kryten-webqueue 0.32.3__tar.gz → 0.33.2__tar.gz

{kryten_webqueue-0.32.3 → kryten_webqueue-0.33.2}/CHANGELOG.md

@@ -5,6 +5,24 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.33.2] — 2026-07-29
+
+### Added
+
+- **Per-user submission quota on feedback and title suggestions.** Each user may now submit at most **2 per day and 6 per week** for feedback *and* (independently) for suggestions. Exceeding either tier returns `429` with a message pointing at the day/week limit. Implemented as a new `QuotaLimiter` (multi-tier sliding window) wired into the two submit endpoints, in addition to the existing short-burst throttle. Search/resolve requests are unaffected.
+
+## [0.33.1] — 2026-07-29
+
+### Changed
+
+- **Applied `black` formatting across the codebase.** Repository-wide `black` pass (default profile) to bring all source and test modules — including the vendored `integrations/cmsutils/*` tools — into a consistent style. No behavioral changes; purely cosmetic.
+
+## [0.33.0] — 2026-07-29
+
+### Added
+
+- **Sunday schedule in the "Fetch URLs (weekend workbook)" job.** `fetchurls` now resolves two additional column-A sections from the weekend workbook: `SUNDAY MORNING` → the **"Sunday Morning"** saved playlist (slug `sunday-morning`), and `SUNDAY AFTERNOON` → the **"Sunday Daytime"** saved playlist (slug `sunday-daytime`). The two new sections join the existing Friday/Saturday sections and are resolved and imported the same way (dropsugar.co validated via HEAD; YouTube/Tubi auto-downloaded and posted to the CMS). The job's `section` parameter gains `sunday-morning` and `sunday-daytime` options (`all` still runs every section). Sunday lives in the existing `M.D-M.D` weekend sheet as extra rows — the worksheet naming scheme is unchanged (first sheet with Sunday rows is `8.7-8.8`).
+
 ## [0.32.3] — 2026-07-09
 
 ### Fixed

{kryten_webqueue-0.32.3 → kryten_webqueue-0.33.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kryten-webqueue
-Version: 0.32.3
+Version: 0.33.2
 Summary: Netflix/Tubi-style catalog browser and pay-to-play queue management for CyTube
 Author: grobertson
 License-Expression: MIT

{kryten_webqueue-0.32.3 → kryten_webqueue-0.33.2}/docs/SPEC_JOBS_AND_BROWSE.md

@@ -146,14 +146,14 @@ Reimplements `fetchurls.py`: read the Channel Z Excel workbook from SharePoint,
 
 | Field | Type | Default | Notes |
 |-------|------|---------|-------|
-| `section` | enum | `all` | `all` \| `friday` \| `saturday-night` \| `saturday-morning`. |
+| `section` | enum | `all` | `all` \| `friday` \| `saturday-night` \| `saturday-morning` \| `sunday-morning` \| `sunday-daytime`. |
 | `dry_run` | bool | `false` | Resolve/preview only; no downloads, no writeback, no import. |
 | `writeback` | bool | `true` | Write resolved URLs back to column F. |
 | `validate` | bool | `true` | HEAD-check existing dropsugar.co URLs. |
 
 **Import resulting playlists (new):**
-- The tool produces `playlists/{sheet}-friday.txt`, `{sheet}-saturday-night.txt`, `{sheet}-saturday-morning.txt`, and `{sheet}-failures.txt`.
-- After a successful (non-dry-run) run, **import each non-failures file as a saved playlist** named exactly like the file stem: `{sheet}-friday`, `{sheet}-saturday-night`, `{sheet}-saturday-morning`. Reuse `import_playlist_text()` to resolve lines, then `create_saved_playlist(name=stem, created_by=triggered_by)` + `replace_playlist_items()`.
+- The tool produces `playlists/{sheet}-friday.txt`, `{sheet}-saturday-night.txt`, `{sheet}-saturday-morning.txt`, `{sheet}-sunday-morning.txt`, `{sheet}-sunday-daytime.txt`, and `{sheet}-failures.txt`.
+- After a successful (non-dry-run) run, **import each non-failures file as a saved playlist** named exactly like the file stem: `{sheet}-friday`, `{sheet}-saturday-night`, `{sheet}-saturday-morning`, `{sheet}-sunday-morning`, `{sheet}-sunday-daytime`. Reuse `import_playlist_text()` to resolve lines, then `create_saved_playlist(name=stem, created_by=triggered_by)` + `replace_playlist_items()`.
 - If a playlist of that name already exists, **replace its items** (idempotent re-runs) rather than creating a duplicate. (Match by exact name + `created_by`.)
 - The `{sheet}-failures` file is **not** imported; surface its count in the run detail.
 

{kryten_webqueue-0.32.3 → kryten_webqueue-0.33.2}/kryten_webqueue/api_gate/client.py

@@ -59,14 +59,24 @@ class ApiGateClient:
 
     # --- Playlist CRUD ---
 
-    async def playlist_add(self, media_type: str, media_id: str, *, position: str = "end", temp: bool = True) -> dict:
+    async def playlist_add(
+        self,
+        media_type: str,
+        media_id: str,
+        *,
+        position: str = "end",
+        temp: bool = True,
+    ) -> dict:
         """Add item to playlist. Returns {"success": bool, "uid": int|None}."""
-        return await self.post("/playlist/add", json={
-            "type": media_type,
-            "id": media_id,
-            "position": position,
-            "temp": temp,
-        })
+        return await self.post(
+            "/playlist/add",
+            json={
+                "type": media_type,
+                "id": media_id,
+                "position": position,
+                "temp": temp,
+            },
+        )
 
     async def playlist_move(self, uid: int, position: int | str) -> dict:
         """Move item. position is a UID (int) or "prepend"/"append"."""
@@ -87,7 +97,9 @@ class ApiGateClient:
         return await self.post("/chat/send", json={"message": message})
 
     async def send_pm(self, username: str, message: str) -> dict:
-        return await self.post("/chat/pm", json={"username": username, "message": message})
+        return await self.post(
+            "/chat/pm", json={"username": username, "message": message}
+        )
 
     # --- Admin ---
 
@@ -100,51 +112,77 @@ class ApiGateClient:
     async def get_balance(self, username: str) -> dict:
         return await self.get(f"/economy/balance/{username}")
 
-    async def get_transactions(self, username: str, limit: int = 20, offset: int = 0) -> dict:
-        return await self.get(f"/economy/transactions/{username}", limit=limit, offset=offset)
+    async def get_transactions(
+        self, username: str, limit: int = 20, offset: int = 0
+    ) -> dict:
+        return await self.get(
+            f"/economy/transactions/{username}", limit=limit, offset=offset
+        )
 
     async def get_account_summary(self, username: str) -> dict:
         return await self.get(f"/economy/account/{username}")
 
     async def set_vanity_greeting(self, username: str, value: str) -> dict:
-        return await self.post("/economy/vanity/greeting", json={
-            "username": username,
-            "value": value,
-        })
+        return await self.post(
+            "/economy/vanity/greeting",
+            json={
+                "username": username,
+                "value": value,
+            },
+        )
 
     async def set_vanity_color(self, username: str, value: str) -> dict:
-        return await self.post("/economy/vanity/color", json={
-            "username": username,
-            "value": value,
-        })
+        return await self.post(
+            "/economy/vanity/color",
+            json={
+                "username": username,
+                "value": value,
+            },
+        )
 
     async def set_vanity_shoutout(self, username: str, value: str) -> dict:
-        return await self.post("/economy/vanity/shoutout", json={
-            "username": username,
-            "value": value,
-        })
-
-    async def queue_preview(self, username: str, duration_sec: int, tier: str = "queue") -> dict:
-        return await self.post("/economy/queue-preview", json={
-            "username": username,
-            "duration_sec": duration_sec,
-            "tier": tier,
-        })
-
-    async def queue_spend(self, username: str, duration_sec: int, tier: str, request_id: str) -> dict:
-        return await self.post("/economy/queue-spend", json={
-            "username": username,
-            "duration_sec": duration_sec,
-            "tier": tier,
-            "request_id": request_id,
-        })
+        return await self.post(
+            "/economy/vanity/shoutout",
+            json={
+                "username": username,
+                "value": value,
+            },
+        )
+
+    async def queue_preview(
+        self, username: str, duration_sec: int, tier: str = "queue"
+    ) -> dict:
+        return await self.post(
+            "/economy/queue-preview",
+            json={
+                "username": username,
+                "duration_sec": duration_sec,
+                "tier": tier,
+            },
+        )
+
+    async def queue_spend(
+        self, username: str, duration_sec: int, tier: str, request_id: str
+    ) -> dict:
+        return await self.post(
+            "/economy/queue-spend",
+            json={
+                "username": username,
+                "duration_sec": duration_sec,
+                "tier": tier,
+                "request_id": request_id,
+            },
+        )
 
     async def queue_refund(self, username: str, request_id: str, reason: str) -> dict:
-        return await self.post("/economy/queue-refund", json={
-            "username": username,
-            "request_id": request_id,
-            "reason": reason,
-        })
+        return await self.post(
+            "/economy/queue-refund",
+            json={
+                "username": username,
+                "request_id": request_id,
+                "reason": reason,
+            },
+        )
 
     # --- Moderator service status ---
 
@@ -159,7 +197,9 @@ class ApiGateClient:
 
     # --- Moderation entries ---
 
-    async def mod_list_entries(self, channel: str, action_filter: str | None = None) -> dict:
+    async def mod_list_entries(
+        self, channel: str, action_filter: str | None = None
+    ) -> dict:
         params: dict = {}
         if action_filter:
             params["filter"] = action_filter
@@ -206,12 +246,15 @@ class ApiGateClient:
 
     async def mod_remove_pattern(self, channel: str, pattern: str) -> dict:
         from urllib.parse import quote
+
         encoded = quote(pattern, safe="")
         return await self.delete(f"/channels/{channel}/patterns/{encoded}")
 
     # --- Recent users ---
 
-    async def mod_recent_users(self, channel: str, window_minutes: float = 60.0) -> dict:
+    async def mod_recent_users(
+        self, channel: str, window_minutes: float = 60.0
+    ) -> dict:
         return await self.get(
             f"/channels/{channel}/users/recent", window_minutes=window_minutes
         )

{kryten_webqueue-0.32.3 → kryten_webqueue-0.33.2}/kryten_webqueue/app.py

@@ -22,7 +22,7 @@ from .queue.presence import PresenceRefundMonitor
 from .promos.director import PromoDirector
 from .ws.manager import WebSocketManager
 from .playlists.scheduler import PlaylistScheduler
-from .auth.rate_limit import RateLimiter
+from .auth.rate_limit import QuotaLimiter, RateLimiter
 
 from .routes.auth import router as auth_router
 from .routes.catalog import router as catalog_router
@@ -59,7 +59,8 @@ async def lifespan(app: FastAPI):
     if purged["completions"] or purged["playlist_pass"]:
         logger.info(
             "Purged promo recently-played state: %d completion(s), %d pass row(s)",
-            purged["completions"], purged["playlist_pass"],
+            purged["completions"],
+            purged["playlist_pass"],
         )
     # Any job run still marked 'running' is an orphan from a prior crash/restart
     # (the running flag is in-memory only). Reconcile before registering jobs.
@@ -108,21 +109,42 @@ async def lifespan(app: FastAPI):
     # register regardless of optional deps; a missing dep fails the run fast
     # with a clear message rather than crashing startup.
     from .jobs.tasks import (
-        enrichtitles_job, enrichmeta_job, enrichtv_job,
-        fetch_job, fetchurls_job,
-        ENRICHTITLES_SCHEMA, ENRICHMETA_SCHEMA, ENRICHTV_SCHEMA,
-        FETCH_SCHEMA, FETCHURLS_SCHEMA,
+        enrichtitles_job,
+        enrichmeta_job,
+        enrichtv_job,
+        fetch_job,
+        fetchurls_job,
+        ENRICHTITLES_SCHEMA,
+        ENRICHMETA_SCHEMA,
+        ENRICHTV_SCHEMA,
+        FETCH_SCHEMA,
+        FETCHURLS_SCHEMA,
+    )
+
+    job_manager.register(
+        "enrichtitles",
+        enrichtitles_job,
+        label="Enrich Titles",
+        schema=ENRICHTITLES_SCHEMA,
+    )
+    job_manager.register(
+        "enrichmeta",
+        enrichmeta_job,
+        label="Enrich Movie Metadata",
+        schema=ENRICHMETA_SCHEMA,
+    )
+    job_manager.register(
+        "enrichtv", enrichtv_job, label="Enrich TV Metadata", schema=ENRICHTV_SCHEMA
+    )
+    job_manager.register(
+        "fetch", fetch_job, label="Fetch (download → MediaCMS)", schema=FETCH_SCHEMA
+    )
+    job_manager.register(
+        "fetchurls",
+        fetchurls_job,
+        label="Fetch URLs (weekend workbook)",
+        schema=FETCHURLS_SCHEMA,
     )
-    job_manager.register("enrichtitles", enrichtitles_job,
-                         label="Enrich Titles", schema=ENRICHTITLES_SCHEMA)
-    job_manager.register("enrichmeta", enrichmeta_job,
-                         label="Enrich Movie Metadata", schema=ENRICHMETA_SCHEMA)
-    job_manager.register("enrichtv", enrichtv_job,
-                         label="Enrich TV Metadata", schema=ENRICHTV_SCHEMA)
-    job_manager.register("fetch", fetch_job,
-                         label="Fetch (download → MediaCMS)", schema=FETCH_SCHEMA)
-    job_manager.register("fetchurls", fetchurls_job,
-                         label="Fetch URLs (weekend workbook)", schema=FETCHURLS_SCHEMA)
     app.state.job_manager = job_manager
 
     # WebSocket manager
@@ -143,7 +165,10 @@ async def lifespan(app: FastAPI):
 
     # Promo director (poller-driven; also used synchronously by the pay path)
     promo_director = PromoDirector(
-        api_gate=api_gate, db=db, shadow=shadow, config=config.promos,
+        api_gate=api_gate,
+        db=db,
+        shadow=shadow,
+        config=config.promos,
         add_delay_sec=config.playlist_bulk_add_delay_sec,
         add_max_retries=config.playlist_bulk_add_max_retries,
     )
@@ -171,10 +196,18 @@ async def lifespan(app: FastAPI):
     # feedback/suggestion endpoints (per-user, namespaced keys).
     app.state.rate_limiter = RateLimiter()
     app.state.feedback_rate_limiter = RateLimiter(max_requests=12, window_seconds=300)
+    # Hard per-user submission quota for feedback and suggestions: 2/day, 6/week
+    # (namespaced keys, checked in addition to the short-burst limiter above).
+    app.state.feedback_quota_limiter = QuotaLimiter(
+        [("day", 2, 86_400), ("week", 6, 604_800)]
+    )
 
     # Playlist scheduler
     scheduler = PlaylistScheduler(
-        db=db, api_gate=api_gate, shadow=shadow, ws_manager=ws_manager,
+        db=db,
+        api_gate=api_gate,
+        shadow=shadow,
+        ws_manager=ws_manager,
         add_delay_sec=config.playlist_bulk_add_delay_sec,
         add_max_retries=config.playlist_bulk_add_max_retries,
         promo_director=promo_director,
@@ -184,7 +217,10 @@ async def lifespan(app: FastAPI):
 
     # Presence-based cancel/refund monitor
     presence_monitor = PresenceRefundMonitor(
-        api_gate=api_gate, shadow=shadow, db=db, ws_manager=ws_manager,
+        api_gate=api_gate,
+        shadow=shadow,
+        db=db,
+        ws_manager=ws_manager,
         config=config.presence_refund,
     )
     await presence_monitor.start()
@@ -215,7 +251,8 @@ async def lifespan(app: FastAPI):
         while True:
             await asyncio.sleep(300)  # every 5 minutes
             try:
-                await db._execute("""
+                await db._execute(
+                    """
                     UPDATE saved_playlists SET is_immutable = 0
                     WHERE id IN (
                         SELECT sp.id FROM saved_playlists sp
@@ -230,7 +267,8 @@ async def lifespan(app: FastAPI):
                                 AND (ps2.immutability_expires_at IS NULL OR ps2.immutability_expires_at > datetime('now'))
                           )
                     )
-                """)
+                """
+                )
             except Exception as e:
                 logger.error(f"Immutability expiry error: {e}")
 
@@ -240,7 +278,9 @@ async def lifespan(app: FastAPI):
         asyncio.create_task(_immutability_expiry_loop()),
     ]
 
-    logger.info(f"kryten-webqueue v{__version__} started on {config.host}:{config.port}")
+    logger.info(
+        f"kryten-webqueue v{__version__} started on {config.host}:{config.port}"
+    )
 
     yield
 

kryten_webqueue-0.33.2/kryten_webqueue/auth/rate_limit.py

@@ -0,0 +1,62 @@
+import time
+from collections import defaultdict, deque
+
+
+class RateLimiter:
+    """Sliding-window rate limiter for OTP requests."""
+
+    def __init__(self, max_requests: int = 3, window_seconds: int = 300):
+        self._max = max_requests
+        self._window = window_seconds
+        self._requests: dict[str, deque] = defaultdict(deque)
+
+    def is_allowed(self, key: str) -> bool:
+        now = time.time()
+        window = self._requests[key]
+        # Remove expired entries
+        while window and window[0] < now - self._window:
+            window.popleft()
+        if len(window) >= self._max:
+            return False
+        window.append(now)
+        return True
+
+    def remaining(self, key: str) -> int:
+        now = time.time()
+        window = self._requests[key]
+        while window and window[0] < now - self._window:
+            window.popleft()
+        return max(0, self._max - len(window))
+
+
+class QuotaLimiter:
+    """Sliding-window limiter that enforces several named tiers at once.
+
+    Each tier is ``(label, max_requests, window_seconds)``. An action is only
+    permitted when *every* tier still has room; a permitted action is recorded
+    against all tiers atomically. Used for hard per-user submission quotas
+    (e.g. 2/day and 6/week) rather than short-burst throttling.
+    """
+
+    def __init__(self, tiers: list[tuple[str, int, int]]):
+        if not tiers:
+            raise ValueError("QuotaLimiter requires at least one tier")
+        self._tiers = list(tiers)
+        self._max_window = max(window for _, _, window in self._tiers)
+        self._events: dict[str, deque] = defaultdict(deque)
+
+    def check(self, key: str) -> str | None:
+        """Return the label of the first exhausted tier, or ``None`` if allowed.
+
+        When allowed the action is recorded; when blocked nothing is recorded.
+        """
+        now = time.time()
+        events = self._events[key]
+        while events and events[0] < now - self._max_window:
+            events.popleft()
+        for label, max_requests, window in self._tiers:
+            count = sum(1 for ts in events if ts >= now - window)
+            if count >= max_requests:
+                return label
+        events.append(now)
+        return None

{kryten_webqueue-0.32.3 → kryten_webqueue-0.33.2}/kryten_webqueue/auth/session.py

@@ -3,7 +3,9 @@ from datetime import datetime, timedelta, UTC
 from fastapi import Request, HTTPException
 
 
-def create_session_token(username: str, rank: int, secret_key: str, ttl_hours: int = 24) -> str:
+def create_session_token(
+    username: str, rank: int, secret_key: str, ttl_hours: int = 24
+) -> str:
     payload = {
         "sub": username,
         "rank": rank,

{kryten_webqueue-0.32.3 → kryten_webqueue-0.33.2}/kryten_webqueue/catalog/db/__init__.py

@@ -1,5 +1,10 @@
 from ._connection import _DBBase
-from ._catalog import _CatalogMixin, HIDDEN_ITEM_TAG, HIDDEN_CATEGORY_NAMES, HIDDEN_TAG_NAMES
+from ._catalog import (
+    _CatalogMixin,
+    HIDDEN_ITEM_TAG,
+    HIDDEN_CATEGORY_NAMES,
+    HIDDEN_TAG_NAMES,
+)
 from ._playlists import _PlaylistsMixin
 from ._queue import _QueueMixin
 from ._feedback import _FeedbackMixin