mirror of
https://github.com/got-feedBack/feedBack.git
synced 2026-07-25 14:21:21 +00:00
7ca736d525
* library: cover-art layer — CAA auto-fetch + user overrides, GIF local-only (R3/P9)
Third slice of the enrichment series (stacked on the matcher): covers.
- Serve chain for GET /api/song/{fn}/art: USER OVERRIDE -> PACK ART ->
COVER ART ARCHIVE cache -> 404. Behaviour change, deliberate: a
user-uploaded cover now OVERRIDES pack art (previously the upload only
filled the no-art gap, which made custom art look broken on any song
that already shipped a cover).
- GIF is allowed as an override and kept VERBATIM (animation intact) —
a local-only bonus. Everything else normalizes to RGB PNG as before.
One override per song (saving either kind removes the other), and
nothing ever writes art INTO a pack file — test-pinned: the pack's
cover.jpg is byte-identical after a GIF upload.
- Art by URL: POST /api/song/{fn}/art/url fetches server-side (http(s)
only, 10 MB cap enforced while streaming) into the same override slot.
DELETE /api/art/{fn}/override drops it — under /api/art because the
greedy DELETE /api/song/{path} catch-all shadows anything beneath it
(the same dodge the chart split/unsplit routes use).
- Cover Art Archive fetch as phase 3 of the enrichment pass: matched
songs that LACK pack art get their release's front cover, throttled +
identified + offline-guarded exactly like the MusicBrainz client
(pytest can never reach the network; a transport error pauses the
pass without burning the row). The cache is keyed by RELEASE MBID —
ten charts of one album cost one fetch — and every outcome writes an
art_state (pack/user/caa/none/error) so a row is evaluated once.
- LRU cap (200 MB) on the CAA side of the cache only; user overrides
are never evicted, and evicted rows reset so a later pass may
re-fetch. Deleting a song removes its override files (CAA files stay
— they may be shared by other charts of the release).
No frontend changes: the grid, the review modal, and the player pick
the new art up through the same route they already use. The
upload/paste-a-link surfaces in the Details drawer land with the
context-menu slice once the drawer PR merges.
13 new tests (tests/test_art_layer.py) + demo-mode routes; full-suite
failure set byte-identical with the change stashed vs applied.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nm7tHs1Yvjjtnnu4nzJgdN
* library: harden cover-art layer — SSRF guard, demo/size caps, override-delete state reset
Follow-up hardening on the R3 cover-art layer:
- remove_song_art_override: reset the enrichment row (set_enrichment_art(fn,
None, None)) when an override is deleted, so a row previously settled as
'user' re-queues and the CAA fallback resumes. Previously a removed override
stranded the row (enrichment_art_pending only re-queues art_state IS NULL),
leaving the song with no art at all.
- Base64 art upload: block it in demo mode (was open — a write/disk-fill vector,
worse now that GIFs are stored verbatim), validate the filename resolves to a
real song (mirrors the url route), and cap the decoded payload at 10 MB.
- Art-by-URL: reject hosts that resolve to loopback/private/link-local/reserved/
multicast/unspecified addresses (SSRF, e.g. cloud metadata) and stop following
redirects (allow_redirects=False) so a redirect can't smuggle the request to an
internal target. Fails closed on unresolvable/unparseable hosts.
- _caa_http_get: stream with a per-file 10 MB cap (bounds any one response
independently of the aggregate LRU); guard release_id against a conservative
token before interpolating it into a cache-file path (no separators/dots).
Tests: delete-override→CAA-fallback, upload unknown-song/oversize rejection,
SSRF internal-host guard, and a demo-mode block assertion for art/upload.
Note: art_state='error' rows are intentionally not auto-retried — there is no
per-row attempt counter on the art side, so an unbounded retry could storm CAA
for permanently-bad rows; a bounded retry would need extra state, left out here.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: byrongamatos <xasiklas@gmail.com>
|
||
|---|---|---|
| .. | ||
| browser | ||
| fixtures | ||
| js | ||
| plugins | ||
| __init__.py | ||
| conftest.py | ||
| test_albums_view.py | ||
| test_art_layer.py | ||
| test_artist_alias.py | ||
| test_artist_sort_title_order.py | ||
| test_audio_bundled.py | ||
| test_audio_effect_mappings.py | ||
| test_audio_local_path.py | ||
| test_audio.py | ||
| test_batch_user_meta.py | ||
| test_builtin_diagnostic_seed.py | ||
| test_collections_api.py | ||
| test_context_menu_api.py | ||
| test_correlation_id.py | ||
| test_curated_album.py | ||
| test_demo_mode.py | ||
| test_diagnostics_bundle.py | ||
| test_diagnostics_hardware.py | ||
| test_diagnostics_redact.py | ||
| test_drums_lib.py | ||
| test_enrichment_plumbing.py | ||
| test_env_compat.py | ||
| test_feedpak_extension.py | ||
| test_gap_fill.py | ||
| test_gp2midi.py | ||
| test_gp2notation.py | ||
| test_gp2rs_drums.py | ||
| test_gp2rs_gpx.py | ||
| test_gp2rs.py | ||
| test_gp_audio_sync.py | ||
| test_group_filter_law.py | ||
| test_highway_3d_routes.py | ||
| test_highway_ws_authors.py | ||
| test_highway_ws_instrument_routing.py | ||
| test_highway_ws_notation.py | ||
| test_library_filters.py | ||
| test_library_keyset.py | ||
| test_library_providers.py | ||
| test_lift_keys_notation.py | ||
| test_logging_setup.py | ||
| test_loose_traversal.py | ||
| test_loosefolder.py | ||
| test_lyrics_transcribe.py | ||
| test_mb_enrichment.py | ||
| test_mb_match.py | ||
| test_midi_import_drums.py | ||
| test_midi_import.py | ||
| test_minigames_routes.py | ||
| test_notation_lib.py | ||
| test_notation_lift.py | ||
| test_notation_to_notes.py | ||
| test_parse_arrangement.py | ||
| test_playlists_api.py | ||
| test_plugin_manifest_contract.py | ||
| test_plugin_runtime_idempotence.py | ||
| test_plugins.py | ||
| test_practice_suggestions.py | ||
| test_profile_api.py | ||
| test_profile_domains.py | ||
| test_progression_api.py | ||
| test_progression.py | ||
| test_safepath.py | ||
| test_settings_api.py | ||
| test_settings_export_library_db.py | ||
| test_settings_export.py | ||
| test_settings_instrument.py | ||
| test_sloppak_cent_offset.py | ||
| test_sloppak_cover_art.py | ||
| test_sloppak_drumtab_load.py | ||
| test_sloppak_feedpak_version.py | ||
| test_sloppak_file_traversal.py | ||
| test_sloppak_jsonc_load.py | ||
| test_sloppak_keys_load.py | ||
| test_sloppak_notation_load.py | ||
| test_sloppak_original_audio_load.py | ||
| test_sloppak_song_timeline_load.py | ||
| test_song_score.py | ||
| test_song_stats_api.py | ||
| test_song_user_meta.py | ||
| test_song.py | ||
| test_songmeta.py | ||
| test_startup_status.py | ||
| test_tailwind_rebuild.py | ||
| test_tones.py | ||
| test_tunings.py | ||
| test_version_endpoint.py | ||
| test_vocal_pitch.py | ||
| test_wanted_api.py | ||
| test_work_charts_api.py | ||
| test_work_grouping.py | ||
| test_xp.py | ||