Merge remote-tracking branch 'upstream/main'

Author: tomballgithub

.github/workflows/gitleaks.yml

@@ -0,0 +1,24 @@
+name: Gitleaks
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  scan:
+    name: gitleaks
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Run gitleaks scan
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_CONFIG: .gitleaks.toml
+          GITLEAKS_ENABLE_COMMENTS: "false"

.github/workflows/release-assets.yml

@@ -0,0 +1,39 @@
+name: Build release archives
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  build-and-upload-assets:
+    name: Build zip and tar.gz and upload to release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Build archives from release tag
+        shell: bash
+        run: |
+          set -euo pipefail
+          TAG="${{ github.event.release.tag_name }}"
+          PREFIX="spotify_monitor_${TAG}"
+
+          git archive --format=zip --output "${PREFIX}.zip" "${TAG}"
+          git archive --format=tar.gz --output "${PREFIX}.tar.gz" "${TAG}"
+
+          ls -lh "${PREFIX}.zip" "${PREFIX}.tar.gz"
+
+      - name: Upload archives to GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            spotify_monitor_${{ github.event.release.tag_name }}.zip
+            spotify_monitor_${{ github.event.release.tag_name }}.tar.gz
+          fail_on_unmatched_files: true
+          overwrite_files: true

.gitleaks.toml

@@ -0,0 +1,47 @@
+title = "Shared monitor repos gitleaks config"
+
+[extend]
+useDefault = true
+
+[[rules]]
+id = "monitor-secret-assignment"
+description = "Detects monitor project secret assignments with lower entropy tolerance"
+path = '''(?i)(?:^|/)(?:\.env(?:\.[^/]+)?|[^/]+\.(?:py|env|ini|cfg|conf|toml|ya?ml|json|sh))$'''
+regex = '''(?i)\b(?:steam_api_key|github_token|lastfm_api_key|lastfm_api_secret|riot_api_key|psn_npsso|ms_app_client_secret|sp_app_client_secret|sp_user_client_secret|sp_client_secret|sp_dc_cookie|refresh_token|session_password|smtp_password|sp_sha256)\b(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|:{1,3}=|:|=>|\?=)[\s=]{0,3}[\x60'"]([^\x60'"\s#]{8,256})[\x60'"](?:[\x60'"\s;]|\\[nr]|$)'''
+secretGroup = 1
+entropy = 3.1
+keywords = [
+    "steam_api_key",
+    "github_token",
+    "lastfm_api_key",
+    "lastfm_api_secret",
+    "riot_api_key",
+    "psn_npsso",
+    "ms_app_client_secret",
+    "sp_app_client_secret",
+    "sp_user_client_secret",
+    "sp_client_secret",
+    "sp_dc_cookie",
+    "refresh_token",
+    "session_password",
+    "smtp_password",
+    "sp_sha256",
+]
+
+[[rules.allowlists]]
+description = "Skip placeholders and variable references"
+regexTarget = "secret"
+regexes = [
+    '''(?i)^your_[a-z0-9_]+$''',
+    '''(?i)^example(?:_[a-z0-9_]+)?$''',
+    '''(?i)^dummy(?:_[a-z0-9_]+)?$''',
+    '''(?i)^changeme(?:_[a-z0-9_]+)?$''',
+    '''(?i)^replace(?:_[a-z0-9_]+)?$''',
+    '''(?i)^[a-z_][a-z0-9_]*(?:\.[a-z_][a-z0-9_]*)+$''',
+    '''(?i)^[a-z_][a-z0-9_]*\([^\)]{0,80}\)$''',
+    '''(?i)^<[^>]{1,64}>$''',
+    '''(?i)^\$\{?[A-Z0-9_]{2,64}\}?$''',
+    '''(?i)^\$\{?[a-z_][a-z0-9_]{1,63}\}?$''',
+    '''(?i)^x{8,}$''',
+    '''^_+$''',
+]

RELEASE_NOTES.md

@@ -2,6 +2,13 @@
 
 This is a high-level summary of the most important changes.
 
+# Changes in 2.9.2 (27 Apr 2026)
+
+**Bug fixes**:
+
+- **BUGFIX:** Bounded the retry loop in `spotify_get_access_token_from_sp_dc` to prevent an infinite loop when TOTP secrets are repeatedly fetched but the resulting token refresh keeps failing (thanks [@tomballgithub](https://github.com/tomballgithub), fixes [#37](https://github.com/misiektoja/spotify_monitor/issues/37))
+- **BUGFIX:** Auto-fallback to the highest available TOTP version when the configured `TOTP_VER` is missing from `SECRET_CIPHER_DICT` (with a warning) so the script self-heals instead of failing every retry
+
 # Changes in 2.9.1 (09 Mar 2026)
 
 **Features and Improvements**:

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "spotify_monitor"
-version = "2.9.1"
+version = "2.9.2"
 description = "Track Spotify friends' music activity in real time with auto-playback, skipped tracks detection and instant notifications"
 readme = "README.md"
 license = "GPL-3.0-or-later"

spotify_monitor.py

@@ -159,7 +159,7 @@
 #!/usr/bin/env python3
 """
 Author: Michal Szymanski <misiektoja-github@rm-rf.ninja>
-v2.9.1
+v2.9.2
 
 Tool implementing real-time tracking of Spotify friends music activity:
 https://github.com/misiektoja/spotify_monitor/
@@ -175,7 +175,7 @@
 spotipy (required since v2.7 due to new Spotify restrictions introduced on 22 Dec 2025)
 """
 
-VERSION = "2.9.1"
+VERSION = "2.9.2"
 
 # API 401 error means sp_dc cookie has expired. Lasts one year. 03/15/2025
 
@@ -2602,16 +2602,24 @@ def fetch_server_time(session: req.Session, ua: str) -> int:
     return int(parsedate_to_datetime(date_hdr).timestamp())
 
 
+# Resolves the effective TOTP version, falling back to the highest available when the configured TOTP_VER is missing from SECRET_CIPHER_DICT
+def resolve_totp_ver() -> int:
+    if not SECRET_CIPHER_DICT:
+        raise SecretsUnavailableError("resolve_totp_ver(): SECRET_CIPHER_DICT is empty")
+    if TOTP_VER and str(TOTP_VER) in SECRET_CIPHER_DICT:
+        return TOTP_VER
+    available = sorted(map(int, SECRET_CIPHER_DICT))
+    fallback = available[-1]
+    if TOTP_VER:
+        print(f"Warning: configured TOTP_VER ({TOTP_VER}) is missing from SECRET_CIPHER_DICT (available: {available}); falling back to auto-selected version {fallback}")
+    return fallback
+
+
 # Creates a TOTP object using a secret derived from transformed cipher bytes
 def generate_totp():
     import pyotp
 
-    if not SECRET_CIPHER_DICT:
-        raise SecretsUnavailableError("generate_totp(): SECRET_CIPHER_DICT is empty")
-
-    ver = TOTP_VER or max(map(int, SECRET_CIPHER_DICT))
-    if str(ver) not in SECRET_CIPHER_DICT:
-        raise SecretsUnavailableError(f"generate_totp(): Defined TOTP_VER ({ver}) is missing in SECRET_CIPHER_DICT")
+    ver = resolve_totp_ver()
 
     secret_cipher_bytes = SECRET_CIPHER_DICT[str(ver)]
 
@@ -2704,7 +2712,7 @@ def refresh_access_token_from_sp_dc(sp_dc: str) -> dict:
     client_time = int(time_ns() / 1000 / 1000)
     otp_value = totp_obj.at(server_time)
 
-    totp_ver = TOTP_VER or max(map(int, SECRET_CIPHER_DICT))
+    totp_ver = resolve_totp_ver()
 
     params = {
         "reason": "transport",
@@ -2829,7 +2837,10 @@ def spotify_get_access_token_from_sp_dc(sp_dc: str):
             last_error = str(e)
             debug_print(f"TOTP secrets unavailable: {e}")
             if fetch_and_update_secrets():
-                debug_print("TOTP secrets updated, retrying token refresh immediately")
+                debug_print("TOTP secrets updated, retrying token refresh")
+                retry += 1
+                if retry < max_retries:
+                    time.sleep(TOKEN_RETRY_TIMEOUT)
                 continue
             raise RuntimeError(f"Failed to obtain TOTP secrets for token refresh: {e}")
         except Exception as e: