feat: finalize root api.py with X-Auth-Secret auth security and clean pure sales cohort

scripts/fix_stubborn_portraits.py

@@ -0,0 +1,70 @@
+"""
+scripts/fix_stubborn_portraits.py
+Directly fetches guaranteed face portraits for $uicideboy$ and 100k Track
+using unblocked iTunes and Wikimedia editorial CDN sources.
+"""
+
+import sqlite3
+import requests
+import re
+from pathlib import Path
+
+BASE_DIR = Path(__file__).resolve().parent.parent
+DB_PATH = BASE_DIR / "data" / "hiffi_catalog.db"
+AVATAR_DIR = BASE_DIR / "data" / "artist_avatars"
+AVATAR_DIR.mkdir(parents=True, exist_ok=True)
+
+# Direct, verified portrait URLs that do not block requests
+FIXES = {
+    "$uicideboy$": "https://upload.wikimedia.org/wikipedia/commons/thumb/d/d4/Suicideboys_at_Woo_Hah%21_2017.jpg/640px-Suicideboys_at_Woo_Hah%21_2017.jpg",
+    "100k Track": "https://m.media-amazon.com/images/M/MV5BMjA5MjM3NzgtYmY5MC00MGI0LTk5ODEtOGY2OWYxNmYxNmQ3XkEyXkFqcGc@._V1_.jpg"
+}
+
+HEADERS = {
+    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
+}
+
+def clean_file_slug(name: str) -> str:
+    cleaned = re.sub(r'[^a-zA-Z0-9_-]', '_', name.strip().lower())
+    return re.sub(r'_+', '_', cleaned).strip('_')
+
+def main():
+    if not DB_PATH.exists():
+        print(f"[-] Database not found at {DB_PATH}")
+        return
+
+    conn = sqlite3.connect(DB_PATH)
+    cursor = conn.cursor()
+
+    for artist_name, url in FIXES.items():
+        cursor.execute("SELECT artist_id FROM artists WHERE artist_name = ? COLLATE NOCASE", (artist_name,))
+        row = cursor.fetchone()
+        artist_id = str(row[0]) if row else "0"
+
+        slug = clean_file_slug(artist_name)
+        target_path = AVATAR_DIR / f"{slug}_{artist_id}.jpg"
+
+        print(f"[*] Downloading real face for: {artist_name}...", end=" ", flush=True)
+        try:
+            res = requests.get(url, headers=HEADERS, timeout=15)
+            if res.status_code == 200 and len(res.content) > 2000:
+                with open(target_path, "wb") as f:
+                    f.write(res.content)
+                size_kb = len(res.content) / 1024
+                print(f"SUCCESS -> {target_path.name} ({size_kb:.1f} KB)")
+
+                cursor.execute(
+                    "UPDATE artists SET image_url = ?, image_verified_flag = 1 WHERE artist_id = ?",
+                    (url, artist_id)
+                )
+                conn.commit()
+            else:
+                print(f"HTTP {res.status_code}")
+        except Exception as e:
+            print(f"ERROR: {e}")
+
+    conn.close()
+    print("[+] Done.")
+
+if __name__ == "__main__":
+    main()