Add Pocket Casts as an oEmbed provider

[mattwondra]

👋 Hello! I'd like to suggest adding ​Pocket Casts to the ​oEmbed provider allow-list.

Pocket Casts is a podcast player with apps for iOS, Android, Web, Desktop, smart speakers, and more. The service is free (with an optional paid upgrade) and it syncs your listening history and subscriptions across all platforms.

The oEmbed API provides rich HTML to embed any audio or video episode onto a website. The endpoints—which support all required parameters—can be found here:

• ​https://pca.st/oembed.json?url=[EPISODE_URL]
• ​https://pca.st/oembed.xml?url=[EPISODE_URL]

The URLs are for episode share pages like these:

• ​https://pca.st/k2rof194
• ​https://pca.st/qekyjgs6
• ​https://pca.st/63wN

The HTML source of those pages include <link> tags pointing to their relative oEmbed URLs. If you follow those URLs, they will provide code for an <iframe> with the following respective sources:

• ​https://pca.st/embed/k2rof194
• ​https://pca.st/embed/qekyjgs6
• ​https://pca.st/embed/63wN

Here are the answers to the questions that help illustrate Pocket Casts' establishment and popularity:

Is the service is popular enough for core developers to have heard of it before? Is it “mainstream?”

It's a popular podcast player with around 1,000,000 monthly active users, and podcast-listening in general is a fairly mainstream hobby.

If similar services are already supported, how does this service compare in terms of size, features, and backing?

Pocket Casts is a full-featured podcast player which ​moved under the Automattic umbrella in 2021.

The Spotify Block can also embed podcast episodes, however they don't support third-party video podcasts or embeds like Pocket Casts does. Other supported services like Mixcloud, ReverbNation, and SoundCloud, can also embed audio podcasts, but are much more focused on music.

Does this service have a large following on Twitter, Facebook, or other social media? Is its Twitter account verified?

Yes, the ​verified Twitter account has 30.7K followers, and the ​r/pocketcasts subreddit has 14.4K members.

Is its oEmbed endpoint clearly established and properly documented? (Sometimes, they are just a developer’s pet project that may not be supported.)

There is no public documentation yet, but the endpoint is discoverable via <link> tags on episode share pages (​example) and conforms to ​the oEmbed standard.

Does the oEmbed endpoint work with WordPress’ oEmbed auto-discovery? If not, could it be made to work with additional HTML tags or attributes being added to the allow-list?

Yes, we've already tested it and the auto-discovery will pick it up.

Does the service make an effort to build relationships with developers, such as through robust APIs?

Pocket Casts doesn't have any other public APIs at this point, but has internal developer relationships with other companies/vendors who rely on their private APIs to be well-formed and stable.

How old is the service?

The apps debuted 12 years ago.

Does it have a well-established Wikipedia article? (Seriously.)

There's no dedicated article, but it's mentioned in ​this List of Podcast Clients with references.

Has anyone written a WordPress plugin that leverages the service in some way, whether adding it as an oEmbed provider, creating a shortcode, or leveraging other APIs of the service? Do these plugins have any noticeable adoption or traction that would indicate usage and demand?

No, not yet.

Is the provider frequently proposed?

This is the first proposal.

[peterwilsoncc]

Hi Matt and welcome to trac!

Yes, we've already tested it and the auto-discovery will pick it up.

I've confirmed that WP auto-discovery picks up and allows the current embeds to play successfully. As this is the case there is no need to include Pocketcast in the allow list -- it already works.

I'll close this ticket of as worksforme as no code changes are needed for support.

[pento]

I've been thinking about this ticket a little bit. There's ​a corresponding PR to add Pocket Casts to Gutenberg, which I have no concern with.

The issue I'm pondering is that we've historically kept the Gutenberg embed variations list and the oEmbed allow list in sync: this just happens to be the first instance (that I'm aware of) of an embed provider that already works with auto-discovery.

Since the practice of keeping them in sync has been driven by necessity, rather than a formal requirement, it's not a huge deal to break away from it. That said, this seems like a good opportunity to formalise the practice: do we intentionally keep the lists in sync (even if the occasional embed provider doesn't strictly need to be added to the allow list), or do we allow them to fall out of sync?

It's worth noting that they're not entirely in sync right now: Meetup was ​removed from Gutenberg, but not Core; and it looks like Someecards was added to Core, but never to Gutenberg.

@peterwilsoncc: Do you have thoughts on what would be the more maintainable practice?

[peterwilsoncc]

Thanks for the link to the Gutenberg ticket, @pento.

That said, this seems like a good opportunity to formalise the practice: do we intentionally keep the lists in sync (even if the occasional embed provider doesn't strictly need to be added to the allow list), or do we allow them to fall out of sync?

I've reopened this ticket as I think it's important for providers with a core embed block to be included on the allow list regardless of whether it's technically needed.

Rather than the niceties of consistency, I'm treating this more as a defensive coding technique. If the embed markup changes at a future date, we risk an external provider being able to break a core block.

I've put this on the future release milestone and will monitor the Gutenberg ticket to ensure both the block and the allow list update go in to the same release.

@mattwondra do you have any bandwidth to create a patch, it would be lovely to get you a contributor badge on your first ticket.

It would also be great of some docs could be created for the oembed endpoint on a pocketcasts owned property. They don't need to be super detailed, just something to indicate it's likely to stick around. For example: ​https://github.com/someecards/someecards-developer-docs/blob/master/oembed.md

[mattwondra]

Thanks for the help @pento and @peterwilsoncc!

I've ​set up the local trunk environment on my Mac with VVV, added Pocket Casts to the allowlist, and tested it. Now I'm trying to ​upload a patch with grunt but I'm getting permission errors:

src [master] $ grunt upload_patch:55860
package.json has not been modified.
Running "upload_patch:55860" (upload_patch) task
? Enter your WordPress.org username mattwondra
? Enter your WordPress.org password [hidden]
Warning: Something went wrong when attempting to upload the patch. Please confirm your credentials and the ticket number. Error: XML-RPC fault: XML_RPC privileges are required to perform this operation. You don't have the required permissions. Use --force to continue.

Aborted due to warnings.

Any ideas what I could be doing wrong? Here's the diff:

Index: wp-includes/class-wp-oembed.php
===================================================================
--- wp-includes/class-wp-oembed.php	(revision 53547)
+++ wp-includes/class-wp-oembed.php	(working copy)
@@ -104,6 +104,7 @@
 			'#https?://(www\.)?tiktok\.com/.*/video/.*#i'  => array( 'https://www.tiktok.com/oembed', true ),
 			'#https?://([a-z]{2}|www)\.pinterest\.com(\.(au|mx))?/.*#i' => array( 'https://www.pinterest.com/oembed.json', true ),
 			'#https?://(www\.)?wolframcloud\.com/obj/.+#i' => array( 'https://www.wolframcloud.com/oembed', true ),
+			'#https?://pca\.st/.+#i'                       => array( 'https://pca.st/oembed.json', true ),
 		);
 
 		if ( ! empty( self::$early_providers['add'] ) ) {
@@ -181,6 +182,7 @@
 		 * | TikTok       | tiktok.com                                | 5.4.0   |
 		 * | Pinterest    | pinterest.com                             | 5.9.0   |
 		 * | WolframCloud | wolframcloud.com                          | 5.9.0   |
+		 * | Pocket Casts | pocketcasts.com                           | 6.0.1   |
 		 *
 		 * No longer supported providers:
 		 *

[mattwondra]

do we intentionally keep the lists in sync (even if the occasional embed provider doesn't strictly need to be added to the allow list)

@pento @peterwilsoncc In my testing I actually found a user-facing reason to put providers on the allowlist — HTML from trusted providers isn't altered:

https://core.trac.wordpress.org/browser/trunk/src/wp-includes/embed.php#L894

For example, the Pocket Casts embed has several links that open in a new tab, and a responsive layout with rounded corners — all of which was broken until I added it to the allowlist. So though auto-discovery could technically embed _some_ version of the Pocket Casts player, it wasn't the best experience:

[peterwilsoncc]

Thanks Matt, I'm not sure why grunt wasn't allowing you to upload, sorry. I tend to use PRs on ​WordPress/wordpress-develop these days.

The Gutenberg block was merged a short time ago, I've put this on the next major release milestone for WordPress as a result.

55860.diff​ is the patch from comment 4 with the version set to 6.1.0

[mattwondra]

Thank you for all the help!

[audrasjb]

As we don't need to support www domain, so the above patch looks good to me 👍

Adding some workflow keywords to make sure it's properly documented.

Just to make sure the tests pass https://core.trac.wordpress.org/ticket/55860

[peterwilsoncc]

Thanks for the review JB. It occurs to me now I probably didn't need to wait, the code was Matt's; I just got trac to behave and accept the upload.

[peterwilsoncc]

In 53744:

Embeds: Add Pocket Casts as a trusted oEmbed provider.

Props mattwondra, peterwilsoncc, pento, audrasjb.
Fixes #55860.

Merged https://core.trac.wordpress.org/changeset/53744 / 3a20f3e4c5c7bad1f706729a224a91164c913265

[peterwilsoncc]

As shared via Slack, here's my suggestion for the oEmbed paragraph of the "miscellaneous changes" dev note:

New oEmbed provider: Pocket Casts
Pocket Casts is a podcast player with apps for several platforms. The oEmbed API provides rich HTML to embed any audio or video episode onto a website. URLs on the pca.st domain can now be embedded automatically.