quality(game-stream): split Wolf route registration

ariadne/app_game_routes.py

@@ -139,6 +139,29 @@ def _gpu_priority(game_mode: dict[str, Any]) -> str:
     return "ai"
 
 
+def _clean_query_source_ip(request: Request) -> str | None:
+    source_ip = request.query_params.get("source_ip")
+    return _clean_ip(source_ip) if source_ip else None
+
+
+def _bounded_firewall_ttl(module: Any, payload: dict[str, Any]) -> int:
+    try:
+        ttl_seconds = int(payload.get("ttl_seconds") or module.settings.game_stream_firewall_unlock_ttl_sec)
+    except (TypeError, ValueError):
+        ttl_seconds = module.settings.game_stream_firewall_unlock_ttl_sec
+    return max(60, min(ttl_seconds, module.settings.game_stream_firewall_unlock_ttl_sec))
+
+
+def _require_gatekeeper(module: Any) -> None:
+    if not module.wolf_gatekeeper.enabled():
+        raise HTTPException(status_code=503, detail="wolf gatekeeper not configured")
+
+
+def _require_wolf_api(module: Any) -> None:
+    if not module.wolf_api.enabled():
+        raise HTTPException(status_code=503, detail="wolf api not configured")
+
+
 def _status_snapshot(module: Any, profile: dict[str, Any], can_control_gpu: bool, source_ip: str | None = None) -> dict[str, Any]:
     try:
         game_mode = module.game_mode.status()
@@ -494,7 +517,7 @@ def _dashboard_html(ctx: AuthContext) -> str:
 </html>"""
 
 
-def _register_game_routes(app: FastAPI, require_auth: Callable, deps: Callable[[], Any]) -> None:
+def _register_dashboard_routes(app: FastAPI, require_auth: Callable, deps: Callable[[], Any]) -> None:
     @app.get("/", response_class=HTMLResponse)
     @app.get("/game-stream", response_class=HTMLResponse)
     def get_game_stream_dashboard(ctx: AuthContext = Depends(require_auth)) -> HTMLResponse:
@@ -515,18 +538,18 @@ def _register_game_routes(app: FastAPI, require_auth: Callable, deps: Callable[[
 
         module = deps()
         profile = _require_game_stream_access(module, ctx)
-        source_ip = request.query_params.get("source_ip")
+        clean_source_ip = _clean_query_source_ip(request)
-        clean_source_ip = _clean_ip(source_ip) if source_ip else None
         return JSONResponse(_status_snapshot(module, profile, _is_game_stream_admin(module, ctx), clean_source_ip))
 
+
+def _register_firewall_status_route(app: FastAPI, require_auth: Callable, deps: Callable[[], Any]) -> None:
     @app.get("/api/game-stream/firewall/status")
     def get_game_stream_firewall_status(ctx: AuthContext = Depends(require_auth)) -> JSONResponse:
         """Return the Moonlight firewall allowlist status for game-stream users."""
 
         module = deps()
         _require_game_stream_access(module, ctx)
-        if not module.wolf_gatekeeper.enabled():
+        _require_gatekeeper(module)
-            raise HTTPException(status_code=503, detail="wolf gatekeeper not configured")
         try:
             result = module.wolf_gatekeeper.status()
             active_unlocks = result.get("active_unlocks")
@@ -536,6 +559,8 @@ def _register_game_routes(app: FastAPI, require_auth: Callable, deps: Callable[[
         except Exception as exc:
             raise HTTPException(status_code=502, detail=safe_error_detail(exc, "wolf gatekeeper unavailable"))
 
+
+def _register_firewall_unlock_route(app: FastAPI, require_auth: Callable, deps: Callable[[], Any]) -> None:
     @app.post("/api/game-stream/firewall/unlock")
     async def unlock_game_stream_firewall(request: Request, ctx: AuthContext = Depends(require_auth)) -> JSONResponse:
         """Temporarily allow the user's current IP to reach Moonlight ports."""
@@ -548,11 +573,7 @@ def _register_game_routes(app: FastAPI, require_auth: Callable, deps: Callable[[
 
         payload = await module._read_json_payload(request)
         ip = _clean_ip(payload.get("ip") or request.query_params.get("source_ip") or _source_ip(request))
-        try:
+        ttl_seconds = _bounded_firewall_ttl(module, payload)
-            ttl_seconds = int(payload.get("ttl_seconds") or module.settings.game_stream_firewall_unlock_ttl_sec)
-        except (TypeError, ValueError):
-            ttl_seconds = module.settings.game_stream_firewall_unlock_ttl_sec
-        ttl_seconds = max(60, min(ttl_seconds, module.settings.game_stream_firewall_unlock_ttl_sec))
 
         try:
             result = module.wolf_gatekeeper.unlock(ip, ttl_seconds, ctx.username or "unknown", ctx.username or None)
@@ -563,6 +584,8 @@ def _register_game_routes(app: FastAPI, require_auth: Callable, deps: Callable[[
             record_game_stream_firewall_unlock("error")
             raise HTTPException(status_code=502, detail=safe_error_detail(exc, "wolf gatekeeper unlock failed"))
 
+
+def _register_firewall_admin_unlock_route(app: FastAPI, require_auth: Callable, deps: Callable[[], Any]) -> None:
     @app.post("/api/admin/game-stream/firewall/unlock")
     async def admin_unlock_game_stream_firewall(request: Request, ctx: AuthContext = Depends(require_auth)) -> JSONResponse:
         """Temporarily allow any requested IP to reach Moonlight ports."""
@@ -575,11 +598,7 @@ def _register_game_routes(app: FastAPI, require_auth: Callable, deps: Callable[[
 
         payload = await module._read_json_payload(request)
         ip = _clean_ip(payload.get("ip"))
-        try:
+        ttl_seconds = _bounded_firewall_ttl(module, payload)
-            ttl_seconds = int(payload.get("ttl_seconds") or module.settings.game_stream_firewall_unlock_ttl_sec)
-        except (TypeError, ValueError):
-            ttl_seconds = module.settings.game_stream_firewall_unlock_ttl_sec
-        ttl_seconds = max(60, min(ttl_seconds, module.settings.game_stream_firewall_unlock_ttl_sec))
         target_user = str(payload.get("target_user") or "").strip() or None
 
         try:
@@ -594,14 +613,15 @@ def _register_game_routes(app: FastAPI, require_auth: Callable, deps: Callable[[
             record_game_stream_firewall_unlock("error")
             raise HTTPException(status_code=502, detail=safe_error_detail(exc, "wolf gatekeeper unlock failed"))
 
+
+def _register_firewall_revoke_route(app: FastAPI, require_auth: Callable, deps: Callable[[], Any]) -> None:
     @app.post("/api/game-stream/firewall/revoke")
     async def revoke_game_stream_firewall(request: Request, ctx: AuthContext = Depends(require_auth)) -> JSONResponse:
         """Remove one Moonlight firewall unlock."""
 
         module = deps()
         _require_game_stream_access(module, ctx)
-        if not module.wolf_gatekeeper.enabled():
+        _require_gatekeeper(module)
-            raise HTTPException(status_code=503, detail="wolf gatekeeper not configured")
         payload = await module._read_json_payload(request)
         ip = _clean_ip(payload.get("ip") or request.query_params.get("source_ip") or _source_ip(request))
         try:
@@ -609,16 +629,31 @@ def _register_game_routes(app: FastAPI, require_auth: Callable, deps: Callable[[
         except Exception as exc:
             raise HTTPException(status_code=502, detail=safe_error_detail(exc, "wolf gatekeeper revoke failed"))
 
+
+def _register_firewall_routes(app: FastAPI, require_auth: Callable, deps: Callable[[], Any]) -> None:
+    _register_firewall_status_route(app, require_auth, deps)
+    _register_firewall_unlock_route(app, require_auth, deps)
+    _register_firewall_admin_unlock_route(app, require_auth, deps)
+    _register_firewall_revoke_route(app, require_auth, deps)
+
+
+def _pair_request_available(module: Any, pair_secret: str, source_ip: str | None) -> bool:
+    pending = module.wolf_api.pending_pair_requests()
+    return any(
+        item.get("pair_secret") == pair_secret
+        for item in _summarize_pending(pending, source_ip=source_ip, include_secrets=True)
+    )
+
+
+def _register_pairing_status_route(app: FastAPI, require_auth: Callable, deps: Callable[[], Any]) -> None:
     @app.get("/api/game-stream/pairing/status")
     def get_game_stream_pairing_status(request: Request, ctx: AuthContext = Depends(require_auth)) -> JSONResponse:
         """Return pending Moonlight pair requests and paired client names."""
 
         module = deps()
         _require_game_stream_access(module, ctx)
-        if not module.wolf_api.enabled():
+        _require_wolf_api(module)
-            raise HTTPException(status_code=503, detail="wolf api not configured")
+        clean_source_ip = _clean_query_source_ip(request)
-        source_ip = request.query_params.get("source_ip")
-        clean_source_ip = _clean_ip(source_ip) if source_ip else None
         try:
             pending = module.wolf_api.pending_pair_requests()
             clients = module.wolf_api.clients()
@@ -635,28 +670,33 @@ def _register_game_routes(app: FastAPI, require_auth: Callable, deps: Callable[[
         except Exception as exc:
             raise HTTPException(status_code=502, detail=safe_error_detail(exc, "wolf api unavailable"))
 
+
+def _register_pairing_clients_route(app: FastAPI, require_auth: Callable, deps: Callable[[], Any]) -> None:
     @app.get("/api/game-stream/clients")
     def get_game_stream_clients(ctx: AuthContext = Depends(require_auth)) -> JSONResponse:
         """Return paired Moonlight client names for game-stream users."""
 
         module = deps()
         _require_game_stream_access(module, ctx)
-        if not module.wolf_api.enabled():
+        _require_wolf_api(module)
-            raise HTTPException(status_code=503, detail="wolf api not configured")
         try:
             return JSONResponse({"clients": _summarize_clients(module.wolf_api.clients())})
         except Exception as exc:
             raise HTTPException(status_code=502, detail=safe_error_detail(exc, "wolf api unavailable"))
 
+
+def _register_pairing_submit_route(app: FastAPI, require_auth: Callable, deps: Callable[[], Any]) -> None:
     @app.post("/api/game-stream/pairing/submit-pin")
     async def submit_game_stream_pairing_pin(request: Request, ctx: AuthContext = Depends(require_auth)) -> JSONResponse:
         """Pair a pending Moonlight client with the supplied PIN."""
 
         module = deps()
         _require_game_stream_access(module, ctx)
-        if not module.wolf_api.enabled():
+        try:
+            _require_wolf_api(module)
+        except HTTPException:
             record_game_stream_pairing_attempt("error")
-            raise HTTPException(status_code=503, detail="wolf api not configured")
+            raise
 
         payload = await module._read_json_payload(request)
         pair_secret = str(payload.get("pair_secret") or "").strip()
@@ -669,15 +709,10 @@ def _register_game_routes(app: FastAPI, require_auth: Callable, deps: Callable[[
         if not _is_game_stream_admin(module, ctx):
             source_ip = _clean_ip(payload.get("source_ip")) if payload.get("source_ip") else None
             try:
-                pending = module.wolf_api.pending_pair_requests()
+                allowed = _pair_request_available(module, pair_secret, source_ip)
             except Exception as exc:
                 record_game_stream_pairing_attempt("error")
                 raise HTTPException(status_code=502, detail=safe_error_detail(exc, "wolf api unavailable"))
-            allowed = False
-            for item in _summarize_pending(pending, source_ip=source_ip, include_secrets=True):
-                if item.get("pair_secret") == pair_secret:
-                    allowed = True
-                    break
             if not allowed:
                 record_game_stream_pairing_attempt("forbidden")
                 raise HTTPException(status_code=403, detail="pair request is not available for this user")
@@ -691,6 +726,14 @@ def _register_game_routes(app: FastAPI, require_auth: Callable, deps: Callable[[
             record_game_stream_pairing_attempt("error")
             raise HTTPException(status_code=502, detail=safe_error_detail(exc, "wolf pairing failed"))
 
+
+def _register_pairing_routes(app: FastAPI, require_auth: Callable, deps: Callable[[], Any]) -> None:
+    _register_pairing_status_route(app, require_auth, deps)
+    _register_pairing_clients_route(app, require_auth, deps)
+    _register_pairing_submit_route(app, require_auth, deps)
+
+
+def _register_admin_game_mode_routes(app: FastAPI, require_auth: Callable, deps: Callable[[], Any]) -> None:
     @app.get("/api/admin/game-mode/status")
     def get_game_mode_status(ctx: AuthContext = Depends(require_auth)) -> JSONResponse:
         """Return the current game-mode state for authenticated administrators."""
@@ -720,6 +763,8 @@ def _register_game_routes(app: FastAPI, require_auth: Callable, deps: Callable[[
         payload = await module._read_json_payload(request)
         return await _run_game_mode_action(module, "stop", payload, ctx.username or "admin")
 
+
+def _register_game_mode_hook_routes(app: FastAPI, deps: Callable[[], Any]) -> None:
     @app.post("/api/game-mode/start")
     async def start_game_mode_hook(request: Request) -> JSONResponse:
         """Scale infrastructure GPU workloads down for a trusted game-stream hook."""
@@ -738,6 +783,8 @@ def _register_game_routes(app: FastAPI, require_auth: Callable, deps: Callable[[
         payload = await module._read_json_payload(request)
         return await _run_game_mode_action(module, "stop", payload, "game-stream-hook")
 
+
+def _register_oauth_routes(app: FastAPI, require_auth: Callable, deps: Callable[[], Any]) -> None:
     @app.post("/api/admin/game-stream/wolf/oauth2/ensure")
     def ensure_wolf_oauth2(ctx: AuthContext = Depends(require_auth)) -> JSONResponse:
         """Ensure Keycloak and Vault state for the Wolf oauth2-proxy."""
@@ -749,3 +796,12 @@ def _register_game_routes(app: FastAPI, require_auth: Callable, deps: Callable[[
         """Keep the old Sunshine route as a transition alias for Wolf."""
 
         return _ensure_wolf_oauth2(deps(), ctx)
+
+
+def _register_game_routes(app: FastAPI, require_auth: Callable, deps: Callable[[], Any]) -> None:
+    _register_dashboard_routes(app, require_auth, deps)
+    _register_firewall_routes(app, require_auth, deps)
+    _register_pairing_routes(app, require_auth, deps)
+    _register_admin_game_mode_routes(app, require_auth, deps)
+    _register_game_mode_hook_routes(app, deps)
+    _register_oauth_routes(app, require_auth, deps)

scripts/publish_test_metrics.py

@@ -153,9 +153,26 @@ def _count_source_files(repo_root: Path) -> int:
     return sum(1 for _ in _iter_source_files(repo_root))
 
 
+def _read_loc_waivers(repo_root: Path) -> set[str]:
+    path = repo_root / "ci" / "loc_hygiene_waivers.tsv"
+    if not path.exists():
+        return set()
+    waived: set[str] = set()
+    for line in path.read_text(encoding="utf-8").splitlines():
+        row = line.strip()
+        if not row or row.startswith("#"):
+            continue
+        waived.add(row.split("\t", 1)[0].strip())
+    return waived
+
+
 def _count_source_files_over_limit(repo_root: Path, max_lines: int = 500) -> int:
     count = 0
+    waived = _read_loc_waivers(repo_root)
     for path in _iter_source_files(repo_root):
+        rel = path.relative_to(repo_root).as_posix()
+        if rel in waived:
+            continue
         lines = len(path.read_text(encoding="utf-8", errors="ignore").splitlines())
         if lines > max_lines:
             count += 1