Limpieza a fondo: DMs, SSRF en !play, errores de arranque de yt-dlp y tipado

.github/workflows/tests.yml

@@ -5,6 +5,11 @@ on:
     branches: [main]
   pull_request:
 
+# The job only reads the repo. Without this, GITHUB_TOKEN gets the repository's
+# default scopes, which can include write access.
+permissions:
+  contents: read
+
 jobs:
   pytest:
     runs-on: ubuntu-latest
@@ -36,6 +41,15 @@ jobs:
           python -m pip install --upgrade pip
           pip install -r requirements-dev.txt
 
+      - name: Lint
+        # Correctness rules only (see ruff.toml): an undefined name in a
+        # rarely-run branch otherwise surfaces as a crash in production.
+        run: ruff check .
+
+      - name: Type check
+        # Every function must be annotated (see mypy.ini).
+        run: mypy
+
       - name: Run tests
         # The suite needs no credentials, no network and no .env.
         # -ra surfaces anything that skipped, so silent skips stay visible.

.gitignore

@@ -1,218 +1,41 @@
-# Byte-compiled / optimized / DLL files
+# Python
 __pycache__/
 *.py[codz]
 *$py.class
-
-# C extensions
-*.so
-
-# Distribution / packaging
-.Python
+*.egg-info/
 build/
-develop-eggs/
 dist/
-downloads/
-eggs/
-.eggs/
-lib/
-lib64/
-parts/
-sdist/
-var/
-wheels/
-share/python-wheels/
-*.egg-info/
-.installed.cfg
-*.egg
-MANIFEST
 
-# PyInstaller
-#  Usually these files are written by a python script from a template
-#  before PyInstaller builds the exe, so as to inject date/other infos into it.
-*.manifest
-*.spec
-
-# Installer logs
-pip-log.txt
-pip-delete-this-directory.txt
+# Virtual environments
+.venv/
+venv/
+env/
 
-# Unit test / coverage reports
-htmlcov/
-.tox/
-.nox/
+# Test and static-analysis caches
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
 .coverage
 .coverage.*
-.cache
-nosetests.xml
-coverage.xml
-*.cover
-*.py.cover
-.hypothesis/
-.pytest_cache/
-cover/
-
-# Translations
-*.mo
-*.pot
-
-# Django stuff:
-*.log
-local_settings.py
-db.sqlite3
-db.sqlite3-journal
-
-# Flask stuff:
-instance/
-.webassets-cache
-
-# Scrapy stuff:
-.scrapy
-
-# Sphinx documentation
-docs/_build/
-
-# PyBuilder
-.pybuilder/
-target/
-
-# Jupyter Notebook
-.ipynb_checkpoints
-
-# IPython
-profile_default/
-ipython_config.py
-
-# pyenv
-#   For a library or package, you might want to ignore these files since the code is
-#   intended to run in multiple environments; otherwise, check them in:
-# .python-version
-
-# pipenv
-#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
-#   However, in case of collaboration, if having platform-specific dependencies or dependencies
-#   having no cross-platform support, pipenv may install dependencies that don't work, or not
-#   install all needed dependencies.
-#Pipfile.lock
-
-# UV
-#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
-#   This is especially recommended for binary packages to ensure reproducibility, and is more
-#   commonly ignored for libraries.
-#uv.lock
-
-# poetry
-#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
-#   This is especially recommended for binary packages to ensure reproducibility, and is more
-#   commonly ignored for libraries.
-#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
-#poetry.lock
-#poetry.toml
-
-# pdm
-#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
-#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
-#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
-#pdm.lock
-#pdm.toml
-.pdm-python
-.pdm-build/
-
-# pixi
-#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
-#pixi.lock
-#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
-#   in the .venv directory. It is recommended not to include this directory in version control.
-.pixi
-
-# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
-__pypackages__/
-
-# Celery stuff
-celerybeat-schedule
-celerybeat.pid
+htmlcov/
 
-# SageMath parsed files
-*.sage.py
+# Runtime caches. Not test output: the systemd unit points XDG_CACHE_HOME and
+# DENO_DIR here (deploy/install-units.sh), so on the server this fills up.
+.cache
 
 # yt-dlp fragment artifacts: streaming to stdout can drop these in the CWD.
 --Frag*
 *.part
 *.ytdl
 
-# Project-specific: AI assistant notes & sensitive runtime files
-CLAUDE.md
-.claude/
-cookies.txt
-*.pem
+*.log
 
-# Environments
+# Secrets and credentials — never committed.
 .env
 .envrc
-.venv
-env/
-venv/
-ENV/
-env.bak/
-venv.bak/
-
-# Spyder project settings
-.spyderproject
-.spyproject
-
-# Rope project settings
-.ropeproject
-
-# mkdocs documentation
-/site
-
-# mypy
-.mypy_cache/
-.dmypy.json
-dmypy.json
-
-# Pyre type checker
-.pyre/
-
-# pytype static type analyzer
-.pytype/
-
-# Cython debug symbols
-cython_debug/
-
-# PyCharm
-#  JetBrains specific template is maintained in a separate JetBrains.gitignore that can
-#  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
-#  and can be added to the global gitignore or merged into this file.  For a more nuclear
-#  option (not recommended) you can uncomment the following to ignore the entire idea folder.
-#.idea/
-
-# Abstra
-# Abstra is an AI-powered process automation framework.
-# Ignore directories containing user credentials, local state, and settings.
-# Learn more at https://abstra.io/docs
-.abstra/
-
-# Visual Studio Code
-#  Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore 
-#  that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
-#  and can be added to the global gitignore or merged into this file. However, if you prefer, 
-#  you could uncomment the following to ignore the entire vscode folder
-# .vscode/
-
-# Ruff stuff:
-.ruff_cache/
-
-# PyPI configuration file
-.pypirc
-
-# Cursor
-#  Cursor is an AI-powered code editor. `.cursorignore` specifies files/directories to
-#  exclude from AI features like autocomplete and code analysis. Recommended for sensitive data
-#  refer to https://docs.cursor.com/context/ignore-files
-.cursorignore
-.cursorindexingignore
+cookies.txt
+*.pem
 
-# Marimo
-marimo/_static/
-marimo/_lsp/
-__marimo__/
+# Local assistant notes.
+CLAUDE.md
+.claude/

README.md

@@ -85,7 +85,8 @@ No installation required — the bot is hosted and always online.
 ### Requirements
 - Python 3.11+
 - FFmpeg on your PATH
-- A Discord bot token (with the **Message Content** and **Server Members** intents enabled)
+- A Discord bot token with the **Message Content** intent enabled — the only
+  privileged intent the bot asks for
 
 ### Run locally
 ```bash
@@ -103,6 +104,8 @@ adds a fallback for songs LRCLIB does not have.
 ```bash
 .venv/bin/pip install -r requirements-dev.txt   # Windows: .venv\Scripts\pip
 pytest
+ruff check .      # correctness lint (ruff.toml)
+mypy              # every function must be typed (mypy.ini)
 ```
 
 The suite needs **no credentials, no network and no `.env`** — it mocks the
@@ -117,7 +120,8 @@ A few tests render audio through **real FFmpeg** to measure the pitch and speed
 filters, since a wrong filter string looks perfectly reasonable and only shows up
 as the wrong playback speed. Those skip automatically if FFmpeg is not installed.
 
-CI runs everything on every push and pull request against Python 3.11 and 3.12.
+CI runs the lint, the type check and the tests on every push and pull request,
+against Python 3.11 and 3.12.
 
 ### Deploy to a server
 See **[deploy/README.md](deploy/README.md)** for the full walkthrough:

cogs/effects.py

@@ -4,7 +4,9 @@
 import discord
 from discord.ext import commands
 
+from config import COMMAND_PREFIX
 from utils.checks import same_voice_channel
+from utils.context import GuildContext
 from utils.embeds import BLURPLE, error_embed, success_embed
 from utils.player import players
 
@@ -56,61 +58,65 @@ class Effect:
 
 
 class Effects(commands.Cog, name="🎛️ Audio Effects"):
-    def __init__(self, bot: commands.Bot):
+    def __init__(self, bot: commands.Bot) -> None:
         self.bot = bot
         self._last_change: dict[int, float] = {}   # guild_id → monotonic time
 
-    def _throttled(self, ctx) -> bool:
+    def _throttled(self, ctx: GuildContext) -> bool:
         now = time.monotonic()
         if now - self._last_change.get(ctx.guild.id, 0.0) < _EFFECT_COOLDOWN:
             return True
         self._last_change[ctx.guild.id] = now
         return False
 
-    async def _switch_to(self, ctx, name: str | None, filter_str: str, label: str,
+    async def _switch_to(self, ctx: GuildContext, name: str | None, filter_str: str, label: str,
                          rate: float = 1.0) -> None:
         """Throttle, apply, and report — the whole path every effect command takes."""
         if self._throttled(ctx):
-            return await ctx.send(embed=error_embed(
+            await ctx.send(embed=error_embed(
                 f"Easy — wait {_EFFECT_COOLDOWN:.0f}s between effect changes."
             ))
+            return
         player = players.get(ctx.guild.id)
         if player and player.apply_effect(name, filter_str, rate):
             await ctx.send(embed=success_embed(label))
         else:
             await ctx.send(embed=error_embed("Nothing is playing."))
 
     @commands.command(name=_EFFECT_NAMES[0], aliases=_EFFECT_NAMES[1:],
-                      help="Apply an audio effect. Use !effects to see them all.")
+                      help=f"Apply an audio effect. Use {COMMAND_PREFIX}effects to see "
+                           "them all.")
     @same_voice_channel()
-    async def apply_effect(self, ctx):
-        name = ctx.invoked_with.lower()
+    async def apply_effect(self, ctx: GuildContext) -> None:
+        # Always set here: this callback only runs when invoked by one of its names.
+        name = (ctx.invoked_with or _EFFECT_NAMES[0]).lower()
         effect = EFFECTS[name]
         await self._switch_to(ctx, name, effect.filter, effect.label, effect.rate)
 
     @commands.command(name="reset", aliases=["fxreset", "noeffect"])
     @same_voice_channel()
-    async def reset_effect(self, ctx):
+    async def reset_effect(self, ctx: GuildContext) -> None:
         """Remove all audio effects."""
         await self._switch_to(ctx, None, "", "Audio effects removed ✅")
 
     @commands.command(name="effect")
-    async def current_effect(self, ctx):
+    async def current_effect(self, ctx: GuildContext) -> None:
         """Show the active audio effect."""
         player = players.get(ctx.guild.id)
         name = (player.effect_name if player else None) or "none"
         await ctx.send(embed=success_embed(f"Current effect: **{name}**"))
 
     @commands.command(name="effects")
-    async def list_effects(self, ctx):
+    async def list_effects(self, ctx: GuildContext) -> None:
         """List all available audio effects."""
+        prefix = ctx.clean_prefix
         await ctx.send(embed=discord.Embed(
             title="🎛️ Available Effects",
-            description=", ".join(f"`!{name}`" for name in EFFECTS)
-                        + "\n\nUse `!reset` to remove all effects.",
+            description=", ".join(f"`{prefix}{name}`" for name in EFFECTS)
+                        + f"\n\nUse `{prefix}reset` to remove all effects.",
             color=BLURPLE,
         ))
 
 
-async def setup(bot):
+async def setup(bot: commands.Bot) -> None:
     await bot.add_cog(Effects(bot))