qobuz-cli 0.0.2__tar.gz → 0.0.4__tar.gz

{qobuz_cli-0.0.2 → qobuz_cli-0.0.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: qobuz-cli
-Version: 0.0.2
+Version: 0.0.4
 Summary:  Blazing fast Qobuz CLI downloader with modern UI
 Project-URL: Homepage, https://github.com/HongYue1/qobuz-cli
 Project-URL: Repository, https://github.com/HongYue1/qobuz-cli
@@ -15,18 +15,15 @@ Classifier: License :: OSI Approved :: GNU General Public License v3 or later (G
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python
 Classifier: Topic :: Multimedia :: Sound/Audio
-Requires-Python: >=3.10
-Requires-Dist: aiofiles
-Requires-Dist: aiohttp
-Requires-Dist: beautifulsoup4
-Requires-Dist: mutagen
-Requires-Dist: pathvalidate
-Requires-Dist: pydantic
-Requires-Dist: rich
-Requires-Dist: typer
-Provides-Extra: dev
-Requires-Dist: jsonschema; extra == 'dev'
-Requires-Dist: ruff>=0.10.0; extra == 'dev'
+Requires-Python: >=3.12
+Requires-Dist: aiofiles>=25.1.0
+Requires-Dist: aiohttp>=3.14.1
+Requires-Dist: beautifulsoup4>=4.15.0
+Requires-Dist: mutagen>=1.48.1
+Requires-Dist: pathvalidate>=3.3.1
+Requires-Dist: pydantic>=2.13.4
+Requires-Dist: rich>=15.0.0
+Requires-Dist: typer>=0.26.8
 Description-Content-Type: text/markdown
 
 # qobuz-cli

{qobuz_cli-0.0.2 → qobuz_cli-0.0.4}/pyproject.toml

@@ -4,11 +4,11 @@ build-backend = "hatchling.build"
 
 [project]
 name = "qobuz-cli"
-version = "v0.0.2"
+version = "0.0.4"
 authors = [{ name = "HongYue1", email = "moonlord369@gmail.com" }]
 description = " Blazing fast Qobuz CLI downloader with modern UI"
 readme = "README.md"
-requires-python = ">=3.10"
+requires-python = ">=3.12"
 license = "GPL-3.0-or-later"
 license-files = ["LICEN[CS]E.*"]
 keywords = ["qobuz", "music", "downloader", "cli", "audio"]
@@ -24,19 +24,16 @@ classifiers = [
 ]
 
 dependencies = [
-    "aiofiles",
-    "aiohttp",
-    "beautifulsoup4",
-    "mutagen",
-    "pathvalidate",
-    "pydantic",
-    "rich",
-    "typer",
+    "aiofiles>=25.1.0",
+    "aiohttp>=3.14.1",
+    "beautifulsoup4>=4.15.0",
+    "mutagen>=1.48.1",
+    "pathvalidate>=3.3.1",
+    "pydantic>=2.13.4",
+    "rich>=15.0.0",
+    "typer>=0.26.8",
 ]
 
-[project.optional-dependencies]
-dev = ["ruff>=0.10.0", "jsonschema"]
-
 [project.urls]
 Homepage = "https://github.com/HongYue1/qobuz-cli"
 Repository = "https://github.com/HongYue1/qobuz-cli"
@@ -46,9 +43,12 @@ Repository = "https://github.com/HongYue1/qobuz-cli"
 qobuz-cli = "qobuz_cli.__main__:main"
 qcli = "qobuz_cli.__main__:main"
 
+[dependency-groups]
+dev = ["ruff>=0.10.0", "jsonschema"]
+
 [tool.ruff]
 line-length = 88
-target-version = "py310"
+target-version = "py312"
 
 [tool.ruff.lint]
 preview = true
@@ -67,6 +67,9 @@ select = [
     "ASYNC", # flake8-async
     "S",     # flake8-bandit
     "F541",  # f-string-missing-placeholders
+    "PERF",  # perflint (performance anti-patterns)
+    "RET",   # flake8-return (cleaner returns)
+    "FURB",  # refurb (modern idioms)
 ]
 
 
@@ -82,3 +85,10 @@ known-first-party = ["qobuz_cli"]
 "__init__.py" = ["F401"]
 # Relax security rules in tests
 # "tests/**" = ["S"]
+
+[tool.mypy]
+python_version = "3.12"
+ignore_missing_imports = true
+warn_redundant_casts = true
+warn_unused_ignores = true
+no_implicit_optional = true

{qobuz_cli-0.0.2 → qobuz_cli-0.0.4}/qobuz_cli/api/auth.py

@@ -26,7 +26,7 @@ class QobuzAuthenticator:
     Manages the authentication flow for the Qobuz API client.
     """
 
-    def __init__(self, api_client: "QobuzAPIClient"):
+    def __init__(self, api_client: QobuzAPIClient):
         """
         Initializes the authenticator.
 
@@ -111,12 +111,14 @@ class QobuzAuthenticator:
 
         log.debug(f"Testing {len(self._api_client.secrets)} potential app secrets...")
 
-        test_tasks = [
-            self._test_secret(secret) for secret in self._api_client.secrets if secret
-        ]
-        results = await asyncio.gather(*test_tasks)
+        # Only test non-empty secrets, and keep the tested list aligned with the
+        # results so a falsy secret can never desynchronize the zip below.
+        valid_candidates = [s for s in self._api_client.secrets if s]
+        results = await asyncio.gather(
+            *(self._test_secret(secret) for secret in valid_candidates)
+        )
 
-        for secret, is_valid in zip(self._api_client.secrets, results, strict=True):
+        for secret, is_valid in zip(valid_candidates, results, strict=True):
             if is_valid:
                 self._api_client.app_secret = secret
                 log.debug(f"Valid secret found: {secret[:8]}...")

qobuz_cli-0.0.4/qobuz_cli/api/client.py

@@ -0,0 +1,381 @@
+"""
+Enhanced API client with compression for metadata and circuit breaker protection.
+"""
+
+import asyncio
+import hashlib
+import logging
+import time
+import unicodedata
+from collections.abc import AsyncGenerator
+from typing import Any
+
+import aiohttp
+
+from qobuz_cli.exceptions import (
+    AuthenticationError,
+    InvalidAppIdError,
+    InvalidAppSecretError,
+    InvalidQualityError,
+)
+from qobuz_cli.utils.circuit_breaker import CircuitBreaker, CircuitBreakerError
+
+from .auth import QobuzAuthenticator
+from .rate_limiter import AdaptiveRateLimiter
+
+log = logging.getLogger(__name__)
+
+
+def _is_expected_client_error(exc: BaseException) -> bool:
+    """
+    Returns True for errors that mean the API responded but rejected the
+    request for client-side reasons (auth/quality/4xx). These must not count as
+    circuit-breaker failures -- the service itself is healthy.
+    """
+    if isinstance(
+        exc,
+        (
+            AuthenticationError,
+            InvalidAppIdError,
+            InvalidAppSecretError,
+            InvalidQualityError,
+        ),
+    ):
+        return True
+    if isinstance(exc, aiohttp.ClientResponseError):
+        return 400 <= exc.status < 500 and exc.status != 429
+    return False
+
+
+class QobuzAPIClient:
+    """
+    Optimized async client for the Qobuz JSON API (v0.2).
+
+    Features:
+    - Compression for JSON/metadata responses (not audio files)
+    - Circuit breaker for API resilience
+    - Adaptive rate limiting
+    - Connection pooling
+    """
+
+    BASE_URL = "https://www.qobuz.com/api.json/0.2/"
+
+    def __init__(self, app_id: str, secrets: list[str], max_workers: int = 8):
+        """
+        Initializes the API client.
+
+        Args:
+            app_id: 9-digit Qobuz application ID from the web player.
+            secrets: List of potential app secrets scraped from the web player.
+            max_workers: The number of concurrent workers, used to tune the
+            connection pool.
+        """
+        self.app_id: str = str(app_id)
+        self.secrets: list[str] = secrets
+        self.max_workers = max_workers
+
+        # State set by the authenticator
+        self.app_secret: str | None = None
+        self.user_auth_token: str | None = None
+
+        self._session: aiohttp.ClientSession | None = None
+        self._rate_limiter = AdaptiveRateLimiter()
+        self._authenticator = QobuzAuthenticator(self)
+
+        # Circuit breaker for API resilience
+        self._circuit_breaker = CircuitBreaker(
+            failure_threshold=5,
+            recovery_timeout=60,
+            success_threshold=2,
+            ignore_predicate=_is_expected_client_error,
+        )
+
+    @property
+    def authenticator(self) -> QobuzAuthenticator:
+        """Provides access to the authentication helper."""
+        return self._authenticator
+
+    async def _initialize_session(self) -> None:
+        """Ensures an active aiohttp session is available with compression enabled."""
+        if self._session is None or self._session.closed:
+            connector = aiohttp.TCPConnector(
+                limit=self.max_workers * 2,
+                limit_per_host=self.max_workers,
+                ttl_dns_cache=300,
+                enable_cleanup_closed=True,
+            )
+            self._session = aiohttp.ClientSession(
+                connector=connector,
+                headers=self._default_headers(),
+                timeout=aiohttp.ClientTimeout(total=60, connect=15, sock_read=30),
+            )
+
+    def _default_headers(self) -> dict[str, str]:
+        """
+        Browser-equivalent headers for the Qobuz web-player origin.
+
+        Sending the full Client Hints / Sec-Fetch set (matching a real Chrome
+        session) makes requests indistinguishable from the official web player,
+        which avoids the WAF 403s and app-id bans that a bare User-Agent
+        triggers. The User-Agent MUST stay consistent with the Sec-Ch-Ua brand
+        list or the mismatch itself becomes a fingerprinting signal.
+        """
+        return {
+            "User-Agent": (
+                "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 "
+                "(KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
+            ),
+            "Accept": "application/json, text/plain, */*",
+            "Accept-Language": "en-US,en;q=0.9",
+            "Accept-Encoding": "gzip, deflate, br",
+            "Origin": "https://play.qobuz.com",
+            "Referer": "https://play.qobuz.com/",
+            "Sec-Ch-Ua": (
+                '"Chromium";v="124", "Google Chrome";v="124", "Not-A.Brand";v="99"'
+            ),
+            "Sec-Ch-Ua-Mobile": "?0",
+            "Sec-Ch-Ua-Platform": '"Windows"',
+            "Sec-Fetch-Dest": "empty",
+            "Sec-Fetch-Mode": "cors",
+            "Sec-Fetch-Site": "same-site",
+            "X-App-Id": self.app_id,
+        }
+
+    async def close(self) -> None:
+        """Gracefully closes the aiohttp session."""
+        if self._session and not self._session.closed:
+            await self._session.close()
+
+    def _prepare_get_file_url_params(
+        self, track_id: str, format_id: int, secret_override: str | None = None
+    ) -> dict[str, Any]:
+        """
+        Builds the signed parameter dictionary for the 'track/getFileUrl' endpoint.
+        """
+        if format_id not in (5, 6, 7, 27):
+            raise InvalidQualityError(
+                f"Invalid format_id: {format_id}. Must be one of 5, 6, 7, or 27."
+            )
+
+        unix_ts = int(time.time())
+        secret = secret_override or self.app_secret
+        if not secret:
+            raise InvalidAppSecretError(
+                "App secret has not been configured. Cannot sign request."
+            )
+
+        sig_str = (
+            f"trackgetFileUrlformat_id{format_id}intentstreamtrack_id"
+            f"{track_id}{unix_ts}{secret}"
+        )
+        request_sig = hashlib.md5(sig_str.encode("utf-8")).hexdigest()  # noqa: S324
+
+        return {
+            "request_ts": unix_ts,
+            "request_sig": request_sig,
+            "track_id": track_id,
+            "format_id": format_id,
+            "intent": "stream",
+        }
+
+    # Number of attempts for transient failures (429/5xx/network).
+    MAX_API_ATTEMPTS = 3
+
+    async def api_call(self, endpoint: str, **kwargs: Any) -> dict[str, Any]:
+        """
+        Makes an authenticated API call with rate limiting, retry logic, and
+        circuit breaker.
+
+        Compression is automatically applied to JSON responses by aiohttp when
+        the server sends Content-Encoding header.
+        """
+        await self._initialize_session()
+
+        # Check circuit breaker before making request
+        try:
+            async with self._circuit_breaker:
+                return await self._request_with_retry(endpoint, kwargs)
+        except CircuitBreakerError as e:
+            log.error(f"[red]Circuit breaker is open for API calls: {e}[/red]")
+            raise
+        except Exception as e:
+            log.debug(f"API call to {endpoint} failed: {e}")
+            raise
+
+    async def _request_with_retry(
+        self, endpoint: str, params: dict[str, Any]
+    ) -> dict[str, Any]:
+        """
+        Executes a single API request, retrying transient failures (HTTP 429,
+        5xx, and network/timeout errors) with exponential backoff. Client-side
+        4xx errors are raised immediately without retrying.
+        """
+        delay = 1.0
+        last_exc: Exception | None = None
+        for attempt in range(1, self.MAX_API_ATTEMPTS + 1):
+            try:
+                return await self._do_request(endpoint, params)
+            except aiohttp.ClientResponseError as e:
+                last_exc = e
+                is_retryable = e.status == 429 or 500 <= e.status < 600
+                if not is_retryable or attempt == self.MAX_API_ATTEMPTS:
+                    raise
+                log.debug(
+                    f"Transient HTTP {e.status} on {endpoint} "
+                    f"(attempt {attempt}/{self.MAX_API_ATTEMPTS}); "
+                    f"retrying in {delay:.1f}s."
+                )
+            except (aiohttp.ClientError, TimeoutError) as e:
+                last_exc = e
+                if attempt == self.MAX_API_ATTEMPTS:
+                    raise
+                log.debug(
+                    f"Network error on {endpoint} "
+                    f"(attempt {attempt}/{self.MAX_API_ATTEMPTS}): {e}; "
+                    f"retrying in {delay:.1f}s."
+                )
+            await asyncio.sleep(delay)
+            delay *= 2
+
+        # Unreachable in practice: the final attempt always raises above.
+        if last_exc is not None:
+            raise last_exc
+        raise RuntimeError(f"API call to {endpoint} exhausted all retries.")
+
+    async def _do_request(
+        self, endpoint: str, kwargs: dict[str, Any]
+    ) -> dict[str, Any]:
+        """Performs one rate-limited HTTP request and parses the JSON body."""
+        await self._rate_limiter.acquire()
+
+        params = kwargs.copy()
+
+        if endpoint == "track/getFileUrl":
+            params = self._prepare_get_file_url_params(
+                track_id=params.pop("id"),
+                format_id=params.pop("fmt_id"),
+                secret_override=params.pop("sec", None),
+            )
+
+        if self.user_auth_token:
+            params["user_auth_token"] = self.user_auth_token
+
+        async with self._session.get(self.BASE_URL + endpoint, params=params) as r:
+            # Check if response was compressed (for logging)
+            was_compressed = r.headers.get("Content-Encoding") in (
+                "gzip",
+                "deflate",
+                "br",
+            )
+            if was_compressed:
+                log.debug(
+                    f"API response for {endpoint} was compressed "
+                    f"({r.headers.get('Content-Encoding')})"
+                )
+
+            if r.status == 429:
+                await self._rate_limiter.on_429()
+                r.raise_for_status()
+
+            if endpoint == "user/login":
+                if r.status == 401:
+                    raise AuthenticationError("Invalid email or password.")
+                if r.status == 400 and "Invalid application" in await r.text():
+                    raise InvalidAppIdError("The provided App ID is invalid.")
+
+            if endpoint == "track/getFileUrl" and r.status == 400:
+                raise InvalidAppSecretError("The app secret is invalid or has expired.")
+
+            r.raise_for_status()
+            return self._normalize_json_strings(await r.json())
+
+    @staticmethod
+    def _normalize_json_strings(obj: Any) -> Any:
+        """
+        Recursively normalize Unicode strings in an API response to NFC form.
+
+        Qobuz returns some text in decomposed (NFD) form, which produces
+        inconsistent tags and mangled filenames on Windows/macOS. We also fold
+        an ASCII "..." into a real ellipsis (U+2026) since a literal "..." in a
+        title tends to collide with path-truncation logic. URLs are left
+        untouched.
+        """
+        if isinstance(obj, str):
+            if "..." in obj and "://" not in obj:
+                obj = obj.replace("...", "\u2026")
+            return unicodedata.normalize("NFC", obj)
+        if isinstance(obj, dict):
+            return {
+                key: QobuzAPIClient._normalize_json_strings(value)
+                for key, value in obj.items()
+            }
+        if isinstance(obj, list):
+            return [QobuzAPIClient._normalize_json_strings(item) for item in obj]
+        return obj
+
+    async def _yield_paginated(
+        self, endpoint: str, item_key: str, **kwargs: Any
+    ) -> AsyncGenerator[dict[str, Any], None]:
+        """
+        Generator for handling paginated API endpoints.
+        """
+        offset = 0
+        limit = 200
+        total_items = 0
+
+        while True:
+            response = await self.api_call(
+                endpoint, offset=offset, limit=limit, **kwargs
+            )
+
+            if offset == 0:
+                total_items = response.get(f"{item_key}_count", 0)
+
+            items_in_response = len(response.get(item_key, {}).get("items", []))
+            if not items_in_response:
+                break
+
+            yield response
+
+            offset += items_in_response
+
+            # A short page reliably signals the end, regardless of whether the
+            # API returned a usable "<item>_count" total (it sometimes doesn't).
+            if items_in_response < limit:
+                break
+            if total_items and offset >= total_items:
+                break
+
+    # Public API Methods
+    async def fetch_album_metadata(self, album_id: str) -> dict[str, Any]:
+        return await self.api_call("album/get", album_id=album_id)
+
+    async def fetch_track_metadata(self, track_id: str) -> dict[str, Any]:
+        return await self.api_call("track/get", track_id=track_id)
+
+    async def fetch_track_url(self, track_id: str, format_id: int) -> dict[str, Any]:
+        return await self.api_call("track/getFileUrl", id=track_id, fmt_id=format_id)
+
+    def fetch_artist_discography(
+        self, artist_id: str
+    ) -> AsyncGenerator[dict[str, Any], None]:
+        return self._yield_paginated(
+            "artist/get", item_key="albums", artist_id=artist_id, extra="albums"
+        )
+
+    def fetch_playlist_tracks(
+        self, playlist_id: str
+    ) -> AsyncGenerator[dict[str, Any], None]:
+        return self._yield_paginated(
+            "playlist/get", item_key="tracks", playlist_id=playlist_id, extra="tracks"
+        )
+
+    def fetch_label_discography(
+        self, label_id: str
+    ) -> AsyncGenerator[dict[str, Any], None]:
+        return self._yield_paginated(
+            "label/get", item_key="albums", label_id=label_id, extra="albums"
+        )
+
+    async def search_tracks(self, query: str, limit: int = 50) -> dict[str, Any]:
+        return await self.api_call("track/search", query=query, limit=limit)

{qobuz_cli-0.0.2 → qobuz_cli-0.0.4}/qobuz_cli/api/rate_limiter.py

@@ -47,19 +47,26 @@ class AdaptiveRateLimiter:
 
     async def acquire(self) -> None:
         """
-        Waits if necessary to respect the current rate limit before allowing a call
-        to proceed.
+        Waits if necessary to respect the current rate limit before allowing a
+        call to proceed.
+
+        The wait is computed while holding the lock but performed *after*
+        releasing it, so a slow caller's sleep does not serialize every other
+        concurrent caller. Each caller reserves its own slot by advancing
+        ``_last_call_time`` before sleeping.
         """
         async with self._lock:
+            now = time.monotonic()
+
             # Gradually recover the rate if no 429 errors have occurred recently
-            if time.monotonic() - self._last_429_time > 300:  # 5 minutes
+            if now - self._last_429_time > 300:  # 5 minutes
                 self._rate = min(self._max_rate, self._rate * 1.005)  # Slow recovery
                 self._min_interval = 1.0 / self._rate
 
-            now = asyncio.get_event_loop().time()
-            time_since_last = now - self._last_call_time
-
-            if time_since_last < self._min_interval:
-                await asyncio.sleep(self._min_interval - time_since_last)
+            # Reserve the next slot: the earliest time this call may proceed.
+            scheduled_time = max(now, self._last_call_time + self._min_interval)
+            self._last_call_time = scheduled_time
+            wait_time = scheduled_time - now
 
-            self._last_call_time = asyncio.get_event_loop().time()
+        if wait_time > 0:
+            await asyncio.sleep(wait_time)

{qobuz_cli-0.0.2 → qobuz_cli-0.0.4}/qobuz_cli/cli/app.py

@@ -178,7 +178,8 @@ def init(
             secrets = list(bundle.extract_secrets().values())
             console.print("[green]✓ Secrets fetched successfully.[/green]")
         except Exception as e:
-            console.print(f"[red]✗ Failed to fetch secrets: {e}[/red]")
+            detail = str(e) or type(e).__name__
+            console.print(f"[red]✗ Failed to fetch secrets: {detail}[/red]")
             raise typer.Exit(code=1) from e
         settings = {"app_id": app_id, "secrets": secrets}
         if len(credentials) == 1:

{qobuz_cli-0.0.2 → qobuz_cli-0.0.4}/qobuz_cli/cli/progress_manager.py

@@ -6,6 +6,7 @@ statistics.
 
 import asyncio
 import logging
+import time
 from datetime import datetime
 from typing import Any
 
@@ -85,6 +86,11 @@ class ProgressManager:
         self._overall_task_id: TaskID | None = None
         self._active_tasks: dict[TaskID, dict] = {}
 
+        # Throttle expensive full-layout rebuilds; the Live object still
+        # refreshes the last-built layout at its own refresh_per_second.
+        self._last_display_update = 0.0
+        self._display_min_interval = 0.1  # seconds (~10 rebuilds/sec)
+
     def log_message(self, message: str, level: str = "info"):
         """Unified logging respecting dry_run mode."""
         if self.dry_run:
@@ -293,13 +299,23 @@ class ProgressManager:
             border_style="green",
         )
 
-    def _update_display(self):
+    def _update_display(self, force: bool = False):
         """
-        Updates all panels in the layout, letting the Live object handle refresh rate.
+        Rebuilds all panels in the layout, letting the Live object handle the
+        actual on-screen refresh rate.
+
+        Rebuilds are throttled to a few times per second because they are
+        expensive; callers that change structure (task added/removed) pass
+        ``force=True`` so those changes appear immediately.
         """
         if self.dry_run or not self._layout:
             return
 
+        now = time.monotonic()
+        if not force and (now - self._last_display_update) < self._display_min_interval:
+            return
+        self._last_display_update = now
+
         self._layout["header"].update(self._generate_header())
         self._layout["stats"].update(self._generate_stats_panel())
         self._layout["album_context"].update(self._generate_album_context_panel())
@@ -369,7 +385,7 @@ class ProgressManager:
         self._stats["peak_concurrent"] = max(
             self._stats["peak_concurrent"], self._stats["active_downloads"]
         )
-        self._update_display()
+        self._update_display(force=True)
         return task_id
 
     def update_task_progress(self, task_id: TaskID, completed: int):
@@ -402,7 +418,7 @@ class ProgressManager:
                         + self._stats["skipped"]
                     ),
                 )
-            self._update_display()
+            self._update_display(force=True)
         except KeyError:
             pass
 
@@ -417,7 +433,7 @@ class ProgressManager:
                     + self._stats["skipped"]
                 ),
             )
-        self._update_display()
+        self._update_display(force=True)
 
     def get_statistics(self) -> dict[str, Any]:
         return self._stats.copy()
@@ -426,7 +442,7 @@ class ProgressManager:
         if self.dry_run:
             return self
         self._layout = self._create_layout()
-        self._update_display()
+        self._update_display(force=True)
         self._live = Live(
             self._layout,
             console=self.console,