andrew/alembic
1
0
Fork 0
Code Pull Requests Actions Releases 18 Wiki Activity

0.6: Spotify OAuth connect flow, AzuraCast base URL, fingerprint/buy-url fixes

Browse Source 
- Add "Connect Spotify" OAuth flow (/connect/spotify) so newly created Spotify
  apps can read playlists: Spotify now requires a user token for playlist
  reads, which client-credentials alone can no longer provide. The stored
  refresh token is rendered as spotify-refresh into each playlist's sldl
  .conf -- sldl's own docs confirm supplying it skips its interactive login
  flow, which is what was causing multi-hour hangs on a stuck sync.
  Grandfathered apps keep working unchanged if no account is connected.
- Fix the connect flow's redirect_uri: request.url_for() reflected the raw
  connection scheme (http) rather than what the reverse proxy actually
  served over, which Spotify's exact-match redirect_uri check rejected.
  Force https rather than trust the unproxied scheme.
- Add an AzuraCast base URL credential field alongside the API key, with a
  keyfile fallback so the scheduled enrich-buy-url.py job can actually reach
  AzuraCast (previously it had no way to receive a base URL at all when run
  from the scheduler, so the reprocess call was silently always skipped).
- Fix build-fingerprint-index.py exiting non-zero on any single fingerprint
  failure instead of only when nothing was written.
- Guard enrich-buy-url.py's AzuraCast reprocess against an empty
  --azuracast-base (raised ValueError since PD2 removed the hardcoded base).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
andrew
2026-07-14 11:16:55 -06:00
parent 91f3982eff
commit e5d9c7f043
18 changed files with 280 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/services/credential_service.py
+26 -6
View File
@@ -13,11 +13,11 @@ from app.settings import settings
# Which fields exist per scope, and whether each is safe to display back to
# the UI once saved (short opaque strings need never be shown again).
SCOPE_FIELDS = {
"spotify": ["client_id", "client_secret"],
"spotify": ["client_id", "client_secret", "refresh_token"],
"soulseek": ["username", "password"],
"navidrome": ["base_url", "admin_user", "admin_pass"],
"bandcamp": ["username", "format_pref", "cookies_txt"],
"azuracast": ["api_key"],
"azuracast": ["base_url", "api_key"],
"qobuz": ["token", "app_id", "region"],
"telegram": ["bot_token", "chat_id"],
}
@@ -56,6 +56,7 @@ SECRET_KEYS = {
"api_key",
"token",
"bot_token",
"refresh_token",
}
@@ -116,7 +117,7 @@ _SAFE_CONF_NAME = re.compile(r"^[A-Za-z0-9 _-]{1,64}$")
# The credential lines the renderer fills in from the encrypted store. Everything
# else in a rendered .conf comes verbatim from _template.conf.
_CONF_CRED_KEYS = ("user", "pass", "spotify-id", "spotify-secret")
_CONF_CRED_KEYS = ("user", "pass", "spotify-id", "spotify-secret", "spotify-refresh")
def _set_conf_field(text: str, key: str, value: str) -> str:
@@ -153,6 +154,7 @@ def render_playlist_confs(db: Session) -> None:
"pass": soulseek.get("password", ""),
"spotify-id": spotify.get("client_id", ""),
"spotify-secret": spotify.get("client_secret", ""),
"spotify-refresh": spotify.get("refresh_token", ""),
}
# Path placeholders are substituted as LITERAL text in a single left-to-right
# pass (never re-scanned), so a value can't be reinterpreted as another
@@ -191,10 +193,20 @@ def render_scope(db: Session, scope: str) -> None:
if scope == "spotify":
cid = values.get("client_id", "")
csec = values.get("client_secret", "")
# _spotify.env is read by the pipeline python scripts (spotify-genre etc.).
# _spotify.env is read by the pipeline python scripts (spotify-genre,
# spotify-retag, fix-track-metadata). SPOTIFY_REFRESH_TOKEN is only set
# once an account is connected via /connect/spotify -- its presence is
# what switches every reader from client-credentials to a user token
# (see _spotify_auth.get_token). The rendered playlist .conf gets the
# same refresh token too (spotify-refresh, in render_playlist_confs),
# which is what lets sldl itself use a user token.
_write_env_file(
settings.pipeline_config_dir / "_spotify.env",
{"SPOTIFY_CLIENT_ID": cid, "SPOTIFY_CLIENT_SECRET": csec},
{
"SPOTIFY_CLIENT_ID": cid,
"SPOTIFY_CLIENT_SECRET": csec,
"SPOTIFY_REFRESH_TOKEN": values.get("refresh_token", ""),
},
)
# Re-render every playlist .conf so the new Spotify creds land in them.
render_playlist_confs(db)
@@ -239,6 +251,10 @@ def render_scope(db: Session, scope: str) -> None:
key_path = az_dir / "api_key"
key_path.write_text(values.get("api_key", ""))
key_path.chmod(0o600)
# base_url isn't secret, but still keyfile-based (not env) so it's
# readable via the same fallback cascade as api_key -- see
# enrich-buy-url.py's --azuracast-base resolution.
(az_dir / "base_url").write_text(values.get("base_url", ""))
elif scope == "qobuz":
qobuz_dir = settings.pipeline_config_dir / "qobuz"
@@ -289,7 +305,9 @@ def _clear_rendered(scope: str) -> None:
notify-telegram.sh call). Re-enabling calls render_scope() again to
recreate the file from the still-stored values."""
if scope == "azuracast":
(settings.pipeline_config_dir / "azuracast" / "api_key").unlink(missing_ok=True)
az_dir = settings.pipeline_config_dir / "azuracast"
(az_dir / "api_key").unlink(missing_ok=True)
(az_dir / "base_url").unlink(missing_ok=True)
elif scope == "qobuz":
qobuz_dir = settings.pipeline_config_dir / "qobuz"
for name in ("token", "app_id", "region"):
@@ -360,6 +378,8 @@ def auth_states(db: Session) -> list[dict]:
values = get_scope(db, scope)
configured = bool(values)
entry = {"scope": scope, "configured": configured}
if scope == "spotify":
entry["spotify_connected"] = bool(values.get("refresh_token"))
if scope == "bandcamp" and values.get("cookies_txt"):
expiry = _bandcamp_cookie_expiry(values["cookies_txt"])
if expiry is not None:
app/services/spotify_client.py
+25 -6
View File
@@ -11,8 +11,11 @@ TOKEN_URL = "https://accounts.spotify.com/api/token"
API_BASE = "https://api.spotify.com/v1"
# Module-level cache: one alembic process, one Spotify app registration --
# a single shared client-credentials token is fine (no per-user tokens here).
_token_cache: dict = {"token": None, "expires_at": 0.0}
# a single shared token is fine (single-user app, no per-request identity).
# Keyed by mode too, so connecting/disconnecting an account (switching
# between a user token and a client-credentials token) can't serve a stale
# token minted under the other grant type.
_token_cache: dict = {"token": None, "expires_at": 0.0, "mode": None}
_PLAYLIST_ID_RE = re.compile(r"playlist/([A-Za-z0-9]+)")
@@ -26,19 +29,34 @@ def _extract_playlist_id(playlist_url: str) -> str:
def _get_token(db: Session) -> str:
now = time.time()
if _token_cache["token"] and _token_cache["expires_at"] > now + 30:
return _token_cache["token"]
creds = credential_service.get_scope(db, "spotify")
client_id = creds.get("client_id")
client_secret = creds.get("client_secret")
if not client_id or not client_secret:
raise RuntimeError("Spotify credentials not configured (settings/credentials)")
refresh_token = creds.get("refresh_token")
# A user token (from /connect/spotify) can read playlists on newly created
# Spotify apps; client-credentials can't (Spotify blocks GET /items for
# new apps without user auth). Prefer the user token whenever one is
# connected, falling back to client-credentials for grandfathered apps.
mode = "user" if refresh_token else "client_credentials"
if (
_token_cache["token"]
and _token_cache["mode"] == mode
and _token_cache["expires_at"] > now + 30
):
return _token_cache["token"]
basic = base64.b64encode(f"{client_id}:{client_secret}".encode()).decode()
grant_data = (
{"grant_type": "refresh_token", "refresh_token": refresh_token}
if refresh_token
else {"grant_type": "client_credentials"}
)
resp = httpx.post(
TOKEN_URL,
data={"grant_type": "client_credentials"},
data=grant_data,
headers={"Authorization": f"Basic {basic}"},
timeout=15,
)
@@ -46,6 +64,7 @@ def _get_token(db: Session) -> str:
data = resp.json()
_token_cache["token"] = data["access_token"]
_token_cache["expires_at"] = now + data["expires_in"]
_token_cache["mode"] = mode
return _token_cache["token"]