Merge pull request #156 from spoo-me/refactor/repositories-dtos

feat: implement service wiring and enhance repository error handling

Author: Zingzy

app.py

@@ -18,6 +18,7 @@
 from starlette.middleware.sessions import SessionMiddleware
 
 from config import AppSettings
+from dependencies.wiring import wire_services
 from infrastructure.email.zeptomail import ZeptoMailProvider
 from infrastructure.geoip import GeoIPService
 from infrastructure.http_client import HttpClient
@@ -111,7 +112,7 @@ async def lifespan(app: FastAPI) -> AsyncIterator[None]:
         app.state.oauth_providers = oauth_providers
 
         # Shared HTTP client + email provider — singletons to preserve connection pooling
-        http_client = HttpClient(timeout=5.0)
+        http_client = HttpClient(timeout=settings.http_client_timeout)
         app.state.http_client = http_client
         app.state.email_provider = ZeptoMailProvider(
             settings.email, http_client, app_url=settings.app_url
@@ -124,6 +125,9 @@ async def lifespan(app: FastAPI) -> AsyncIterator[None]:
 
         await ensure_indexes(app.state.db)
 
+        # ── Build all repos + services (composition root) ────────────────
+        wire_services(app, settings, redis_client)
+
         # Warn if session secret is missing when auth is enabled
         if settings.jwt and not settings.secret_key:
             log.warning(

config.py

@@ -12,7 +12,7 @@
 
 from urllib.parse import urlparse
 
-from pydantic import model_validator
+from pydantic import field_validator, model_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
@@ -148,6 +148,50 @@ class AppSettings(BaseSettings):
     hcaptcha_secret: str = ""
     hcaptcha_sitekey: str = ""
 
+    # Service limits (overridable by self-hosters via env vars)
+    max_active_api_keys: int = 20
+    max_date_range_days: int = 90
+    http_client_timeout: float = 5.0
+
+    # Validator constraints (overridable by self-hosters via env vars)
+    blocked_url_regex_timeout: float = 0.2
+    max_emoji_alias_length: int = 15
+    url_password_min_length: int = 8
+    account_password_min_length: int = 8
+    account_password_max_length: int = 128
+
+    # ── Field validators for safety-critical config ────────────────────
+
+    @field_validator(
+        "max_active_api_keys", "max_date_range_days", "max_emoji_alias_length"
+    )
+    @classmethod
+    def _must_be_positive_int(cls, v: int, info) -> int:
+        if v < 1:
+            raise ValueError(f"{info.field_name} must be >= 1, got {v}")
+        return v
+
+    @field_validator("http_client_timeout", "blocked_url_regex_timeout")
+    @classmethod
+    def _must_be_positive_float(cls, v: float, info) -> float:
+        if v <= 0:
+            raise ValueError(f"{info.field_name} must be > 0, got {v}")
+        return v
+
+    @field_validator("url_password_min_length", "account_password_min_length")
+    @classmethod
+    def _password_min_length_sane(cls, v: int, info) -> int:
+        if v < 1:
+            raise ValueError(f"{info.field_name} must be >= 1, got {v}")
+        return v
+
+    @field_validator("account_password_max_length")
+    @classmethod
+    def _password_max_length_sane(cls, v: int) -> int:
+        if v < 1:
+            raise ValueError(f"account_password_max_length must be >= 1, got {v}")
+        return v
+
     # Sub-configs (composed via model_validator below)
     db: DatabaseSettings | None = None
     redis: RedisSettings | None = None
@@ -159,6 +203,13 @@ class AppSettings(BaseSettings):
 
     @model_validator(mode="after")
     def _populate_sub_configs_and_secret(self) -> AppSettings:
+        # Cross-field validation
+        if self.account_password_max_length < self.account_password_min_length:
+            raise ValueError(
+                f"account_password_max_length ({self.account_password_max_length}) "
+                f"must be >= account_password_min_length ({self.account_password_min_length})"
+            )
+
         # Accept FLASK_SECRET_KEY as a fallback for backward compatibility
         if not self.secret_key and self.flask_secret_key:
             self.secret_key = self.flask_secret_key

dependencies/__init__.py

@@ -32,7 +32,6 @@
     get_geoip_service,
     get_redis,
     get_settings,
-    get_url_cache,
 )
 from dependencies.services import (
     get_api_key_service,
@@ -75,7 +74,6 @@
     "get_redis",
     "get_settings",
     "get_stats_service",
-    "get_url_cache",
     "get_url_service",
     "optional_scopes",
     "optional_scopes_verified",

dependencies/infra.py

@@ -7,10 +7,9 @@
 
 from __future__ import annotations
 
-from fastapi import Depends, Request
+from fastapi import Request
 
 from config import AppSettings
-from infrastructure.cache.url_cache import UrlCache
 from infrastructure.geoip import GeoIPService
 
 
@@ -37,11 +36,3 @@ def get_email_provider(request: Request):
 def get_geoip_service(request: Request) -> GeoIPService:
     """Return the GeoIPService singleton from app.state."""
     return request.app.state.geoip
-
-
-def get_url_cache(
-    redis=Depends(get_redis),
-    settings: AppSettings = Depends(get_settings),
-) -> UrlCache:
-    """Return a UrlCache wrapping the shared Redis client."""
-    return UrlCache(redis, ttl_seconds=settings.redis.redis_ttl_seconds)

dependencies/services.py

@@ -1,129 +1,57 @@
 """
-Service and repository dependency providers.
+Service dependency providers.
 
-Each function assembles the repositories and infrastructure a service needs,
-then returns a fully-wired service instance for the current request.
+Each function is a thin lookup that returns the singleton service instance
+built during application startup in the lifespan (app.py).  No per-request
+object construction — services are stateless and shared across requests.
 """
 
 from __future__ import annotations
 
-from fastapi import Depends, Request
-
-from config import AppSettings
-from dependencies.infra import (
-    get_db,
-    get_email_provider,
-    get_geoip_service,
-    get_settings,
-    get_url_cache,
-)
-from infrastructure.cache.url_cache import UrlCache
-from infrastructure.captcha.hcaptcha import HCaptchaProvider
-from infrastructure.geoip import GeoIPService
-from infrastructure.webhook.discord import DiscordWebhookProvider
-from repositories.api_key_repository import ApiKeyRepository
-from repositories.blocked_url_repository import BlockedUrlRepository
-from repositories.click_repository import ClickRepository
-from repositories.legacy.emoji_url_repository import EmojiUrlRepository
-from repositories.legacy.legacy_url_repository import LegacyUrlRepository
-from repositories.token_repository import TokenRepository
-from repositories.url_repository import UrlRepository
-from repositories.user_repository import UserRepository
+from fastapi import Request
+
 from services.api_key_service import ApiKeyService
 from services.auth_service import AuthService
-from services.click import ClickService, LegacyClickHandler, V2ClickHandler
+from services.click import ClickService
 from services.contact_service import ContactService
-from services.export.formatters import default_formatters
 from services.export.service import ExportService
 from services.oauth_service import OAuthService
 from services.profile_picture_service import ProfilePictureService
 from services.stats_service import StatsService
 from services.url_service import UrlService
 
 
-async def get_url_service(
-    db=Depends(get_db),
-    url_cache: UrlCache = Depends(get_url_cache),
-    settings: AppSettings = Depends(get_settings),
-) -> UrlService:
-    url_repo = UrlRepository(db["urlsV2"])
-    legacy_repo = LegacyUrlRepository(db["urls"])
-    emoji_repo = EmojiUrlRepository(db["emojis"])
-    blocked_url_repo = BlockedUrlRepository(db["blocked-urls"])
-    blocked_self_domains = [settings.app_url] if settings.app_url else []
-    return UrlService(
-        url_repo,
-        legacy_repo,
-        emoji_repo,
-        blocked_url_repo,
-        url_cache,
-        blocked_self_domains,
-    )
-
-
-async def get_stats_service(db=Depends(get_db)) -> StatsService:
-    click_repo = ClickRepository(db["clicks"])
-    url_repo = UrlRepository(db["urlsV2"])
-    return StatsService(click_repo, url_repo)
-
-
-async def get_export_service(
-    stats: StatsService = Depends(get_stats_service),
-) -> ExportService:
-    return ExportService(stats, default_formatters())
-
-
-async def get_api_key_service(db=Depends(get_db)) -> ApiKeyService:
-    api_key_repo = ApiKeyRepository(db["api-keys"])
-    return ApiKeyService(api_key_repo)
-
-
-async def get_auth_service(
-    db=Depends(get_db),
-    settings: AppSettings = Depends(get_settings),
-    email=Depends(get_email_provider),
-) -> AuthService:
-    """Build and return an AuthService for the current request."""
-    user_repo = UserRepository(db["users"])
-    token_repo = TokenRepository(db["verification-tokens"])
-    return AuthService(user_repo, token_repo, email, settings.jwt)
-
-
-async def get_oauth_service(
-    db=Depends(get_db),
-    auth_service: AuthService = Depends(get_auth_service),
-    email=Depends(get_email_provider),
-) -> OAuthService:
-    """Build and return an OAuthService for the current request."""
-    user_repo = UserRepository(db["users"])
-    return OAuthService(user_repo, auth_service, email)
-
-
-async def get_profile_picture_service(db=Depends(get_db)) -> ProfilePictureService:
-    return ProfilePictureService(UserRepository(db["users"]))
-
-
-async def get_contact_service(
-    request: Request,
-    settings: AppSettings = Depends(get_settings),
-) -> ContactService:
-    http_client = request.app.state.http_client
-    captcha = HCaptchaProvider(settings.hcaptcha_secret, http_client)
-    contact_webhook = DiscordWebhookProvider(settings.contact_webhook, http_client)
-    report_webhook = DiscordWebhookProvider(settings.url_report_webhook, http_client)
-    return ContactService(contact_webhook, report_webhook, captcha)
-
-
-async def get_click_service(
-    db=Depends(get_db),
-    url_cache: UrlCache = Depends(get_url_cache),
-    geoip: GeoIPService = Depends(get_geoip_service),
-) -> ClickService:
-    """Build and return a ClickService with V2 and legacy handlers."""
-    url_repo = UrlRepository(db["urlsV2"])
-    legacy_repo = LegacyUrlRepository(db["urls"])
-    emoji_repo = EmojiUrlRepository(db["emojis"])
-    click_repo = ClickRepository(db["clicks"])
-    v2_handler = V2ClickHandler(click_repo, url_repo, geoip, url_cache)
-    v1_handler = LegacyClickHandler(legacy_repo, emoji_repo, geoip)
-    return ClickService({"v2": v2_handler, "v1": v1_handler})
+def get_url_service(request: Request) -> UrlService:
+    return request.app.state.url_service
+
+
+def get_stats_service(request: Request) -> StatsService:
+    return request.app.state.stats_service
+
+
+def get_export_service(request: Request) -> ExportService:
+    return request.app.state.export_service
+
+
+def get_api_key_service(request: Request) -> ApiKeyService:
+    return request.app.state.api_key_service
+
+
+def get_auth_service(request: Request) -> AuthService:
+    return request.app.state.auth_service
+
+
+def get_oauth_service(request: Request) -> OAuthService:
+    return request.app.state.oauth_service
+
+
+def get_profile_picture_service(request: Request) -> ProfilePictureService:
+    return request.app.state.profile_picture_service
+
+
+def get_contact_service(request: Request) -> ContactService:
+    return request.app.state.contact_service
+
+
+def get_click_service(request: Request) -> ClickService:
+    return request.app.state.click_service