feat(spotify): import liked songs from exports or OAuth PKCE

[notgamermx]

Draft proposal: the README and PR template currently state that Metrolist is in a feature freeze. This is a standalone Spotify import proposal for maintainer consideration; it is not presented as an approved feature or ready to merge.

Problem

Users migrating from Spotify currently have to find and like their saved songs individually in Metrolist.

Cause

Settings has no importer for Spotify liked-library metadata.

Solution

• Add a Spotify Liked Songs dialog under Settings with progress, cancellation, existing-like detection and unmatched-song reporting.
• Import saved-track JSON or CSV exports without requiring a Spotify connection. Match title, primary artist, explicit status when known, and duration when available before adding local likes. Audio is not copied and likes are not synchronized to YouTube by this importer.
• Offer optional read-only OAuth PKCE (user-library-read) using the external browser, a loopback callback with state validation, and encrypted token storage under noBackupFilesDir using Android Keystore. No client secret is required.
• Bound import size, row count, JSON nesting and metadata. Oversized song metadata is skipped without losing valid rows; malformed or oversized files are rejected.
• Keep Metrolist branding, navigation, database schema and version unchanged. Build configuration changes only enable Android resources for unit tests and export the JDK internal file-descriptor interface required by Robolectric; production app configuration is unchanged.

Direct OAuth requires the user's own Spotify developer app and is subject to Spotify development-mode eligibility. The callback follows Spotify's loopback redirect guidance. File import remains the fallback.

Testing

• :app:assembleFossDebug, :app:testFossDebugUnitTest and :innertube:test passed with JDK 21.
• 237 tests passed across 56 suites, including 19 Spotify-specific tests, with no failures or skips.
• Regression coverage checks PKCE/state validation, missing callback payloads, sign-in cancellation, cancellation of a live pending HTTP request, JSON/CSV parsing and bounds, duplicates, oversized-row skipping, and conservative matching.

CodeRabbit CLI reviewed this patch before the PR. Its first review reported three issues: blocking network cancellation, accepting a callback without a code/error, and rejecting an entire export for one oversized metadata row. All three were fixed and regression coverage added. Final CodeRabbit result: 0 findings across all 13 files.

Live Spotify authorization, real-device UI testing and an end-to-end migration have not been performed on this isolated branch. No personal exports, credentials, signing keys or APKs are included.

Related Issues

No linked or previously approved feature issue.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}