fix: enhance error handling in YouTube analysis and implement API key validation with rate limiting

app/routes/analyze.py

@@ -143,7 +143,7 @@ async def _analyze_youtube(
         return AnalyzeResponse(
             result=result,
             warnings=yt_result.warnings,
-            errors=[]
+            errors=yt_result.errors,
         )
 
     except ValueError as e:

app/routes/commend/router.py

@@ -7,9 +7,10 @@ from __future__ import annotations
 
 import os
 import time
+from collections import defaultdict
 from typing import Literal, Optional
 
-from fastapi import APIRouter, HTTPException, status
+from fastapi import APIRouter, Depends, Header, HTTPException, Request, status
 from pydantic import BaseModel, Field, field_validator
 
 from .youtube_service import (
@@ -112,6 +113,48 @@ class CommendHealthResponse(BaseModel):
     message: str
 
 
+# --- Auth & Rate Limiting ---
+
+_COMMEND_API_KEY = os.getenv("COMMEND_API_KEY")
+_COMMEND_POSTING_ENABLED = os.getenv("COMMEND_ENABLE_POSTING", "false").lower() == "true"
+
+# Simple in-memory rate limiter: IP -> list of timestamps
+_rate_limit_store: dict[str, list[float]] = defaultdict(list)
+_RATE_LIMIT_WINDOW = 60  # seconds
+_RATE_LIMIT_MAX = 10  # requests per window
+
+
+def _check_rate_limit(client_ip: str) -> None:
+    now = time.time()
+    window_start = now - _RATE_LIMIT_WINDOW
+    timestamps = _rate_limit_store[client_ip]
+    # Prune old entries
+    _rate_limit_store[client_ip] = [t for t in timestamps if t > window_start]
+    if len(_rate_limit_store[client_ip]) >= _RATE_LIMIT_MAX:
+        raise HTTPException(
+            status_code=status.HTTP_429_TOO_MANY_REQUESTS,
+            detail="Rate limit exceeded. Please wait before making more requests."
+        )
+    _rate_limit_store[client_ip].append(now)
+
+
+async def _require_api_key(
+    request: Request,
+    x_api_key: Optional[str] = Header(None, alias="X-API-Key"),
+) -> None:
+    """Validate API key if COMMEND_API_KEY is configured."""
+    if not _COMMEND_API_KEY:
+        # No key configured — allow (development mode)
+        return
+    if x_api_key != _COMMEND_API_KEY:
+        logger.warning(f"Unauthorized commend request from {request.client.host if request.client else 'unknown'}")
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid or missing API key."
+        )
+    _check_rate_limit(request.client.host if request.client else "unknown")
+
+
 # --- API Endpoints ---
 
 @router.get("/health", response_model=CommendHealthResponse)
@@ -156,7 +199,7 @@ async def get_video_info(request: GenerateCommentRequest):
     return VideoDetailsResponse(**details)
 
 
-@router.post("/generate", response_model=GenerateCommentResponse)
+@router.post("/generate", response_model=GenerateCommentResponse, dependencies=[Depends(_require_api_key)])
 async def generate_youtube_comment(request: GenerateCommentRequest):
     """
     Generate an AI-powered comment for a YouTube video.
@@ -217,7 +260,7 @@ async def generate_youtube_comment(request: GenerateCommentRequest):
     )
 
 
-@router.post("/post", response_model=PostCommentResponse)
+@router.post("/post", response_model=PostCommentResponse, dependencies=[Depends(_require_api_key)])
 async def post_comment_to_youtube(request: PostCommentRequest):
     """
     Post a comment to YouTube.
@@ -225,7 +268,14 @@ async def post_comment_to_youtube(request: PostCommentRequest):
     Note: This requires valid OAuth credentials with YouTube posting permissions.
     Comments include an AI disclaimer as required by platform policies.
     Each video can only receive ONE comment to prevent spam/bot detection.
+    Controlled by COMMEND_ENABLE_POSTING env (default: disabled).
     """
+    if not _COMMEND_POSTING_ENABLED:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Comment posting is disabled. Set COMMEND_ENABLE_POSTING=true to enable."
+        )
+
     video_id = extract_video_id(request.videoUrl)
 
     # Check if already commented on this video

app/routes/commend/youtube_service.py

@@ -13,6 +13,7 @@ import os
 import re
 import json
 from typing import Optional, Tuple, List, Dict, Any
+from urllib.parse import urlparse
 
 from google.oauth2.credentials import Credentials
 from google.auth.transport.requests import Request
@@ -92,8 +93,24 @@ def _get_oauth_service():
         raise ValueError(f"YouTube OAuth authentication failed: {e}")
 
 
+_YOUTUBE_HOSTS = frozenset({
+    "youtube.com", "www.youtube.com", "m.youtube.com",
+    "music.youtube.com", "youtu.be", "www.youtu.be",
+})
+_VIDEO_ID_RE = re.compile(r"^[a-zA-Z0-9_-]{11}$")
+
+
 def extract_video_id(video_url: str) -> Optional[str]:
-    """YouTube URL'sinden video ID'sini çıkarır."""
+    """YouTube URL'sinden video ID'sini çıkarır (exact-host + 11-char ID)."""
+    try:
+        parsed = urlparse(video_url.strip())
+    except Exception:
+        return None
+
+    host = (parsed.hostname or "").lower()
+    if host not in _YOUTUBE_HOSTS:
+        return None
+
     patterns = [
         r"(?<=v=)[^&#?]+",
         r"(?<=be/)[^&#?]+",
@@ -104,7 +121,9 @@ def extract_video_id(video_url: str) -> Optional[str]:
     for pattern in patterns:
         match = re.search(pattern, video_url)
         if match:
-            return match.group(0)
+            candidate = match.group(0)
+            if _VIDEO_ID_RE.match(candidate):
+                return candidate
 
     return None
 

app/routes/data_processing.py

@@ -22,14 +22,17 @@ async def process_audio_endpoint(
     Process an audio file with the given augmentation options.
     Returns the processed WAV file.
     """
+    MAX_PAYLOAD_BYTES = 30 * 1024 * 1024  # 30 MB
     logger.info(f"Received audio processing request for file: {file.filename}")
-    
-    if not file.content_type.startswith("audio/"):
+
+    if not file.content_type or not file.content_type.startswith("audio/"):
         raise HTTPException(status_code=400, detail="Invalid file type. Must be audio.")
 
     try:
-        # Read file content
+        # Read file content with size guard
         content = await file.read()
+        if len(content) > MAX_PAYLOAD_BYTES:
+            raise HTTPException(status_code=413, detail=f"File too large. Maximum size is {MAX_PAYLOAD_BYTES // (1024*1024)} MB.")
         
         # Process audio
         processed_audio = process_audio(content, options)

app/services/preview_model.py

@@ -30,22 +30,23 @@ class PreviewModel:
         
     def analyze(self, fingerprint: str, context: dict | None = None) -> dict:
         """
-        Generate realistic AI detection result from fingerprint.
-        
+        Generate deterministic AI detection result from fingerprint.
+
         Args:
             fingerprint: Unique identifier for the content
             context: Optional context like warnings or metadata
-            
+
         Returns:
             Analysis result with prediction and features
         """
         seed_value = self._generate_seed(fingerprint)
+        rng = random.Random(seed_value)
         base_confidence = self._calculate_base_confidence(seed_value)
-        
-        is_ai = base_confidence > self.threshold
-        confidence = self._add_realistic_variance(base_confidence)
-        
-        features = self._generate_features(seed_value)
+
+        confidence = self._add_realistic_variance(base_confidence, rng)
+        is_ai = confidence > self.threshold
+
+        features = self._generate_features(seed_value, rng)
         indicators = self._build_indicators(is_ai, confidence, context)
         
         return {
@@ -83,23 +84,23 @@ class PreviewModel:
         
         return 0.45 + weighted * 0.45
     
-    def _add_realistic_variance(self, base: float) -> float:
-        """Add human-like variance to confidence score."""
-        variance = random.gauss(0, self._variance_scale)
+    def _add_realistic_variance(self, base: float, rng: random.Random) -> float:
+        """Add deterministic human-like variance to confidence score."""
+        variance = rng.gauss(0, self._variance_scale)
         adjusted = base + variance
-        
+
         if adjusted > 0.95:
-            adjusted = 0.95 - random.uniform(0, 0.03)
+            adjusted = 0.95 - rng.uniform(0, 0.03)
         elif adjusted < 0.51:
-            adjusted = 0.51 + random.uniform(0, 0.02)
-            
+            adjusted = 0.51 + rng.uniform(0, 0.02)
+
         return max(0.51, min(0.97, adjusted))
     
-    def _generate_features(self, seed: float) -> dict:
-        """Generate realistic feature scores."""
+    def _generate_features(self, seed: float, rng: random.Random) -> dict:
+        """Generate deterministic feature scores."""
         def feature_score(offset: float) -> float:
             raw = (seed + offset) % 1.0
-            noise = random.gauss(0, 0.08)
+            noise = rng.gauss(0, 0.08)
             return max(0.0, min(0.99, raw + noise))
         
         return {