feat: youTube API servisi ve backend routing için video interaction ve comment management eklendi

app/main.py

@@ -86,10 +86,9 @@ _origins = _load_origins()
 app.add_middleware(
     CORSMiddleware,
     allow_origins=_origins,
-    # credentials=True is only safe with an explicit origin list, not wildcard
     allow_credentials="*" not in _origins,
-    allow_methods=["*"],
-    allow_headers=["*"],
+    allow_methods=["GET", "POST", "OPTIONS"],
+    allow_headers=["Content-Type", "Accept"],
 )
 
 app.include_router(health_router)

app/routes/analyze.py

@@ -62,7 +62,7 @@ async def _analyze_rate_limit(request: Request) -> None:
     if len(_analyze_rate_store) > _ANALYZE_MAX_IPS:
         stale = [
             ip for ip, ts in _analyze_rate_store.items()
-            if all(t <= cutoff for t in ts)
+            if not ts or all(t <= cutoff for t in ts)
         ]
         for ip in stale:
             del _analyze_rate_store[ip]

app/routes/commend/router.py

@@ -131,7 +131,10 @@ def _evict_stale_ips() -> None:
     if len(_rate_limit_store) <= _MAX_TRACKED_IPS:
         return
     cutoff = time.time() - _RATE_LIMIT_WINDOW
-    stale_keys = [ip for ip, ts in _rate_limit_store.items() if all(t <= cutoff for t in ts)]
+    stale_keys = [
+        ip for ip, ts in _rate_limit_store.items()
+        if not ts or all(t <= cutoff for t in ts)
+    ]
     for key in stale_keys:
         del _rate_limit_store[key]
 

app/routes/commend/youtube_service.py

@@ -18,6 +18,7 @@ from urllib.parse import urlparse
 from google.oauth2.credentials import Credentials
 from google.auth.transport.requests import Request
 from googleapiclient.discovery import build
+from googleapiclient.errors import HttpError
 import isodate
 
 from ...services.logging_config import get_logger
@@ -25,11 +26,11 @@ from ...services.logging_config import get_logger
 logger = get_logger(__name__)
 
 # Cached service instances
-_api_key_service = None
-_oauth_service = None
+_api_key_service: Any = None
+_oauth_service: Any = None
 
 
-def _get_api_key_service():
+def _get_api_key_service() -> Any:
     """
     API Key ile YouTube API servisi oluşturur.
     Read-only işlemler için kullanılır (video detayları, yorumları okuma).
@@ -56,16 +57,12 @@ def _get_api_key_service():
         raise ValueError(f"YouTube API initialization failed: {e}")
 
 
-def _get_oauth_service():
+def _get_oauth_service() -> Any:
     """
     OAuth 2.0 ile YouTube API servisi oluşturur.
     Write işlemleri için kullanılır (yorum gönderme).
+    Credentials are created fresh each call to avoid token reuse issues.
     """
-    global _oauth_service
-
-    if _oauth_service is not None:
-        # Check if credentials are still valid
-        return _oauth_service
 
     SCOPES = ['https://www.googleapis.com/auth/youtube.force-ssl']
 
@@ -82,9 +79,9 @@ def _get_oauth_service():
             logger.info("Refreshing expired OAuth token")
             creds.refresh(Request())
 
-        _oauth_service = build('youtube', 'v3', credentials=creds)
+        service = build('youtube', 'v3', credentials=creds)
         logger.info("YouTube OAuth service initialized")
-        return _oauth_service
+        return service
     except json.JSONDecodeError as e:
         logger.error(f"TOKEN_JSON is not valid JSON: {e}")
         raise ValueError("YouTube OAuth token is malformed")

app/routes/data_processing.py

@@ -3,6 +3,7 @@ Routes for data processing and manipulation (Audio/Image).
 """
 
 import time
+import re
 from collections import defaultdict
 from fastapi import APIRouter, File, UploadFile, Form, HTTPException, Request, Depends, status
 from fastapi.responses import StreamingResponse
@@ -29,7 +30,7 @@ async def _process_rate_limit(request: Request) -> None:
     cutoff = now - _PROCESS_RATE_WINDOW
 
     if len(_process_rate_store) > _PROCESS_MAX_IPS:
-        stale = [ip for ip, ts in _process_rate_store.items() if all(t <= cutoff for t in ts)]
+        stale = [ip for ip, ts in _process_rate_store.items() if not ts or all(t <= cutoff for t in ts)]
         for ip in stale:
             del _process_rate_store[ip]
 
@@ -72,6 +73,11 @@ async def process_audio_endpoint(
         raise HTTPException(status_code=400, detail={"code": "invalid_file_type", "message": "Invalid file type. Must be audio."})
 
     try:
+        # Sanitize filename to prevent injection attacks
+        safe_filename = re.sub(r'[^a-zA-Z0-9._-]', '_', file.filename or 'audio')
+        if safe_filename.endswith('.wav'):
+            safe_filename = safe_filename[:-4]
+
         # Read file in chunks to enforce size limit before full allocation
         chunks = []
         total_read = 0
@@ -90,11 +96,11 @@ async def process_audio_endpoint(
         processed_audio = process_audio(content, parsed_options)
 
         # Return as downloadable file
-        filename = f"processed_{file.filename}.wav"
+        output_filename = f"processed_{safe_filename}.wav"
         return StreamingResponse(
             processed_audio,
             media_type="audio/wav",
-            headers={"Content-Disposition": f"attachment; filename={filename}"}
+            headers={"Content-Disposition": f"attachment; filename={output_filename}"}
         )
 
     except ValueError as e: