Modernize app: deps, ESLint flat config, bug fixes, and security#20
Open
sirugh wants to merge 2 commits into
Open
Modernize app: deps, ESLint flat config, bug fixes, and security#20sirugh wants to merge 2 commits into
sirugh wants to merge 2 commits into
Conversation
Dependencies: Express 4→5, snoowrap/spotify-web-api-node to latest, ESLint 6→9 with flat config (eslint.config.js replaces .eslintrc.json), globals package added. Bug fixes: - Filter for [removed]/[deleted] was broken — checked comment.body on an already-mapped string (always undefined), so nothing was ever filtered - Deduplication was broken for the same reason; now fixed using the array parameter in .filter() instead of the outer comments variable - "by" split matched substrings (e.g. "somebody"); changed to / by /i regex - return inside playlist loop stopped all remaining playlists; changed to continue - Removed unnecessary async from guessTrackAndArtist Security: - OAuth state param (randomUUID) added to prevent CSRF on the callback route - Access/refresh tokens no longer logged to console Code quality: - Removed --experimental-modules flag (not needed since Node 12.17) - Fixed main field in package.json (.js → .mjs) - Replaced path.resolve() with import.meta.url-relative URLs - Replaced custom delay() with built-in timers/promises setTimeout - Converted mixed .then()/.catch() in /spotify_auth to pure async/await - for...of loops throughout, for loop index variables removed - Node engine requirement bumped to >=18.0.0 https://claude.ai/code/session_01TBgDhQraEY3udNqx2MbqoR
Replaces Express + snoowrap + spotify-web-api-node (all deprecated/unmaintained)
with a single dependency: @anthropic-ai/sdk.
Architecture:
- src/reddit.mjs — Reddit public JSON API via native fetch; no auth required
- src/spotify.mjs — Spotify Web API via native fetch; minimal http.createServer
for OAuth callback (no Express); state param for CSRF protection
- src/claude.mjs — Claude Haiku extracts {title, artist} from comment batches
using tool use; system prompt cached for efficiency
- src/index.mjs — Orchestrator: OAuth → Reddit search → Claude → Spotify
Key improvements over the old stack:
- config.json now uses search queries instead of hardcoded thread IDs; the bot
automatically finds the most upvoted matching thread(s) on each run
- Claude parses freeform comments accurately (handles "Title - Artist",
"Artist by Title", plain prose, markdown, multi-song comments)
- Field-filtered Spotify search (track:/artist:) when both are known; falls back
to freeform with cover exclusion filters otherwise
- Secrets format updated: reddit credentials removed (not needed for public reads);
Anthropic key read from ANTHROPIC_API_KEY env var or secrets.anthropic.apiKey
- process exits cleanly after a run; no persistent server process
https://claude.ai/code/session_01TBgDhQraEY3udNqx2MbqoR
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependencies: Express 4→5, snoowrap/spotify-web-api-node to latest,
ESLint 6→9 with flat config (eslint.config.js replaces .eslintrc.json),
globals package added.
Bug fixes:
already-mapped string (always undefined), so nothing was ever filtered
parameter in .filter() instead of the outer comments variable
Security:
Code quality:
https://claude.ai/code/session_01TBgDhQraEY3udNqx2MbqoR