feat: crown Commend API routes remix tools data processing ve istemci IP utilities eklendi

.gitignore

@@ -110,3 +110,6 @@ client_secret*.json
 token.json
 generate_youtube_token.py
 commend_history.json
+
+# Design-tool cache
+.impeccable/

app/routes/commend/router.py

@@ -5,6 +5,7 @@ AI-powered YouTube comment generation and posting.
 
 from __future__ import annotations
 
+import hmac
 import os
 import time
 from collections import defaultdict
@@ -23,6 +24,7 @@ from .youtube_service import (
     is_youtube_configured,
     is_oauth_configured
 )
+from ...services.client_ip import client_ip as _client_ip
 from .gemini_service import generate_comment
 from .comment_tracker import (
     is_video_commented,
@@ -154,13 +156,20 @@ def _check_rate_limit(client_ip: str) -> None:
     _rate_limit_store[client_ip].append(now)
 
 
+def _key_matches(candidate: Optional[str]) -> bool:
+    """Constant-time comparison, so response timing says nothing about the key."""
+    if not _COMMEND_API_KEY or candidate is None:
+        return False
+    return hmac.compare_digest(candidate.encode("utf-8"), _COMMEND_API_KEY.encode("utf-8"))
+
+
 async def _require_api_key(
     request: Request,
     x_api_key: Optional[str] = Header(None, alias="X-API-Key"),
 ) -> None:
     """Validate API key. Fail-closed: if COMMEND_REQUIRE_AUTH is true (default)
     and no COMMEND_API_KEY is configured, all requests are rejected."""
-    client_ip = request.client.host if request.client else "unknown"
+    client_ip = _client_ip(request)
 
     # Always apply rate-limit regardless of auth configuration
     _check_rate_limit(client_ip)
@@ -175,7 +184,7 @@ async def _require_api_key(
             )
         # Explicitly opted out of auth (COMMEND_REQUIRE_AUTH=false)
         return
-    if x_api_key != _COMMEND_API_KEY:
+    if not _key_matches(x_api_key):
         logger.warning(f"Unauthorized commend request from {client_ip}")
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
@@ -183,6 +192,25 @@ async def _require_api_key(
         )
 
 
+async def _rate_limit_only(request: Request) -> None:
+    """For read endpoints that spend YouTube quota but need no key."""
+    _check_rate_limit(_client_ip(request))
+
+
+async def _require_posting_key(
+    request: Request,
+    x_api_key: Optional[str] = Header(None, alias="X-API-Key"),
+) -> None:
+    """Posting writes to a YouTube account that belongs to the server, so it needs
+    the key even when COMMEND_REQUIRE_AUTH=false opened the other endpoints."""
+    await _require_api_key(request, x_api_key)
+    if not _COMMEND_API_KEY or not _key_matches(x_api_key):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail={"code": "unauthorized", "message": "Invalid or missing API key."}
+        )
+
+
 # --- API Endpoints ---
 
 @router.get("/health", response_model=CommendHealthResponse)
@@ -203,7 +231,7 @@ async def commend_health_check():
     )
 
 
-@router.post("/video-details", response_model=VideoDetailsResponse)
+@router.post("/video-details", response_model=VideoDetailsResponse, dependencies=[Depends(_rate_limit_only)])
 async def get_video_info(request: GenerateCommentRequest):
     """
     Fetch video details without generating a comment.
@@ -288,7 +316,7 @@ async def generate_youtube_comment(request: GenerateCommentRequest):
     )
 
 
-@router.post("/post", response_model=PostCommentResponse, dependencies=[Depends(_require_api_key)])
+@router.post("/post", response_model=PostCommentResponse, dependencies=[Depends(_require_posting_key)])
 async def post_comment_to_youtube(request: PostCommentRequest):
     """
     Post a comment to YouTube.
@@ -328,7 +356,7 @@ async def post_comment_to_youtube(request: PostCommentRequest):
         logger.error(f"Comment posting failed: {error}")
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-            detail={"code": "posting_failed", "message": str(error)}
+            detail={"code": "posting_failed", "message": "The comment could not be posted."}
         )
 
     # Mark video as commented (for duplicate prevention)

app/routes/data_processing.py

@@ -14,6 +14,7 @@ import logging
 from app.schemas import AudioAugmentationOptions, AudioConvertOptions, DatasetEntryMetadata
 from app.services.audio_processor import process_audio, convert_audio_format
 from app.services.dataset_organizer import analyze_for_organization
+from app.services.client_ip import client_ip as _client_ip
 
 router = APIRouter(prefix="/api/process", tags=["Data Processing"])
 logger = logging.getLogger(__name__)
@@ -26,7 +27,7 @@ _PROCESS_MAX_IPS = 10_000
 
 
 async def _process_rate_limit(request: Request) -> None:
-    client_ip = request.client.host if request.client else "unknown"
+    client_ip = _client_ip(request)
     now = time.time()
     cutoff = now - _PROCESS_RATE_WINDOW
 

app/routes/remix.py

@@ -14,6 +14,7 @@ from pydantic import ValidationError
 from app.schemas import MultitrackAnalysis, MultitrackOptions, RemixAnalysis, RemixOptions
 from app.services.multitrack_mixer import MAX_CHANNELS, MIN_CHANNELS, mix_tracks
 from app.services.remix_engine import build_remix
+from app.services.client_ip import client_ip as _client_ip
 
 router = APIRouter(prefix="/api/remix", tags=["Creator Studio"])
 logger = logging.getLogger(__name__)
@@ -28,7 +29,7 @@ _REMIX_MAX_IPS = 10_000
 
 
 async def _remix_rate_limit(request: Request) -> None:
-    client_ip = request.client.host if request.client else "unknown"
+    client_ip = _client_ip(request)
     now = time.time()
     cutoff = now - _REMIX_RATE_WINDOW
 

app/services/client_ip.py

@@ -0,0 +1,18 @@
+"""The visitor's address behind the Hugging Face proxy."""
+
+from __future__ import annotations
+
+from fastapi import Request
+
+
+def client_ip(request: Request) -> str:
+    """The address rate limits are counted against.
+
+    uvicorn sees the proxy, so request.client alone would put every visitor in
+    one bucket; the proxy lists the original client first in X-Forwarded-For.
+    """
+    forwarded = request.headers.get("x-forwarded-for", "")
+    first = forwarded.split(",")[0].strip()
+    if first:
+        return first
+    return request.client.host if request.client else "unknown"

tests/test_commend_auth.py

@@ -0,0 +1,89 @@
+"""Crown Commend: who may post, and how requests are counted.
+
+Runs on a small app holding only the Commend router, with YouTube stubbed.
+"""
+
+from __future__ import annotations
+
+import importlib
+from collections import defaultdict
+
+import pytest
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+from app.routes.commend.router import router
+
+commend_module = importlib.import_module("app.routes.commend.router")
+
+URL = "https://www.youtube.com/watch?v=dQw4w9WgXcQ"
+POST_BODY = {"videoUrl": URL, "commentText": "Nice one."}
+
+
+@pytest.fixture
+def client(monkeypatch):
+    monkeypatch.setattr(commend_module, "_rate_limit_store", defaultdict(list))
+    monkeypatch.setattr(commend_module, "get_video_details", lambda url: (None, "stubbed"))
+    app = FastAPI()
+    app.include_router(router)
+    return TestClient(app)
+
+
+def configure(monkeypatch, *, key=None, require_auth=True, posting=True):
+    monkeypatch.setattr(commend_module, "_COMMEND_API_KEY", key)
+    monkeypatch.setattr(commend_module, "_COMMEND_REQUIRE_AUTH", require_auth)
+    monkeypatch.setattr(commend_module, "_COMMEND_POSTING_ENABLED", posting)
+
+
+def test_posting_needs_a_key_even_when_auth_is_switched_off(client, monkeypatch) -> None:
+    configure(monkeypatch, key=None, require_auth=False, posting=True)
+    response = client.post("/api/commend/post", json=POST_BODY)
+    assert response.status_code == 401
+    assert response.json()["detail"]["code"] == "unauthorized"
+
+
+def test_posting_rejects_a_wrong_key(client, monkeypatch) -> None:
+    configure(monkeypatch, key="secret-key", require_auth=False)
+    response = client.post("/api/commend/post", json=POST_BODY, headers={"X-API-Key": "nope"})
+    assert response.status_code == 401
+
+
+def test_posting_with_the_key_reaches_the_posting_switch(client, monkeypatch) -> None:
+    configure(monkeypatch, key="secret-key", posting=False)
+    response = client.post("/api/commend/post", json=POST_BODY, headers={"X-API-Key": "secret-key"})
+    assert response.status_code == 403
+    assert response.json()["detail"]["code"] == "posting_disabled"
+
+
+def test_posting_error_does_not_echo_the_provider_message(client, monkeypatch) -> None:
+    configure(monkeypatch, key="secret-key", posting=True)
+    monkeypatch.setattr(commend_module, "is_video_commented", lambda video_id: False)
+    monkeypatch.setattr(commend_module, "post_youtube_comment", lambda video_id, text: (None, "token=abc123 expired"))
+    response = client.post("/api/commend/post", json=POST_BODY, headers={"X-API-Key": "secret-key"})
+    assert response.status_code == 500
+    assert "abc123" not in response.text
+
+
+def test_generate_stays_closed_when_auth_is_required_but_no_key_is_set(client, monkeypatch) -> None:
+    configure(monkeypatch, key=None, require_auth=True)
+    body = {"videoUrl": URL, "language": "English", "commentStyle": "supportive"}
+    assert client.post("/api/commend/generate", json=body).status_code == 503
+
+
+def test_video_details_is_rate_limited(client, monkeypatch) -> None:
+    monkeypatch.setattr(commend_module, "_RATE_LIMIT_MAX", 2)
+    body = {"videoUrl": URL, "language": "English", "commentStyle": "supportive"}
+    codes = [client.post("/api/commend/video-details", json=body).status_code for _ in range(3)]
+    assert codes[:2] == [400, 400]
+    assert codes[2] == 429
+
+
+def test_visitors_behind_the_proxy_are_counted_separately(client, monkeypatch) -> None:
+    monkeypatch.setattr(commend_module, "_RATE_LIMIT_MAX", 1)
+    body = {"videoUrl": URL, "language": "English", "commentStyle": "supportive"}
+    first = client.post("/api/commend/video-details", json=body, headers={"X-Forwarded-For": "203.0.113.1"})
+    second = client.post("/api/commend/video-details", json=body, headers={"X-Forwarded-For": "203.0.113.2"})
+    again = client.post("/api/commend/video-details", json=body, headers={"X-Forwarded-For": "203.0.113.1"})
+    assert first.status_code == 400
+    assert second.status_code == 400
+    assert again.status_code == 429