Refactor feed creation and token internals

Author: gildesmarais

Gemfile

@@ -4,14 +4,15 @@ source 'https://rubygems.org'
 
 git_source(:github) { |repo_name| "https://github.com/#{repo_name}" }
 
-gem 'html2rss', '~> 0.18'
-# gem 'html2rss', github: 'html2rss/html2rss', branch: :master
+# gem 'html2rss', '~> 0.18'
+gem 'html2rss', github: 'html2rss/html2rss', branch: 'codex-pr-auto-fallback-pipeline'
 gem 'html2rss-configs', github: 'html2rss/html2rss-configs'
 
 # Use these instead of the two above (uncomment them) when developing locally:
 # gem 'html2rss', path: '../html2rss'
 # gem 'html2rss-configs', path: '../html2rss-configs'
 
+gem 'concurrent-ruby'
 gem 'parallel'
 gem 'rack-cache'
 gem 'rack-timeout'
@@ -21,7 +22,6 @@ gem 'zeitwerk'
 gem 'puma', require: false
 
 group :development do
-  gem 'byebug'
   gem 'irb', require: false
   gem 'rake', require: false
   gem 'rubocop', require: false

Gemfile.lock

@@ -1,24 +1,29 @@
 # frozen_string_literal: true
 
-require 'time'
 require 'json'
+require 'time'
 
 module Html2rss
   module Web
     module Api
       module V1
         ##
         # Creates stable feed records from authenticated API requests.
-        module CreateFeed # rubocop:disable Metrics/ModuleLength
+        module CreateFeed
           FEED_ATTRIBUTE_KEYS =
             %i[id name url feed_token public_url json_public_url created_at updated_at].freeze
-          class << self # rubocop:disable Metrics/ClassLength
+
+          class << self
             # Creates a feed and returns a normalized API success payload.
             #
             # @param request [Rack::Request] HTTP request with auth context.
             # @return [Hash{Symbol=>Object}] API response payload.
-            def call(request) # rubocop:disable Metrics/MethodLength
-              params, feed_data = build_feed_from_request(request)
+            # rubocop:disable Metrics/MethodLength
+            def call(request)
+              account = require_account(request)
+              params = build_create_params(request, account)
+              feed_data = create_feed(params, account)
+
               emit_create_success(params)
               Response.success(response: request.response,
                                status: 201,
@@ -30,14 +35,10 @@ def call(request) # rubocop:disable Metrics/MethodLength
               emit_create_failure(error)
               raise
             end
+            # rubocop:enable Metrics/MethodLength
 
             private
 
-            # @return [void]
-            def ensure_auto_source_enabled!
-              raise Html2rss::Web::AutoSourceDisabledError unless AutoSource.enabled?
-            end
-
             # @param request [Rack::Request]
             # @return [Hash]
             def require_account(request)
@@ -47,15 +48,41 @@ def require_account(request)
               account
             end
 
-            # @param params [Hash]
+            # @param request [Rack::Request]
             # @param account [Hash]
             # @return [Html2rss::Web::Api::V1::FeedMetadata::CreateParams]
-            def build_create_params(params, account)
-              url = validated_url(params['url'], account)
-              FeedMetadata::CreateParams.new(
-                url: url,
-                name: FeedMetadata.site_title_for(url)
-              )
+            def build_create_params(request, account)
+              url = validated_url(request_params(request)['url'], account)
+              FeedMetadata::CreateParams.new(url:, name: FeedMetadata.site_title_for(url))
+            end
+
+            # @param request [Rack::Request]
+            # @return [Hash]
+            def request_params(request)
+              return request.params unless json_request?(request)
+
+              request.GET.merge(parsed_json_body(request))
+            end
+
+            # @param request [Rack::Request]
+            # @return [Hash]
+            def parsed_json_body(request)
+              raw_body = request.body.read
+              request.body.rewind
+              return {} if raw_body.strip.empty?
+
+              parsed = JSON.parse(raw_body)
+              raise Html2rss::Web::BadRequestError, 'Invalid JSON payload' unless parsed.is_a?(Hash)
+
+              parsed
+            rescue JSON::ParserError
+              raise Html2rss::Web::BadRequestError, 'Invalid JSON payload'
+            end
+
+            # @param request [Rack::Request]
+            # @return [Boolean]
+            def json_request?(request)
+              request.env['CONTENT_TYPE'].to_s.include?('application/json')
             end
 
             # @param raw_url [String, nil]
@@ -102,49 +129,23 @@ def hostname_input?(url)
               }ix.match?(url)
             end
 
-            # @param feed_data [Hash, Html2rss::Web::Api::V1::FeedMetadata::Metadata]
-            # @return [Hash{Symbol=>Object}]
-            def feed_attributes(feed_data)
-              timestamp = Time.now.iso8601
-              typed_feed = feed_metadata(feed_data)
-              typed_feed_attributes(typed_feed, timestamp).slice(*FEED_ATTRIBUTE_KEYS)
-            end
-
-            # @param request [Rack::Request]
-            # @return [Hash]
-            def request_params(request)
-              return request.params unless json_request?(request)
-
-              raw_body = request.body.read
-              request.body.rewind
-              return request.params if raw_body.strip.empty?
-
-              parsed = JSON.parse(raw_body)
-              raise Html2rss::Web::BadRequestError, 'Invalid JSON payload' unless parsed.is_a?(Hash)
-
-              request.params.merge(parsed)
-            rescue JSON::ParserError
-              raise Html2rss::Web::BadRequestError, 'Invalid JSON payload'
-            end
-
-            # @param request [Rack::Request]
-            # @return [Boolean]
-            def json_request?(request)
-              content_type = request.env['CONTENT_TYPE'].to_s
-              content_type.include?('application/json')
-            end
-
-            # @param request [Rack::Request]
-            # @return [Array<(Html2rss::Web::Api::V1::FeedMetadata::CreateParams, Object)>]
-            def build_feed_from_request(request)
-              account = require_account(request)
-              ensure_auto_source_enabled!
-              params = build_create_params(request_params(request), account)
+            # @param params [Html2rss::Web::Api::V1::FeedMetadata::CreateParams]
+            # @param account [Hash]
+            # @return [Html2rss::Web::Api::V1::FeedMetadata::Metadata]
+            def create_feed(params, account)
+              raise Html2rss::Web::AutoSourceDisabledError unless AutoSource.enabled?
 
               feed_data = AutoSource.create_stable_feed(params.name, params.url, account)
               raise Html2rss::Web::InternalServerError, 'Failed to create feed' unless feed_data
 
-              [params, feed_data]
+              feed_data.is_a?(FeedMetadata::Metadata) ? feed_data : FeedMetadata::Metadata.new(**feed_data)
+            end
+
+            # @param feed_data [Html2rss::Web::Api::V1::FeedMetadata::Metadata]
+            # @return [Hash{Symbol=>Object}]
+            def feed_attributes(feed_data)
+              timestamp = Time.now.iso8601
+              feed_data.to_h.merge(created_at: timestamp, updated_at: timestamp).slice(*FEED_ATTRIBUTE_KEYS)
             end
 
             # @param params [Html2rss::Web::Api::V1::FeedMetadata::CreateParams]
@@ -168,21 +169,6 @@ def emit_create_failure(error)
                 level: :warn
               )
             end
-
-            # @param feed_data [Hash, Html2rss::Web::Api::V1::FeedMetadata::Metadata]
-            # @return [Html2rss::Web::Api::V1::FeedMetadata::Metadata]
-            def feed_metadata(feed_data)
-              return feed_data if feed_data.is_a?(FeedMetadata::Metadata)
-
-              FeedMetadata::Metadata.new(**feed_data)
-            end
-
-            # @param typed_feed [Html2rss::Web::Api::V1::FeedMetadata::Metadata]
-            # @param timestamp [String]
-            # @return [Hash{Symbol=>Object}]
-            def typed_feed_attributes(typed_feed, timestamp)
-              typed_feed.to_h.merge(created_at: timestamp, updated_at: timestamp)
-            end
           end
         end
       end

app/web/api/v1/create_feed.rb

@@ -7,29 +7,33 @@ module Web
     ##
     # Boot helpers for code loading and runtime setup.
     module Boot
+      @mutex = Mutex.new
+      @setup = false
+      @loader = nil
+
       class << self
         # @param reloadable [Boolean]
         # @return [Zeitwerk::Loader]
         def setup!(reloadable: false)
-          return loader if setup?
+          @mutex.synchronize do
+            return @loader if @setup
 
-          loader.enable_reloading if reloadable
-          loader.setup
-          @setup = true # rubocop:disable ThreadSafety/ClassInstanceVariable
-          loader
+            @loader ||= build_loader
+            @loader.enable_reloading if reloadable
+            @loader.setup
+            @setup = true
+            @loader
+          end
         end
 
         # @return [Zeitwerk::Loader]
         def loader
-          @loader ||= build_loader # rubocop:disable ThreadSafety/ClassInstanceVariable
+          @mutex.synchronize { @loader ||= build_loader }
         end
 
         # @return [Boolean]
         def setup?
-          # Loader setup happens once during process boot.
-          # rubocop:disable ThreadSafety/ClassInstanceVariable
-          @setup == true
-          # rubocop:enable ThreadSafety/ClassInstanceVariable
+          @mutex.synchronize { @setup == true }
         end
 
         # @return [void]

app/web/boot.rb

@@ -16,6 +16,9 @@ module Web
     # Keeping lookup/defaulting here gives the rest of the app one predictable
     # config shape instead of repeating file parsing and fallback logic.
     module LocalConfig
+      @mutex = Mutex.new
+      @snapshot = nil
+
       ##
       # raised when the local config wasn't found
       class NotFound < RuntimeError; end
@@ -63,9 +66,7 @@ def yaml
         ##
         # @return [Html2rss::Web::ConfigSnapshot::Snapshot]
         def snapshot
-          return @snapshot if @snapshot # rubocop:disable ThreadSafety/ClassInstanceVariable
-
-          @snapshot = ConfigSnapshot.load(yaml) # rubocop:disable ThreadSafety/ClassInstanceVariable
+          @mutex.synchronize { @snapshot ||= ConfigSnapshot.load(yaml) }
         rescue KeyError, TypeError, ArgumentError => error
           raise InvalidConfig, "Invalid local config: #{error.message}"
         end
@@ -74,7 +75,7 @@ def snapshot
         # @param reason [String]
         # @return [nil]
         def reload!(reason: 'manual')
-          @snapshot = nil # rubocop:disable ThreadSafety/ClassInstanceVariable
+          @mutex.synchronize { @snapshot = nil }
           SecurityLogger.log_cache_lifecycle('local_config', 'reload', reason: reason)
           nil
         end

app/web/config/local_config.rb

@@ -8,18 +8,20 @@ module Web
     module RuntimeEnv
       SENSITIVE_KEYS = %w[HTML2RSS_SECRET_KEY HEALTH_CHECK_TOKEN SENTRY_DSN].freeze
       BOOT_METADATA_KEYS = %w[BUILD_TAG GIT_SHA RACK_ENV SENTRY_ENABLE_LOGS].freeze
+      @mutex = Mutex.new
+      @values = nil
 
       class << self
         # @return [void]
         def capture!
-          @values = tracked_env_values.freeze # rubocop:disable ThreadSafety/ClassInstanceVariable
+          @mutex.synchronize { @values = tracked_env_values.freeze }
           scrub_sensitive_env!
           nil
         end
 
         # @return [void]
         def reset!
-          @values = nil # rubocop:disable ThreadSafety/ClassInstanceVariable
+          @mutex.synchronize { @values = nil }
         end
 
         # @return [String]
@@ -70,8 +72,8 @@ def rack_env
         def fetch(key, default = :__missing__)
           return ENV.fetch(key) if ENV.key?(key)
 
-          values = @values || {} # rubocop:disable ThreadSafety/ClassInstanceVariable
-          return values.fetch(key) if values.key?(key)
+          current_values = @mutex.synchronize { @values || {} }
+          return current_values.fetch(key) if current_values.key?(key)
           return default unless default == :__missing__
 
           raise KeyError, "key not found: #{key}"

app/web/config/runtime_env.rb

@@ -22,7 +22,8 @@ def enabled?
         # @param strategy [String, nil]
         # @return [Html2rss::Web::Api::V1::FeedMetadata::Metadata, nil]
         def create_stable_feed(name, url, token_data, strategy = nil)
-          return nil unless token_data && FeedAccess.url_allowed_for_username?(token_data[:username], url)
+          account = AccountManager.get_account_by_username(token_data&.dig(:username))
+          return nil unless account && UrlValidator.url_allowed?(account, url)
 
           feed_token = Auth.generate_feed_token(token_data[:username], url, strategy: strategy)
           return nil unless feed_token