Render playlist configs directly in-app; retire regen.sh and playlists.json (R3)

The app owns every input to a playlist's sldl .conf (playlists in its DB,
credentials in its encrypted store), so the old
DB -> playlists.json -> regen.sh subprocess -> regex credential patch-back
chain was three serialization hops for no reason. Collapse it:

- credential_service.render_playlist_confs(db) renders each <playlist>.conf
  from _template.conf in one pass: path placeholders substituted as literal
  text, then the four credential lines set, written 0600. This is now the
  single source of .conf rendering.
- playlist_service loses _write_playlists_json and regenerate_confs; _sync_to_disk
  just calls render_playlist_confs and syncs the scheduler. No subprocess, no
  intermediate JSON file.
- render_scope for spotify/soulseek re-renders confs via the same function
  (spotify still also writes _spotify.env for the python scripts). The dead
  _patch_conf_field / _every_playlist_conf helpers are removed.
- Delete pipeline/configs/regen.sh and drop it from the Dockerfile chmod;
  update _template.conf's comments.

Nothing outside playlist_service consumed regen.sh or playlists.json (verified).
Also closes the last remnants of the S2/S3 injection surface: names are
re-validated and path/credential values are substituted as literals, never
through sed or a shell.

Verified: end-to-end render in a throwaway DB (paths, creds incl. a password
with shell metacharacters, 0600, bad-name rejection) and a live re-render of
all 17 playlist configs with credentials preserved.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/services/credential_service.py

@@ -95,25 +95,67 @@ def get_scope(db: Session, scope: str) -> dict[str, str]:
     return {row.key: crypto.decrypt(row.value_encrypted) for row in rows}
 
 
-def _patch_conf_field(path: Path, key: str, value: str) -> None:
-    """Rewrite a single `key = value` line in an sldl .conf file, leaving
-    every other line (including PLAYLIST_NAME/SPOTIFY_URL substitutions
-    regen.sh already applied) untouched."""
-    text = path.read_text()
-    # A newline in the value would inject an extra `key = value` line into the
-    # sldl config. Credentials never legitimately contain one, so strip any.
+# A playlist name is also its .conf filename; it is validated to this charset
+# at creation (playlist_service.validate_name). Re-checked here as defense in
+# depth so a bad name can never escape the config dir or inject config text.
+_SAFE_CONF_NAME = re.compile(r"^[A-Za-z0-9 _-]{1,64}$")
+
+# The credential lines the renderer fills in from the encrypted store. Everything
+# else in a rendered .conf comes verbatim from _template.conf.
+_CONF_CRED_KEYS = ("user", "pass", "spotify-id", "spotify-secret")
+
+
+def _set_conf_field(text: str, key: str, value: str) -> str:
+    """Return `text` with the single `key = ...` line set to `value`,
+    appending the line if absent. Newlines in the value are stripped so a
+    credential can't inject an extra config line."""
     value = value.replace("\r", "").replace("\n", "")
     pattern = re.compile(rf"^{re.escape(key)}\s*=.*$", re.MULTILINE)
     new_line = f"{key} = {value}"
     if pattern.search(text):
-        text = pattern.sub(new_line, text)
-    else:
-        text = text.rstrip("\n") + f"\n{new_line}\n"
-    path.write_text(text)
+        return pattern.sub(new_line, text)
+    return text.rstrip("\n") + f"\n{new_line}\n"
 
 
-def _every_playlist_conf() -> list[Path]:
-    return sorted(settings.pipeline_config_dir.glob("*.conf"))
+def render_playlist_confs(db: Session) -> None:
+    """Render every playlist's sldl .conf directly from _template.conf, with
+    the path placeholders and the Soulseek/Spotify credentials substituted in
+    one pass, written 0600.
+
+    This is the single source of .conf rendering. It replaces the older
+    DB -> playlists.json -> regen.sh -> regex-patch-back chain: the app owns
+    every input (playlists in its DB, credentials in its encrypted store), so
+    there is no reason to round-trip through an intermediate file and a
+    subprocess. Called on any playlist change (playlist_service) and on any
+    Spotify/Soulseek credential change (render_scope)."""
+    from app.services import playlist_service
+
+    template = (settings.pipeline_dir / "configs" / "_template.conf").read_text()
+    dropbox_root = str(settings.music_data_dir / "sldl-dropbox")
+    spotify = get_scope(db, "spotify")
+    soulseek = get_scope(db, "soulseek")
+    creds = {
+        "user": soulseek.get("username", ""),
+        "pass": soulseek.get("password", ""),
+        "spotify-id": spotify.get("client_id", ""),
+        "spotify-secret": spotify.get("client_secret", ""),
+    }
+    # Path placeholders are substituted as LITERAL text in a single left-to-right
+    # pass (never re-scanned), so a value can't be reinterpreted as another
+    # placeholder. Credential values are set as whole lines afterwards.
+    token_re = re.compile("|".join(map(re.escape, ("PLAYLIST_NAME", "SPOTIFY_URL", "SLDL_DROPBOX_ROOT"))))
+
+    settings.pipeline_config_dir.mkdir(parents=True, exist_ok=True)
+    for p in playlist_service.list_all(db):
+        if not _SAFE_CONF_NAME.match(p.name):
+            continue
+        mapping = {"PLAYLIST_NAME": p.name, "SPOTIFY_URL": p.spotify_url, "SLDL_DROPBOX_ROOT": dropbox_root}
+        text = token_re.sub(lambda m: mapping[m.group(0)], template)
+        for key in _CONF_CRED_KEYS:
+            text = _set_conf_field(text, key, creds[key])
+        out = settings.pipeline_config_dir / f"{p.name}.conf"
+        out.write_text(text)
+        out.chmod(0o600)
 
 
 def _write_env_file(path: Path, values: dict[str, str]) -> None:
@@ -135,20 +177,16 @@ def render_scope(db: Session, scope: str) -> None:
     if scope == "spotify":
         cid = values.get("client_id", "")
         csec = values.get("client_secret", "")
-        for conf in _every_playlist_conf():
-            _patch_conf_field(conf, "spotify-id", cid)
-            _patch_conf_field(conf, "spotify-secret", csec)
+        # _spotify.env is read by the pipeline python scripts (spotify-genre etc.).
         _write_env_file(
             settings.pipeline_config_dir / "_spotify.env",
             {"SPOTIFY_CLIENT_ID": cid, "SPOTIFY_CLIENT_SECRET": csec},
         )
+        # Re-render every playlist .conf so the new Spotify creds land in them.
+        render_playlist_confs(db)
 
     elif scope == "soulseek":
-        user = values.get("username", "")
-        pw = values.get("password", "")
-        for conf in _every_playlist_conf():
-            _patch_conf_field(conf, "user", user)
-            _patch_conf_field(conf, "pass", pw)
+        render_playlist_confs(db)
 
     elif scope == "navidrome":
         _write_env_file(