From 56493f5ea7e1586415f38eb3beb06d4b2ae298f4 Mon Sep 17 00:00:00 2001
From: "Troll (Hermes Agent)" <ai@hallsworth.ca>
Date: Mon, 3 Aug 2026 18:49:26 +0000
Subject: [PATCH] feat: disable direct MP3 download from customer player page

- Add controlsList=nodownload to audio elements.
- Serve audio with Content-Disposition: inline to discourage browser save dialogs.
---
 app.py                | 5 ++++-
 templates/player.html | 4 ++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/app.py b/app.py
index 30f8990..5caff8a 100644
--- a/app.py
+++ b/app.py
@@ -649,7 +649,10 @@ def audio(token, version):
     path = req.get(field)
     if not path or not Path(path).exists():
         abort(404)
-    return send_from_directory(Path(path).parent, Path(path).name)
+    response = send_from_directory(Path(path).parent, Path(path).name)
+    response.headers['Content-Disposition'] = 'inline'
+    response.headers['X-Content-Type-Options'] = 'nosniff'
+    return response
 
 
 # ---------------------------------------------------------------------------
diff --git a/templates/player.html b/templates/player.html
index 00aacb8..212b252 100644
--- a/templates/player.html
+++ b/templates/player.html
@@ -131,13 +131,13 @@
     <!-- Version A player -->
     <div class="player">
       <h3>Version A</h3>
-      <audio controls src="{{ url_for('audio', token=req.player_token, version='a') }}"></audio>
+      <audio controls controlsList="nodownload" src="{{ url_for('audio', token=req.player_token, version='a') }}"></audio>
     </div>
 
     <!-- Version B player -->
     <div class="player">
       <h3>Version B</h3>
-      <audio controls src="{{ url_for('audio', token=req.player_token, version='b') }}"></audio>
+      <audio controls controlsList="nodownload" src="{{ url_for('audio', token=req.player_token, version='b') }}"></audio>
     </div>
 
     {% if req.status == 'revisions_requested' %}