From 9da78ae6335056d414fa6e1802f3cbb730e42ef9 Mon Sep 17 00:00:00 2001 From: David Nguyen Date: Tue, 10 Nov 2026 14:10:15 +0700 Subject: [PATCH 1/7] chore(license): add standard MIT license for original project software --- LICENSE | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 LICENSE diff --git a/LICENSE b/LICENSE new file mode 100644 index 00000000..2814a0a4 --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 David Nguyen and ePlus OnAir contributors + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. From d9fd8e36a849d25ca923cfd13c277666eb608c9c Mon Sep 17 00:00:00 2001 From: David Nguyen Date: Tue, 10 Nov 2026 14:10:19 +0700 Subject: [PATCH 2/7] docs(rights): explicitly exclude third-party streams, assets, data and brands from MIT --- CONTENT_AND_THIRD_PARTY_RIGHTS.md | 88 +++++++++++++++++++++++++++++++ 1 file changed, 88 insertions(+) create mode 100644 CONTENT_AND_THIRD_PARTY_RIGHTS.md diff --git a/CONTENT_AND_THIRD_PARTY_RIGHTS.md b/CONTENT_AND_THIRD_PARTY_RIGHTS.md new file mode 100644 index 00000000..7cecf6e6 --- /dev/null +++ b/CONTENT_AND_THIRD_PARTY_RIGHTS.md @@ -0,0 +1,88 @@ +# Content, data and third-party rights + +ePlus OnAir is a radio discovery and listening application. Its original +application code and the radio programs accessible through it are **different +works with different rights holders**. + +This document clarifies the scope of the root [MIT License](./LICENSE). It +does **not** change or add conditions to MIT-covered code, nor does it claim +ownership of third-party works or facts that are not protected by copyright. + +## MIT-licensed source code + +The MIT License covers **original source code and accompanying documentation** +that David Nguyen / ePlus OnAir contributors have the right to license, +including the first-party Nuxt/Vue app, UI/player logic, tests, scripts, and +deployment workflows. This includes original code in `components/`, +`composables/`, `stores/`, `pages/`, `plugins/`, `server/`, `utils/`, +`types/`, `config/`, `build/`, `scripts/`, `tests/`, `assets/css/`, +and first-party source configuration, to the extent owned by or licensed to +these contributors. + +The MIT License permits copying, modification, redistribution, and +commercial use of covered code when its conditions are met. A fork may use +that code but receives **no license to the ePlus OnAir branding or any +third-party radio content** from this repository. + +Any code incorporated from another project retains its own applicable +license and notices. The root MIT License does not relicense material whose +rights are held by unrelated third parties. + +## Not included in the MIT grant + +| Repository content | Scope and rights | +| --- | --- | +| `public/radio/**` | Geographic station directory data, names, schedules, streaming endpoints and associated provider metadata. Sources and permissions vary; no blanket rights grant or guarantee of redistribution, scraping or playback rights. | +| `public/catalog/providers/**` | Third-party provider directories, including Apple Music/TuneIn names, links and metadata; provider rights and terms remain applicable. | +| `public/img/**` | Station logos/artwork and other image assets, including images synced from InstantAudio/Radio Browser and seven Apple Music radio images sourced from TuneIn. No blanket MIT license; assess each image's provenance. | +| `public/brand/**`, `public/favicon.ico` | ePlus OnAir marks, logos, branding and associated visual assets. No trademark, endorsement or brand-asset license is granted by the MIT source-code license. | +| `data/instant-audio-countries.json`, `data/world.ts` | Imported or derived station/world metadata, to the extent it contains third-party material. Treat as data, not automatically MIT-licensed software. | +| Third-party packages, libraries, fonts, icons and other embedded materials | Their own license terms and attribution requirements apply, whether installed via npm or included elsewhere in the tree. | +| Live broadcasts, music, programs, stream segments, playlists, provider access credentials and signed stream URLs | Rights are held by broadcasters, artists, platforms or other licensors; they are **not** owned or licensed by ePlus OnAir. A public URL is not an authorization to rebroadcast, record, cache, redistribute or use a stream commercially. | + +Some station directory fields are public facts or links that may not themselves +be copyrightable. This notice does not assert exclusive rights over such +facts; it only avoids promising permissions ePlus OnAir does not control. +The repository's public availability and any permitted playback functionality +are not evidence of rights to republish third-party audio or artwork. + +`public/img/holiday/**` is also outside the default code grant pending a +per-asset provenance and permission review. New images should carry documented +ownership and applicable license information before redistribution. + +## Secrets, environment configuration and private services + +- Private `.env` files, credentials, API keys, deployment tokens and GitHub + Environment Secrets are **not distributed** or licensed by this repository. + `.env.example` describes public-safe configuration placeholders only. +- `NUXT_PUBLIC_*` values and `runtimeConfig.public` are **browser-visible** in + Nuxt builds. They must not contain private credentials, even when set from + a protected GitHub Environment. +- Private backends, stream resolvers and infrastructure not published here + are not made open source by the MIT License on this repository. +- Never commit, log or redistribute expiring HLS `accessKey` values. + +## Adding or correcting a station + +Contributors must identify the official station/provider page, verify source +provenance, and document artwork and playback permission when available. Do +not upload a third party's image or copy a proprietary catalog just because +it is publicly reachable. Do not record, mirror or redistribute third-party +audio without appropriate permission. + +A maintainer may remove or replace a station link, metadata or artwork if +the source is unauthorized or a rights holder requests correction. + +## Rights-holder contact + +If you own or represent a station, artwork, trademark, metadata or audio +program and have a rights concern, please contact **report@eplus.dev** +with the specific ePlus OnAir URL, the material involved, a description of +your rights and your requested correction or removal. Do **not** send API +keys, access tokens or other secrets. + +A source-code issue report is not a substitute for permission from the +relevant station, rights holder or stream provider. + +This document is an explanation of licensing scope, not legal clearance +of any individual station, image, provider API or stream. From 15e5956f2aace9d5edbe929bc8a7a1a4aabeb3c7 Mon Sep 17 00:00:00 2001 From: David Nguyen Date: Tue, 10 Nov 2026 14:11:13 +0700 Subject: [PATCH 3/7] docs(readme): link MIT source license and third-party rights --- README.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 777a36af..ef7ccb68 100644 --- a/README.md +++ b/README.md @@ -53,4 +53,7 @@ For contributions, see [CONTRIBUTING.md](./CONTRIBUTING.md), [SECURITY.md](./SEC ## License -A source license has **not yet been selected**. Public visibility alone does not grant permission to reuse or redistribute the code, station artwork or third-party streams. +Original ePlus OnAir source code is available under the [MIT License](./LICENSE). +**Radio streams, station artwork, provider metadata and logos are not included** +in that grant; see [Content & third-party rights](./CONTENT_AND_THIRD_PARTY_RIGHTS.md). +Private environment secrets are never part of the published source. From bf0dea3b9db3435d7dcfd3d839859331a705a6ce Mon Sep 17 00:00:00 2001 From: David Nguyen Date: Tue, 10 Nov 2026 14:11:17 +0700 Subject: [PATCH 4/7] docs(contributing): document MIT contributions and content-rights boundaries --- CONTRIBUTING.md | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index a6e66d52..85eabd7f 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -27,6 +27,22 @@ and [coding guide](./AGENTS.md) before proposing changes. 7. If a security issue is discovered, report it **privately** as described in [SECURITY.md](./SECURITY.md), not in a public issue. -Source code publication does not itself grant permission to redistribute -radio station logos, audio streams, third-party media or proprietary metadata. -A repository source license will need to be selected and published separately. +## Licensing and content provenance + +Original code you contribute must be your own or material you have the right +to submit under the project's [MIT License](./LICENSE). Contributors retain +their own copyright; submission does not transfer ownership to ePlus OnAir. +Keep attribution and license notices required by upstream dependencies. + +The [Content & third-party rights](./CONTENT_AND_THIRD_PARTY_RIGHTS.md) +policy excludes broadcasters' audio, third-party station logos/artwork, +provider metadata and ePlus branding from the default MIT code grant. +A publicly accessible stream URL is **not** permission to record, mirror, +rebroadcast or redistribute audio. Explain the provenance of any new +catalog entry, logo, image or provider integration in its PR and include +evidence of permission when available. + +Never place private environment values, tokens or service credentials in +source, screenshots, test fixtures, issue comments or PR descriptions. +Browser-visible `NUXT_PUBLIC_*` values are not a safe place for secrets. +For copyright or takedown requests, contact **report@eplus.dev** directly. From 2f386b5c8aae2e95086531cc9fa33296558564a2 Mon Sep 17 00:00:00 2001 From: David Nguyen Date: Tue, 10 Nov 2026 14:11:21 +0700 Subject: [PATCH 5/7] chore(package): declare MIT for original non-published app source --- package.json | 1 + 1 file changed, 1 insertion(+) diff --git a/package.json b/package.json index c864695f..a409d95c 100644 --- a/package.json +++ b/package.json @@ -4,6 +4,7 @@ "repository": "https://github.com/ePlus-DEV/radio.eplus.dev", "description": "ePlus OnAir — Listen Beyond Borders. Live radio from around the world.", "author": "David Nguyen", + "license": "MIT", "private": true, "type": "module", "scripts": { From f100a0dcec0c2f1a845c9bfaeb354cbc5d7e826e Mon Sep 17 00:00:00 2001 From: David Nguyen Date: Tue, 10 Nov 2026 14:11:25 +0700 Subject: [PATCH 6/7] docs(agents): prevent automated relicensing of radio content --- AGENTS.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/AGENTS.md b/AGENTS.md index 823de59e..eaae62ae 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -196,6 +196,24 @@ Regression guards include `tests/playback-store.test.mjs`, `tests/station-pollin See `docs/instant-audio-sync.md`. +## Licensing and rights guardrails + +- The repository `LICENSE` grants MIT rights only for **original project-owned + source code**, not broadcaster audio, stream rights, provider data/artwork, + third-party icons/packages or ePlus OnAir branding. Preserve the + [content-rights policy](./CONTENT_AND_THIRD_PARTY_RIGHTS.md). +- Do not treat a stream URL, public provider page, locally copied logo or an + `artwork_source_url` as proof of a redistribution/playback license. Review + provenance and permissions before importing assets or catalogs. +- Do not relicense `public/radio/**`, `public/catalog/providers/**`, + `public/img/**`, `public/brand/**` or derived third-party catalog data as + MIT just because they live in the same GitHub repository. +- Private `.env`, backend credentials and GitHub Environment Secrets are + never part of the public source grant. `NUXT_PUBLIC_*` settings are + browser-visible and must not contain secrets. +- License documentation changes must not alter audio behavior, station data, + production SEO/GA4, images or deployment configuration. + ## i18n and text direction Station names/descriptions may use Arabic or other RTL/mixed scripts. From 24fd67940a762b4a8d9616648a067ce00a8444dd Mon Sep 17 00:00:00 2001 From: David Nguyen Date: Tue, 10 Nov 2026 14:11:55 +0700 Subject: [PATCH 7/7] test(license): guard third-party exclusion and secrets boundary --- tests/license-scope.test.mjs | 43 ++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 tests/license-scope.test.mjs diff --git a/tests/license-scope.test.mjs b/tests/license-scope.test.mjs new file mode 100644 index 00000000..b2bff698 --- /dev/null +++ b/tests/license-scope.test.mjs @@ -0,0 +1,43 @@ +import test from 'node:test'; +import assert from 'node:assert/strict'; +import { readFile } from 'node:fs/promises'; + +const read = file => readFile(new URL('../' + file, import.meta.url), 'utf8'); + +test('original application software declares MIT without changing the standard permission grant', async () => { + const [license, manifest] = await Promise.all([read('LICENSE'), read('package.json')]); + assert.match(license, /^MIT License\n/); + assert.match(license, /Permission is hereby granted, free of charge/); + assert.match(license, /use, copy, modify, merge, publish, distribute, sublicense, and\/or sell/); + assert.match(license, /THE SOFTWARE IS PROVIDED "AS IS"/); + assert.equal(JSON.parse(manifest).license, 'MIT'); + assert.equal(JSON.parse(manifest).private, true, 'publishing npm package is unrelated to open-source license'); +}); + +test('license scope explicitly excludes streams, provider catalogs, station images, and marks', async () => { + const [readme, rights, contributing, agents] = await Promise.all([ + read('README.md'), + read('CONTENT_AND_THIRD_PARTY_RIGHTS.md'), + read('CONTRIBUTING.md'), + read('AGENTS.md'), + ]); + assert.match(readme, /\[MIT License\]\(\.\/LICENSE\)/); + assert.match(readme, /\[Content & third-party rights\]\(\.\/CONTENT_AND_THIRD_PARTY_RIGHTS\.md\)/); + for (const pattern of [ + 'public/radio/**', 'public/catalog/providers/**', 'public/img/**', + 'public/brand/**', 'data/instant-audio-countries.json', 'data/world.ts', + ]) assert.ok(rights.includes(pattern), `rights policy should mention ${pattern}`); + assert.match(rights, /not.*licensed by ePlus OnAir/i); + assert.match(rights, /report@eplus\.dev/); + assert.match(contributing, /MIT License/); + assert.match(agents, /Licensing and rights guardrails/); +}); + +test('environment files remain ignored and public Nuxt settings are not described as secret', async () => { + const [ignore, rights] = await Promise.all([read('.gitignore'), read('CONTENT_AND_THIRD_PARTY_RIGHTS.md')]); + assert.match(ignore, /^\.env\n/m); + assert.match(ignore, /^\.env\.\*\n/m); + assert.match(ignore, /^!\.env\.example\n/m); + assert.match(rights, /browser-visible/); + assert.match(rights, /not distributed/); +});