Upload app.py

app.py

@@ -961,17 +961,102 @@ async def _fetch_deezer_editorial_playlists(limit: int = 20) -> list:
 #  External API helpers — Spotify  (Client Credentials, 100% free)
 # ─────────────────────────────────────────────────────────────────────────────
 
-_spotify_token:         str   = ""
-_spotify_token_expires: float = 0.0
-_spotify_token_lock           = threading.Lock()   # sync lock for token state
+# ── Spotify Android-client token state ───────────────────────────────────────
+# We simulate the Spotify Android app.  Two separate tokens are maintained:
+#   _spotify_client_token  — short-lived token from clienttoken.spotify.com
+#                            (proves we are a known Spotify client; no secret)
+#   _spotify_access_token  — Bearer token from accounts.spotify.com
+#                            (used in Authorization header; needs client_secret)
+# Both are refreshed automatically; all state protected by a threading.Lock.
+# ─────────────────────────────────────────────────────────────────────────────
+
+import secrets as _secrets
+
+_SPOTIFY_DEVICE_ID = _secrets.token_hex(16)   # stable per-process, random across restarts
+
+# Android Spotify app version strings (update periodically if Spotify changes them)
+_SPOTIFY_ANDROID_VERSION    = "8.6.96.470"
+_SPOTIFY_ANDROID_OS_VERSION = "30"            # Android 11
 
+_spotify_access_token:        str   = ""
+_spotify_access_expires:      float = 0.0
+_spotify_client_token:        str   = ""
+_spotify_client_token_expires: float = 0.0
+_spotify_token_lock                  = threading.Lock()
 
-async def _refresh_spotify_token() -> str:
-    """Fetch a fresh Spotify access token (client credentials flow)."""
-    global _spotify_token, _spotify_token_expires
+
+async def _refresh_spotify_client_token() -> str:
+    """
+    Fetch a Spotify client-token via clienttoken.spotify.com.
+    This endpoint accepts just the client_id (no secret) and returns a short-lived
+    client-token that proves the caller is a known Spotify client application.
+    Used identically by the real Spotify Android / iOS apps.
+    """
+    global _spotify_client_token, _spotify_client_token_expires
+    if not _SPOTIFY_CLIENT_ID:
+        return ""
+    payload = {
+        "client_data": {
+            "client_version": _SPOTIFY_ANDROID_VERSION,
+            "client_id":      _SPOTIFY_CLIENT_ID,
+            "js_sdk_data": {
+                "device_brand":   "Google",
+                "device_model":   "sdk_gphone64_x86_64",
+                "os":             "android",
+                "os_version":     _SPOTIFY_ANDROID_OS_VERSION,
+                "device_id":      _SPOTIFY_DEVICE_ID,
+                "device_type":    "smartphone",
+            },
+        }
+    }
+    try:
+        async with _get_semaphore():
+            resp = await _get_http_client().post(
+                "https://clienttoken.spotify.com/v1/clienttoken",
+                json=payload,
+                headers={"Accept": "application/json"},
+            )
+        resp.raise_for_status()
+        data = resp.json()
+        token = (
+            data.get("granted_token", {}).get("token") or
+            data.get("client_token") or ""
+        )
+        ttl = int(
+            data.get("granted_token", {}).get("expires_after_seconds") or
+            data.get("refresh_after_seconds") or
+            1_800
+        )
+        with _spotify_token_lock:
+            _spotify_client_token         = token
+            _spotify_client_token_expires = time.monotonic() + ttl - 30
+        log.info("Spotify: client-token refreshed (ttl=%ds)", ttl)
+        return token
+    except Exception as exc:
+        log.warning("Spotify client-token refresh FAILED: %s", exc)
+        log.debug("Spotify client-token traceback:\n%s", traceback.format_exc())
+        return ""
+
+
+async def _get_spotify_client_token() -> str:
+    with _spotify_token_lock:
+        if _spotify_client_token and time.monotonic() < _spotify_client_token_expires:
+            return _spotify_client_token
+    return await _refresh_spotify_client_token()
+
+
+async def _refresh_spotify_access_token() -> str:
+    """
+    Fetch a Spotify Bearer access token via client_credentials grant.
+    Uses the provided SPOTIFY_CLIENT_ID + SPOTIFY_CLIENT_SECRET (Android/iOS app creds).
+    Does NOT require Spotify Premium — gives access to all public catalog endpoints.
+    """
+    global _spotify_access_token, _spotify_access_expires
     if not _SPOTIFY_CLIENT_ID or not _SPOTIFY_CLIENT_SECRET:
         return ""
-    creds = base64.b64encode(f"{_SPOTIFY_CLIENT_ID}:{_SPOTIFY_CLIENT_SECRET}".encode()).decode()
+    creds = base64.b64encode(
+        f"{_SPOTIFY_CLIENT_ID}:{_SPOTIFY_CLIENT_SECRET}".encode()
+    ).decode()
     try:
         async with _get_semaphore():
             resp = await _get_http_client().post(
@@ -985,81 +1070,123 @@ async def _refresh_spotify_token() -> str:
         resp.raise_for_status()
         data = resp.json()
         with _spotify_token_lock:
-            _spotify_token         = data["access_token"]
-            _spotify_token_expires = time.monotonic() + data.get("expires_in", 3_600)
-        log.info("Spotify: token refreshed (expires in %ds)", data.get("expires_in", 3_600))
-        return _spotify_token
+            _spotify_access_token   = data["access_token"]
+            _spotify_access_expires = time.monotonic() + data.get("expires_in", 3_600) - 30
+        log.info("Spotify: access token refreshed (expires in %ds)", data.get("expires_in", 3_600))
+        return _spotify_access_token
     except Exception as exc:
-        log.warning("Spotify token refresh FAILED: %s", exc)
+        log.warning("Spotify access token refresh FAILED: %s", exc)
         log.debug("Spotify token traceback:\n%s", traceback.format_exc())
         return ""
 
 
-async def _get_spotify_token() -> str:
+async def _get_spotify_tokens() -> tuple[str, str]:
+    """Return (access_token, client_token). Either may be empty on failure."""
+    with _spotify_token_lock:
+        access_ok  = _spotify_access_token  and time.monotonic() < _spotify_access_expires
+        client_ok  = _spotify_client_token  and time.monotonic() < _spotify_client_token_expires
+
+    access_task  = (asyncio.sleep(0) if access_ok  else _refresh_spotify_access_token())
+    client_task  = (asyncio.sleep(0) if client_ok  else _refresh_spotify_client_token())
+    await asyncio.gather(access_task, client_task, return_exceptions=True)
+
     with _spotify_token_lock:
-        if _spotify_token and time.monotonic() < _spotify_token_expires - 60:
-            return _spotify_token
-    return await _refresh_spotify_token()
+        return _spotify_access_token, _spotify_client_token
+
+
+def _spotify_headers(access_token: str, client_token: str) -> dict:
+    """Build the full set of headers the Spotify Android app sends."""
+    h = {
+        "Authorization":    f"Bearer {access_token}",
+        "Accept":           "application/json",
+        "Accept-Language":  "en",
+        "app-platform":     "Android",
+        "spotify-app-version": _SPOTIFY_ANDROID_VERSION,
+        "User-Agent": (
+            f"Spotify/{_SPOTIFY_ANDROID_VERSION} Android/{_SPOTIFY_ANDROID_OS_VERSION} "
+            "(Google sdk_gphone64_x86_64)"
+        ),
+    }
+    if client_token:
+        h["client-token"] = client_token
+    return h
 
 
 async def _fetch_spotify_trending(country: str, limit: int = 50) -> list:
     """
-    Spotify featured playlists + top tracks — free with Client Credentials.
-    Returns [] silently when SPOTIFY_CLIENT_ID / SPOTIFY_CLIENT_SECRET are not set.
+    Fetch country trending tracks via the Spotify Android client approach:
+      1. GET /v1/browse/featured-playlists  — country-aware editorial playlists
+      2. GET /v1/browse/new-releases         — new albums/singles for the country
+      3. Pull tracks from the top playlists using Android client headers.
+
+    Falls back gracefully to [] when credentials are absent or the circuit is open.
+    No Spotify Premium required.
     """
     if not _SPOTIFY_CLIENT_ID or not _SPOTIFY_CLIENT_SECRET:
         return []
     if not _cb_spotify.available:
         log.debug("Spotify circuit breaker open — skipping fetch")
         return []
+
     c = country.upper() if country and country not in ("ZZ", "zz") else "US"
-    token = await _get_spotify_token()
-    if not token:
+    access_token, client_token = await _get_spotify_tokens()
+    if not access_token:
+        log.warning("Spotify: no access token available, skipping trending for %s", c)
         return []
-    headers = {"Authorization": f"Bearer {token}"}
+
+    headers = _spotify_headers(access_token, client_token)
     t0      = time.monotonic()
+
     try:
-        # Fetch featured playlists for the country
+        # ── 1. Featured playlists (country-localised) ──────────────────────
         async with _get_semaphore():
-            resp = await _get_http_client().get(
+            fp_resp = await _get_http_client().get(
                 "https://api.spotify.com/v1/browse/featured-playlists",
                 headers=headers,
-                params={"country": c, "limit": 4},
+                params={"country": c, "limit": 5},
             )
-        resp.raise_for_status()
-        playlists = resp.json().get("playlists", {}).get("items") or []
+        fp_resp.raise_for_status()
+        playlists = fp_resp.json().get("playlists", {}).get("items") or []
+        log.debug("Spotify: %d featured playlists for %s", len(playlists), c)
 
         tracks: list = []
-        per_playlist = max(limit // max(len(playlists), 1), 10)
+        per_playlist  = max((limit // max(len(playlists), 1)) + 5, 15)
 
-        for playlist in playlists[:3]:   # cap to 3 playlists for speed
+        for playlist in playlists[:4]:
             pid = playlist.get("id", "")
             if not pid:
                 continue
             try:
                 async with _get_semaphore():
-                    r2 = await _get_http_client().get(
+                    tr_resp = await _get_http_client().get(
                         f"https://api.spotify.com/v1/playlists/{pid}/tracks",
                         headers=headers,
                         params={
                             "limit":  per_playlist,
-                            "fields": "items(track(id,name,artists,album,duration_ms,explicit,popularity))",
+                            "market": c,
+                            "fields": (
+                                "items(track("
+                                "id,name,artists(name,id),album(name,images),"
+                                "duration_ms,explicit,popularity))"
+                            ),
                         },
                     )
-                r2.raise_for_status()
-                items = r2.json().get("items") or []
-                for item in items:
+                tr_resp.raise_for_status()
+                for item in (tr_resp.json().get("items") or []):
                     t = item.get("track")
-                    if not t or not isinstance(t, dict):
+                    if not t or not isinstance(t, dict) or not t.get("id"):
                         continue
                     album  = t.get("album") or {}
                     images = album.get("images") or []
-                    art    = images[0]["url"] if images else ""
+                    # pick largest image (Spotify orders by descending width)
+                    art = images[0]["url"] if images else ""
                     tracks.append({
                         "videoId":    "",
                         "title":      t.get("name", ""),
-                        "artists":    [{"name": a.get("name", ""), "id": ""}
-                                       for a in (t.get("artists") or [])],
+                        "artists":    [
+                            {"name": a.get("name", ""), "id": a.get("id", "")}
+                            for a in (t.get("artists") or [])
+                        ],
                         "album":      album.get("name", ""),
                         "duration":   str(int(t.get("duration_ms", 0)) // 1_000),
                         "thumbnails": [{"url": art, "width": 640, "height": 640}] if art else [],
@@ -1072,12 +1199,47 @@ async def _fetch_spotify_trending(country: str, limit: int = 50) -> list:
                         "popularity": t.get("popularity", 0),
                     })
             except Exception as exc:
-                log.debug("Spotify playlist fetch (%s) skipped: %s", pid, exc)
+                log.debug("Spotify playlist %s track fetch skipped: %s", pid, exc)
+
+        # ── 2. New releases as supplemental source ─────────────────────────
+        if len(tracks) < limit // 2:
+            try:
+                async with _get_semaphore():
+                    nr_resp = await _get_http_client().get(
+                        "https://api.spotify.com/v1/browse/new-releases",
+                        headers=headers,
+                        params={"country": c, "limit": 10},
+                    )
+                nr_resp.raise_for_status()
+                for album in (nr_resp.json().get("albums", {}).get("items") or []):
+                    images = album.get("images") or []
+                    art    = images[0]["url"] if images else ""
+                    tracks.append({
+                        "videoId":    "",
+                        "title":      album.get("name", ""),
+                        "artists":    [
+                            {"name": a.get("name", ""), "id": a.get("id", "")}
+                            for a in (album.get("artists") or [])
+                        ],
+                        "album":      album.get("name", ""),
+                        "duration":   "",
+                        "thumbnails": [{"url": art, "width": 640, "height": 640}] if art else [],
+                        "thumbnail":  art,
+                        "isExplicit": False,
+                        "year":       (album.get("release_date") or "")[:4],
+                        "rank":       len(tracks) + 1,
+                        "source":     "spotify",
+                        "spotifyId":  album.get("id", ""),
+                        "popularity": 0,
+                    })
+            except Exception as exc:
+                log.debug("Spotify new-releases skipped: %s", exc)
 
         elapsed = (time.monotonic() - t0) * 1000
         _cb_spotify.success()
         log.info("Spotify: %d tracks for country=%s (%.0f ms)", len(tracks), c, elapsed)
         return tracks[:limit]
+
     except Exception as exc:
         _cb_spotify.failure()
         log.warning("Spotify trending FAILED country=%s: %s", c, exc)