Private storage
MP3 files are stored privately, so they can't be opened from a permanent public link. The player streams them through signed URLs that stop working after one hour.
Overview
This platform was built for music producers who need a secure way to review unreleased music and mixes without publicly exposing the original audio files. It acts as a private audio library where tracks are stored in Firebase Storage and can be accessed from anywhere by an authorized user.
MP3 files are stored privately, so they can't be opened from a permanent public link. The player streams them through signed URLs that stop working after one hour.
Access is intentionally minimal: a single PIN unlocks the library, and the catalog stays hidden from the general public.
Browse, stream, and A | B compare mixes, then organize tracks with tags, ratings, notes, and release destinations.
Screens
What it does
Upload and securely stream your tracks from anywhere.
Compare your track against another reference track in real time.
Convert up to 20 WAV files (50 MB each) at a time into 320 kbps MP3s.
Filter tracks using custom tags, artist tags, moods, and track types.
Load tracks in paginated batches, with or without active filters.
Mark intended release destinations such as SoundCloud or YouTube.
Rate each track from 0 to 5 stars.
Create and save custom notes for every track.
Built with
SvelteKit, TypeScript, custom audio player, reactive stores, responsive UI, and secure API integration.
Node.js, Express, TypeScript, REST APIs, middleware-driven authentication, file upload handling, FFmpeg, and Socket.IO.
Firebase Firestore, Firebase Storage, Firebase Admin SDK, and time-limited signed URLs for secure audio access.
PIN-based authentication, IP verification, JWT authentication, signed Firebase Storage URLs, rate limiting, and secure HTTP-only cookies.
Delivery
MP3s are uploaded to Firebase Storage as private objects, so their plain storage URLs can't be opened directly. Each time an authenticated request loads tracks, the backend generates a signed URL that expires after one hour for every MP3, and the audio player streams straight from Firebase Storage with it. The frontend only ever holds these temporary URLs; once one expires it stops working, and loading the tracks again issues fresh ones. The next and previous tracks are preloaded with small range requests so skipping feels instant.
Access
Access is protected by a PIN combined with IP validation. Five wrong PINs from the same IP block it for seven days, and login attempts are rate limited. A correct PIN issues a 30-second JWT access token bound to the client's IP, plus a 48-hour refresh token in a secure HTTP-only cookie. Protected routes check that the IP still matches and quietly issue new access tokens as they expire. All of this runs on the server, so only an authenticated session can load tracks or receive signed audio URLs.
This is a live deployment of the application, so the PIN is not publicly available. Since the source code is public on GitHub, you can download the source code from GitHub , configure your own environment variables (including your PIN), and deploy your own instance. Every deployment uses its own PIN, so there isn't a shared PIN that grants access to this demo.
Client
SvelteKit and TypeScript with reusable components, shared layouts, app-wide UI patterns, and responsive mobile and desktop behavior.
Reactive Svelte stores for audio playback, selected tracks, loading states, filters, pagination, autoplay, navigation, and shared application data.
Custom playback controls, seeking, buffering states, track navigation, autoplay behavior, waveform support, and secure streamed audio playback.
Reusable track, player, range, and toggle components for synchronized playback and instant switching between two tracks.
Shared buttons, modals, forms, navigation, track lists, artwork, filters, audio controls, and screenshot swipers used throughout the app.
Separate fetch helpers for public and authenticated requests, including token attachment, token refresh handling, normalized errors, and forced logout flows.
Adaptive navigation, mobile audio controls, swipeable content, responsive layouts, and device-specific interface behavior.
Server
Node.js, Express, and TypeScript with organized controllers, middleware, helpers, validators, and REST API routes.
PIN-based login, IP-bound JWTs, 30-second access tokens, 48-hour refresh tokens in secure HTTP-only cookies, and automatic access token renewal.
Centralized request protection for token validation, IP normalization, session checks, error handling, and authorization before protected routes run.
MP3s stay private in Firebase Storage. Track requests return one-hour V4 signed URLs, and the browser streams directly from Storage with them.
API endpoints for uploads, edits, deletion, ratings, notes, tags, future destinations, pagination, and filtered track retrieval.
Memory-based uploads, MP3 and image validation, artwork converted to optimized WebP, Firebase Storage uploads, and private MP3 storage.
Converts uploaded WAV files to 320 kbps MP3s with FFmpeg, sending live progress to the browser over Socket.IO. Converted files are automatically removed from the database and cloud storage after two weeks.
Firebase Admin SDK and Firestore queries for track data, authentication records, filtering, sorting, and paginated responses.
Custom application errors, normalized API responses, session-expiration handling, force-logout flows, and centralized Express error middleware.
Request throttling (300 requests per 15 minutes overall, 35 failed logins per 15 minutes) plus failed-PIN tracking that blocks an IP for seven days after five wrong PINs.
All Rights Reserved | Copyright © 2026 PATTSWAY