTIVES = [
   "style-src 'self'",
   "style-src-elem 'self'",
   "style-src-attr 'unsafe-inline'",
-  "img-src 'self' data: blob: https://*.basemaps.cartocdn.com https://basemaps.cartocdn.com",
+  "img-src 'self' data: blob: https://*.basemaps.cartocdn.com https://basemaps.cartocdn.com https://lastfm.freetls.fastly.net https://*.lastfm.freetls.fastly.net",
   "font-src 'self' data:",
   "connect-src 'self' https://challenges.cloudflare.com",
   "frame-src https://challenges.cloudflare.com",
@@ -204,6 +204,22 @@ function todayKey() {
   return new Date().toISOString().slice(0, 10)
 }
 
+function lastfmImage(track) {
+  const images = Array.isArray(track.image) ? track.image : []
+  const image = [...images].reverse().find((item) => item?.['#text'])
+  const url = image?.['#text'] || ''
+  if (!url) return ''
+
+  try {
+    const parsed = new URL(url)
+    if (parsed.protocol !== 'https:') return ''
+    if (parsed.hostname !== 'lastfm.freetls.fastly.net' && !parsed.hostname.endsWith('.lastfm.freetls.fastly.net')) return ''
+    return parsed.toString()
+  } catch {
+    return ''
+  }
+}
+
 function normalizeLastfmTrack(track) {
   const artist = track?.artist?.['#text'] || track?.artist?.name || ''
   const name = track?.name || ''
@@ -215,7 +231,7 @@ function normalizeLastfmTrack(track) {
     name,
     album: track?.album?.['#text'] || '',
     url: track?.url || '',
-    image: '',
+    image: lastfmImage(track),
     played_at: track?.date?.uts ? Number(track.date.uts) : null,
   }
 }