Merge pull request #116 from spoo-me/chore/dead-code-cleanup

Chore/Oauth Refactor & Dead code Cleanup

Author: Zingzy

.dockerignore

@@ -0,0 +1,35 @@
+# Secrets — never bake into image layers
+.env
+.env.*
+!.env.example
+
+# Version control
+.git
+.gitignore
+
+# Python artifacts
+__pycache__/
+*.py[cod]
+*.so
+.venv
+.ruff_cache/
+.mypy_cache/
+.pytest_cache/
+.coverage
+.coverage.*
+htmlcov/
+
+# Dev/test files
+tests/
+k6-tests/
+local_test_db/
+misc/
+thoughts/
+
+# Editor/OS
+.vscode/
+.DS_Store
+
+# Docs
+*.md
+!README.md

.env.example

@@ -1,11 +1,8 @@
 # MongoDB connection details
 MONGODB_URI="mongodb://localhost:27017/"
-MONGODB_URI_DEV="mongodb://localhost:27017/"
-MONGO_DB_NAME="url-shortener"
 
 # Redis connection details
 REDIS_URI="redis://localhost:6379"
-REDIS_URI_DEV="redis://localhost:6379"
 REDIS_TTL_SECONDS=3600 # 1 hour
 
 # Sentry configuration (error tracking & performance monitoring)
@@ -17,7 +14,6 @@ SENTRY_PROFILE_SAMPLE_RATE=0.05     # % of profiling sessions to capture (1.0 in
 # Flask configs
 FLASK_SECRET_KEY="" # To generate: import os; print(os.urandom(32))
 HOST_URI="127.0.0.1:8000"
-SHORTEN_API_RATE_LIMIT_PER_HOUR=100
 ENV="development"  # change to "production" in production
 
 # Logging Configuration

.github/workflows/api_test.yaml

@@ -21,15 +21,17 @@ jobs:
       uses: actions/checkout@v6
 
     - name: Setup environment
-      run: cp .env.example .env
+      run: |
+        cp .env.example .env
+        echo "FLASK_SECRET_KEY=$(python3 -c 'import secrets; print(secrets.token_hex(32))')" >> .env
 
     - name: Start services
       run: docker compose up -d --build --wait
 
     - name: Wait for app to be ready
       run: |
         for i in {1..30}; do
-          if docker compose exec app uv run python -c "import requests; requests.get('http://localhost:8000/metric', timeout=2)" 2>/dev/null; then
+          if docker compose exec app uv run python3 -c "import requests; requests.get('http://localhost:8000/metric', timeout=2)" 2>/dev/null; then
             echo "✅ App is ready"
             exit 0
           fi

.gitignore

@@ -187,4 +187,6 @@ todo.md
 k6-tests/
 local_test_db/
 
-.DS_Store
+.DS_Store
+
+thoughts/

api/v1/keys.py

@@ -13,6 +13,7 @@
     revoke_api_key_by_id,
 )
 from blueprints.limiter import limiter, rate_limit_key_for_request
+from blueprints.limits import Limits
 
 from . import api_v1
 
@@ -46,7 +47,7 @@ def _parse_expires_at(value: Optional[str | int | float]):
 
 
 @api_v1.route("/keys", methods=["POST"])
-@limiter.limit("5 per hour", key_func=rate_limit_key_for_request)
+@limiter.limit(Limits.API_KEY_CREATE, key_func=rate_limit_key_for_request)
 @requires_auth
 def create_api_key():
     """
@@ -255,7 +256,7 @@ def create_api_key():
 
 
 @api_v1.route("/keys", methods=["GET"])
-@limiter.limit("60 per minute", key_func=rate_limit_key_for_request)
+@limiter.limit(Limits.API_KEY_READ, key_func=rate_limit_key_for_request)
 @requires_auth
 def list_api_keys():
     """

api/v1/management.py

@@ -272,9 +272,11 @@ def delete_url_v1(url_id: str) -> tuple[Response, int]:
         return jsonify({"error": "Invalid URL ID format"}), 400
 
     # Validate ownership first
-    builder = UpdateUrlRequestBuilder({}, url_id)
-    builder.parse_auth_scope(required_scopes={"urls:manage", "admin:all"})
-    builder.load_and_validate_ownership()
+    builder = (
+        UpdateUrlRequestBuilder({}, url_id)
+        .parse_auth_scope(required_scopes={"urls:manage", "admin:all"})
+        .load_and_validate_ownership()
+    )
 
     if builder.error:
         return builder.error

blueprints/auth.py

@@ -4,6 +4,7 @@
 from pymongo.errors import DuplicateKeyError
 
 from .limiter import limiter, rate_limit_key_for_request
+from .limits import Limits
 from utils.logger import get_logger
 from utils.auth_utils import (
     verify_password,
@@ -42,8 +43,7 @@
 
 
 @auth.route("/auth/login", methods=["POST"])
-@limiter.limit("5/minute")
-@limiter.limit("50/day")
+@limiter.limit(Limits.LOGIN)
 def login():
     body = request.get_json(silent=True) or {}
     email = (body.get("email") or "").strip().lower()
@@ -76,7 +76,7 @@ def login():
 
 
 @auth.route("/auth/refresh", methods=["POST"])
-@limiter.limit("20/minute")
+@limiter.limit(Limits.TOKEN_REFRESH)
 def refresh():
     refresh_token = request.cookies.get("refresh_token")
     if not refresh_token:
@@ -122,7 +122,7 @@ def refresh():
 
 
 @auth.route("/auth/logout", methods=["POST"])
-@limiter.limit("60/hour")
+@limiter.limit(Limits.LOGOUT)
 def logout():
     user_id = getattr(g, "user_id", None)
     if user_id:
@@ -136,7 +136,7 @@ def logout():
 
 @auth.route("/auth/me", methods=["GET"])
 @requires_auth
-@limiter.limit("60/minute", key_func=rate_limit_key_for_request)
+@limiter.limit(Limits.AUTH_READ, key_func=rate_limit_key_for_request)
 def me():
     user_id = g.user_id
     user = get_user_by_id(user_id)
@@ -146,8 +146,7 @@ def me():
 
 
 @auth.route("/auth/register", methods=["POST"])
-@limiter.limit("5/minute")
-@limiter.limit("50/day")
+@limiter.limit(Limits.SIGNUP)
 def register():
     body = request.get_json(silent=True) or {}
     email = (body.get("email") or "").strip().lower()
@@ -157,7 +156,7 @@ def register():
         return jsonify({"error": "email and password are required"}), 400
 
     # Validate password with comprehensive checks
-    is_valid, missing_requirements = validate_password(password)
+    is_valid, missing_requirements, _ = validate_password(password)
     if not is_valid:
         return jsonify(
             {
@@ -240,7 +239,7 @@ def register():
 
 @auth.route("/auth/set-password", methods=["POST"])
 @requires_auth
-@limiter.limit("5/minute")
+@limiter.limit(Limits.SET_PASSWORD)
 def set_password():
     """Set password for OAuth-only users"""
     user = get_user_by_id(g.user_id)
@@ -257,7 +256,7 @@ def set_password():
         return jsonify({"error": "password is required"}), 400
 
     # Validate password with comprehensive checks
-    is_valid, missing_requirements = validate_password(password)
+    is_valid, missing_requirements, _ = validate_password(password)
     if not is_valid:
         return jsonify(
             {
@@ -312,7 +311,7 @@ def register_redirect():
 
 @auth.route("/auth/verify", methods=["GET"])
 @requires_auth
-@limiter.limit("60/minute", key_func=rate_limit_key_for_request)
+@limiter.limit(Limits.AUTH_READ, key_func=rate_limit_key_for_request)
 def verify_page():
     """Email verification page"""
     user = get_user_by_id(g.user_id)
@@ -328,7 +327,7 @@ def verify_page():
 
 @auth.route("/auth/send-verification", methods=["POST"])
 @requires_auth
-@limiter.limit("3/hour", key_func=rate_limit_key_for_request)
+@limiter.limit(Limits.RESEND_VERIFICATION, key_func=rate_limit_key_for_request)
 def send_verification_email():
     """Send email verification OTP to authenticated user"""
     user = get_user_by_id(g.user_id)
@@ -379,7 +378,7 @@ def send_verification_email():
 
 @auth.route("/auth/verify-email", methods=["POST"])
 @requires_auth
-@limiter.limit("10/hour", key_func=rate_limit_key_for_request)
+@limiter.limit(Limits.EMAIL_VERIFY, key_func=rate_limit_key_for_request)
 def verify_email():
     """Verify email using OTP code"""
     user = get_user_by_id(g.user_id)
@@ -457,7 +456,7 @@ def verify_email():
 
 
 @auth.route("/auth/request-password-reset", methods=["POST"])
-@limiter.limit("3/hour")
+@limiter.limit(Limits.PASSWORD_RESET_REQUEST)
 def request_password_reset():
     """Request password reset OTP"""
     body = request.get_json(silent=True) or {}
@@ -543,7 +542,7 @@ def request_password_reset():
 
 
 @auth.route("/auth/reset-password", methods=["POST"])
-@limiter.limit("5/hour")
+@limiter.limit(Limits.PASSWORD_RESET_CONFIRM)
 def reset_password():
     """Reset password using OTP code"""
     body = request.get_json(silent=True) or {}
@@ -565,7 +564,7 @@ def reset_password():
     user_id = str(user["_id"])
 
     # Validate new password
-    is_valid, missing_requirements = validate_password(new_password)
+    is_valid, missing_requirements, _ = validate_password(new_password)
     if not is_valid:
         return jsonify(
             {

blueprints/contact.py

@@ -10,15 +10,16 @@
 from utils.url_utils import get_client_ip
 from utils.logger import get_logger
 from .limiter import limiter
+from .limits import Limits
 
 contact = Blueprint("contact", __name__)
 log = get_logger(__name__)
 
 
 @contact.route("/contact", methods=["GET", "POST"])
-@limiter.limit("20/day")
-@limiter.limit("10/hour")
-@limiter.limit("3/minute")
+@limiter.limit(Limits.CONTACT_DAY)
+@limiter.limit(Limits.CONTACT_HOUR)
+@limiter.limit(Limits.CONTACT_MINUTE)
 def contact_route():
     if request.method == "POST":
         email = request.values.get("email")
@@ -88,9 +89,9 @@ def contact_route():
 
 
 @contact.route("/report", methods=["GET", "POST"])
-@limiter.limit("20/day")
-@limiter.limit("10/hour")
-@limiter.limit("3/minute")
+@limiter.limit(Limits.CONTACT_DAY)
+@limiter.limit(Limits.CONTACT_HOUR)
+@limiter.limit(Limits.CONTACT_MINUTE)
 def report():
     if request.method == "POST":
         # Only read from form data (POST), not query parameters

blueprints/dashboard.py

@@ -11,6 +11,7 @@
 )
 from utils.auth_utils import get_user_profile
 from blueprints.limiter import limiter, rate_limit_key_for_request
+from blueprints.limits import Limits
 from utils.logger import get_logger
 
 log = get_logger(__name__)
@@ -20,7 +21,7 @@
 
 
 @dashboard_bp.route("/", methods=["GET"])
-@limiter.limit("60 per minute", key_func=rate_limit_key_for_request)
+@limiter.limit(Limits.DASHBOARD_READ, key_func=rate_limit_key_for_request)
 @requires_auth
 def dashboard():
     # Redirect to links page as the default dashboard view
@@ -29,7 +30,7 @@ def dashboard():
 
 @dashboard_bp.route("/links", methods=["GET"])
 @requires_auth
-@limiter.limit("60 per minute", key_func=rate_limit_key_for_request)
+@limiter.limit(Limits.DASHBOARD_READ, key_func=rate_limit_key_for_request)
 def dashboard_links():
     user = get_user_by_id(g.user_id)
     if not user:
@@ -43,7 +44,7 @@ def dashboard_links():
 
 
 @dashboard_bp.route("/keys", methods=["GET"])
-@limiter.limit("60 per minute", key_func=rate_limit_key_for_request)
+@limiter.limit(Limits.DASHBOARD_READ, key_func=rate_limit_key_for_request)
 @requires_auth
 def dashboard_keys():
     user = get_user_by_id(g.user_id)
@@ -76,7 +77,7 @@ def dashboard_statistics():
 
 @dashboard_bp.route("/settings", methods=["GET"])
 @requires_auth
-@limiter.limit("60 per minute", key_func=rate_limit_key_for_request)
+@limiter.limit(Limits.DASHBOARD_READ, key_func=rate_limit_key_for_request)
 def dashboard_settings():
     user = get_user_by_id(g.user_id)
     if not user:
@@ -91,7 +92,7 @@ def dashboard_settings():
 
 @dashboard_bp.route("/billing", methods=["GET"])
 @requires_auth
-@limiter.limit("60 per minute", key_func=rate_limit_key_for_request)
+@limiter.limit(Limits.DASHBOARD_READ, key_func=rate_limit_key_for_request)
 def dashboard_billing():
     user = get_user_by_id(g.user_id)
     if not user:
@@ -105,7 +106,7 @@ def dashboard_billing():
 
 
 @dashboard_bp.route("/profile-pictures", methods=["GET"])
-@limiter.limit("30 per minute", key_func=rate_limit_key_for_request)
+@limiter.limit(Limits.DASHBOARD_WRITE, key_func=rate_limit_key_for_request)
 @requires_auth
 def get_profile_pictures():
     """Get available profile pictures from connected OAuth providers"""
@@ -136,7 +137,7 @@ def get_profile_pictures():
 
 
 @dashboard_bp.route("/profile-pictures", methods=["POST"])
-@limiter.limit("5 per minute", key_func=rate_limit_key_for_request)
+@limiter.limit(Limits.DASHBOARD_SENSITIVE, key_func=rate_limit_key_for_request)
 @requires_auth
 def set_profile_picture():
     """Set user's profile picture from available options"""