fix: make playlist detail page publicly viewable (#519)

- add get_record_public() to _internal/atproto/records.py for unauthenticated ATProto record fetches
- remove auth requirement from GET /playlists/{id} endpoint
- remove auth redirect from frontend playlist page loader
- edit/delete buttons still only show for playlist owner (via client-side auth check)

ATProto records are public by design - the previous auth requirement was unnecessary for read access.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude <[e-mail]>

backend/src/backend/_internal/atproto/records.py

···
     return parts[0], parts[1], parts[2]
 
 
+async def get_record_public(
+    record_uri: str,
+    pds_url: str | None = None,
+) -> dict[str, Any]:
+    """fetch an ATProto record without authentication.
+
+    ATProto records are public by design - any client can read them.
+    uses the owner's PDS URL if provided, otherwise falls back to
+    bsky.network relay which indexes all public records.
+
+    args:
+        record_uri: AT URI of the record (at://did/collection/rkey)
+        pds_url: optional PDS URL to use (falls back to bsky.network)
+
+    returns:
+        the record value dict
+
+    raises:
+        ValueError: if URI is malformed
+        Exception: if fetch fails
+    """
+    import httpx
+
+    repo, collection, rkey = _parse_at_uri(record_uri)
+
+    base_url = pds_url or "https://bsky.network"
+    url = f"{base_url}/xrpc/com.atproto.repo.getRecord"
+    params = {"repo": repo, "collection": collection, "rkey": rkey}
+
+    async with httpx.AsyncClient() as client:
+        response = await client.get(url, params=params, timeout=10.0)
+
+    if response.status_code != 200:
+        raise Exception(
+            f"failed to fetch record: {response.status_code} {response.text}"
+        )
+
+    return response.json()
+
+
 async def update_record(
     auth_session: AuthSession,
     record_uri: str,

backend/src/backend/api/lists.py

···
     create_list_record,
     update_list_record,
 )
-from backend.models import Artist, Playlist, Track, TrackLike, UserPreferences, get_db
+from backend.models import Artist, Playlist, Track, UserPreferences, get_db
 from backend.schemas import TrackResponse
 from backend.storage import storage
 from backend.utilities.aggregations import get_comment_counts, get_like_counts
···
 @router.get("/playlists/{playlist_id}", response_model=PlaylistWithTracksResponse)
 async def get_playlist(
     playlist_id: str,
-    session: AuthSession = Depends(require_auth),
     db: AsyncSession = Depends(get_db),
 ) -> PlaylistWithTracksResponse:
-    """get a playlist with full track details.
+    """get a playlist with full track details (public, no auth required).
 
     fetches the ATProto list record to get track ordering, then hydrates
     track metadata from the database.
     """
+    from backend._internal.atproto.records import get_record_public
+
     # get playlist from database
     result = await db.execute(
         select(Playlist, Artist)
···
 
     playlist, artist = row
 
-    # fetch ATProto list record to get track ordering
-    oauth_data = session.oauth_session
-    if not oauth_data or "access_token" not in oauth_data:
-        raise HTTPException(status_code=401, detail="invalid session")
-
-    oauth_session = _reconstruct_oauth_session(oauth_data)
-    from backend._internal import get_oauth_client
-
-    # parse the AT URI to get repo and rkey
-    parts = playlist.atproto_record_uri.replace("at://", "").split("/")
-    if len(parts) != 3:
-        raise HTTPException(status_code=500, detail="invalid playlist URI")
+    # fetch ATProto record (public - no auth needed)
+    try:
+        record_data = await get_record_public(
+            record_uri=playlist.atproto_record_uri,
+            pds_url=artist.pds_url,
+        )
+    except Exception as e:
+        raise HTTPException(
+            status_code=500, detail=f"failed to fetch playlist record: {e}"
+        ) from e
 
-    repo, collection, rkey = parts
-
-    # get the list record from PDS
-    url = f"{oauth_data['pds_url']}/xrpc/com.atproto.repo.getRecord"
-    params = {"repo": repo, "collection": collection, "rkey": rkey}
-
-    response = await get_oauth_client().make_authenticated_request(
-        session=oauth_session,
-        method="GET",
-        url=url,
-        params=params,
-    )
-
-    if response.status_code != 200:
-        raise HTTPException(status_code=500, detail="failed to fetch playlist record")
-
-    record_data = response.json()
     items = record_data.get("value", {}).get("items", [])
 
     # extract track URIs in order
···
         like_counts = await get_like_counts(db, track_ids) if track_ids else {}
         comment_counts = await get_comment_counts(db, track_ids) if track_ids else {}
 
-        # get authenticated user's liked tracks
+        # no authenticated user for public endpoint - liked status not available
         liked_track_ids: set[int] = set()
-        if track_ids:
-            liked_result = await db.execute(
-                select(TrackLike.track_id).where(
-                    TrackLike.user_did == session.did,
-                    TrackLike.track_id.in_(track_ids),
-                )
-            )
-            liked_track_ids = set(liked_result.scalars().all())
 
         # maintain ATProto ordering, skip unavailable tracks
         for uri in track_uris:
···
                 track = track_by_uri[uri]
                 track_response = await TrackResponse.from_track(
                     track,
-                    pds_url=oauth_data.get("pds_url"),
                     liked_track_ids=liked_track_ids,
                     like_counts=like_counts,
                     comment_counts=comment_counts,

frontend/src/routes/playlist/[id]/+page.ts

···
 import { browser } from '$app/environment';
-import { redirect, error } from '@sveltejs/kit';
+import { error } from '@sveltejs/kit';
 import { API_URL } from '$lib/config';
 import type { LoadEvent } from '@sveltejs/kit';
 import type { PlaylistWithTracks, Playlist } from '$lib/types';
···
 	playlistMeta: Playlist | null;
 }
 
-export async function load({ params, parent, data }: LoadEvent): Promise<PageData> {
+export async function load({ params, data }: LoadEvent): Promise<PageData> {
 	// server data for OG tags
 	const serverData = data as { playlistMeta: Playlist | null } | undefined;
 
···
 		};
 	}
 
-	// check auth from parent layout data
-	const { isAuthenticated } = await parent();
-	if (!isAuthenticated) {
-		throw redirect(302, '/');
-	}
-
+	// playlist endpoint is public - no auth required
 	const response = await fetch(`${API_URL}/lists/playlists/${params.id}`, {
 		credentials: 'include'
 	});