feat: finalize root api.py with X-Auth-Secret auth security and clean pure sales cohort

scripts/test_spotify_extract.py

@@ -0,0 +1,38 @@
+"""
+scripts/test_spotify_extract.py
+Tests parsing of Spotify's base64 hydration payload for monthly listeners.
+"""
+
+import base64
+import re
+import requests
+
+url = "https://open.spotify.com/artist/2YZyLoL8N0Wb9xBt1NhZWg"  # Kendrick Lamar
+headers = {
+    "User-Agent": (
+        "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
+        "AppleWebKit/537.36 (KHTML, like Gecko) "
+        "Chrome/124.0.0.0 Safari/537.36"
+    )
+}
+
+r = requests.get(url, headers=headers, timeout=12)
+print("HTTP Status:", r.status_code)
+
+# 1. Search for embedded base64 state tag
+match = re.search(r'<script id="initial-state"[^>]*>(.*?)</script>', r.text, re.DOTALL)
+if match:
+    encoded_data = match.group(1).strip()
+    try:
+        decoded = base64.b64decode(encoded_data).decode("utf-8", errors="ignore")
+        hits = re.findall(r'"monthlyListeners":\s*(\d+)', decoded)
+        print("Found via initial-state tag:")
+        print("Monthly listeners hits:", hits)
+    except Exception as e:
+        print("Base64 decode error:", e)
+else:
+    print("Could not find <script id='initial-state'> tag.")
+
+# 2. Raw fallback check on full body
+raw_hits = re.findall(r'"monthlyListeners":\s*(\d+)', r.text)
+print("Direct HTML body hits:", raw_hits)