CORE: Added Last.FM scrobbling

Cargo.lock

@@ -1418,7 +1418,7 @@ checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
 
 [[package]]
 name = "furumusic"
-version = "0.1.20"
+version = "0.1.21"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1430,6 +1430,7 @@ dependencies = [
  "id3",
  "image",
  "librqbit",
+ "md-5",
  "openidconnect",
  "reqwest",
  "schemars 0.9.0",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "furumusic"
-version = "0.1.20"
+version = "0.1.21"
 edition = "2024"
 description = "Reusable web-app boilerplate: auth, OIDC/SSO, admin panel, user management, i18n, PostgreSQL"
 
@@ -20,6 +20,7 @@ symphonia = { version = "0.5", default-features = false, features = ["mp3","aac"
 id3 = "1"
 encoding_rs = "0.8"
 sha2 = "0.10"
+md-5 = "0.10"
 image = { version = "0.25", default-features = false, features = ["jpeg", "png", "webp", "gif", "bmp"] }
 sqlx = { version = "0.8", features = ["runtime-tokio-rustls", "postgres"] }
 anyhow = "1.0"

src/admin/v2.rs

@@ -260,6 +260,8 @@ struct AdminSettingsDto {
     values: AdminSettingsValues,
     sources: AdminSettingsSources,
     lastfm_api_key_configured: bool,
+    lastfm_shared_secret_configured: bool,
+    lastfm_scrobbling_configured: bool,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
@@ -274,6 +276,7 @@ struct AdminSettingsValues {
     oidc_user_groups: String,
     swagger_enabled: bool,
     lastfm_api_key: String,
+    lastfm_shared_secret: String,
     agent_enabled: bool,
     agent_inbox_dir: String,
     agent_storage_dir: String,
@@ -297,6 +300,7 @@ struct AdminSettingsSources {
     oidc_user_groups: &'static str,
     swagger_enabled: &'static str,
     lastfm_api_key: &'static str,
+    lastfm_shared_secret: &'static str,
     agent_enabled: &'static str,
     agent_inbox_dir: &'static str,
     agent_storage_dir: &'static str,
@@ -320,6 +324,7 @@ pub(super) struct UpdateSettingsRequest {
     oidc_user_groups: String,
     swagger_enabled: bool,
     lastfm_api_key: String,
+    lastfm_shared_secret: String,
     agent_enabled: bool,
     agent_inbox_dir: String,
     agent_storage_dir: String,
@@ -709,6 +714,10 @@ pub async fn update_settings(
         ("oidc_user_groups", body.oidc_user_groups.trim().to_string()),
         ("swagger_enabled", body.swagger_enabled.to_string()),
         ("lastfm_api_key", body.lastfm_api_key.trim().to_string()),
+        (
+            "lastfm_shared_secret",
+            body.lastfm_shared_secret.trim().to_string(),
+        ),
         ("agent_enabled", body.agent_enabled.to_string()),
         ("agent_inbox_dir", body.agent_inbox_dir.trim().to_string()),
         (
@@ -785,6 +794,9 @@ pub async fn settings_probe(
 fn settings_dto(config: AppConfig, sources: ConfigSources) -> AdminSettingsDto {
     AdminSettingsDto {
         lastfm_api_key_configured: !config.lastfm_api_key.trim().is_empty(),
+        lastfm_shared_secret_configured: !config.lastfm_shared_secret.trim().is_empty(),
+        lastfm_scrobbling_configured: !config.lastfm_api_key.trim().is_empty()
+            && !config.lastfm_shared_secret.trim().is_empty(),
         values: AdminSettingsValues {
             auth_password_enabled: config.auth_password_enabled,
             auth_sso_enabled: config.auth_sso_enabled,
@@ -796,6 +808,7 @@ fn settings_dto(config: AppConfig, sources: ConfigSources) -> AdminSettingsDto {
             oidc_user_groups: config.oidc_user_groups,
             swagger_enabled: config.swagger_enabled,
             lastfm_api_key: config.lastfm_api_key,
+            lastfm_shared_secret: config.lastfm_shared_secret,
             agent_enabled: config.agent_enabled,
             agent_inbox_dir: config.agent_inbox_dir,
             agent_storage_dir: config.agent_storage_dir,
@@ -817,6 +830,7 @@ fn settings_dto(config: AppConfig, sources: ConfigSources) -> AdminSettingsDto {
             oidc_user_groups: sources.oidc_user_groups.code(),
             swagger_enabled: sources.swagger_enabled.code(),
             lastfm_api_key: sources.lastfm_api_key.code(),
+            lastfm_shared_secret: sources.lastfm_shared_secret.code(),
             agent_enabled: sources.agent_enabled.code(),
             agent_inbox_dir: sources.agent_inbox_dir.code(),
             agent_storage_dir: sources.agent_storage_dir.code(),

src/admin/views.rs

@@ -184,6 +184,16 @@ fn config_display_entries(config: &AppConfig, sources: &ConfigSources) -> Vec<Co
             config.agent_concurrency.to_string(),
             defaults.agent_concurrency.to_string()
         ),
+        entry!(
+            lastfm_api_key,
+            config.lastfm_api_key.clone(),
+            defaults.lastfm_api_key.clone()
+        ),
+        entry!(
+            lastfm_shared_secret,
+            config.lastfm_shared_secret.clone(),
+            defaults.lastfm_shared_secret.clone()
+        ),
     ]
 }
 
@@ -258,6 +268,10 @@ struct SettingsTemplate {
     agent_context_limit_source: &'static str,
     agent_concurrency: String,
     agent_concurrency_source: &'static str,
+    lastfm_api_key: String,
+    lastfm_api_key_source: &'static str,
+    lastfm_shared_secret: String,
+    lastfm_shared_secret_source: &'static str,
 }
 
 pub async fn settings_handler(
@@ -310,6 +324,10 @@ pub async fn settings_handler(
         agent_context_limit_source: sources.agent_context_limit.code(),
         agent_concurrency: config.agent_concurrency.to_string(),
         agent_concurrency_source: sources.agent_concurrency.code(),
+        lastfm_api_key: config.lastfm_api_key.clone(),
+        lastfm_api_key_source: sources.lastfm_api_key.code(),
+        lastfm_shared_secret: config.lastfm_shared_secret.clone(),
+        lastfm_shared_secret_source: sources.lastfm_shared_secret.code(),
     };
     Ok(Html::new(template.render()?))
 }
@@ -334,6 +352,8 @@ pub struct OidcSettingsForm {
     agent_confidence_threshold: Option<String>,
     agent_context_limit: Option<String>,
     agent_concurrency: Option<String>,
+    lastfm_api_key: Option<String>,
+    lastfm_shared_secret: Option<String>,
 }
 
 pub async fn settings_submit(
@@ -380,7 +400,9 @@ pub async fn settings_submit(
             let agent_confidence_threshold = data.agent_confidence_threshold.unwrap_or_default();
             let agent_context_limit = data.agent_context_limit.unwrap_or_default();
             let agent_concurrency = data.agent_concurrency.unwrap_or_default();
-            let fields: [(&str, &str); 18] = [
+            let lastfm_api_key = data.lastfm_api_key.unwrap_or_default();
+            let lastfm_shared_secret = data.lastfm_shared_secret.unwrap_or_default();
+            let fields: [(&str, &str); 20] = [
                 ("auth_password_enabled", pw_enabled),
                 ("auth_sso_enabled", sso_enabled),
                 ("oidc_button_text", &oidc_button_text),
@@ -399,6 +421,8 @@ pub async fn settings_submit(
                 ("agent_confidence_threshold", &agent_confidence_threshold),
                 ("agent_context_limit", &agent_context_limit),
                 ("agent_concurrency", &agent_concurrency),
+                ("lastfm_api_key", &lastfm_api_key),
+                ("lastfm_shared_secret", &lastfm_shared_secret),
             ];
             for (key, value) in fields {
                 let mut entry = ConfigEntry::new(key.to_owned(), value.to_owned());

src/config.rs

@@ -134,6 +134,7 @@ pub struct ConfigSources {
     pub agent_context_limit: ConfigSource,
     pub agent_concurrency: ConfigSource,
     pub lastfm_api_key: ConfigSource,
+    pub lastfm_shared_secret: ConfigSource,
 }
 
 impl Default for ConfigSources {
@@ -160,6 +161,7 @@ impl Default for ConfigSources {
             agent_context_limit: ConfigSource::Default,
             agent_concurrency: ConfigSource::Default,
             lastfm_api_key: ConfigSource::Default,
+            lastfm_shared_secret: ConfigSource::Default,
         }
     }
 }
@@ -266,6 +268,8 @@ pub struct AppConfig {
     pub agent_concurrency: u64,
     /// Last.fm API key for weekly popularity enrichment.
     pub lastfm_api_key: String,
+    /// Last.fm shared secret for authenticated scrobbling calls.
+    pub lastfm_shared_secret: String,
 }
 
 impl Default for AppConfig {
@@ -292,6 +296,7 @@ impl Default for AppConfig {
             agent_context_limit: 8192,
             agent_concurrency: 2,
             lastfm_api_key: String::new(),
+            lastfm_shared_secret: String::new(),
         }
     }
 }
@@ -319,6 +324,7 @@ impl_env_overrides!(
     agent_context_limit,
     agent_concurrency,
     lastfm_api_key,
+    lastfm_shared_secret,
 );
 
 impl AppConfig {
@@ -403,6 +409,7 @@ impl AppConfig {
         apply_db_field!(agent_context_limit);
         apply_db_field!(agent_concurrency);
         apply_db_field!(lastfm_api_key);
+        apply_db_field!(lastfm_shared_secret);
     }
 }
 

src/i18n/phrases.rs

@@ -95,6 +95,10 @@ translations! {
     settings_api:             "API"                           , "API";
     settings_swagger:         "Swagger UI"                    , "Swagger UI";
     settings_swagger_help:    "Serves interactive API docs at /swagger/ (requires restart)" , "Интерактивная документация API на /swagger/ (требуется перезапуск)";
+    settings_lastfm_api_key:  "Last.fm API key"               , "API ключ Last.fm";
+    settings_lastfm_api_key_help: "Used for Last.fm popularity and account connection" , "Используется для популярности Last.fm и подключения аккаунта";
+    settings_lastfm_shared_secret: "Last.fm shared secret"    , "Shared secret Last.fm";
+    settings_lastfm_shared_secret_help: "Required for signed Last.fm scrobbling requests" , "Нужен для подписанных запросов скробблинга Last.fm";
 
     // OIDC login errors
     login_oidc_error:         "SSO login failed. Please try again." , "Ошибка входа через SSO. Попробуйте ещё раз.";
@@ -327,6 +331,14 @@ translations! {
     player_lastfm_playcount: "Last.fm plays"                   , "Прослушивания Last.fm";
     player_lastfm_updated:   "Last.fm updated"                 , "Last.fm обновлён";
     player_lastfm_not_loaded: "not loaded yet"                 , "ещё не загружено";
+    player_lastfm_profile:   "Last.fm"                         , "Last.fm";
+    player_lastfm_connect:   "Connect Last.fm"                 , "Подключить Last.fm";
+    player_lastfm_connected: "Connected as {user}"             , "Подключён: {user}";
+    player_lastfm_reconnect: "Reconnect Last.fm"               , "Переподключить Last.fm";
+    player_lastfm_not_configured: "Last.fm is not configured"  , "Last.fm не настроен";
+    player_lastfm_disconnect_confirm: "Disconnect Last.fm account {user}?" , "Отвязать аккаунт Last.fm {user}?";
+    player_lastfm_connect_failed: "Could not open Last.fm connection" , "Не удалось открыть подключение Last.fm";
+    player_lastfm_disconnect_failed: "Could not disconnect Last.fm" , "Не удалось отвязать Last.fm";
     player_play:             "Play"                            , "Играть";
     player_like:             "Like"                            , "Лайк";
     player_add_to_queue:     "Add to queue"                    , "Добавить в очередь";

src/jobs/lastfm_scrobble.rs

@@ -0,0 +1,34 @@
+use crate::lastfm;
+use crate::scheduler::{Job, JobContext, JobLog};
+
+pub struct LastfmScrobbleJob;
+
+#[async_trait::async_trait]
+impl Job for LastfmScrobbleJob {
+    fn name(&self) -> &'static str {
+        "lastfm_scrobble"
+    }
+
+    fn description(&self) -> &'static str {
+        "Send queued Last.fm scrobbles for connected users"
+    }
+
+    fn default_cron(&self) -> &'static str {
+        // Every minute.
+        "0 * * * * *"
+    }
+
+    async fn run(&self, ctx: &JobContext, log: &mut JobLog) -> anyhow::Result<()> {
+        if !lastfm::is_configured(&ctx.config) {
+            log.warn("Last.fm API key/shared secret are not configured; skipping scrobble outbox");
+            return Ok(());
+        }
+
+        let summary = lastfm::process_pending_scrobbles(&ctx.pool, &ctx.config, None, 50).await?;
+        log.info(&format!(
+            "Last.fm scrobble outbox processed: considered={}, sent={}, failed={}, blocked={}, skipped={}",
+            summary.considered, summary.sent, summary.failed, summary.blocked, summary.skipped
+        ));
+        Ok(())
+    }
+}

src/jobs/mod.rs

@@ -5,6 +5,7 @@ pub mod cover_variant_backfill;
 pub mod inbox_discover;
 pub mod inbox_process;
 pub mod lastfm_popularity;
+pub mod lastfm_scrobble;
 pub mod metadata_backfill;
 
 use std::path::{Component, Path, PathBuf};

src/lastfm.rs

@@ -0,0 +1,619 @@
+use std::collections::BTreeMap;
+use std::time::Duration;
+
+use anyhow::Context;
+use md5::{Digest, Md5};
+use reqwest::Client;
+use serde::Deserialize;
+use sqlx::PgPool;
+
+use crate::config::AppConfig;
+
+const LASTFM_API_URL: &str = "https://ws.audioscrobbler.com/2.0/";
+const MAX_BATCH_SIZE: i64 = 50;
+const MAX_ATTEMPTS: i32 = 8;
+
+#[derive(Debug, Clone)]
+pub struct LastfmCredentials {
+    api_key: String,
+    shared_secret: String,
+}
+
+#[derive(Debug, Clone)]
+pub struct LastfmSession {
+    pub username: String,
+    pub session_key: String,
+}
+
+#[derive(Debug, Clone)]
+pub struct LastfmTrackPayload {
+    pub artist: String,
+    pub track: String,
+    pub album: Option<String>,
+    pub album_artist: Option<String>,
+    pub track_number: Option<i32>,
+    pub duration_seconds: Option<i32>,
+}
+
+#[derive(Debug, Clone)]
+pub struct LastfmScrobblePayload {
+    pub track: LastfmTrackPayload,
+    pub timestamp: i64,
+}
+
+#[derive(Debug)]
+pub struct LastfmApiError {
+    pub code: Option<i32>,
+    pub message: String,
+}
+
+impl std::fmt::Display for LastfmApiError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self.code {
+            Some(code) => write!(f, "Last.fm API error {code}: {}", self.message),
+            None => write!(f, "Last.fm API error: {}", self.message),
+        }
+    }
+}
+
+impl std::error::Error for LastfmApiError {}
+
+impl LastfmApiError {
+    fn new(code: Option<i32>, message: impl Into<String>) -> Self {
+        Self {
+            code,
+            message: message.into(),
+        }
+    }
+
+    pub fn is_invalid_session(&self) -> bool {
+        self.code == Some(9)
+    }
+
+    pub fn is_retryable(&self) -> bool {
+        matches!(self.code, Some(11 | 16 | 29) | None)
+    }
+}
+
+#[derive(Debug, Default)]
+pub struct ScrobbleProcessSummary {
+    pub considered: u64,
+    pub sent: u64,
+    pub failed: u64,
+    pub blocked: u64,
+    pub skipped: u64,
+}
+
+pub fn is_configured(config: &AppConfig) -> bool {
+    !config.lastfm_api_key.trim().is_empty() && !config.lastfm_shared_secret.trim().is_empty()
+}
+
+impl LastfmCredentials {
+    pub fn from_config(config: &AppConfig) -> Option<Self> {
+        let api_key = config.lastfm_api_key.trim();
+        let shared_secret = config.lastfm_shared_secret.trim();
+        if api_key.is_empty() || shared_secret.is_empty() {
+            return None;
+        }
+        Some(Self {
+            api_key: api_key.to_owned(),
+            shared_secret: shared_secret.to_owned(),
+        })
+    }
+
+    pub fn api_key(&self) -> &str {
+        &self.api_key
+    }
+}
+
+pub struct LastfmClient {
+    client: Client,
+    credentials: LastfmCredentials,
+}
+
+impl LastfmClient {
+    pub fn new(credentials: LastfmCredentials) -> anyhow::Result<Self> {
+        let client = Client::builder()
+            .user_agent(format!(
+                "furumusic-lastfm-scrobbler/{}",
+                env!("CARGO_PKG_VERSION")
+            ))
+            .timeout(Duration::from_secs(15))
+            .build()
+            .context("failed to build Last.fm HTTP client")?;
+        Ok(Self {
+            client,
+            credentials,
+        })
+    }
+
+    pub async fn get_session(&self, token: &str) -> Result<LastfmSession, LastfmApiError> {
+        let params = self.signed_params(
+            "auth.getSession",
+            None,
+            vec![("token".to_string(), token.to_string())],
+        );
+        let body = self.post(params).await?;
+        let response: AuthSessionResponse = serde_json::from_str(&body)
+            .map_err(|err| LastfmApiError::new(None, err.to_string()))?;
+        if let Some(code) = response.error {
+            return Err(LastfmApiError::new(
+                Some(code),
+                response
+                    .message
+                    .unwrap_or_else(|| "authentication failed".to_string()),
+            ));
+        }
+        let Some(session) = response.session else {
+            return Err(LastfmApiError::new(
+                None,
+                "Last.fm auth response did not include a session",
+            ));
+        };
+        Ok(LastfmSession {
+            username: session.name,
+            session_key: session.key,
+        })
+    }
+
+    pub async fn update_now_playing(
+        &self,
+        session_key: &str,
+        track: &LastfmTrackPayload,
+    ) -> Result<(), LastfmApiError> {
+        let mut extra = vec![
+            ("artist".to_string(), track.artist.clone()),
+            ("track".to_string(), track.track.clone()),
+        ];
+        push_optional(&mut extra, "album", track.album.as_deref());
+        push_optional(&mut extra, "albumArtist", track.album_artist.as_deref());
+        push_optional_i32(&mut extra, "trackNumber", track.track_number);
+        push_optional_i32(&mut extra, "duration", track.duration_seconds);
+
+        let params = self.signed_params("track.updateNowPlaying", Some(session_key), extra);
+        let body = self.post(params).await?;
+        check_lastfm_error(&body)
+    }
+
+    pub async fn scrobble_batch(
+        &self,
+        session_key: &str,
+        scrobbles: &[LastfmScrobblePayload],
+    ) -> Result<(), LastfmApiError> {
+        let mut extra = Vec::new();
+        for (index, scrobble) in scrobbles.iter().take(MAX_BATCH_SIZE as usize).enumerate() {
+            let suffix = format!("[{index}]");
+            extra.push((format!("artist{suffix}"), scrobble.track.artist.clone()));
+            extra.push((format!("track{suffix}"), scrobble.track.track.clone()));
+            extra.push((format!("timestamp{suffix}"), scrobble.timestamp.to_string()));
+            push_optional(
+                &mut extra,
+                &format!("album{suffix}"),
+                scrobble.track.album.as_deref(),
+            );
+            push_optional(
+                &mut extra,
+                &format!("albumArtist{suffix}"),
+                scrobble.track.album_artist.as_deref(),
+            );
+            push_optional_i32(
+                &mut extra,
+                &format!("trackNumber{suffix}"),
+                scrobble.track.track_number,
+            );
+            push_optional_i32(
+                &mut extra,
+                &format!("duration{suffix}"),
+                scrobble.track.duration_seconds,
+            );
+        }
+
+        let params = self.signed_params("track.scrobble", Some(session_key), extra);
+        let body = self.post(params).await?;
+        check_lastfm_error(&body)
+    }
+
+    fn signed_params(
+        &self,
+        method: &str,
+        session_key: Option<&str>,
+        extra: Vec<(String, String)>,
+    ) -> Vec<(String, String)> {
+        let mut params = BTreeMap::new();
+        params.insert("api_key".to_string(), self.credentials.api_key.clone());
+        params.insert("method".to_string(), method.to_string());
+        if let Some(session_key) = session_key {
+            params.insert("sk".to_string(), session_key.to_string());
+        }
+        for (key, value) in extra {
+            params.insert(key, value);
+        }
+
+        let mut signature_input = String::new();
+        for (key, value) in &params {
+            signature_input.push_str(key);
+            signature_input.push_str(value);
+        }
+        signature_input.push_str(&self.credentials.shared_secret);
+        let digest = Md5::digest(signature_input.as_bytes());
+        let api_sig = format!("{digest:x}");
+
+        let mut out = params.into_iter().collect::<Vec<_>>();
+        out.push(("api_sig".to_string(), api_sig));
+        out.push(("format".to_string(), "json".to_string()));
+        out
+    }
+
+    async fn post(&self, params: Vec<(String, String)>) -> Result<String, LastfmApiError> {
+        let response = self
+            .client
+            .post(LASTFM_API_URL)
+            .form(&params)
+            .send()
+            .await
+            .map_err(|err| LastfmApiError::new(None, err.to_string()))?;
+        let status = response.status();
+        let body = response
+            .text()
+            .await
+            .map_err(|err| LastfmApiError::new(None, err.to_string()))?;
+        if !status.is_success() {
+            if let Some(err) = parse_error(&body) {
+                return Err(err);
+            }
+            return Err(LastfmApiError::new(None, format!("HTTP {status}: {body}")));
+        }
+        Ok(body)
+    }
+}
+
+pub async fn process_pending_scrobbles(
+    pool: &PgPool,
+    config: &AppConfig,
+    user_id: Option<i64>,
+    limit_per_user: i64,
+) -> anyhow::Result<ScrobbleProcessSummary> {
+    let Some(credentials) = LastfmCredentials::from_config(config) else {
+        return Ok(ScrobbleProcessSummary::default());
+    };
+    let client = LastfmClient::new(credentials)?;
+    let user_ids = pending_user_ids(pool, user_id).await?;
+    let mut summary = ScrobbleProcessSummary::default();
+
+    for uid in user_ids {
+        let rows = fetch_pending_scrobbles(pool, uid, limit_per_user.min(MAX_BATCH_SIZE)).await?;
+        if rows.is_empty() {
+            continue;
+        }
+        summary.considered += rows.len() as u64;
+
+        let mut ids = Vec::new();
+        let mut attempt_rows = Vec::new();
+        let mut payloads = Vec::new();
+        for row in &rows {
+            match row.payload() {
+                Some(payload) => {
+                    ids.push(row.id);
+                    attempt_rows.push((row.id, row.attempt_count));
+                    payloads.push(payload);
+                }
+                None => {
+                    mark_row_failed(pool, row.id, "track has no primary Last.fm artist").await?;
+                    summary.skipped += 1;
+                }
+            }
+        }
+        if ids.is_empty() {
+            continue;
+        }
+
+        match client.scrobble_batch(&rows[0].session_key, &payloads).await {
+            Ok(()) => {
+                mark_rows_sent(pool, &ids).await?;
+                clear_account_error(pool, uid).await?;
+                summary.sent += ids.len() as u64;
+            }
+            Err(err) if err.is_invalid_session() => {
+                mark_account_reauth_required(pool, uid, &err.to_string()).await?;
+                mark_rows_blocked(pool, &ids, &err.to_string()).await?;
+                summary.blocked += ids.len() as u64;
+            }
+            Err(err) => {
+                mark_rows_retry_or_failed(pool, &attempt_rows, &err).await?;
+                summary.failed += ids.len() as u64;
+                if err.code == Some(29) {
+                    break;
+                }
+            }
+        }
+    }
+
+    Ok(summary)
+}
+
+#[derive(Debug, Deserialize)]
+struct AuthSessionResponse {
+    session: Option<AuthSession>,
+    error: Option<i32>,
+    message: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+struct AuthSession {
+    name: String,
+    key: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct ErrorEnvelope {
+    error: Option<i32>,
+    message: Option<String>,
+}
+
+#[derive(Debug, sqlx::FromRow)]
+struct PendingScrobbleRow {
+    id: i64,
+    started_at: i64,
+    duration_seconds: i32,
+    attempt_count: i32,
+    session_key: String,
+    title: String,
+    artist_name: Option<String>,
+    album_title: Option<String>,
+    album_artist_name: Option<String>,
+    track_number: Option<i32>,
+}
+
+impl PendingScrobbleRow {
+    fn payload(&self) -> Option<LastfmScrobblePayload> {
+        let artist = self
+            .artist_name
+            .as_deref()
+            .map(str::trim)
+            .filter(|value| !value.is_empty())?
+            .to_string();
+        Some(LastfmScrobblePayload {
+            track: LastfmTrackPayload {
+                artist,
+                track: self.title.clone(),
+                album: non_empty(self.album_title.as_deref()),
+                album_artist: non_empty(self.album_artist_name.as_deref()),
+                track_number: self.track_number,
+                duration_seconds: Some(self.duration_seconds),
+            },
+            timestamp: self.started_at,
+        })
+    }
+}
+
+fn non_empty(value: Option<&str>) -> Option<String> {
+    value
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .map(ToOwned::to_owned)
+}
+
+fn push_optional(params: &mut Vec<(String, String)>, key: &str, value: Option<&str>) {
+    if let Some(value) = value.map(str::trim).filter(|value| !value.is_empty()) {
+        params.push((key.to_string(), value.to_string()));
+    }
+}
+
+fn push_optional_i32(params: &mut Vec<(String, String)>, key: &str, value: Option<i32>) {
+    if let Some(value) = value {
+        params.push((key.to_string(), value.to_string()));
+    }
+}
+
+fn check_lastfm_error(body: &str) -> Result<(), LastfmApiError> {
+    if let Some(err) = parse_error(body) {
+        return Err(err);
+    }
+    Ok(())
+}
+
+fn parse_error(body: &str) -> Option<LastfmApiError> {
+    let envelope: ErrorEnvelope = serde_json::from_str(body).ok()?;
+    envelope
+        .error
+        .map(|code| LastfmApiError::new(Some(code), envelope.message.unwrap_or_default()))
+}
+
+async fn pending_user_ids(pool: &PgPool, user_id: Option<i64>) -> anyhow::Result<Vec<i64>> {
+    if let Some(user_id) = user_id {
+        return Ok(vec![user_id]);
+    }
+    let rows = sqlx::query_scalar::<_, i64>(
+        r#"SELECT DISTINCT o.user_id
+             FROM furumusic__lastfm_scrobble_outbox o
+             JOIN furumusic__lastfm_account a ON a.user_id = o.user_id
+            WHERE o.status IN ('pending', 'retry')
+              AND a.reauth_required = false
+            ORDER BY o.user_id"#,
+    )
+    .fetch_all(pool)
+    .await?;
+    Ok(rows)
+}
+
+async fn fetch_pending_scrobbles(
+    pool: &PgPool,
+    user_id: i64,
+    limit: i64,
+) -> anyhow::Result<Vec<PendingScrobbleRow>> {
+    let rows = sqlx::query_as::<_, PendingScrobbleRow>(
+        r#"SELECT o.id,
+                  o.started_at,
+                  o.duration_seconds,
+                  o.attempt_count,
+                  a.session_key::text AS session_key,
+                  t.title::text AS title,
+                  r.title::text AS album_title,
+                  t.track_number,
+                  (
+                    SELECT ar.name::text
+                      FROM furumusic__track_artist ta
+                      JOIN furumusic__artist ar ON ar.id = ta.artist_id
+                     WHERE ta.track_id = t.id AND ta.role <> 'featuring'
+                     ORDER BY ta.position
+                     LIMIT 1
+                  ) AS artist_name,
+                  (
+                    SELECT ar.name::text
+                      FROM furumusic__release_artist ra
+                      JOIN furumusic__artist ar ON ar.id = ra.artist_id
+                     WHERE ra.release_id = r.id
+                     ORDER BY ra.position
+                     LIMIT 1
+                  ) AS album_artist_name
+             FROM furumusic__lastfm_scrobble_outbox o
+             JOIN furumusic__lastfm_account a ON a.user_id = o.user_id
+             JOIN furumusic__track t ON t.id = o.track_id
+             LEFT JOIN furumusic__release r ON r.id = t.release_id
+            WHERE o.user_id = $1
+              AND o.status IN ('pending', 'retry')
+              AND a.reauth_required = false
+            ORDER BY o.created_at, o.id
+            LIMIT $2"#,
+    )
+    .bind(user_id)
+    .bind(limit)
+    .fetch_all(pool)
+    .await?;
+    Ok(rows)
+}
+
+async fn clear_account_error(pool: &PgPool, user_id: i64) -> anyhow::Result<()> {
+    sqlx::query(
+        r#"UPDATE furumusic__lastfm_account
+              SET last_error = NULL,
+                  reauth_required = false,
+                  updated_at = $2
+            WHERE user_id = $1"#,
+    )
+    .bind(user_id)
+    .bind(now_iso())
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+async fn mark_account_reauth_required(
+    pool: &PgPool,
+    user_id: i64,
+    error: &str,
+) -> anyhow::Result<()> {
+    sqlx::query(
+        r#"UPDATE furumusic__lastfm_account
+              SET reauth_required = true,
+                  last_error = $2,
+                  updated_at = $3
+            WHERE user_id = $1"#,
+    )
+    .bind(user_id)
+    .bind(error)
+    .bind(now_iso())
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+async fn mark_rows_sent(pool: &PgPool, ids: &[i64]) -> anyhow::Result<()> {
+    if ids.is_empty() {
+        return Ok(());
+    }
+    let now = now_iso();
+    sqlx::query(
+        r#"UPDATE furumusic__lastfm_scrobble_outbox
+              SET status = 'sent',
+                  updated_at = $2,
+                  scrobbled_at = $2,
+                  last_error = NULL
+            WHERE id = ANY($1)"#,
+    )
+    .bind(ids)
+    .bind(now)
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+async fn mark_row_failed(pool: &PgPool, id: i64, error: &str) -> anyhow::Result<()> {
+    sqlx::query(
+        r#"UPDATE furumusic__lastfm_scrobble_outbox
+              SET status = 'failed',
+                  attempt_count = attempt_count + 1,
+                  last_error = $2,
+                  updated_at = $3
+            WHERE id = $1"#,
+    )
+    .bind(id)
+    .bind(error)
+    .bind(now_iso())
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+async fn mark_rows_blocked(pool: &PgPool, ids: &[i64], error: &str) -> anyhow::Result<()> {
+    if ids.is_empty() {
+        return Ok(());
+    }
+    sqlx::query(
+        r#"UPDATE furumusic__lastfm_scrobble_outbox
+              SET status = 'blocked',
+                  attempt_count = attempt_count + 1,
+                  last_error = $2,
+                  updated_at = $3
+            WHERE id = ANY($1)"#,
+    )
+    .bind(ids)
+    .bind(error)
+    .bind(now_iso())
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+async fn mark_rows_retry_or_failed(
+    pool: &PgPool,
+    rows: &[(i64, i32)],
+    error: &LastfmApiError,
+) -> anyhow::Result<()> {
+    if rows.is_empty() {
+        return Ok(());
+    }
+    let ids: Vec<i64> = rows.iter().map(|(id, _)| *id).collect();
+    let next_status = if error.is_retryable()
+        && rows
+            .iter()
+            .any(|(_, attempt_count)| attempt_count + 1 < MAX_ATTEMPTS)
+    {
+        "retry"
+    } else {
+        "failed"
+    };
+    sqlx::query(
+        r#"UPDATE furumusic__lastfm_scrobble_outbox
+              SET status = CASE
+                    WHEN attempt_count + 1 >= $2 THEN 'failed'
+                    ELSE $3
+                  END,
+                  attempt_count = attempt_count + 1,
+                  last_error = $4,
+                  updated_at = $5
+            WHERE id = ANY($1)"#,
+    )
+    .bind(&ids)
+    .bind(MAX_ATTEMPTS)
+    .bind(next_status)
+    .bind(error.to_string())
+    .bind(now_iso())
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+fn now_iso() -> String {
+    chrono::Utc::now().format("%Y-%m-%dT%H:%M:%SZ").to_string()
+}

src/main.rs

@@ -5,6 +5,7 @@ mod auth;
 mod config;
 mod i18n;
 mod jobs;
+mod lastfm;
 mod music;
 mod oidc;
 mod player;
@@ -55,6 +56,7 @@ fn build_registry() -> Arc<JobRegistry> {
     registry.register(jobs::cover_variant_backfill::CoverVariantBackfillJob);
     registry.register(jobs::metadata_backfill::MetadataBackfillJob);
     registry.register(jobs::lastfm_popularity::LastfmPopularityJob);
+    registry.register(jobs::lastfm_scrobble::LastfmScrobbleJob);
     Arc::new(registry)
 }
 

src/music/mod.rs

@@ -1692,6 +1692,83 @@ pub mod db_migrations {
             &[Operation::custom(create_lastfm_track_popularity).build()];
     }
 
+    // -- M0033: Last.fm scrobbling -----------------------------------------
+
+    #[cot::db::migrations::migration_op]
+    async fn create_lastfm_scrobbling(
+        ctx: migrations::MigrationContext<'_>,
+    ) -> cot::db::Result<()> {
+        ctx.db
+            .raw(
+                "CREATE TABLE IF NOT EXISTS furumusic__lastfm_account (
+                    user_id BIGINT PRIMARY KEY,
+                    lastfm_username VARCHAR(255) NOT NULL,
+                    session_key TEXT NOT NULL,
+                    connected_at VARCHAR(32) NOT NULL,
+                    updated_at VARCHAR(32) NOT NULL,
+                    last_error TEXT,
+                    reauth_required BOOLEAN NOT NULL DEFAULT FALSE
+                )",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE TABLE IF NOT EXISTS furumusic__lastfm_auth_state (
+                    state VARCHAR(64) PRIMARY KEY,
+                    user_id BIGINT NOT NULL,
+                    created_at VARCHAR(32) NOT NULL
+                )",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE TABLE IF NOT EXISTS furumusic__lastfm_scrobble_outbox (
+                    id BIGSERIAL PRIMARY KEY,
+                    user_id BIGINT NOT NULL,
+                    track_id BIGINT NOT NULL,
+                    started_at BIGINT NOT NULL,
+                    listened_seconds INTEGER NOT NULL,
+                    duration_seconds INTEGER NOT NULL,
+                    status VARCHAR(32) NOT NULL,
+                    attempt_count INTEGER NOT NULL DEFAULT 0,
+                    last_error TEXT,
+                    created_at VARCHAR(32) NOT NULL,
+                    updated_at VARCHAR(32) NOT NULL,
+                    scrobbled_at VARCHAR(32),
+                    dedupe_key VARCHAR(128) NOT NULL UNIQUE
+                )",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE INDEX IF NOT EXISTS idx_lastfm_scrobble_outbox_status
+                   ON furumusic__lastfm_scrobble_outbox (status, created_at, id)",
+            )
+            .await?;
+        ctx.db
+            .raw(
+                "CREATE INDEX IF NOT EXISTS idx_lastfm_scrobble_outbox_user
+                   ON furumusic__lastfm_scrobble_outbox (user_id, status, created_at)",
+            )
+            .await?;
+        Ok(())
+    }
+
+    #[derive(Debug, Copy, Clone)]
+    pub struct M0033CreateLastfmScrobbling;
+
+    impl migrations::Migration for M0033CreateLastfmScrobbling {
+        const APP_NAME: &'static str = "furumusic";
+        const MIGRATION_NAME: &'static str = "m_0033_create_lastfm_scrobbling";
+        const DEPENDENCIES: &'static [migrations::MigrationDependency] =
+            &[migrations::MigrationDependency::migration(
+                "furumusic",
+                "m_0032_create_lastfm_track_popularity",
+            )];
+        const OPERATIONS: &'static [Operation] =
+            &[Operation::custom(create_lastfm_scrobbling).build()];
+    }
+
     pub const MIGRATIONS: &[&SyncDynMigration] = &[
         &M0006CreateMediaFile,
         &M0007CreateArtist,
@@ -1715,5 +1792,6 @@ pub mod db_migrations {
         &M0030AddMediaFileUploader,
         &M0031CreateTorrentSession,
         &M0032CreateLastfmTrackPopularity,
+        &M0033CreateLastfmScrobbling,
     ];
 }

src/player/dto.rs

@@ -172,6 +172,35 @@ pub(super) struct UserProfile {
     pub(super) stats: UserStats,
 }
 
+#[derive(Debug, Serialize, JsonSchema)]
+pub(super) struct LastfmStatus {
+    pub(super) configured: bool,
+    pub(super) connected: bool,
+    pub(super) username: Option<String>,
+    pub(super) reauth_required: bool,
+    pub(super) last_error: Option<String>,
+}
+
+#[derive(Debug, Serialize, JsonSchema)]
+pub(super) struct LastfmActionResponse {
+    pub(super) ok: bool,
+    pub(super) queued: bool,
+    pub(super) sent: bool,
+    pub(super) message: Option<String>,
+}
+
+#[derive(Debug, Deserialize, JsonSchema)]
+pub(super) struct LastfmNowPlayingRequest {
+    pub(super) track_id: i64,
+}
+
+#[derive(Debug, Deserialize, JsonSchema)]
+pub(super) struct LastfmScrobbleRequest {
+    pub(super) track_id: i64,
+    pub(super) started_at: Option<i64>,
+    pub(super) listened_seconds: i32,
+}
+
 #[derive(Debug, Serialize, JsonSchema)]
 pub(super) struct AgentQueueStatus {
     pub(super) queued_count: i64,

src/player/mod.rs

@@ -16,6 +16,7 @@ use cot::{App, Body, Template};
 use crate::auth;
 use crate::config::AppConfig;
 use crate::i18n::Translations;
+use crate::lastfm::{LastfmClient, LastfmCredentials, LastfmTrackPayload};
 use crate::scheduler::SchedulerHandle;
 use crate::torrents::{TorrentPreviewRequest, TorrentService, TorrentStartRequest};
 
@@ -49,6 +50,36 @@ struct LocalUploadResponse {
     size: u64,
 }
 
+#[derive(Debug, sqlx::FromRow)]
+struct LastfmAccountApiRow {
+    session_key: String,
+    reauth_required: bool,
+    last_error: Option<String>,
+}
+
+#[derive(Debug, sqlx::FromRow)]
+struct LastfmStatusRow {
+    username: String,
+    reauth_required: bool,
+    last_error: Option<String>,
+}
+
+#[derive(Debug, sqlx::FromRow)]
+struct LastfmTrackMetaRow {
+    title: String,
+    duration_seconds: f64,
+    track_number: Option<i32>,
+    album_title: Option<String>,
+    artist_name: Option<String>,
+    album_artist_name: Option<String>,
+}
+
+#[derive(Debug, serde::Deserialize)]
+struct LastfmCallbackQuery {
+    token: Option<String>,
+    state: Option<String>,
+}
+
 // ---------------------------------------------------------------------------
 // SPA shell
 // ---------------------------------------------------------------------------
@@ -114,6 +145,493 @@ async fn me_handler(
     .into_response()
 }
 
+// ---------------------------------------------------------------------------
+// Last.fm account + scrobbling
+// ---------------------------------------------------------------------------
+
+fn redirect_response(location: &str) -> cot::response::Response {
+    cot::http::Response::builder()
+        .status(StatusCode::SEE_OTHER)
+        .header(cot::http::header::LOCATION, location)
+        .body(Body::fixed(""))
+        .expect("valid response")
+}
+
+fn request_origin(request: &cot::request::Request) -> Option<String> {
+    let headers = request.headers();
+    let host = headers
+        .get("x-forwarded-host")
+        .or_else(|| headers.get("host"))?
+        .to_str()
+        .ok()?;
+    let proto = headers
+        .get("x-forwarded-proto")
+        .and_then(|value| value.to_str().ok())
+        .unwrap_or("http");
+    Some(format!("{proto}://{host}"))
+}
+
+async fn lastfm_status_handler(
+    session: Session,
+    db: Database,
+    pool: &sqlx::PgPool,
+) -> cot::Result<cot::response::Response> {
+    let Some(user) = auth::get_session_user(&session, &db).await else {
+        return Ok(json_error(StatusCode::UNAUTHORIZED, "not authenticated"));
+    };
+    let (config, _) = AppConfig::load_with_db(&db).await;
+    let configured = crate::lastfm::is_configured(&config);
+    let account = sqlx::query_as::<_, LastfmStatusRow>(
+        r#"SELECT lastfm_username::text AS username,
+                  reauth_required,
+                  last_error::text AS last_error
+             FROM furumusic__lastfm_account
+            WHERE user_id = $1"#,
+    )
+    .bind(user.id)
+    .fetch_optional(pool)
+    .await
+    .map_err(|e| cot::Error::internal(e.to_string()))?;
+
+    Json(LastfmStatus {
+        configured,
+        connected: account.is_some(),
+        username: account.as_ref().map(|row| row.username.clone()),
+        reauth_required: account
+            .as_ref()
+            .map(|row| row.reauth_required)
+            .unwrap_or(false),
+        last_error: account.and_then(|row| row.last_error),
+    })
+    .into_response()
+}
+
+async fn lastfm_connect_handler(
+    session: Session,
+    db: Database,
+    pool: &sqlx::PgPool,
+    request: cot::request::Request,
+) -> cot::Result<cot::response::Response> {
+    let Some(user) = auth::get_session_user(&session, &db).await else {
+        return Ok(redirect_response("/login"));
+    };
+    let (config, _) = AppConfig::load_with_db(&db).await;
+    let Some(credentials) = LastfmCredentials::from_config(&config) else {
+        return Ok(redirect_response("/?lastfm=not_configured"));
+    };
+    let Some(origin) = request_origin(&request) else {
+        return Ok(redirect_response("/?lastfm=bad_origin"));
+    };
+
+    let state = uuid::Uuid::new_v4().simple().to_string();
+    let now = chrono::Utc::now();
+    let stale = (now - chrono::Duration::hours(1))
+        .format("%Y-%m-%dT%H:%M:%SZ")
+        .to_string();
+    sqlx::query("DELETE FROM furumusic__lastfm_auth_state WHERE created_at < $1")
+        .bind(stale)
+        .execute(pool)
+        .await
+        .map_err(|e| cot::Error::internal(e.to_string()))?;
+    sqlx::query(
+        r#"INSERT INTO furumusic__lastfm_auth_state (state, user_id, created_at)
+           VALUES ($1, $2, $3)
+           ON CONFLICT (state) DO NOTHING"#,
+    )
+    .bind(&state)
+    .bind(user.id)
+    .bind(now.format("%Y-%m-%dT%H:%M:%SZ").to_string())
+    .execute(pool)
+    .await
+    .map_err(|e| cot::Error::internal(e.to_string()))?;
+
+    let callback = format!("{origin}/api/player/lastfm/callback?state={state}");
+    let mut url = reqwest::Url::parse("https://www.last.fm/api/auth/")
+        .map_err(|e| cot::Error::internal(e.to_string()))?;
+    url.query_pairs_mut()
+        .append_pair("api_key", credentials.api_key())
+        .append_pair("cb", &callback);
+    Ok(redirect_response(url.as_str()))
+}
+
+async fn lastfm_callback_handler(
+    session: Session,
+    db: Database,
+    pool: &sqlx::PgPool,
+    query: cot::request::extractors::UrlQuery<LastfmCallbackQuery>,
+) -> cot::Result<cot::response::Response> {
+    let Some(user) = auth::get_session_user(&session, &db).await else {
+        return Ok(redirect_response("/login"));
+    };
+    let Some(token) = query
+        .0
+        .token
+        .as_deref()
+        .map(str::trim)
+        .filter(|v| !v.is_empty())
+    else {
+        return Ok(redirect_response("/?lastfm=missing_token"));
+    };
+    let Some(state) = query
+        .0
+        .state
+        .as_deref()
+        .map(str::trim)
+        .filter(|v| !v.is_empty())
+    else {
+        return Ok(redirect_response("/?lastfm=missing_state"));
+    };
+
+    let state_user_id = sqlx::query_scalar::<_, i64>(
+        "SELECT user_id FROM furumusic__lastfm_auth_state WHERE state = $1",
+    )
+    .bind(state)
+    .fetch_optional(pool)
+    .await
+    .map_err(|e| cot::Error::internal(e.to_string()))?;
+    if state_user_id != Some(user.id) {
+        return Ok(redirect_response("/?lastfm=bad_state"));
+    }
+    sqlx::query("DELETE FROM furumusic__lastfm_auth_state WHERE state = $1")
+        .bind(state)
+        .execute(pool)
+        .await
+        .map_err(|e| cot::Error::internal(e.to_string()))?;
+
+    let (config, _) = AppConfig::load_with_db(&db).await;
+    let Some(credentials) = LastfmCredentials::from_config(&config) else {
+        return Ok(redirect_response("/?lastfm=not_configured"));
+    };
+    let client = LastfmClient::new(credentials).map_err(|e| cot::Error::internal(e.to_string()))?;
+    match client.get_session(token).await {
+        Ok(lastfm_session) => {
+            let now = chrono::Utc::now().format("%Y-%m-%dT%H:%M:%SZ").to_string();
+            sqlx::query(
+                r#"INSERT INTO furumusic__lastfm_account
+                      (user_id, lastfm_username, session_key, connected_at, updated_at, last_error, reauth_required)
+                   VALUES ($1, $2, $3, $4, $4, NULL, false)
+                   ON CONFLICT (user_id) DO UPDATE SET
+                      lastfm_username = EXCLUDED.lastfm_username,
+                      session_key = EXCLUDED.session_key,
+                      updated_at = EXCLUDED.updated_at,
+                      last_error = NULL,
+                      reauth_required = false"#,
+            )
+            .bind(user.id)
+            .bind(&lastfm_session.username)
+            .bind(&lastfm_session.session_key)
+            .bind(&now)
+            .execute(pool)
+            .await
+            .map_err(|e| cot::Error::internal(e.to_string()))?;
+            Ok(redirect_response("/?lastfm=connected"))
+        }
+        Err(err) => {
+            tracing::warn!("Last.fm auth failed for user {}: {err}", user.id);
+            Ok(redirect_response("/?lastfm=auth_failed"))
+        }
+    }
+}
+
+async fn lastfm_disconnect_handler(
+    session: Session,
+    db: Database,
+    pool: &sqlx::PgPool,
+) -> cot::Result<cot::response::Response> {
+    let Some(user) = auth::get_session_user(&session, &db).await else {
+        return Ok(json_error(StatusCode::UNAUTHORIZED, "not authenticated"));
+    };
+    let now = chrono::Utc::now().format("%Y-%m-%dT%H:%M:%SZ").to_string();
+    sqlx::query("DELETE FROM furumusic__lastfm_account WHERE user_id = $1")
+        .bind(user.id)
+        .execute(pool)
+        .await
+        .map_err(|e| cot::Error::internal(e.to_string()))?;
+    sqlx::query(
+        r#"UPDATE furumusic__lastfm_scrobble_outbox
+              SET status = 'blocked',
+                  last_error = 'Last.fm account disconnected',
+                  updated_at = $2
+            WHERE user_id = $1 AND status IN ('pending', 'retry')"#,
+    )
+    .bind(user.id)
+    .bind(now)
+    .execute(pool)
+    .await
+    .map_err(|e| cot::Error::internal(e.to_string()))?;
+    Json(serde_json::json!({"ok": true})).into_response()
+}
+
+async fn load_lastfm_account(
+    pool: &sqlx::PgPool,
+    user_id: i64,
+) -> cot::Result<Option<LastfmAccountApiRow>> {
+    sqlx::query_as::<_, LastfmAccountApiRow>(
+        r#"SELECT session_key::text AS session_key,
+                  reauth_required,
+                  last_error::text AS last_error
+             FROM furumusic__lastfm_account
+            WHERE user_id = $1"#,
+    )
+    .bind(user_id)
+    .fetch_optional(pool)
+    .await
+    .map_err(|e| cot::Error::internal(e.to_string()))
+}
+
+async fn load_lastfm_track_payload(
+    pool: &sqlx::PgPool,
+    track_id: i64,
+) -> cot::Result<Option<LastfmTrackPayload>> {
+    let row = sqlx::query_as::<_, LastfmTrackMetaRow>(
+        r#"SELECT t.title::text AS title,
+                  t.duration_seconds,
+                  t.track_number,
+                  r.title::text AS album_title,
+                  (
+                    SELECT a.name::text
+                      FROM furumusic__track_artist ta
+                      JOIN furumusic__artist a ON a.id = ta.artist_id
+                     WHERE ta.track_id = t.id AND ta.role <> 'featuring'
+                     ORDER BY ta.position
+                     LIMIT 1
+                  ) AS artist_name,
+                  (
+                    SELECT a.name::text
+                      FROM furumusic__release_artist ra
+                      JOIN furumusic__artist a ON a.id = ra.artist_id
+                     WHERE ra.release_id = r.id
+                     ORDER BY ra.position
+                     LIMIT 1
+                  ) AS album_artist_name
+             FROM furumusic__track t
+             LEFT JOIN furumusic__release r ON r.id = t.release_id
+            WHERE t.id = $1 AND t.is_hidden = false"#,
+    )
+    .bind(track_id)
+    .fetch_optional(pool)
+    .await
+    .map_err(|e| cot::Error::internal(e.to_string()))?;
+
+    Ok(row.and_then(|row| {
+        let artist = row
+            .artist_name
+            .as_deref()
+            .map(str::trim)
+            .filter(|value| !value.is_empty())?
+            .to_string();
+        Some(LastfmTrackPayload {
+            artist,
+            track: row.title,
+            album: row
+                .album_title
+                .map(|value| value.trim().to_string())
+                .filter(|value| !value.is_empty()),
+            album_artist: row
+                .album_artist_name
+                .map(|value| value.trim().to_string())
+                .filter(|value| !value.is_empty()),
+            track_number: row.track_number,
+            duration_seconds: Some(row.duration_seconds.round() as i32),
+        })
+    }))
+}
+
+async fn update_lastfm_account_error(
+    pool: &sqlx::PgPool,
+    user_id: i64,
+    error: &str,
+    reauth_required: bool,
+) -> cot::Result<()> {
+    sqlx::query(
+        r#"UPDATE furumusic__lastfm_account
+              SET last_error = $2,
+                  reauth_required = $3,
+                  updated_at = $4
+            WHERE user_id = $1"#,
+    )
+    .bind(user_id)
+    .bind(error)
+    .bind(reauth_required)
+    .bind(chrono::Utc::now().format("%Y-%m-%dT%H:%M:%SZ").to_string())
+    .execute(pool)
+    .await
+    .map_err(|e| cot::Error::internal(e.to_string()))?;
+    Ok(())
+}
+
+async fn lastfm_now_playing_handler(
+    session: Session,
+    db: Database,
+    pool: &sqlx::PgPool,
+    Json(entry): Json<LastfmNowPlayingRequest>,
+) -> cot::Result<cot::response::Response> {
+    let Some(user) = auth::get_session_user(&session, &db).await else {
+        return Ok(json_error(StatusCode::UNAUTHORIZED, "not authenticated"));
+    };
+    let (config, _) = AppConfig::load_with_db(&db).await;
+    let Some(credentials) = LastfmCredentials::from_config(&config) else {
+        return Json(LastfmActionResponse {
+            ok: false,
+            queued: false,
+            sent: false,
+            message: Some("Last.fm is not configured".to_string()),
+        })
+        .into_response();
+    };
+    let Some(account) = load_lastfm_account(pool, user.id).await? else {
+        return Json(LastfmActionResponse {
+            ok: false,
+            queued: false,
+            sent: false,
+            message: Some("Last.fm account is not connected".to_string()),
+        })
+        .into_response();
+    };
+    if account.reauth_required {
+        return Json(LastfmActionResponse {
+            ok: false,
+            queued: false,
+            sent: false,
+            message: account.last_error,
+        })
+        .into_response();
+    }
+    let Some(track) = load_lastfm_track_payload(pool, entry.track_id).await? else {
+        return Json(LastfmActionResponse {
+            ok: false,
+            queued: false,
+            sent: false,
+            message: Some("Track has no primary artist for Last.fm".to_string()),
+        })
+        .into_response();
+    };
+    let client = LastfmClient::new(credentials).map_err(|e| cot::Error::internal(e.to_string()))?;
+    match client
+        .update_now_playing(&account.session_key, &track)
+        .await
+    {
+        Ok(()) => Json(LastfmActionResponse {
+            ok: true,
+            queued: false,
+            sent: true,
+            message: None,
+        })
+        .into_response(),
+        Err(err) => {
+            let reauth_required = err.is_invalid_session();
+            update_lastfm_account_error(pool, user.id, &err.to_string(), reauth_required).await?;
+            Json(LastfmActionResponse {
+                ok: false,
+                queued: false,
+                sent: false,
+                message: Some(err.to_string()),
+            })
+            .into_response()
+        }
+    }
+}
+
+async fn lastfm_scrobble_handler(
+    session: Session,
+    db: Database,
+    pool: &sqlx::PgPool,
+    Json(entry): Json<LastfmScrobbleRequest>,
+) -> cot::Result<cot::response::Response> {
+    let Some(user) = auth::get_session_user(&session, &db).await else {
+        return Ok(json_error(StatusCode::UNAUTHORIZED, "not authenticated"));
+    };
+    let (config, _) = AppConfig::load_with_db(&db).await;
+    if !crate::lastfm::is_configured(&config) {
+        return Json(LastfmActionResponse {
+            ok: false,
+            queued: false,
+            sent: false,
+            message: Some("Last.fm is not configured".to_string()),
+        })
+        .into_response();
+    }
+    if load_lastfm_account(pool, user.id).await?.is_none() {
+        return Json(LastfmActionResponse {
+            ok: false,
+            queued: false,
+            sent: false,
+            message: Some("Last.fm account is not connected".to_string()),
+        })
+        .into_response();
+    }
+    let Some(track) = load_lastfm_track_payload(pool, entry.track_id).await? else {
+        return Json(LastfmActionResponse {
+            ok: false,
+            queued: false,
+            sent: false,
+            message: Some("Track has no primary artist for Last.fm".to_string()),
+        })
+        .into_response();
+    };
+    let duration_seconds = track.duration_seconds.unwrap_or(0).max(0);
+    if duration_seconds <= 30 {
+        return Json(LastfmActionResponse {
+            ok: false,
+            queued: false,
+            sent: false,
+            message: Some("Track is too short to scrobble".to_string()),
+        })
+        .into_response();
+    }
+    let threshold = ((duration_seconds as f64 / 2.0).min(240.0)).ceil() as i32;
+    let listened_seconds = entry.listened_seconds.max(0);
+    if listened_seconds < threshold {
+        return Json(LastfmActionResponse {
+            ok: false,
+            queued: false,
+            sent: false,
+            message: Some("Scrobble threshold has not been reached".to_string()),
+        })
+        .into_response();
+    }
+
+    let now_ts = chrono::Utc::now().timestamp();
+    let started_at = entry
+        .started_at
+        .unwrap_or(now_ts - listened_seconds as i64)
+        .min(now_ts);
+    let now = chrono::Utc::now().format("%Y-%m-%dT%H:%M:%SZ").to_string();
+    let dedupe_key = format!("{}:{}:{}", user.id, entry.track_id, started_at);
+    sqlx::query(
+        r#"INSERT INTO furumusic__lastfm_scrobble_outbox
+              (user_id, track_id, started_at, listened_seconds, duration_seconds, status, created_at, updated_at, dedupe_key)
+           VALUES ($1, $2, $3, $4, $5, 'pending', $6, $6, $7)
+           ON CONFLICT (dedupe_key) DO NOTHING"#,
+    )
+    .bind(user.id)
+    .bind(entry.track_id)
+    .bind(started_at)
+    .bind(listened_seconds)
+    .bind(duration_seconds)
+    .bind(&now)
+    .bind(&dedupe_key)
+    .execute(pool)
+    .await
+    .map_err(|e| cot::Error::internal(e.to_string()))?;
+
+    let sent =
+        match crate::lastfm::process_pending_scrobbles(pool, &config, Some(user.id), 10).await {
+            Ok(summary) => summary.sent > 0,
+            Err(err) => {
+                tracing::warn!("Last.fm immediate scrobble send failed: {err:#}");
+                false
+            }
+        };
+    Json(LastfmActionResponse {
+        ok: true,
+        queued: true,
+        sent,
+        message: None,
+    })
+    .into_response()
+}
+
 // ---------------------------------------------------------------------------
 // GET /api/player/agent-queue
 // ---------------------------------------------------------------------------
@@ -2437,6 +2955,152 @@ impl App for PlayerApp {
                 },
                 "player_me",
             ),
+            Route::with_handler_and_name(
+                "/lastfm/status",
+                get({
+                    let pool = Arc::clone(&pool);
+                    let pool_config = Arc::clone(&pool_config);
+                    move |session: Session, db: Database| {
+                        let pool = Arc::clone(&pool);
+                        let pool_config = Arc::clone(&pool_config);
+                        async move {
+                            let pg_pool = pool
+                                .get_or_init(|| async {
+                                    sqlx::postgres::PgPoolOptions::new()
+                                        .max_connections(5)
+                                        .connect(&pool_config.database_url)
+                                        .await
+                                        .expect("player pool")
+                                })
+                                .await;
+                            lastfm_status_handler(session, db, pg_pool).await
+                        }
+                    }
+                }),
+                "player_lastfm_status",
+            ),
+            Route::with_handler_and_name(
+                "/lastfm/connect",
+                get({
+                    let pool = Arc::clone(&pool);
+                    let pool_config = Arc::clone(&pool_config);
+                    move |session: Session, db: Database, request: cot::request::Request| {
+                        let pool = Arc::clone(&pool);
+                        let pool_config = Arc::clone(&pool_config);
+                        async move {
+                            let pg_pool = pool
+                                .get_or_init(|| async {
+                                    sqlx::postgres::PgPoolOptions::new()
+                                        .max_connections(5)
+                                        .connect(&pool_config.database_url)
+                                        .await
+                                        .expect("player pool")
+                                })
+                                .await;
+                            lastfm_connect_handler(session, db, pg_pool, request).await
+                        }
+                    }
+                }),
+                "player_lastfm_connect",
+            ),
+            Route::with_handler_and_name(
+                "/lastfm/callback",
+                get({
+                    let pool = Arc::clone(&pool);
+                    let pool_config = Arc::clone(&pool_config);
+                    move |session: Session,
+                          db: Database,
+                          query: cot::request::extractors::UrlQuery<LastfmCallbackQuery>| {
+                        let pool = Arc::clone(&pool);
+                        let pool_config = Arc::clone(&pool_config);
+                        async move {
+                            let pg_pool = pool
+                                .get_or_init(|| async {
+                                    sqlx::postgres::PgPoolOptions::new()
+                                        .max_connections(5)
+                                        .connect(&pool_config.database_url)
+                                        .await
+                                        .expect("player pool")
+                                })
+                                .await;
+                            lastfm_callback_handler(session, db, pg_pool, query).await
+                        }
+                    }
+                }),
+                "player_lastfm_callback",
+            ),
+            Route::with_handler_and_name(
+                "/lastfm/disconnect",
+                post({
+                    let pool = Arc::clone(&pool);
+                    let pool_config = Arc::clone(&pool_config);
+                    move |session: Session, db: Database| {
+                        let pool = Arc::clone(&pool);
+                        let pool_config = Arc::clone(&pool_config);
+                        async move {
+                            let pg_pool = pool
+                                .get_or_init(|| async {
+                                    sqlx::postgres::PgPoolOptions::new()
+                                        .max_connections(5)
+                                        .connect(&pool_config.database_url)
+                                        .await
+                                        .expect("player pool")
+                                })
+                                .await;
+                            lastfm_disconnect_handler(session, db, pg_pool).await
+                        }
+                    }
+                }),
+                "player_lastfm_disconnect",
+            ),
+            Route::with_handler_and_name(
+                "/lastfm/now-playing",
+                post({
+                    let pool = Arc::clone(&pool);
+                    let pool_config = Arc::clone(&pool_config);
+                    move |session: Session, db: Database, json: Json<LastfmNowPlayingRequest>| {
+                        let pool = Arc::clone(&pool);
+                        let pool_config = Arc::clone(&pool_config);
+                        async move {
+                            let pg_pool = pool
+                                .get_or_init(|| async {
+                                    sqlx::postgres::PgPoolOptions::new()
+                                        .max_connections(5)
+                                        .connect(&pool_config.database_url)
+                                        .await
+                                        .expect("player pool")
+                                })
+                                .await;
+                            lastfm_now_playing_handler(session, db, pg_pool, json).await
+                        }
+                    }
+                }),
+                "player_lastfm_now_playing",
+            ),
+            Route::with_handler_and_name(
+                "/lastfm/scrobble",
+                post({
+                    let pool = Arc::clone(&pool);
+                    let pool_config = Arc::clone(&pool_config);
+                    move |session: Session, db: Database, json: Json<LastfmScrobbleRequest>| {
+                        let pool = Arc::clone(&pool);
+                        let pool_config = Arc::clone(&pool_config);
+                        async move {
+                            let pg_pool = pool
+                                .get_or_init(|| async {
+                                    sqlx::postgres::PgPoolOptions::new()
+                                        .max_connections(5)
+                                        .connect(&pool_config.database_url)
+                                        .await
+                                        .expect("player pool")
+                                })
+                                .await;
+                            lastfm_scrobble_handler(session, db, pg_pool, json).await
+                        }
+                    }
+                }),
+                "player_lastfm_scrobble",
+            ),
             Route::with_handler_and_name(
                 "/agent-queue",
                 {

src/scheduler/mod.rs

@@ -1357,7 +1357,10 @@ async fn run_scheduled_job(
 
     // Check agent_enabled (re-read from DB every run)
     let (live_config, _) = AppConfig::load_with_db(db).await;
-    if !live_config.agent_enabled && job_name != "lastfm_popularity" {
+    if !live_config.agent_enabled
+        && job_name != "lastfm_popularity"
+        && job_name != "lastfm_scrobble"
+    {
         tracing::warn!(job = job_name, "Skipping: agent_enabled=false");
         return;
     }

templates/admin/settings.html

@@ -85,6 +85,16 @@
     <td><input type="checkbox" name="swagger_enabled" id="swagger_enabled" value="on"{% if swagger_enabled %} checked{% endif %}></td>
     <td><span class="badge badge-{{ swagger_enabled_source }}">{{ swagger_enabled_source }}</span></td>
   </tr>
+  <tr>
+    <td><label for="lastfm_api_key">{{ t.settings_lastfm_api_key }}</label><br><span style="font-size:.75rem;color:#999;">{{ t.settings_lastfm_api_key_help }}</span></td>
+    <td><input type="password" name="lastfm_api_key" id="lastfm_api_key" value="{{ lastfm_api_key }}"></td>
+    <td><span class="badge badge-{{ lastfm_api_key_source }}">{{ lastfm_api_key_source }}</span></td>
+  </tr>
+  <tr>
+    <td><label for="lastfm_shared_secret">{{ t.settings_lastfm_shared_secret }}</label><br><span style="font-size:.75rem;color:#999;">{{ t.settings_lastfm_shared_secret_help }}</span></td>
+    <td><input type="password" name="lastfm_shared_secret" id="lastfm_shared_secret" value="{{ lastfm_shared_secret }}"></td>
+    <td><span class="badge badge-{{ lastfm_shared_secret_source }}">{{ lastfm_shared_secret_source }}</span></td>
+  </tr>
 </table>
 
 <h2>{{ t.settings_agent }}</h2>

templates/admin/v2.html

@@ -1136,7 +1136,7 @@ tbody tr:hover {
             <button class="nav-btn" :class="{active: activeView === 'settings'}" @click="openSettings()">
                 <i data-lucide="settings"></i>
                 <span>Settings</span>
-                <span class="nav-count" x-text="settings.lastfm_api_key_configured ? 'ok' : ''"></span>
+                <span class="nav-count" x-text="settings.lastfm_scrobbling_configured ? 'ok' : ''"></span>
             </button>
         </div>
 
@@ -1734,7 +1734,7 @@ tbody tr:hover {
                                     <strong>API</strong>
                                     <span>Developer and enrichment integrations</span>
                                 </div>
-                                <span class="badge" :class="settings.lastfm_api_key_configured ? 'ok' : 'disabled'" x-text="settings.lastfm_api_key_configured ? 'Last.fm configured' : 'Last.fm missing'"></span>
+                                <span class="badge" :class="settings.lastfm_scrobbling_configured ? 'ok' : 'disabled'" x-text="settings.lastfm_scrobbling_configured ? 'Last.fm configured' : 'Last.fm missing'"></span>
                             </div>
                             <div class="settings-grid">
                                 <div class="setting-toggle">
@@ -1750,11 +1750,19 @@ tbody tr:hover {
                                 </div>
                                 <div class="setting-field">
                                     <label>
-                                        <span>Last.fm API key</span>
+                                        <span>{{ t.settings_lastfm_api_key }}</span>
                                         <span class="source-pill" :class="sourceClass('lastfm_api_key')" x-text="settingSource('lastfm_api_key')"></span>
                                     </label>
                                     <input type="password" x-model="settingsDraft.lastfm_api_key" autocomplete="off" />
-                                    <div class="setting-help">Used by the weekly Last.fm popularity task.</div>
+                                    <div class="setting-help">{{ t.settings_lastfm_api_key_help }}</div>
+                                </div>
+                                <div class="setting-field">
+                                    <label>
+                                        <span>{{ t.settings_lastfm_shared_secret }}</span>
+                                        <span class="source-pill" :class="sourceClass('lastfm_shared_secret')" x-text="settingSource('lastfm_shared_secret')"></span>
+                                    </label>
+                                    <input type="password" x-model="settingsDraft.lastfm_shared_secret" autocomplete="off" />
+                                    <div class="setting-help">{{ t.settings_lastfm_shared_secret_help }}</div>
                                 </div>
                             </div>
                         </section>
@@ -2093,7 +2101,7 @@ function adminV2() {
         editorArtistToAdd: '',
         editorDetail: null,
         editorDraft: { title: '', hidden: 'false', release_type: 'album', year: '', artist_ids: [] },
-        settings: { values: {}, sources: {}, lastfm_api_key_configured: false },
+        settings: { values: {}, sources: {}, lastfm_api_key_configured: false, lastfm_shared_secret_configured: false, lastfm_scrobbling_configured: false },
         settingsDraft: {
             auth_password_enabled: false,
             auth_sso_enabled: false,
@@ -2105,6 +2113,7 @@ function adminV2() {
             oidc_user_groups: '',
             swagger_enabled: false,
             lastfm_api_key: '',
+            lastfm_shared_secret: '',
             agent_enabled: false,
             agent_inbox_dir: '',
             agent_storage_dir: '',

templates/player/scripts.html

@@ -30,6 +30,14 @@ const T = {
     lastfmPlaycount: "{{ t.player_lastfm_playcount }}",
     lastfmUpdated: "{{ t.player_lastfm_updated }}",
     lastfmNotLoaded: "{{ t.player_lastfm_not_loaded }}",
+    lastfmProfile: "{{ t.player_lastfm_profile }}",
+    lastfmConnect: "{{ t.player_lastfm_connect }}",
+    lastfmConnected: "{{ t.player_lastfm_connected }}",
+    lastfmReconnect: "{{ t.player_lastfm_reconnect }}",
+    lastfmNotConfigured: "{{ t.player_lastfm_not_configured }}",
+    lastfmDisconnectConfirm: "{{ t.player_lastfm_disconnect_confirm }}",
+    lastfmConnectFailed: "{{ t.player_lastfm_connect_failed }}",
+    lastfmDisconnectFailed: "{{ t.player_lastfm_disconnect_failed }}",
     trackWord: "{{ t.player_tracks_count }}",
     clientIdle: "{{ t.player_client_idle }}",
     active: "{{ t.player_active }}",
@@ -162,9 +170,12 @@ document.addEventListener('alpine:init', () => {
     Alpine.store('user', {
         profile: null,
         menuOpen: false,
+        lastfm: { configured: false, connected: false, username: null, reauth_required: false, last_error: null },
+        lastfmBusy: false,
 
         init() {
             this.load();
+            this.loadLastfm();
         },
 
         async load() {
@@ -177,6 +188,56 @@ document.addEventListener('alpine:init', () => {
             }
         },
 
+        async loadLastfm() {
+            try {
+                const res = await fetch('/api/player/lastfm/status');
+                if (!res.ok) throw new Error('failed');
+                this.lastfm = await res.json();
+                const player = Alpine.store('player');
+                if (player?.isPlaying) player._sendNowPlaying();
+            } catch {
+                this.lastfm = { configured: false, connected: false, username: null, reauth_required: false, last_error: null };
+            }
+        },
+
+        lastfmLabel() {
+            if (!this.lastfm?.configured) return T.lastfmNotConfigured;
+            if (this.lastfm?.connected && this.lastfm?.reauth_required) return T.lastfmReconnect;
+            if (this.lastfm?.connected) {
+                const user = this.lastfm.username || T.unknown;
+                return T.lastfmConnected.replace('{user}', user);
+            }
+            return T.lastfmConnect;
+        },
+
+        lastfmClass() {
+            if (!this.lastfm?.configured) return 'not-configured';
+            if (this.lastfm?.connected && this.lastfm?.reauth_required) return 'needs-auth';
+            if (this.lastfm?.connected) return 'connected';
+            return 'available';
+        },
+
+        async handleLastfm() {
+            if (this.lastfmBusy) return;
+            if (!this.lastfm?.configured) return;
+            if (!this.lastfm?.connected || this.lastfm?.reauth_required) {
+                window.location.href = '/api/player/lastfm/connect';
+                return;
+            }
+            const user = this.lastfm.username || T.unknown;
+            if (!window.confirm(T.lastfmDisconnectConfirm.replace('{user}', user))) return;
+            this.lastfmBusy = true;
+            try {
+                const res = await fetch('/api/player/lastfm/disconnect', { method: 'POST' });
+                if (!res.ok) throw new Error(T.lastfmDisconnectFailed);
+                await this.loadLastfm();
+            } catch {
+                alert(T.lastfmDisconnectFailed);
+            } finally {
+                this.lastfmBusy = false;
+            }
+        },
+
         initials() {
             const name = this.profile?.name || '';
             return name.trim().charAt(0) || '?';
@@ -294,6 +355,11 @@ document.addEventListener('alpine:init', () => {
         progress: 0,
         _saveTimer: null,
         _historyRecorded: false,
+        _nowPlayingSent: false,
+        _scrobbleSent: false,
+        _playbackStartedAt: null,
+        _listenedSeconds: 0,
+        _lastAudioTime: 0,
 
         init() {
             audio.volume = this.volume;
@@ -302,15 +368,27 @@ document.addEventListener('alpine:init', () => {
                 this.currentTime = audio.currentTime;
                 this.duration = audio.duration || 0;
                 this.progress = this.duration > 0 ? (this.currentTime / this.duration) * 100 : 0;
+                this._trackListenedDelta();
+                this._maybeScrobble();
             });
 
             audio.addEventListener('ended', () => {
+                this._trackListenedDelta();
+                this._maybeScrobble(true);
                 this._recordHistory(true);
                 this.next();
             });
 
-            audio.addEventListener('play', () => { this.isPlaying = true; });
-            audio.addEventListener('pause', () => { this.isPlaying = false; });
+            audio.addEventListener('play', () => {
+                this.isPlaying = true;
+                if (!this._playbackStartedAt) this._playbackStartedAt = Math.floor(Date.now() / 1000);
+                this._lastAudioTime = audio.currentTime || 0;
+                this._sendNowPlaying();
+            });
+            audio.addEventListener('pause', () => {
+                this.isPlaying = false;
+                this._lastAudioTime = audio.currentTime || 0;
+            });
 
             audio.addEventListener('loadedmetadata', () => {
                 this.duration = audio.duration || 0;
@@ -333,6 +411,7 @@ document.addEventListener('alpine:init', () => {
         play(track) {
             this.currentTrack = track;
             this._historyRecorded = false;
+            this._resetPlaybackTracking();
             audio.src = track.stream_url;
             audio.play().catch(() => {});
             this._updateMediaSession();
@@ -349,11 +428,13 @@ document.addEventListener('alpine:init', () => {
 
         seek(time) {
             audio.currentTime = time;
+            this._lastAudioTime = audio.currentTime || 0;
         },
 
         seekRelative(delta) {
             if (!this.currentTrack) return;
             audio.currentTime = Math.max(0, Math.min(audio.duration || 0, audio.currentTime + delta));
+            this._lastAudioTime = audio.currentTime || 0;
         },
 
         seekFromClick(event) {
@@ -541,6 +622,7 @@ document.addEventListener('alpine:init', () => {
                                 if (currentTrack) {
                                     this.currentTrack = currentTrack;
                                     this._historyRecorded = false;
+                                    this._resetPlaybackTracking();
                                     audio.src = currentTrack.stream_url;
                                     // Seek to saved position once metadata is loaded
                                     const seekMs = state.position_ms || 0;
@@ -573,6 +655,87 @@ document.addEventListener('alpine:init', () => {
                 }),
             }).catch(() => {});
         },
+
+        _resetPlaybackTracking() {
+            this._nowPlayingSent = false;
+            this._scrobbleSent = false;
+            this._playbackStartedAt = null;
+            this._listenedSeconds = 0;
+            this._lastAudioTime = 0;
+        },
+
+        _trackListenedDelta() {
+            if (!this.currentTrack) return;
+            const current = audio.currentTime || 0;
+            if (!this.isPlaying) {
+                this._lastAudioTime = current;
+                return;
+            }
+            const previous = Number.isFinite(this._lastAudioTime) ? this._lastAudioTime : current;
+            const delta = current - previous;
+            if (delta > 0 && delta < 5) {
+                this._listenedSeconds += delta;
+            }
+            this._lastAudioTime = current;
+        },
+
+        _trackDuration() {
+            const candidates = [
+                this.currentTrack?.duration_seconds,
+                this.duration,
+                audio.duration,
+            ];
+            for (const value of candidates) {
+                const duration = Number(value || 0);
+                if (Number.isFinite(duration) && duration > 0) return duration;
+            }
+            return 0;
+        },
+
+        _scrobbleThreshold(duration) {
+            return Math.min(duration / 2, 240);
+        },
+
+        _sendNowPlaying() {
+            if (this._nowPlayingSent || !this.currentTrack) return;
+            const lastfm = Alpine.store('user')?.lastfm;
+            if (!lastfm?.configured || !lastfm?.connected || lastfm?.reauth_required) return;
+            this._nowPlayingSent = true;
+            fetch('/api/player/lastfm/now-playing', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ track_id: this.currentTrack.id }),
+            }).catch(() => {});
+        },
+
+        _maybeScrobble(force = false) {
+            if (this._scrobbleSent || !this.currentTrack) return;
+            const lastfm = Alpine.store('user')?.lastfm;
+            if (!lastfm?.configured || !lastfm?.connected || lastfm?.reauth_required) return;
+            const duration = this._trackDuration();
+            if (!duration || duration <= 30) return;
+            const threshold = this._scrobbleThreshold(duration);
+            const listened = force ? this._listenedSeconds + 1 : this._listenedSeconds;
+            if (listened < threshold) return;
+            this._listenedSeconds = Math.max(this._listenedSeconds, listened);
+            this._sendScrobble();
+        },
+
+        _sendScrobble() {
+            if (this._scrobbleSent || !this.currentTrack) return;
+            this._scrobbleSent = true;
+            fetch('/api/player/lastfm/scrobble', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    track_id: this.currentTrack.id,
+                    started_at: this._playbackStartedAt || Math.floor(Date.now() / 1000),
+                    listened_seconds: Math.floor(this._listenedSeconds),
+                }),
+            }).catch(() => {
+                this._scrobbleSent = false;
+            });
+        },
     });
 
     // -----------------------------------------------------------------------

templates/player/shell.html

@@ -38,6 +38,13 @@
                         <span class="user-stat-label">{{ t.player_listened }}</span>
                     </div>
                 </div>
+                <button class="lastfm-profile-action"
+                        :class="$store.user.lastfmClass()"
+                        :disabled="$store.user.lastfmBusy || !$store.user.lastfm?.configured"
+                        @click="$store.user.handleLastfm()">
+                    <span class="lastfm-dot"></span>
+                    <span class="lastfm-profile-text" x-text="$store.user.lastfmLabel()"></span>
+                </button>
             </div>
             <div class="sidebar-header">
                 <h2>{{ t.player_library }}</h2>
@@ -324,6 +331,13 @@
                             <span class="user-stat-label">{{ t.player_listened }}</span>
                         </div>
                     </div>
+                    <button class="lastfm-profile-action"
+                            :class="$store.user.lastfmClass()"
+                            :disabled="$store.user.lastfmBusy || !$store.user.lastfm?.configured"
+                            @click="$store.user.handleLastfm()">
+                        <span class="lastfm-dot"></span>
+                        <span class="lastfm-profile-text" x-text="$store.user.lastfmLabel()"></span>
+                    </button>
                     <button class="modal-btn modal-btn-primary mobile-account-logout"
                             @click="$store.user.logout()">
                         {{ t.player_log_out }}

templates/player/styles.html

@@ -165,6 +165,68 @@ button.user-stat:hover {
     color: var(--text-subdued);
 }
 
+.lastfm-profile-action {
+    width: 100%;
+    min-height: 34px;
+    margin-top: 8px;
+    padding: 7px 9px;
+    border: 1px solid var(--border-color);
+    border-radius: 6px;
+    background: var(--bg-primary);
+    color: var(--text-secondary);
+    cursor: pointer;
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    text-align: left;
+    transition: background 0.15s, border-color 0.15s, color 0.15s;
+}
+
+.lastfm-profile-action:not(:disabled):hover {
+    background: var(--bg-hover);
+    color: var(--text-primary);
+}
+
+.lastfm-profile-action:disabled {
+    cursor: default;
+    opacity: 0.72;
+}
+
+.lastfm-dot {
+    width: 8px;
+    height: 8px;
+    border-radius: 50%;
+    background: var(--text-subdued);
+    flex-shrink: 0;
+}
+
+.lastfm-profile-action.connected {
+    border-color: rgba(29, 185, 84, 0.32);
+    color: var(--text-primary);
+}
+
+.lastfm-profile-action.connected .lastfm-dot {
+    background: #1db954;
+}
+
+.lastfm-profile-action.available .lastfm-dot,
+.lastfm-profile-action.needs-auth .lastfm-dot {
+    background: var(--accent);
+}
+
+.lastfm-profile-action.needs-auth {
+    border-color: rgba(255, 184, 77, 0.4);
+}
+
+.lastfm-profile-text {
+    min-width: 0;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+    font-size: 11px;
+    font-weight: 650;
+}
+
 .sidebar-header {
     padding: 16px;
     display: flex;