From 5863c32e35d6cd81f1d3a74e5fda9c270cda0e1e Mon Sep 17 00:00:00 2001
From: "Troll (Hermes Agent)" <ai@hallsworth.ca>
Date: Mon, 3 Aug 2026 18:52:01 +0000
Subject: [PATCH] ui: assign audio src via JS so direct MP3 URLs are not in
 page source

---
 templates/player.html | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/templates/player.html b/templates/player.html
index 212b252..27a2c7e 100644
--- a/templates/player.html
+++ b/templates/player.html
@@ -131,15 +131,23 @@
     <!-- Version A player -->
     <div class="player">
       <h3>Version A</h3>
-      <audio controls controlsList="nodownload" src="{{ url_for('audio', token=req.player_token, version='a') }}"></audio>
+      <audio controls controlsList="nodownload" id="player-a"></audio>
     </div>
 
     <!-- Version B player -->
     <div class="player">
       <h3>Version B</h3>
-      <audio controls controlsList="nodownload" src="{{ url_for('audio', token=req.player_token, version='b') }}"></audio>
+      <audio controls controlsList="nodownload" id="player-b"></audio>
     </div>
 
+    <script>
+      (function(){
+        // Audio sources are assigned via JS so they do not appear in static HTML source.
+        document.getElementById('player-a').src = "{{ url_for('audio', token=req.player_token, version='a') }}";
+        document.getElementById('player-b').src = "{{ url_for('audio', token=req.player_token, version='b') }}";
+      })();
+    </script>
+
     {% if req.status == 'revisions_requested' %}
     <!-- Customer asked for changes; lock the page and tell them to wait -->
     <div class="locked waiting">